Brookings Inst. on crypto: "There are reasonable compromises"

[Declan McCullagh <declan@well.com>]

---------- Forwarded message ----------
Date: Fri, 18 Jul 1997 09:17:52 -0700 (PDT)
From: Declan McCullagh <declan@well.com>
To: fight-censorship-announce@vorlon.mit.edu
Subject: Brookings Inst. on crypto: "There are reasonable compromises"

Morton's Steakhouse is a true Washington institution. Nestled
in the heart of lawyer country, between K and L streets, the
clientele are well-heeled lobbyists hungry for red meat. Which
is all you'll find at Morton's, where the menu lists a fine
selection of slabs, all thick, bloody, expensive.

I had lunch at Morton's yesterday with a colleague, a fellow
from the NSA, and a gentleman from the armed forces. We
talked Net-regulation, censorship, and hacking. Most of all
we talked encryption, and crypto-compromises. This is a theme
you'll see repeated in this recent policy paper from the
liberal Brookings Institution:

	There are reasonable compromises. A useful place to start
	is a national cryptography policy... rigorous oversight
	and accountability for government access to the keys
	needed to intercept and read coded data, negotiation of
	an agreement with our close allies on a global encryption
	standard, and formation of a government/private sector
	oversight body... the basic elements of a reasonable
	compromise are now in sight and may yet be achieved...

	Current initiatives that would allow export of any
	technological solution, of unlimited strength, subject
	only to the proviso that an acceptable key recovery
	system be maintained with a suitably defined and trusted
	party (including self-escrow), are headed in the right
	direction...

-Declan

------------------

no. 21
Deciphering the Cryptography Debate

July 1997
By Kenneth Flamm

FOR THE PAST FIVE YEARS, the U.S. government and
America's information industries-producers and users
of computers, communications systems, software,
information services-have been locked in a bitter and
highly technical battle over cryptography policy: the
rules of the game for techniques used to scramble and
unscramble data. Such encryption and decryption is
vital in maintaining the confidentiality of
information (whether business information, financial
transactions, personal medical records, or government
secrets) passing through the exploding web of computer
and communications links joining this nation together.
The hard fought and often arcane debate has come to an
inconclusive and unsatisfactory draw that does little
to deal effectively with any of the conflicting
objectives-civil liberties, economic competitiveness,
law enforcement, and national security-brought to the
bargaining table.

This does not have to be. There are reasonable
compromises. A useful place to start is a national
cryptography policy built around four key
elements-strong cryptography put into wide use, a
strengthened legal framework and electronic logging
system that provides rigorous oversight and
accountability for government access to the keys
needed to intercept and read coded data, negotiation
of an agreement with our close allies on a global
encryption standard, and formation of a
government/private sector oversight body to review
both the overall security of our national information
infrastructure and the voluntary testing and
certification of encryption and security products.



Why Is Cryptography Important?


UNTIL THE MIDDLE OF THIS CENTURY, codemaking and
codebreaking were primarily the concern of governments
protecting diplomatic and military communications.
World War II was a turning point for cryptography. The
first primitive electronic computers were built by the
United States and Britain during that war and used to
break German and Japanese codes. Using technology and
methods that remained closely guarded military secrets
until the late 1970s, the Allies succeeded in building
electronic machines to break the supposedly
unbreakable codes used to encrypt virtually all Axis
radio messages. This allowed the Allies, for example,
to read signals sent by German submarines as they
reported their locations, send forces to destroy them,
and win the vitally important battle for the North
Atlantic shipping lanes.

After the war, U.S. codebreakers continued to play a
central role in the development of the fastest
possible computers of the day, so-called
supercomputers. In the late 1960s, others in the
military funded research into damage-resistant digital
communications networks that gave us the first working
prototype of today's Internet.

