Industry Reaction To Government's Key-Recovery Scheme Is Lukewarm

Welcome Guest. | Log In| Register | Membership Benefits

March 19, 1998 (12:00 AM EST)

Industry Reaction To Government's Key-Recovery Scheme Is Lukewarm

By Charlotte Dunlap,

Industry reaction to Tuesday's Justice Department announcement that the Federal Bureau of Investigation (FBI) and DOJ will not push for legislation requiring domestic key escrow in the United States is lukewarm.

Key escrow is a security technique that places a cryptographic key into the hands of a trusted third party. The government has said it would like access to that key, either by acting as the third-party holder or insuring that a U.S. party holds the key. This criteria is not expected to go over well with foreign customers.

Although the recent DOJ announcement is seen as a win for privacy advocates and encryption technology vendors, value-added resellers (VARs) and observers said they are waiting for the other shoe to drop.

Most VARs said they expect that eventually, legislation will be passed that requires key escrow in security products exported to foreign customers.

VAR Steve Burke, CEO of Secure Distribution, in Oakland, Calif., is confirming the industry's worst nightmare by bypassing U.S. technology and recommending foreign encryption products to his clients to bypass potentially illegal export laws.

"We've been forced to find some security products manufactured internationally to supply to our international customers because of the export laws," Burke said. "It's what the private sector has been telling the government all along. You're not eliminating the security in order [for the FBI] to get to the customer -- you're taking business away from the States," he said, referring to current law that dictates limited encryption key lengths may be exported from the country.

"Corporations want to deploy a consistent solution globally, and if they can't find it here, they'll go elsewhere and import here," he added.

Vendors including RSA Data Security have become outspoken advocates for less government access to corporate information, largely to protect their core business. RSA, the leader in the encryption marketplace whose software has become the industry de facto standard, maintains that U.S. vendors will lose business to foreign competitors that are able to export higher levels of cryptography.

"It's a step in the right direction," said Martin Burack, executive director at Internet Society, in Reston, Va., of the news issued Tuesday by the Justice Department. His motto is: "Work the technology, not the laws."

"We have mixed emotions because we don't want to support the bad guys, but we're concerned that the cure is worse than the disease," he said.