IP: Crypto

[Dave Farber <farber@cis.upenn.edu>]

U.S. to relax encryption export limits 
 
Steps fall short of what administration critics seek 
 
By Will Rodger, Inter@ctive Week Online
ZDNN 
 
Sept. 15 ? The Clinton administration is expected to relax export controls on data scrambling equipment Wednesday, preparing the ground for yet another round of debate over encryption policy. 


         ACCORDING TO ADMINISTRATION SOURCES, the White House will loosen its grip on the technology in several areas central to the five-year argument over the issue. Among other things, the new policy will relax controls for sales to specific industries, including e-commerce, medicine and insurance
       The liberalization will fall far short of what administration critics wanted. Even so, many crypto advocates expressed hope their position will continue to gain ground.
       ?It?s not as far along as my bill would go, but it?s a significant improvement on our current policy,? said Rep. Zoe Lofgren, D-Calif., a sponsor of encryption liberalization legislation in the House and one of several key Democrats briefed on the issue on the last two days. ?It will still give us something to argue about next year.?
       Electronic encryption, or the process of scrambling information so that only its intended recipient can read it, is widely believed to be the sine qua non of secure commerce and personal information on an insecure Internet. To date, however, federal policy has required stringent licensing of encryption technology that uses digital codes, or ?keys,? longer than 40 bits in length. Law enforcement has insisted on that restriction so that the encoding technology cannot be used to thwart surveillance techniques used in investigations.
       
CURRENT EXCEPTIONS WILL EXPAND
       Under an exception granted in December 1996, however, the government has allowed exports of equipment whose keys are as long as 56 bits, or roughly 64,000 times more powerful than 40-bit products. That exception was granted companies that committed to develop technologies to give law enforcement ?lawful access? to messages encrypted with their products through various back doors built into them.
       Notably free from those restrictions have been foreign financial institutions, which in most cases have been able to buy U.S.-made encryption software of unlimited strength since last year.
       That exception will be broadened under the new policy, sources said. Now, insurance companies, handlers of medical records and companies that use specialized transaction software to do business over the Internet will be able to buy American encryption software after a one-time review of their purchase plans by the U.S. Commerce Department. In addition, administration sources confirmed Tuesday evening, the government will no longer require prior approval of ?key recovery? agents, who hold spare keys to encoded messages for law enforcement.
       Some 45 nations, including Russia, China, Venezuela and Mexico, will likely be ineligible for the relief control as long as the U.S. government believes they harbor money-laundering operations, however.
       Finally, administration sources said, any U.S. company will be able to export powerful encryption technology to its own subsidiaries as long as it does not share the technology with non-U.S. companies. ...
       
http://www.msnbc.com/news/196751.asp