As computers and network use also took hold within
business in the 1960s and 1970s, cryptography (mainly
the domain of government in earlier decades)
increasingly began to protect sensitive business
information stored in private sector computers. With
outside computer links through communications networks
growing, the dangers of unauthorized penetration into
sensitive computer databases through these external
ties also multiplied. The financial sector led these
technological changes. As global financial markets,
national banking systems, and local automated teller
machines all went electronic, cryptographic systems
were installed to protect sensitive data coursing
through the digital arteries of finance.

Today, we are teetering at the precipice of an even
wider transformation of the basic infrastructure for
commerce. Telecommunications services, retailing, and
the electric power grid are already organized around
vast computer networks. Multinational companies link
global operations over international networks. By
1999, all U.S. government benefits will be paid
electronically. Doctors will access data and
communicate remotely with patients, businesses will
buy services from consultants, contractors will sell
to government, researchers will provide policy advice,
seminars will be organized-all over computer networks.
Vast savings in time and resources and improvements in
business productivity seem possible. For this leap
forward in our economic infrastructure to be realized,
however, the information running through the system
will have to be authenticated, verified, protected
from unauthorized access, and guarded against witting
or unwitting corruption.

Equally profound changes are going on within the
military establishments whose investments initially
spurred the computer revolution. Our post-Desert Storm
military forces are as dependent on complex
computerized command, control, and communications
networks as commercial industry. The Defense
Department is today groping toward an information
technology-based Revolution in Military Affairs, a
future in which sensors, intelligence databases,
command and control systems, precision munitions, and
smart weapons platforms are seamlessly linked together
in real time to deliver measured military force
swiftly, surely, and over great distances.

In contrast to the situation of forty years ago,
enormous private sector investments are today driving
the engine of information technology, with the
military largely drawing on commercial technology for
its particular variant of the information revolution.
Commercial and military computer and communications
systems-like the core industrial infrastructure
underlying modern military power-are hopelessly
intermingled within the sinews of the U.S. information
economy. A new term, information warfare, explicitly
recognizes that an attack designed to disrupt our
military capability or will to fight is as likely to
target nominally civil infrastructure, like
telecommunications networks, the electric power grid,
the banking system, or air traffic control, as any
purely military system.

Widespread use of effective cryptography to secure and
protect the rivers of data flowing through computer
and communications systems is needed now to enable the
further development of the information infrastructure
for tomorrow's high-tech economy and to protect
military capabilities dependent on that same
information infrastructure.

What Are the Issues?


The heated debate over cryptography policy is
fundamentally driven by rapid technological change.
The price of computing power has been dropping 20 to
30 percent annually over decades now, an order of
magnitude greater than anything measured during the
first great Industrial Revolution of two centuries
ago.

Computing power is used to both make and break codes,
and as the cost of computing power plummets,
cryptographic systems that once offered adequate
protection for data become insecure. By the same
token, however, cheaper computers also make it cost
effective to encrypt data where once it would have
been uneconomic. Paradoxically, then, plummeting
computing costs have both enabled the widespread use
of encryption to defend information security and
increased the ability of moderate to large
organizations (in the private sector and governments)
to afford the computing resources needed to
successfully attack once-capable encryption systems.
To balance these shifting forces, the United States
must grapple with multiple and often conflicting
objectives.

First, there are constitutional issues. On the one
hand, the United States has a well-established
tradition of respect for privacy and civil liberties
that is a bedrock of our society. On the other hand,
there are few absolute rights-under court order,
communications can be legally intercepted, and private
homes may be entered and searched. Encryption-like
"speaking in tongues"-might even be interpreted as a
form of speech and offered the greater protection that
freedom of speech enjoys. Historically, the government
has not attempted to control the use of encryption
within domestic U.S. borders but instead limited its
export overseas. Similarly, court orders are required
to lawfully intercept domestic telephone
conversations, but not for foreign traffic. The legal
framework protecting data communications-including
encryption of data-has not changed to address the many
new channels for expression (and surveillance of
expression) opened up by the computer revolution. It
is now appropriate to establish an organized and
systematic legal framework for our information
society.

