{"id":18867877,"url":"https://github.com/trustsource/exportcontrols","last_synced_at":"2026-01-27T15:33:23.365Z","repository":{"id":99726596,"uuid":"578078582","full_name":"TrustSource/exportcontrols","owner":"TrustSource","description":"Collection of assets, papers, information and tools on export controls","archived":false,"fork":false,"pushed_at":"2022-12-16T08:33:09.000Z","size":4,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-05-30T15:19:00.952Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/TrustSource.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-12-14T07:53:00.000Z","updated_at":"2022-12-14T07:53:00.000Z","dependencies_parsed_at":null,"dependency_job_id":"bcdb203a-fdac-4372-84fd-643c132746fb","html_url":"https://github.com/TrustSource/exportcontrols","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/TrustSource/exportcontrols","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TrustSource%2Fexportcontrols","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TrustSource%2Fexportcontrols/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TrustSource%2Fexportcontrols/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TrustSource%2Fexportcontrols/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/TrustSource","download_url":"https://codeload.github.com/TrustSource/exportcontrols/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TrustSource%2Fexportcontrols/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28815412,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-27T12:25:15.069Z","status":"ssl_error","status_checked_at":"2026-01-27T12:25:05.297Z","response_time":168,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T05:11:43.625Z","updated_at":"2026-01-27T15:33:23.349Z","avatar_url":"https://github.com/TrustSource.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Export controls\n\nThe topic of export cotrols is quiet old. In the mid 90s a group of 16 states introduces the [Wassenaar agreement](!https://www.wassenaar.org), which is a mutual agreement on coordinting the efforts and legistlation on export controls. Meanwhile 42 states joined the club. However, on an annual basis they develop two lists, the **Munition List** and and the list for **Conventional Arms and Dual Use Goods**. For Software development this starts bein interesting when it comes to specifc use, e.g. jamming capabilities (see ML21), image processing (cameras, infrared, radar sensor, etc.) (see ML15) and all sorts of software which is designed to operate or maintain specific primary purpose military goods. \nRelatively important becomes the scope of ML21.b.5, which also includes all sorts of software designed to *...cyber reconnaissance and cyber copmmand and control \"software\"...*. Thus it may address also simple network managemnet tools.\nHowever, even more of interest is the *List for Dual Use Goods*. Chapter 5 covers software, especially cryptography (see 5.D.Part 1)A exemption is given only, if it can be purchased as a simple retail transaction (online, offline, whatever), does not allow to change encryption and may be used and setup without further support by the supplier. Section 5.A.Part 2 gives a handful of additinal use cases that may free you from the regulations. However, this only will apply for the Wassenaar member states. \nThus, Dealing with software, even open source, it will be benficial to get an idea of the included encrypton capabilities. If you have an understanding of what is contained, you will gain two benefits:\na) you have a chance to manage the security of your product (just becaus a tool implements encryption does not mean it is secure!) by creating allow/deny lists across your organisation\nb) you can trigger pro-actively action when exporting in crypto-sensitive states (e.g. China or Saudi-Arabia)\n\n# Links and Resources\n\nThe following websites contain / collect or provide additional information on export control regulations.\n- http://www.cryptolaw.org/\none of the most comprehensive free resources, compiled be Bert-Jappe Koops, a researcher during his PHD in the 90s. He stopped maintaining it in 2013. Thus the information may be outdated. But the site also conatins a plethora of contact information and links to regulatory authorities, so that it will at least be an excellent start for every investigation. \n\n\n\n# Tools\nSince the topic became relevant in the early 1990s, it is quiet a while since software vendors have to cope witht he challenges. Some of them shared the results of their effforts and provde their tooling. Find here a list of cool tools:\n\n- **Crypto-Detector** by Wind-River\nprovides an automated and efficient code parser that can determine, with a certain confidence, that a piece of code contains restricted encryption algorithms. The output could then be verified by a human expert.  It supports two assessments: Using keywords and using API indicators. The lists arae available and can be modified/extended. The tool can be used to scan repos, packages and local sources. It is licensed under Apache-2.0.\n\n- **minr** from SCANOSS:\nCan be found [here](https://github.com/scanoss/minr) is a Linux-based service, that allos to identify for a huge list of encryption algorithms in source code. It will write the results in a DB accompanied with the tooling to allow later assessment. Minr contains a definition  The tool can be used to scan  Licensed under GPL-2.0\n\n- **ts-deepscan** from [TrustSource](!https://www.trustsource.io)\nDeepScan has been designed to assess repositoriestakes the capabilities \n\n- **Application-Inspector** from Microsoft\nIs a Dot-Net based solution and can be found [here](!https://github.com/microsoft/ApplicationInspector), that assesses source code for its capabilities. The results are documented and provided as a report. Application inspector uses regex patterns for it analysis. \n\n# License\n\u003ca rel=\"license\" href=\"http://creativecommons.org/licenses/by-sa/4.0/\"\u003e\u003cimg alt=\"Creative Commons Licence\" style=\"border-width:0\" src=\"https://i.creativecommons.org/l/by-sa/4.0/88x31.png\" /\u003e\u003c/a\u003e\u003cbr /\u003e\u003cspan xmlns:dct=\"http://purl.org/dc/terms/\" property=\"dct:title\"\u003eInfo-Collection on `export controls`\u003c/span\u003e by \u003ca xmlns:cc=\"http://creativecommons.org/ns#\" href=\"https://github.com/trutssource/exportcontrols\" property=\"cc:attributionName\" rel=\"cc:attributionURL\"\u003eTrustSource Research\u003c/a\u003e is licensed under a \u003ca rel=\"license\" href=\"http://creativecommons.org/licenses/by-sa/4.0/\"\u003eCreative Commons Attribution-ShareAlike 4.0 International License\u003c/a\u003e.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrustsource%2Fexportcontrols","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftrustsource%2Fexportcontrols","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrustsource%2Fexportcontrols/lists"}