NYT on NRC Report

[jya@pipeline.com (John Young)]

   The New York Times, May 31, 1996, p. D2. 
 
 
   White House Challenged on Data Security 
 
   By John Markoff 
 
 
   The United States Government should immediately relax 
   export controls on electronic data coding products and 
   allow the computer, software and telecommunications 
   industries to set data security standards, a new report 
   urged yesterday. 
 
   The report, commissioned by Congress and prepared for the 
   National Research Council of the National Academy of 
   Sciences, stands in direct opposition to existing Clinton 
   Administration proposals for data security standards and 
   for linking the relaxation of export controls to the 
   adoption of such standards. The report calls for the 
   widespread commercial adoption of technologies used to 
   prevent illegal wiretapping of computer data, telephone, 
   cellular and other wireless communications. The National 
   Research Council provides science and technology advice 
   under a Congressional charter. 
 
   The report also states that despite creating potential 
   problems for law enforcement agencies by making it easier 
   for criminals to shield their communications from 
   Government wiretappers, cryptography would also help 
   prevent crime by sheltering communications and electronic 
   transactions from the prying eyes of electronic 
   interlopers. 
 
   "Without information security, computer crime in this 
   country will rise very rapidly," said Kenneth W. Dam, the 
   chairman of the panel that prepared the report. Mr. Dam, 
   Deputy Secretary of State during the Reagan Administration, 
   is also professor of American and foreign law at the 
   University of Chicago. 
 
   The report, industry executives said, is likely to become 
   a key weapon in the battle between the Federal Government 
   and industry and civil liberties groups. 
 
   "It echoes things we have been saying for some time," said 
   Jim Bidzos, chief executive of RSA Data Security Inc., a 
   developer of computer security software. "The next 
   battleground is going to be Capitol Hill because the 
   Administration isn't going to give up easily." 
 
   In particular, the report takes issue with Administration 
   efforts to force the use of data-scrambling systems using 
   "escrowed" keys that would let law enforcement and 
   intelligence agencies use built-in backdoors to read coded 
   information. 
 
   Cryptography, once used only by spies and the military, has 
   become an increasingly vital technology for insuring 
   security in electronic commerce and personal privacy. It 
   relies on the use of mathematical formulas to scramble 
   electronic information so that it cannot be read without 
   the proper digital "key." 
 
   Key escrow systems like those proposed by the 
   Administration in its Clipper chip program would split the 
   key and have trusted third parties like the Treasury 
   Department hold parts of it, making it possible for law 
   enforcement agencies to generate keys without consulting 
   the sources of the data. 
 
   As recently as two weeks ago, the Administration was 
   pushing for key escrow coding approaches to data 
   scrambling. A draft White.House policy paper has proposed 
   linking relaxation of export controls to systems that 
   included key escrowing. The recent paper also indicated 
   that the Government was willing to accept "self-escrow" 
   systems for some large corporations that would allow them 
   to to hold all parts of the keys. 
 
   Critics of key escrow management technology note that it 
   can be abused by agencies that wish to exceed their 
   surveillance authority and that the technology is 
   vulnerable to a single point of failure. If a so-called 
   master key is stolen, they say, the entire coding system 
   can be compromised. 
 
   Because strong cryptography would complicate the mission of 
   United States intelligence agencies, the Federal Government 
   currently places tight controls on the export of software 
   and hardware that offer stronger cryptographic protection 
   than 40-bit keys. Such keys are made up of a binary number 
   that is 40 digits long. Computer experts have shown that 
   40-bit keys are vulnerable to attacks. 
 
   The report released yesterday, "Cryptography's Role in 
   Securing the Information Society," calls for dropping stiff 
   export controls on products that use the Data Encryption 
   Standard, which relies on a 56-bit key and offers stronger 
   protection against computerized attacks than a 40-bit key. 
 
   [End]