Second, we need to use strong cryptography to enable
electronic commerce on the burgeoning information
infrastructure that is going up all around us. The
potential economic benefits from moving forward
rapidly to locate our businesses on the information
superhighway seem large. Without ironclad security,
however, no business is going to drive its sensitive
data up the on-ramp. Strong cryptography is a small
but vital piece in the systems that will provide
information security.

Third, U.S. companies are world leaders in computers
and communications, where success in global markets is
an essential ingredient in maintaining competitive
advantage. But the market for information technology
is one in which capable foreign competitors stand
ready to pick up the baton of technological leadership
should American firms stumble. The economic
preeminence of U.S. information technology
companies-and the resulting benefits to the U.S.
economy-are arguably at risk should U.S. producers be
blocked from selling important technology that is
available from foreign competitors.

Law enforcement objectives, in contrast, argue for
controls on use of strong cryptography (while
recognizing that cryptography also protects against
electronic crimes). Since the dawn of the age of
telephony, lawful wiretapping has been viewed as an
essential tool for police, the legal extension of the
right to enter and search under warrant. In the
information age, with the proliferation of digital
technology, cryptography has the potential to deny
police the lawful access that they now enjoy to voice
and data communications.

National security has been another powerful argument
for limits on encryption. Though not often discussed
openly, interception of foreign communications traffic
is in all likelihood one of the most valuable and
reliable sources of intelligence for defense and
foreign policy purposes. Routine use of strong and
difficult-to-break cryptography in, say, the global
public telephone network would be a nightmare scenario
for both law enforcement and the intelligence
community.

But we should also recognize that while global
availability of strong encryption may limit our
offensive gathering of foreign intelligence and
perhaps in the future, offensive "information
warfare," the global economic success of U.S.
information technology producers also has a positive
value for offensive intelligence gathering. Even the
strongest encryption technology may be rendered
vulnerable by the way it is administered and used. A
global marketplace dominated by the products of the
United States and its allies-which will be well
understood by a substantial community of American
technologists-will be much more transparent to allied
intelligence gathering than a world market dominated
by the unfamiliar and poorly understood products of
others.

And strong encryption, even if pervasive and
unbreakable, will nonetheless have a positive national
security value in protecting U.S. information from the
snooping of adversaries, political and economic. It
will also have significant value as a defensive
rampart against the information warfare offensives of
adversaries. Arguably the United States, now reliant
on the most advanced and pervasive information
infrastructure in the world, is also the nation with
the most to lose to disruption by a successful
offensive attack.

Finally, we must acknowledge that as more and more
aspects of our personal and economic lives are
connected to, and accessible over, the information
superhighway-things like medical records, corporate
accounts, personal travel plans, even daily calendars
and diaries-the "wiretapping" metaphor for permitting
government access to electronic information begins to
break down. It is no strain to forecast a
not-too-distant digital future in which almost
everything-all sorts of personal information, records,
even art and music-is stored or communicated
electronically, connected to or accessible through
some computer network. As the Worldwide Web reaches
out to encompass all aspects of our lives, a
surreptitious government access hatch begins to
resemble a special door built into the basement of our
homes through which government can enter without our
knowledge or consent.

Our Constitution's protections against "unreasonable
searches and seizures" should be our guide as we chart
these deep and unknown waters. Government access to
private information should be governed by clear rules
that "we, the people" make after open debate. Even in
simpler times, there have been occasional but deeply
disturbing instances in which individuals in
government have abused powers granted for legitimate
law enforcement and national security purposes. As
pervasive electronic tendrils from the information
superhighway reach into the nooks and crannies of our
lives, the potential damage from poor judgment (or
worse yet, corruption) by some individual in
government will be enormous. It is vital that a system
with clear guidelines and strict accountability be put
into place to oversee our national encryption policy
as we strike a balance among the multiple, legitimate
objectives.

Where Are We Now?


In the late 1970s, industry, in collaboration with the
U.S. government, developed a Data Encryption Standard
(DES) based on coding keys (sequences of binary
digits, or bits) that were 56 bits long. Though widely
used today, steady advances in computer performance
now make this system vulnerable (commercial
supercomputers almost double in power every year,
sufficient to "break" a key that is one bit longer in
some given time). Much stronger encryption systems are
used within the military and other parts of the U.S.
government. Until 1996, the State Department did not
readily permit the export of encryption systems using
keys longer than 40 bits, which can be easily broken
today.

