Cryptic Crypto Rules Uncloaked

[Anonymous <nobody@replay.com>]

November 23, 1999 

<http://www.thestandard.com/article/display/0,1151,7836,00.html>

by Keith Perine

WASHINGTON Ð With billions of dollars in high-tech encryption tools at stake, U.S. companies have been eager to know the details of new export regulations proposed last September. The industry got a first glimpse yesterday, when the Clinton administration released draft language of the new rules.

Last night, the government group released a preliminary draft to several companies that manufacture encryption products. The government asked the firms to keep the details secret for the time being, but leaked copies of the draft started circulating earlier today.

The new regulations have so far been met with mixed feelings by the industry representatives who have seen them. Early reactions suggest that the government hasn't done enough to calm industry fears about continued regulatory constraints.

"The draft regulations make progress, but fall short of the breakthrough announced in September," said Ed Gillespie, executive director of Americans for Computer Privacy. "Instead of a clean lifting of export restrictions, we have a complicated morass of regulations."

For years, the U.S. government, led by FBI director Louis Freeh, has argued that the U.S. must keep a tight lid on the export of data-scrambling products that guard information transmitted via the Internet. The FBI had also sought to tie relaxation of the export rules to concessions allowing the agency greater access to "keys" that can descramble encrypted data.

But the high-tech industry is worried that the tough U.S. stance would make it impossible for U.S. companies to compete against encryption products made elsewhere in the world. An industry-sponsored study unveiled last June reported that American-made encryption products must compete with 805 products made in 35 different countries.

Spurred by industry concerns, Rep. Bob Goodlatte, R-Va., and Rep. Zoe Lofgren, D-Ca., introduced the Security and Freedom Through Encryption Act, or SAFE, which would mandate relaxation of encryption export regulations and thwart attempts by law enforcement to get its hands on the descrambling keys.

The bill attracted widespread support in the U.S. House of Representatives. Sensing which way the wind was blowing, the administration announced on Sept. 16 that it would revise, and presumably relax, export regulations. The FBI backed off on some of its efforts regarding the descrambling keys. The industry hailed the administration's move, and Goodlatte temporarily put the brakes on the bill.

Since September, several government agencies, including the FBI, the National Security Agency and the Department of Commerce have been hashing out the details. Earlier this month, rumors began circulating that the new rules wouldn't go far enough to open up the export market.

"It certainly looks like the administration is trying to do the right thing," said Lauren Hill, chief technology officer for the Software & Information Industry Association. "But I'm not sure they're ready to bite the bullet."

Among industry's concerns: How the regulations will define retail products and government entities. Direct exports to foreign governments are more tightly controlled than retail sales. And, even under the new regulations, direct sales to seven nations that the U.S. says are guilty of state-sponsored terrorism Ð including Cuba, Iraq and Syria Ð are forbidden outright.

The industry wants a broad definition of "retail" and a narrow definition of "government." The law enforcement and national security communities want the reverse, to help them keep a lid on espionage."The draft of the regulations appears to be favorable to industry on those points, according to Kelly Blough, a spokeswoman for Network Associates, a manufacturer of encryption products.

"This pretty much liberalizes 90 percent of my company's exports," said Blough. She said that some of the draft language, including the rules for sales to telecommunications companies and Internet service providers abroad, is unclear.

But Network Associates and its competitors in the industry can now weigh in with their opinions. For the next week or so, government will be taking comments from the industry. The final draft of the new regulations is due Dec. 15.