Newsweek on Crypto

[jya@pipeline.com (John Young)]

   Newsweek, June 10, 1996, pp. 49-55. 
 
 
   Scared Bitless 
 
      The arcane world of cryptography used to be the 
      exclusive realm of spies. Now it's everybody's business 
      -- to the chagrin of the government. 
 
   By Steven Levy 
 
      [Photo] Loosen up: Sen. Conrad Burns says the United 
      States should ease the export rules on crypto software 
 
 
   On the face of it, the issue of cryptography -- the 
   technology that employs secret codes to protect information 
   -- seems more suited to math class than "The McLaughlin 
   Group." Yet this once esoteric subject has wound up in the 
   center of a Beltway controversy, complete with 
   congressional infighting, lobbyists, entrenched government 
   agencies, blue-ribbon reports and even a bit of 
   presidential politics. This sudden spotlight on what was 
   previously the domain of deep-black spy stuff turns out to 
   be a good thing, because in the Information Age crypto 
   policy is more than an abstraction: it could provide the 
   difference between security and vulnerability, or even 
   between life and death. Unfortunately, choosing the right 
   policy is not a given, and there the controversy lies. 
 
   Here's the problem: we're increasingly entrusting 
   information to computers -- everything from confidential 
   medical records to business plans to money itself. But how 
   can we provide security so that these data will be 
   protected from eavesdroppers, thieves and saboteurs? The 
   answer hinges on cryptography. By scrambling the 
   information into digital codes, it allows only those 
   entrusted with the keys to decipher those files to see 
   them. Some hot-shot cryptographers have developed systems 
   that can provide all of us with unprecedented security, 
   automatically coding and decoding in such a way that we 
   won't have to know it's there. (We can even have our phone 
   calls encoded something Prince Charles might have 
   appreciated.) Silicon Valley would love to set such a 
   system in motion. It not only would generate revenues, but 
   would also address the main problem that's keeping the 
   Internet from fulfilling its potential as a center of 
   commerce: security. 
 
   Problem solved? Not quite. Law-enforcement and 
   national-security agencies view this prospect with dread. 
   Legal eavesdroppers, like FBI wiretappers and National 
   Security Agency snoopers, couldn't make sense of 
   intercepted transmissions. They warn that we could miss 
   indications of a terrorist act, like a nuke smuggled into 
   Manhattan. In addition, drug dealers, child pornographers 
   and garden-variety thugs could mask their activities with 
   a mere mouse click. 
 
   Even before the Clinton administration took office, the NSA 
   and FBI presented those nightmare scenarios to the 
   transition team. The Clintonites were scared bitless. They 
   vowed to make sure that the worst didn't happen. They 
   understood that cryptography should be put to general use 
   -- but only if it were altered in such a way that the 
   government could, if necessary, get access to secret 
   messages, using a new technology known as "key escrow." The 
   best-known of those schemes was the ill-fated Clipper Chip, 
   and subsequent systems haven't caught on. (Yet another was 
   presented two weeks ago.) Until then they would maintain 
   the strict export controls that treat crypto software as 
   powerful munitions. That's right -- Uncle Sam regards that 
   copy of Netscape you downloaded as sort of a Stinger 
   missile. 
 
   But now the government position of slowing down the flow of 
   crypto is under increasing attack. Software companies 
   complain that regulations cost them money and hold down 
   innovation. Privacy groups complain that the controls reek 
   of Orwell's "1984." Congress is demanding changes. Bob Dole 
   wants to make it an issue. And on Thursday came what Sen. 
   Conrad Burns, a Montana Republican, called "the nail in the 
   coffin" of the Clinton crypto policy: a report by the 
   National Research Council that clearly rebukes the 
   administration's position. Despite the Clinton-Gore attempt 
   to protect us against the abuse of cryptography, says the 
   Congress-commissioned report, our safety is at risk -- 
   because the lack of cryptography has weakened our security. 
 
   Under particular attack are the regulations that limit the 
   strength of exported software like IBM's Lotus Notes, 
   mostly by mandating that the keys that encode and decipher 
   the information not exceed 40 bits (the longer the key, the 
   stronger the protection). Often, domestic users have to 
   settle for this crippled crypto: since software companies 
   are loath to release two versions of their products, they 
   simply choose to offer the weaker, approved-for-export 
   version. 
 
