NSA in the WSJ

[Duncan Frissell <frissell@panix.com>]

From:  The Wall Street Journal, Tuesday March 22, 1994, p. B1


TECHNOLOGY


Clipper Chip Is Your Fried, NSA Contends

NSA Seeks to Dispel Misgivings of Public About Clipper Chip


By Bob Davis

Staff Reporter of The Wall Street Journal.

FORT MEADE, Md. --- The National Security Agency wants everyone to know
that its new computer-security system will protect individual privacy.
But as the spy agency knows, hardly anyone believes that.

Critics fear the government will use the NSA technology, designed in
secret, to spy on Americans.  The project "is a focal point for the
distrust of government," acknowledges Clinton Brooks, the NSA scientist
who led the so-called Clipper Chip project, in the agency's first
interview on the subject.

The Clinton administration last month adopted the NSA plan for a series
of computer chips that would protect telephones and computers.  Use
of the technology would be voluntary.  Federal agencies would adopt it
first, and public use is expected to spread gradually.

Under the plan, cryptographic "keys" that could unscramble the
communications would be split in two and held separately at the Treasury
Department and the National Institute of Standards and Technology.  That
way, law-enforcement agents could tap the communications by getting court
authorization to obtain the two halves.  The idea is to boost security
but to keep the technology out of the hands of criminals and spies.

The NSA is the world's biggest eaves-dropper.  Equipped with the latest
in super-computers and satellite receivers, it targets communications by
foreign governments.  The agency shuns publicity but agreed to the
interview to explain its role in the Clipper controversy and try to
dispel fears.  Mr. Brooks, a 26-year veteran of the NSA, says the project
began in 1989 and cost more than $2.5 million.

He says the NSA is consumed with what it calls the "equities problem" ---
how to balance privacy rights against the needs of law enforcement,
national security and private industry.  In 1989, he and Raymond Kammer,
deputy director of NIST, began discussions about how to improve computer
security without making it impenetrable to police.  NIST is a Commerce
Department agency with formal responsibility for unclassified computer
security.

Before the interview, Mr. Brooks takes a look around a small cryptographic
museum just outside the NSA's gates.  He stands before an exhibit of
Enigma machines, used by the Germans during World War II to encrypt
messages --- and later broken by Allied intelligence.  Enigma started as
a commercial product; recognizing its military value, the Nazis pulled
it off the market.  "That was the concern we're wrestling with today,"
Mr. Brooks says --- commercial encryption technology becoming so good that
U.S. spy agencies can't crack it.

In 1989, NIST and the NSA put together an eight-person team, split evenly
between the agencies, to quietly work out security concepts.  The team
decided against using a weak encryption code --- "Roman Numeral One is
that it had to be good security," says Mr. Brooks.  And it also rejected
a so-called trapdoor approach, in which the computer code would be
designed so it would have a weak spot --- a trapdoor --- that federal
agencies could enter via computer to tap the communications.  Someone else
could discover the trapdoor, they decided.

The team settled on a system with a powerful encryption formula, called
an algorithm, and encryption keys that would be held by outsiders.  Law-
enforcement agencies could get copes of the keys when they needed to bug
the conversations.  The toughest decision, both Mr. Brooks and Mr. Kammer
say, was to keep the algorithm, dubbed the Skipjack, secret.  That meant
the public wouldn't know for sure whether the NSA had inserted a trapdoor
or some other eavesdropping device.

"It would defeat the purpose [of the project] if we gave the knowledge
of how the algorithm worked" to the public, says the 56-year-old Mr.
Brooks.  "It was going to have to be kept classified."  Otherwise, he
explains, engineers could use the algorithm to design computer-security
systems that the government's encryption keys couldn't unlock.

By 1990, he says, as many as 30 NSA "cryptomathematicians" and other
employees were working to perfect the algorithm and other features.  A
year later, the NSA launched what it called the Capstone Project to build
the algorithm into a computer chip.  The NSA contracted with Mykotronx
Inc., a small company in Torrance, Calif., to do much of the development.
By September 1992, the NSA was confident the system would work.

None too early for the NSA.  Earlier that year, Mr. Brooks says, American
Telephone & Telegraph Co. informed the NSA that it wanted to sell a
phone using a popular encryption technology to scramble conversations.
The NSA balked.  "We said it probably wouldn't get an export license
from this country," Mr. Brooks says.  Instead, AT&T was told of the
Capstone work and agreed to use the technology if it became a federal
standard and was exportable, he says.  The NSA then took some of the
functions of the Capstone chip and tailored it to phone equipment, calling
the resulting product the Clipper Chip.  For computers, Capstone was
encased on a computer card that became known as Tessera.

The the Bush administration, enmeshed in a re-election bid, never pushed
Capstone.  So shortly after the election, National-security heavyweights
importuned the Clinton transition team to move quickly on Capstone.  Just
weeks after the inauguration, the new administration's national-security
team was debating the NSA proposal and in April announced to the public
that it would adopt the scheme.

Last month, the administration gave the final go-ahead --- despite
withering criticism from industry.  Vice President Gore called encryption
a "law and order issue."  NIST's Mr. Kammer says the new administration
was also trying to line up backing among national-security officials to
liberalize export controls on computer equipment and other high-tech
gear.

The high-tech industry was stunned at the decision.  David Peyton, vice
president of the Information Technology Association of America, a trade
group of computer companies, says the scheme will dangerously centralize
power in the federal government and will limit exports.  James Bidzos,
president of a computer-security firm, RSA Data Security Inc., goes
further.  He posted a letter on the Internet computer network arguing
that Clipper may be the "visible portion of a large-scale covert
operation on U.S. soil by NSA."

Nonsense, responds Mr. Brooks, who says he is distressed by the
"emotionalism" of the arguments.  "The only reason we're involved is
that we have the best cryptomathematicians in the country."

--- WinQwk 2.0b#1165