Cryptography is export-controlled by the US government as a munition, and Netscape makes exportable versions of its software, which are the ones predominantly used on the Internet.

The claim has three parts, tested as of June 1995: (a) US law controlled the export of cryptography as a munition (under ITAR / the US Munitions List); (b) Netscape produced exportable versions of its software (for example with 40-bit encryption); (c) those export versions were the ones mainly in use on the Internet. True: all three hold. Mostly true: (a) and (b) hold and (c) is roughly right (export or weak-crypto versions were the majority in use), with only a minor imprecision. Mixed: (a) and (b) hold but (c) is clearly wrong or cannot be supported, or one of (a) or (b) is materially inaccurate. Mostly false: two of the three parts are wrong. False: cryptography was not export-controlled as a munition at that time and Netscape did not make exportable versions.

Set before the research began.

1. E1 Export of cryptography from the United States - Wikipedia Wikipedia · 15 July 2004

   “the encryption technology (techniques as well as equipment and, after computers began to play a larger role in modern life, crypto software) was included as "Category XI - Miscellaneous Articles" and later "Category XIII - Auxiliary Military Equipment" item into the United States Munitions List on November 17, 1954.”

2. E2 Export of cryptography from the United States - Wikipedia Wikipedia · 15 July 2004

   “Acquiring the 'U.S. domestic' version turned out to be sufficient hassle that most computer users, even in the U.S., ended up with the 'International' version,”

3. E3 Export of cryptography from the United States - Wikipedia Wikipedia · 15 July 2004

   “a deal between NSA and the Software Publishers Association made 40-bit RC2 and RC4 encryption easily exportable using a Commodity Jurisdiction with special "7-day" and "15-day" review processes (which transferred control from the State Department to the Commerce Department).”

4. E4 1995-97: From Clipper to Key Recovery | Ethics and the Law on the Electronic Frontier | Electrical Engineering and Computer Science | MIT OpenCourseWare MIT OpenCourseWare · 18 August 1995

   “break the 40-bit RC4 encryption algorithm used in Netscape’s SSL (the only encryption algorithm generally approved for export from the U.S.,”

E1 says encryption technology, including crypto software, was on the US Munitions List from 1954, which supports part (a). E4, a source dated August 1995, describes the 40-bit RC4 encryption in Netscape's SSL as the only encryption generally approved for export, and E3 describes the deal that made 40-bit RC4 easy to export; together these support part (b). E2 says that most computer users, even in the US, ended up with the 'International' version of encryption software, which is consistent with part (c). However, E2 gives no date, so the evidence does not pin part (c) to June 1995 specifically, which makes this mostly true rather than true.