   Meanwhile, foreign companies have no such restrictions, and 
   U.S. companies maintain they are losing sales. Congress has 
   taken up their case; bills introduced by Sen. Patrick 
   Leahy, Rep. Bob Goodlatte and Burns all would relax the 
   export rules. "These bills are pro-privacy, pro-jobs and 
   pro-business," says Leahy. While prospects for passage are 
   slim, the fact that a sizable number of legislators are 
   defying intelligence and law-enforcement agencies is itself 
   significant. 
 
   Crypto policy is even finding its way into the presidential 
   campaign. On a visit to Silicon Valley, Bob Dole was 
   alerted to the problem by Netscape CEO Jim Barksdale. He 
   also saw a chance to chip away at Clinton's support in the 
   high-tech world. Dole not only cosponsored the Senate bills 
   but issued a neo-cypherpunk statement charging that "the 
   administration's big brother proposal will literally 
   destroy America's computer industry." 
 
   The NRC report, entitled "Cryptography's Role in Securing 
   the Information Society," stands as the most serious 
   challenge to current policy. It is drenched in credibility: 
   its 16 authors include former attorney general Benjamin 
   Civiletti, onetime NSA deputy director Ann Caracristi, 
   privacy expert Willis Ware and cryptographer Martin 
   Hellman. The panel was briefed by all sides of the issue, 
   including some classified sessions with government 
   officials. Despite the group's diversity, it reached 
   consensus: "Widespread commercial and private use of 
   cryptography is inevitable in the long run and ... its 
   advantages, on balance, outweigh its disadvantages." 
 
   The NRC made some specific recommendations. The government 
   should stop building a system around the umproven 
   Clipper-style technology. The export regulations should be 
   relaxed, specifically permitting free export of the 
   well-tested Data Encryption Standard, which uses a 56-bit 
   key. (While some argue for even bigger keys, this is a 
   significant jump. The increase in key size alone means that 
   theoretically it will be more than 65,000 times harder to 
   crack a code.) Perhaps the strongest rebuke came with the 
   rejection of the "if you only knew" defense. The committee 
   concluded that informed decisions on crypto could be made 
   without access to classified material. 
 
   If the NRC advice was followed, would criminals hide 
   nefarious activities behind a digital wall of gibberish? 
   Quite possibly, admits the committee -- but without action 
   to promote crypto, we are increasingly dependent on a 
   computer-controlled world with insufficient protection. 
   "We're encouraging a world that supports greater 
   confidentiality -- but we think it's worth the risk," says 
   panelist Ray Ozzie, creator of IBM's Lotus Notes. The 
   committee cited security breaches like the recent raid on 
   Citicorp by Russian hackers, and warned that without 
   crypto, we are more vulnerable to "information warfare" 
   threats -- endangering operations like the 
   air-traffic-control system. 
 
   The government's response? "We do care about the security 
   of information, but we need to do it in a way that does not 
   diminish law enforcement," says an administration official. 
   "People writing academic reports can take chances. But when 
   you are the policeman, you have to err on the side of 
   protecting people." 
 
   The question is, which approach provides the most 
   protection? The NRC report undercuts the government's 
   position at a time when many were already beginning to 
   question it. On May 21, 11 senators sat down in a bugproof 
   room for a classified briefing, presumably designed to make 
   them rethink their proposals. But, said Leahy, "no one 
   seemed to change their mind." Looks like they've cracked 
   the code. 
 
   [Two photos] 'Pro-privacy, pro-jobs, pro-business': Sen. 
   Patrick Leahy (right) and Lotus Notes creator Ray Ozzie 
   think strong codes will make a stronger economy 
 
   _________________________________________________________ 
   [Box] 
 
   Sending Messages In Private 
 
   Cryptography makes it possible to turn intelligible words 
   into a hodgepodge of letters, numbers and symbols, keeping 
   them out of the hands of cybersnoops. 
 
   [Illustration: computer  > key > encrypted message > key > 
   computer.] 
 
   To send a private message through a network, a cryptography 
   program is used to "lock" the message -- making it 
   unreadable to anyone who intercepts it. 
 
   The program generates a secret, digital key when it 
   scrambles the message. The receiver then uses the key to 
   translate the message back into plain text. 
 
   _________________________________________________________ 
 
   [End] 
 
   Thanks to SL and Newsweek.