Kantor Mischaracterizes

[John Young <jya@pipeline.com>]

   The Washington Post, October 18, 1996, p. A26.


   The Administration's Encryption Plan


   I write in response to The Post's Oct. 4 editorial [below]
   that mischaracterizes the administration's recent
   encryption plan.

   The administration's encryption plan is reasonable,
   workable, fair and coherent. It addresses the critical
   issues of promoting the export of encryption products and
   protecting the public safety and our national security. The
   administration's objective is to put forth a balanced plan
   that promotes commerce and protects people. And that's
   exactly what we've done.

   The proof that our plan will work is with the critical mass
   of industry that has announced its intention to work with
   the administration to develop a key recovery system, which
   will allow law enforcement, under proper court order, to
   have access to encrypted data. In fact, many of these
   companies have products they will soon market that both
   safeguard information and protect society, and more are
   expected to follow.

   The National Research Council (NRC) report to which the
   editorial referred recommended allowing the export of
   encryption up to the strength of 56 bits. Contrary to the
   editorial, the president has not "embraced a looser form of
   licensure" than this report. Instead, this administration's
   plan allows the export of encryption up to 56 bits so long
   as industry commits to build and market products that
   support a key recovery system. This is, in fact, a stronger
   form of licensure not called for by the NRC report.

   The Post's editorial conveniently ignores the critical role
   encrypted products play in protecting businesses against
   illegal activity and the privacy rights of individuals.
   This is a disturbing omission that avoids critical concerns
   that can only be advanced by the administration's plan.

   Finally, this administration takes seriously its
   responsibility to protect its citizens and our national
   security. That's why we are not lifting all restrictions on
   the export of encryption products, and why there is a
   two-year deadline on the export of 56-bit encryption
   products. The administration's plan will accelerate the
   development of a market-driven, global key management
   system. That will provide the best security of all.

   Michael Kantor
   Secretary of Commerce
   Washington

   [End]

----------

   The Washington Post, October 4, 1996, p. A22.


   Crypto Politics [Editorial]


   The Clinton administration once had a coherent, if
   unpopular, position on encryption software, the stuff that
   allows you to encode your email messages or other data so
   that no one can read it en route without a key. Now, in the
   wake of word that the president will sign an executive
   order, the position is no longer coherent, nor discernibly
   more popular with the high-tech audience it attempts to
   mollify.

   People and companies doing international financial business
   are highly interested in this kind of software, the more
   powerfully "uncrackable" the better. The U.S. software
   industry thinks there's a lot of money in it, especially if
   encryption becomes routine.

   The administration position till recently was that, much as
   U.S. software companies might profit from being able to
   market "uncrackable" encryption software freely, national
   security and law enforcement considerations dictated that
   such exports be controlled by license. Powerful encryption,
   like arms, could be dangerous in the hands of terrorists,
   rogue governments or international criminals. The software
   was classed as a munition; software above a certain
   uncrackability level could not be exported unless law
   enforcement authorities could get access somehow to the
   "key" after obtaining the proper warrants.

   Unbreakable codes on the loose strike us as a real danger,
   a legitimate reason for tight export controls. But if the
   administration really believes this, you'd think it would
   stick with steps that can plausibly meet the goal of
   control.

   Instead, trying to please, it has been splitting and
   splitting the difference between itself and the largely
   unmoved industry, which argues that no one will buy an
   encryption product that a government can decrypt at will.
   As with arms sales, the companies also argue that if they
   don't sell it, somebody else will, and that anyway it's far
   too late to fence off rogues. The national security people
   respond that there is still a "window," perhaps two years,
   in which they can prevent, if not all leaks of unauthorized
   crypto technology, at least its off-the-shelf use and wide
   adoption as the international standard.

   The administration initially proposed, then repeatedly
   refined, the concept of key "escrow" -- depositing a copy
   of the code with trusted third parties -- but never came up
   with a version the industry would accept. It commissioned
   a National Research Council report, which recommended a
   significant easing of restrictions. Now the president
   appears to have embraced a yet looser form of licensure
   upon declaration by a company that it will develop a plan
   within two years for key recovery. Also, the technology no
   longer will be considered munitions.

   What kind of plan? Nobody can quite say. What if the plans
   aren't acceptable? Licensing will revert to the old rule in
   two years. Will the security issue be moot by then?
   Probably. Barring some burst of clarity, one is left
   wondering whether the administration has compromised or
   caved, and what it now believes about the dangers of
   exporting uncrackable software.

   [End]

   See the National Research Council report:

   http://jya.com/nrcindex.htm