Dealing With A Private Institution Policy To Inspect All Encryption-capable Devices Leaving The Country
<p>I am a student recently admitted to the University of Cincinnati, and I noticed something very peculiar and frightening in section 3.11 of their <a href="https://www.uc.edu/content/dam/uc/infosec/docs/policies/Acceptable_Use_of_University_Information_Technology_Resources_9.1.3.pdf" rel="nofollow noreferrer">technology code of conduct</a>.</p>

<p>In light of clause 3.1, <em>"When an Individual accesses university computing services and accepts any
university issued computing accounts, they agree to comply with this and all other
related policies,"</em> and pursuant to clause 3.11, <em>"Exporting software, technical information, select research data, <strong>encryption software</strong>
or <strong>technology</strong>, to a location outside of the United States in violation of
international or regional export control laws, is illegal. The Export Controls Office
must be consulted prior to export of any material that is in question,"</em> the policy definitely asserts with no wiggle-room that, by using the resources at the University of Cincinnati, I have to confirm all devices with <em>encryption software</em> with the <em>Export Controls Office</em>. There is no clause in section 3 which limits the applicability to the campus, so this policy should in theory apply to anywhere I am. The problem is that almost every electronic device in existence has complex encryption software. For example, any device able to access the internet has powerful decryption software in order to decrypt SSL-encrypted streams. Hence, this broad policy seems to demand that I have to check through the Export Controls Office with every personal electronic device in my suitcase before I leave the country.</p>

<p>I understand the well-meaning original intentions of this policy and I fully intend to comply with the entire policy, but I am struggling to find a way around this unintended side-effect of the policy. What can I do to not have to submit my personal electronics from home for inspection every time I leave the country?</p>

<p>I would imagine that, reading up on <a href="https://en.wikipedia.org/wiki/Privacy_laws_of_the_United_States#cite_note-14" rel="nofollow noreferrer">US privacy laws</a>, the broadness of this policy makes the policy partially inapplicable because the policy is not above the law. Could the inapplicability of this policy extend so far as to void the policy (for my purposes, of course)?</p>

<p>Thank you everyone! You are amazing!</p>

<p>You're completely misreading the goals and purpose of the <a href="https://research.uc.edu/support/offices/export-controls/overview" rel="nofollow noreferrer">Export Controls Office - Overview</a>. They regulate the </p>

<blockquote>
  <p>transfer of US regulated information and technology, commodities, and
  software in the interest of national security and economic growth.</p>
</blockquote>

<p><em>Transfer and export</em> are not the same as the <em>use of technology</em> that personal devices contain. The simplest thing to do is simply call the Export Controls Office, and they will explain the difference, and tell what you need to do and what is not required of you when traveling.</p>

<p>Some countries do prevent the use of some personal tech or Apps, i.e. Russia and Signal, the encrypted phone app; but that has nothing to do with UC.</p>

united-states privacy international encryption travel