U.S. Crypto-Export Plan Gets Mixed Reviews

Welcome Guest. | Log In| Register | Membership Benefits

September 16, 1998 (2:41 PM EDT)

By John Borland,

The White House released new export rules for encryption software on Wednesday, to mixed praise from civil-liberties groups and high-tech businesses.

Under the plan, U.S. companies will be able to sell strong data-scrambling products to overseas insurance companies and health care firms, as well as to subsidiaries of U.S. businesses. These exceptions to the general rules will be added to existing exemptions for financial-services companies.

The plan is another step in loosening restrictions on the export of data-scrambling software. While still far from what many critics of administration policy have asked for, most said it was a welcome step in the right direction.

"[Our group] considers today's announcement to be a positive first step toward a sensible long-term policy," said Ed Gillespie, executive director of Americans for Computer Privacy, a business-backed group that has taken a lead in lobbying for loosened encryption-export rules.

"We're very happy with the plan," said Kelly Blough, director of government relations for Network Associates, the company that produces Pretty Good Privacy and other corporate encryption products. "We think this provides us with a lot of opportunity we haven't had before."

Civil-liberties groups were cooler in their response to the plan, however.

"We're glad the administration has taken a step forward, but it is a small step," said Lusan Chua, a policy analyst with the Washington, D.C.-based Center for Democracy and Technology (CDT). "We don't think the new regulations adequately address the privacy and security concerns of individuals."

The new policy will not go into effect until written into official Commerce Department regulations. It contains conflicting messages about the administration's commitment to controversial "key recovery" plans, which allow law enforcement back-door access to the plain text of encrypted messages.

A key is the string of digits required to unscramble a digitally encrypted message. Encoded messages become exponentially more difficult to crack as the key length grows. Cutting-edge encryption programs produced in the U.S. and overseas use key lengths of at least 128 bits.

"If we're going to guarantee that individuals have adequate privacy and security, government is going to have to move a little faster."
-- Lusan Chua
Center for Democracy and Technology

Under the old export laws, companies can export encryption products with key lengths of up to 56 bits if they commit to creating products that will include a key-recovery feature. This requirement is being phased out for export of products with 56-bit keys under the new rules.

But the White House plan also boosts a different kind of back-door recovery method, in which a network administrator would have access to the plain text of a corporation's internal documents, and could provide this information to law enforcement. Software with this feature will be given the green light under the new export rules.

The plan appeared to be targeted primarily at concerns of high-tech companies, which have said they are losing business to overseas firms that can create and sell super-strong encryption without licensing requirements.

Network Associates' Blough said 40 percent of their business is overseas, where there's a stronger market for security products. The company will continue to lobby for looser export laws, she said, since these changes still ban it from selling strong data-scrambling products to foreign-owned companies like Honda or Siemens.

The plan continues to ignore individuals' need for secure communications, the CDT's Chua said. "There's a real disconnect here," she said. "If we're going to guarantee that individuals have adequate privacy and security, government is going to have to move a little faster."

The White House said it would review its plan after a year.