The Clinton administration, recognizing the need to
promote commercial use of stronger encryption,
unveiled such a system in April 1993 (actually
developed under previous administrations but not
publicly promoted). The system used special computer
circuitry dubbed the "Clipper" chip, with decoding
keys issued in two parts and held by two separate
government agencies-within the Treasury Department and
the Commerce Department. This Clipper chip initiative
championed the concept of "key escrow," with
government holding copies of the keys used to encrypt
data, and argued for its voluntary adoption by the
private sector as a solution to increasingly evident
data security problems.

Since only stronger encryption systems using the
Clipper chip, or similar technology, were likely to be
approved for export, critics argued that the system
was not really voluntary. No U.S. multinational
corporation would want to build and maintain two
separate computer and communications networks-one for
domestic use and one for international use.

There were other practical objections. It was unclear
how foreign governments would react to companies
operating in their nations giving the U.S. government
the keys to read encrypted communications, or even if
this would be required. There was suspicion that the
Clipper chip, with its proprietary
government-developed technology, was not as secure as
advertised and might even allow surreptitious
government interception without appropriate legal
safeguards. Even more important, there was concern
that a government-mandated technical solution was
being imposed on an industry that was far more capable
and responsive to continuing technological change than
any cobwebbed and inflexible government bureaucracy,
and that industry itself through market forces was
much better able to work out the best solutions to its
information security problems.

Furthermore, argued much of U.S. industry,
increasingly capable foreign producers were beginning
to market and sell encryption systems that were
stronger than what U.S. industry would be permitted to
sell in export markets. The net effect of
administration policy, in this case, would be to tie
the hands of U.S. industry and leave an important and
growing segment of the information industry to foreign
producers, free to sell any and all strong encryption
products to customers anywhere.

Stung by these criticisms, the Clinton administration
withdrew and regrouped. In mid-1994, it offered up a
new proposal in which "trusted third parties" within
the private sector, rather than the government itself,
would act as key escrow agents. This did little to
silence industry critics.

Finally, in 1996 the administration revealed a new
plan and made some important changes in the direction
of its policies. There would henceforth be no
restrictions on exports of cryptographic systems-based
on key length or technology-if those systems contained
so-called key recovery features. That is, if U.S.
exporters could demonstrate a viable plan in which
trusted third parties (possibly including
"self-escrow" within user organizations) would hold
(and supply to government when presented "appropriate
legal authority") information that would permit
recovery of code keys and decryption of data,
unrestricted export of such encryption systems would
be allowed. Over an interim period of two years,
exports of non-key recovery 56-bit cryptography
systems would be permitted by producers demonstrating
a commitment to develop viable key recovery systems.
Cryptographic systems would be reclassified as a
dual-use commercial product, rather than a munition,
and export controls transferred from the State
Department to the Commerce Department (though the
Department of Justice would now play a new advisory
role in the export licensing process). Finally, an
explicitly international framework would be sought,
with mutual access to national key recovery agents
negotiated with foreign governments through carefully
defined legal procedures.

Though some in the U..S. business community continued
to object, initial reaction was much more favorable
than with previous cryptography initiatives. The
government had worked with U.S. business in developing
the new initiative, and a number of major U.S.
computer and software companies voiced support for the
general principles outlined in the initiative. (A
system that enabled recovery of their own encrypted
business data, in fact, was actually useful to
companies in dealing with the risks of employee
turnover.) Others took a wait-and-see approach.

The wait was not a long one. Within months, a number
of the proposal's initial supporters had publicly or
privately defected as the details of its
implementation were revealed. One major sticking point
was the government's apparent desire to involve itself
in frequent and detailed reviews of proprietary
company business plans and progress in developing key
recovery systems, as a condition for continued
approval of interim exports of 56-bit systems.

