US to Ease Crypto Export

[John Young <jya@pipeline.com>]

7 July 1998 
Source:
http://www.washingtonpost.com/wp-srv/WPlate/1998-07/07/064l-070798-idx.html
Thanks to FT
  
U.S. to Ease Limits on Export of Data-Scrambling Technology

By Elizabeth Corcoran
Washington Post Staff Writer
Tuesday, July 7, 1998; Page E04 

Commerce Secretary William Daley plans to announce today
that the government will give U.S. software companies new
freedom to export their most sophisticated data-scrambling
technology to financial institutions chartered in 45 countries,
according to Clinton administration sources.

Under the new rules, which officials said are likely to take
effect in late summer, eligible banks, securities firms,
brokerage houses and credit-card companies will need to
receive approval only once from the Commerce Department
before they can license the most sophisticated "encryption," or
data-scrambling, technology.

Once they receive approval, those institutions will be
permitted to share the technology with any of their branch
offices, except for those located in terrorist states.
Government sources estimate that the new rules will include
about 70 percent of the world's banks, including the 100
largest (ranked by assets).

For years, the government has closely regulated export of
encryption software, on the grounds that terrorists or hostile
governments might use it to cloak their communications. The
software industry argues that the rules are unworkable and
unfairly block foreign sales. Unfriendly parties wanting to use
encryption already can obtain it overseas, industry executives
said.

The new rules on banks are "a move in the right direction,"
said one industry executive familiar with the regulations. "But
we're still leaving some groups out. Basically, we need to keep
spreading the circle wider," to include the growing number of
businesses offering financial services, such as insurance
companies.

"What we've heard sounds great," said Kawika Daguio, a
lobbyist for the American Bankers Association. "We've been
arguing [for several years] that the regulatory structure we
have guarantees we're good citizens" who wouldn't make illicit
use of the technology, he said.

Now the government appears to have agreed.

Current regulations require that U.S. companies apply for
permits before exporting anything but the simplest versions of
encryption products. To export more sophisticated
technology, organizations must have a plan for creating
so-called "spare keys." That way, law enforcement officials
who have obtained a court order would be able to unlock the
information.

In May 1997, the Commerce Department said it would not
restrict the sophistication of the data-encryption technology
sold to financial institutions. But it required spare keys and
case-by-case licensing. Approvals have been slow. Now the
government is doing away with the key requirement, defining
more precisely which financial institutions qualify and pledging
to end case-by-case approval.

Because of concerns about money laundering, the government
will grant the new permission only to financial institutions
chartered in countries that have agreed to take steps against
money-laundering. If U.S. companies want to sell to financial
institutions chartered in other countries, they will have to
apply for licenses from the Commerce Department.

Such provisions still fall short of the demands of U.S.
companies. "To take a piecemeal approach [to loosening
encryption restrictions] is the wrong direction," said Ed
Gillespie, executive director of Americans for Computer
Privacy, a lobbying group. "We need a blanket lifting of
restrictions with individual prohibitions," such as bans on
sending such technology to terrorist states, he said.

In a related development, a federal court in Ohio ruled on
Friday that posting the text of an encryption program on the
Internet, where people all over the world could see it, was not
protected by the constitutional right to free speech.

The ruling, made late Friday, contradicts a ruling made by a
California district court last August. Privacy advocates predict

that the issue will be taken up by the U.S. Supreme Court. 

� Copyright 1998 The Washington Post Company