IP: French law encouraging key escrow encryption

[Dave Farber <farber@central.cis.upenn.edu>]

Date: Tue, 07 May 96 08:30:54 EST
From: "Stewart Baker" <sbaker@mail.steptoe.com>
To: farber@central.cis.upenn.edu


     
     Dave:
     
     I attach my firm's translation of Article 12 of France's 
     proposed telecommunications law. It's from the Steptoe 
     "Law and the Net" web page 
     (www.us.net/~steptoe/pubtoc.htm#net).  The law would 
     appear to restrict the import, sale, or use of encryption 
     products unless a key to the product is escrowed in 
     France with an escrow agent certified by the French 
     government. This draft law indicates that France is 
     seriously considering mandatory key escrow. 
     
     One possible concern is the law's import provisions, which 
     impose no barriers to imports of European products while 
     imposing restrictions on imports of products from other 
     countries. Read literally, this could violate France's 
     obligations under the most-favored-nation provisions
     of the World Trade Organization agreements. It is possible 
     that this provision will not in fact favor German and 
     Finnish products over Japanese and U.S. products because the 
     European-preference provisions apply only to importation of 
     encryption products, and the law's restrictions on use and 
     supply seem to apply irrespective of product source. The 
     apparent import preference for European products may simply 
     reflect France's obligation to allow the free flow of goods 
     within the European Union. 
     
     Stewart Baker
     
     
     Art. 12
     
     Article 28 of the Law No. 90-1170 dated December 29, 1990, 
     on telecommunications regulation is hereby amended as 
     follows:
     
     I - Section I is hereby amended as follows:
     
     1) The first paragraph shall be completed by the following 
     phrase: "Secret coding method denotes all materials or 
     programs conceived or modified for the same purpose."
     
     2) The second and third paragraphs are hereby replaced by 
     the following provisions:
     
     "To preserve the interests of national defense and the 
     internal or external security of the State, while 
     permitting the protection of information and the 
     development of secure communications and transactions, 
     
     1) the use of a secret coding method or service shall be:
     
     a) allowed freely:
     
     - if the secret coding method or service does not allow the assurance of 
     confidentiality, particularly when it can only be used to authenticate a 
     communication or ensure the integrity of the transmitted message;
     
     - or if the method or the service assures confidentiality 
     and uses only coding
     
     conventions managed according to the procedures and by an 
     organization approved under the conditions defined in 
     Section II;
     
     b) subject to the authorization of the Prime Minister in 
     other cases.
     
     2) the supply, importation from countries not belonging to 
     the European Community, and exportation of secret coding 
     methods as well as services:
     
     a) shall require the prior authorization of the Prime 
     Minister when they assure confidentiality; the authorization 
     may require the supplier to reveal the identity of the 
     purchaser;
     
     b) shall require declaration in other cases."
     
     3) A decree sets the conditions under which the declarations are signed and 
     the authorizations approved. This decree provides for:
     
     a) a simplified system of declaration or authorization for certain types of 
     methods or services or for certain categories of users;
     
     b) the substitution of the declaration for the 
     authorization, for transactions concerning secret
     coding methods or services whose technical characteristics or 
     conditions of use, while justifying a certain attention being paid 
     with regard to the aforementioned interests, do not
     require the prior authorization of these transactions;
     
     c) the waiver of all prior formalities for transactions 
     concerning secret coding methods or services whose 
     technical characteristics or conditions of use are such 
     that the transactions are not capable of damaging the 
     interests mentioned at the beginning of this paragraph.
     
     II - Section II is hereby replaced by the following 
     provisions:
     
     "II - Organizations responsible for managing, on behalf of others, the 
     coding conventions for secret coding methods or services that allow the 
     assurance of confidentiality must be approved in advance by the Prime 
     Minister.
     
     They are obligated to maintain professional confidentiality in the exercise 
     of their approved activities.
     
     The approval shall specify the methods and services that 
     they may use or supply.
     