By mid-1997, some additional problems had become
visible. A U.S. attempt at internationalizing the key
recovery principle met only limited success: a draft
policy from the Organization for Economic Cooperation
and Development (OECD) recommended only that the
issues be left to national discretion. While the
United States, Britain, and France publicly supported
the idea (and Japanese officials made it clear
privately that they too would cooperate), opinion in
Germany was divided, and other countries hesitated.
Dueling bills-establishing a legal framework for key
recovery, decontrolling cryptography export-were
debated on Capitol Hill. On the face of it, another
impasse was shaping up.

In fact, however, with a little more flexibility and
some degree of innovation, the basic elements of a
reasonable compromise are now in sight and may yet be
achieved. For the first time, the varied interests at
stake are close enough to a workable solution to make
establishment of a functioning and effective national
cryptography policy a real possibility.

Seeking Common Ground


Four basic elements make up the core of what a
national cryptography policy should do. First and
foremost, strong cryptography-strong enough to resist
the attacks that rapidly improving computer technology
will continue to breed-must be available for routine
business use. In an integrated global economy, this
also means that it must be usable and exportable
around the world. Current initiatives that would allow
export of any technological solution, of unlimited
strength, subject only to the proviso that an
acceptable key recovery system be maintained with a
suitably defined and trusted party (including
self-escrow), are headed in the right direction. This
will permit market forces to determine the most cost
effective and flexible technologies, build in the
ability to respond dynamically to continuing
innovations in computer and communications technology,
and yet maintain the ability of law enforcement and
national security authorities to gain lawful access to
encrypted communications when a critical national
interest makes such access imperative.

But the government should be more forthright in
presenting its case. Though it is true that no
constraints on domestic use of encryption are being
proposed, the only product likely to gain wide
acceptance in today's global economy is cryptography
that is exportable to one's foreign subsidiaries and
business partners. The government should be crystal
clear in acknowledging that this debate is in fact
about the encryption systems that will be used widely
within the domestic U.S. economy. Also, key recovery
remains an untried and untested system. It is entirely
possible that a better solution to the cryptography
problem may be discovered as computing technology
advances, and policy should be flexible enough to
adapt if this happens. The critical thing is the
principle: strong encryption, widely available, with
the potential for lawful decryption by accountable
authorities.

The government still must establish clear principles
and a transparent cryptography policy. The new export
regulations do not explicitly address a large number
of significant issues (for example, backwards
compatibility of key escrow with interim 56-bit
systems, length of time escrowed keys must be kept for
different types of data) that are now being defined in
a piecemeal and private fashion as individual
companies' key recovery product development plans are
submitted with license requests. Various "exceptions"
to the infant policy- permitting the export of
stronger encryption without key recovery, for example,
in specialized financial applications, or to banks and
foreign subsidiaries of U.S. companies- are announced
weekly. A "black box" process ("just submit it, and
we'll tell you if it's OK") that sets limits on
cryptography without open discussion and debate and
forces Americans to struggle to infer the policy from
the sparse and sometimes inaccurate details published
in the press is totally unacceptable in an area this
important to the nation.

A second core element of a new national policy-and one
that has yet to be carefully addressed by any broad
initiative-is the construction of a clear, up-to-date
legal framework for, and safeguards on, government
access to encrypted data and communications.
Government access is only tolerable in pursuing the
legitimate social objectives outlined earlier. The
legal framework defining privacy and freedom of speech
in electronic data and communications is currently a
crazy, patchwork quilt with many holes in it. The
administration's new rules specify that key recovery
agents must hand over keys to the government within
two hours after receiving "appropriate legal
authority" but nowhere define precisely what this
authority must be. Is a court order required, or
merely a signature from a political appointee, and
under what circumstances? Our laws should be debated
and updated to define the answers better and more
comprehensively, given current and foreseeable
technological realities.

