Business Week on PGP subpoenas

[an12070@anon.penet.fi (S. Boxx)]

BusinessWeek, October 4, 1993

p. 43, Washington Outlook


SPY VS. COMPUTER NERD: THE FIGHT OVER DATA SECURITY

Philip Zimmermann wanted to strike a blow for freedom.  To help
computer users keep data safe from snoopers, the Boulder (Colo.)
software consultant and self-described "privacy activist" wrote
a program making it easy to encode messages with an all-but-unbreakable
cipher.  And he offered it free through the network known as the
Internet.

Now, Zimmermann's gift to cyberspace has exposed an enormous gap in
the Administration's vision of a high-tech future.  The White House
is promoting a data superhighway as a key to a competitive future.
But the National Security Agency is trying to restrict the use of
high-quality encryption, which experts believe business will need
to take full advantage of the "information infrastructure."

The focus of the fight is a program Zimmermann calls "pretty good
privacy" (PGP).  On Sept. 9, two software companies in Texas and
Arizona that have been involved in publishing PGP received federal
grand-jury subpoenas requesting documents and information about
the program.

CRACKDOWN.  Although the government won't discuss the investigation,
the computer world has a pretty good idea what's going on.  Because
sophisticated encryption allows friends and foes alike to protect
communications, the software is subject to the same export controls
as munitions.  But PGP has popped up all over the world.  The probe,
says Zimmermann's lawyer, Philip Dubois, is aimed at "finding out how
it occurred and whether an offence was committed."

Oddly, the crackdown on software comes just as the Administration is
loosening export controls on computer hardware.  But the schizophrenia
may be more apparent than real.  "I don't think they've got the export
policy together enough to be split," says a key congressional staffer.
The underlying problem, explains Paul Freedenberg, a Washington attorney
and export-controls specialist, is that "Clinton is very cautious about
dabbling in national security.  This is an area that has essentially been
turned over to the spooks."

Meanwhile, there is growing concern in Congress about possible damange
to exports.  Quality encryption software "is available from foreign
manufacturers...and is easily transmitted using only a long-distance
telephone line and a modem," complained Representative Sam Gejdenson
(D-Conn.) and a high-powered bipartisan group of colleagues in a Sept.
20 letter to the President.  "Yet the U.S. continues to control this
computer software as a Munitions List item."  Says Douglas Miller of
the Software Publishers Assn.: "The U.S. government is succeeding only
in crippling an American industry's exporting ability."

While the goal of the NSA and other security agencies - keeping U.S.
messages secure while allowing Uncle Sam to read those of both
domestic and foreign bad guys - is laudable, technology may be rendering
it impossible.  "Law enforcers no longer have the inside track," says
Eben Moglen of Columbia University law school.

Experts agree that NSA officials are smart enough to see the writing
on the wall, encrypted or not.  But, says James Bitzos [sic], president
of RSA Data Security Inc. in Redwood City, Calif., the agency wants to
maintain as much control as possible for as long as possible.  Today,
intelligence agencies still have a shot at finding "needles in the
haystack," he says.  "If they lift export controls, they might as well
go home."

Still, the NSA can't stave off the inevitable for long.  Gejdenson hopes
to produce legislation by early next year to revamp government policy
on high-tech exports.  The result will probably include looser
restrictions on encryption software - and a victory for Phil Zimmermann
in his battle to keep snoops out of his cyberspace.

By John Carey





-------------------------------------------------------------------------
To find out more about the anon service, send mail to help@anon.penet.fi.
Due to the double-blind, any mail replies to this message will be anonymized,
and an anonymous id will be allocated automatically. You have been warned.
Please report any problems, inappropriate use etc. to admin@anon.penet.fi.