     They shall be responsible to preserve the coding conventions that they 
     manage. Within the framework of application of the Law No. 91-646 dated 
     July 10, 1991, concerning the confidentiality of correspondence sent via 
     telecommunications, and within the framework of investigations made under 
     the rubric of Articles 53 et seq. and 75 et seq. of the Code of Criminal 
     Procedure, they must release them to judicial authorities or to qualified 
     authorities, or implement them according to their request. 
     
     They must exercise their activities on domestic soil. 
     
     A decree in the Council of State sets the conditions under which 
     these organizations shall be approved, as well as the guarantees 
     which the approval shall require; it specifies the
     procedures and the technical provisions allowing the enforcement of the 
     obligations indicated above.
     
     III - a) Without prejudice to the application of the Customs Code, the fact 
     of supplying, importing from a country not belonging to the European 
     Community, or exporting, a secret coding method or service, without having 
     obtained the prior authorization mentioned in I or in violation of the 
     conditions of the granted approval, shall be punishable by six months 
     imprisonment and a fine of FF 200,000.
     
     The fact of managing, on behalf of others, the coding conventions for 
     secret coding methods or services that allow the assurance of 
     confidentiality, without having obtained the approval mentioned in II or in 
     violation of the conditions of this approval, shall be punishable by two 
     years imprisonment and a fine of FF 300,000.
     
     The fact of supplying, importing from a country not belonging 
     to the European Community, or exporting, a secret coding 
     method or service, in order to facilitate the preparation or
     commission of a felony or misdemeanor, shall be punishable by three years 
     imprisonment and a fine of FF 500,000.
     
     The attempt to commit the infractions mentioned in the preceding paragraphs 
     shall be punishable by the same penalties.
     
     b) The natural persons guilty of the infractions mentioned 
     under a) shall incur the complementary penalties provided 
     for in Articles 131-19, 131-21, and 131-27, as well as,
     either indefinitely or for a period of five years or longer, the penalties 
     provided for in Articles 131-33 and 131-34 of the Criminal Code. 
     
     c) Judicial persons may be declared criminally responsible for the 
     infractions defined in the first paragraph under the conditions provided 
     for in Article 121-2 of the Criminal Code. The penalties incurred by 
     judicial persons are:
     
     1) the fine according to the modalities provided for by 
     Article 131-38 of the Criminal Code;
     
     2) the penalties mentioned in the Article L. 
     131-39 of the same code. The prohibition mentioned 
     in 2) of this article L. 131-39 concerns 
     activities, during the exercise of which, or on
     the occasion of the exercise of which, the infraction was 
     committed."
     
     III - Section III becomes IV.
     
     Its last paragraph is hereby replaced by the following 
     provisions:
     
     "The fact of refusing to supply information or documents, or 
     of obstructing the progress of the
     investigations mentioned in this section IV, shall be 
     punishable by six months imprisonment and
     a fine of FF 200,000."
     
     IV - Section IV becomes V.
     
     After the word "authorizations," the words "and 
     declarations" are hereby inserted.
     
     V - A section VI is hereby added, formulated as follows:
     
     "VI - The provisions of this article shall not hinder the 
     application of the Decree dated April
     18, 1939, establishing the regulation of war materials, 
     arms, and munitions, to those secret
     coding methods which are specially conceived or modified to 
     allow or facilitate the use or
     manufacture of arms."
     
     VI - This article is applicable to overseas territories and 
     to the territorial commonwealth of
     Mayotte. 
     
     
     
     Copyright 1996 Steptoe & Johnson LLP 
     
         Steptoe & Johnson LLP grants permission for the contents 
     of this publication to be reproduced and distributed in full 
     free of charge, provided that: (i) such reproduction and 
     distribution is limited to educational and professional 
     non-profit use only (and not for advertising or other use); 
     (ii) the reproductions or distributions make no edits or 
     changes in this publication; and (iii) all reproductions and 
     distributions include the name of the author(s) and the 
     copyright notice(s) included in the original publication.