Export is generally assumed to include sending cryptologic algorithms, hardware, or software through the U.S. mail, across the Internet, or by other means of information transmission.
However, if you move outside the borders of the USA, then you are free of U.S. Munitions List restrictions in the place where you reside. Unfortunately, many countries have similar laws, so it would be difficult to find a place where one could export crypto technology in safety and security.
How does this affect the students taking this class? Simply put, do not E-mail or otherwise send cryptologic technology (including class notes) to destinations outside the USA. Unpleasant circumstances can result if you are caught, as discussed near the end of this section.
Part 121 -- The United States Munitions List
§ 121.1 General. The United States Munitions List
Category XIII -- Auxiliary Military Equipment
(1) Cryptographic (including key management) systems, equipment,
assemblies, modules, integrated circuits, components or software
with the capability of maintaining secrecy or confidentiality of
information or information systems, except cryptographic equipment
and software as follows:
(i) Restricted to decryption functions specifically designed
to allow the execution of copy protected software,
provided the decryption functions are not user-accessible.
(ii) Specially designed, developed or modified for use in
machines for banking or money transactions, and
restricted to use only in such transactions. Machines
for banking or money transactions include automatic
teller machines, self-service statement printers, point
of sale terminals or equipment for the encryption of
interbanking transactions.
(iii) Employing only analog techniques to provide the
cryptographic processing that ensures information
security in the following applications ....
(iv) Personalized smart cards using cryptography restricted
for use only in equipment or systems exempted from the
controls of the USML.
(v) Limited to access control, such as automatic teller
machines, self-service statement printers or point of
sale terminals, which protects password or personal
identification numbers (PIN) or similar data to prevent
unauthorized access to facilities but does not allow
for encryption of files or text, except as directly
related to the password of PIN protection.
(vi) Limited to data authentication which calculates a
Message Authentication Code (MAC) or similar result to
ensure no alteration of text has taken place, or to
authenticate users, but does not allow for encryption
of data, text or other media other than that needed
for the authentication.
(vii) Restricted to fixed data compression or coding techniques.
(viii) Limited to receiving for radio broadcast, pay television
or similar restricted audience television of the consumer
type, without digital encryption and where digital
decryption is limited to the video, audio or management
functions.
(ix) Software designed or modified to protect against
malicious computer damage, (e.g., viruses).
(2) Cryptographic (including key management) systems, equipment,
assemblies, modules, integrated circuits, components or software
which have the capability of generating spreading or hopping codes
for spread spectrum systems or equipment.
(3) Cryptanalytic systems, equipment, assemblies, modules, integrated
circuits, components or software.
(4) Systems, equipment, assemblies, modules, integrated circuits,
components or software providing certified or certifiable multi-
level security or user isolation exceeding class B2 of the Trusted
Computer System Evaluation Criteria (TCSEC) and software to certify
such systems, equipment or software.
If want more information about the ITAR-regulations switch to ITAR in full (about 380kB).