Careful attention must also be paid to the potential
for abuse or corruption. Even after appropriate legal
authority is granted on paper for some narrow purpose,
there is typically substantial room for interpretation
as to what is "reasonable" in deciding how wide to
cast an electronic net in trapping suspicious
communications and how to deal with unexpected
discoveries that turn up. Most government officials
can be expected to behave in a responsible and lawful
way, but an excessively curious or aggressive, or even
corrupt, official using a legal interception to "surf"
through data or communications beyond its intended
scope creates a potential for damage that will grow
just as quickly as the information superhighway
itself. The same computer technology that makes
electronic communication so cheap and pervasive also
makes it possible to electronically record and log,
with a permanent and verifiable audit trail, any
government interception of electronic communications.
Just as financial services companies safeguard against
abuse by logging and taping telephone contacts with
customers, comprehensive logs and a verifiable audit
trail should be automatically recorded and stored
electronically in each and every instance that a
government official intercepts private data or
communications. In addition, tougher standards for
private abuse of personal data and illegal access to
private communications should be included in whatever
new legal framework is adopted, and significant
penalties should be defined.

Third, a national cryptography policy must recognize
that the problems-and solutions-outlined above are
inherently international in scope. Law enforcement,
national security, regulation and oversight of global
finance and trade are all areas that span national
boundaries today and require cooperation among
governments. Just as our private sector works with its
foreign partners to define standards that allow it to
operate easily and effectively in global markets, the
U.S. government must work with foreign governments to
define an international encryption policy that makes
the U.S. approach compatible with foreign systems.
U.S. requirements imposed on U.S.-based businesses
must be compatible with the foreign environments in
which they operate.

U.S. requirements should also be no more onerous than
those imposed by foreign governments on their business
communities. A level playing field, with common global
rules of the game, is needed to avoid giving economic
rivals competitive advantages over one another. The
administration made an important and correct decision
in seeking an international consensus on the key
recovery approach to strong encryption and must be
sure to continue to work hard in seeking this common
global approach. While it has yet to achieve such a
consensus within the OECD, many of the key players
with the technical capability to ship advanced
cryptography products and affect global
markets-Britain, France, and (quietly) Japan-are
supporting the U.S. approach, and if a few more (like
Germany and Israel) can be brought on board, the
critical mass around which the core of an
international agreement can be assembled will exist.

Finally, with cryptography set to play such a key role
in tomorrow's information infrastructure, some new
institution that provides a framework for business and
government to jointly examine both the overall
security of our information infrastructure and the
integrity of its individual parts is needed. At the
micro level, we must recognize that acquiring a
cryptographic product is not like buying a computer or
auto- simply testing or using it within an
organization gives insufficient insight into its
quality or utility. The essence of an effective
cryptography system is what the most capable and
potentially hostile forces outside a business or other
organization can do with the system. There are also
obvious economic benefits from some sort of
government-industry testing and certification process
that spares individual customers a costly and
duplicative investment in determining the
effectiveness of a cryptography product (and makes use
of sensitive information that may be available only to
the government). At the macro level, the integrity of
our power grid, banking system, and phone network are
clearly as vital to our national security as the
number of transport aircraft the U.S. Air Force buys,
and both government and industry have an obvious
interest in scrutinizing the entire information
infrastructure and taking steps to reduce weaknesses
and vulnerabilities. Government and the private sector
should form an oversight body tasked with both
reviewing the overall integrity and security of the
national information infrastructure and creating a
voluntary testing and certification process for the
information security products developed by the private
sector.

A national cryptography policy built around these four
elements- strong cryptography put into wide use, a
strengthened legal framework and electronic logging
system that provides rigorous oversight and
accountability for government access to the keys
needed to intercept and read coded data, negotiation
of an agreement with our close allies on a global
encryption standard, and formation of a
government/private sector oversight body to review
both the overall security of our national information
infrastructure and the voluntary testing and
certification of encryption and security products-will
leave many (maybe even most) participants in the
current debate unsatisfied. An absolute right to
privacy would not be created in the electronic realm.
The government would probably face greater constraints
in seeking lawful access to electronic communications,
and maintenance of auditable records probably will
create some additional costs. Business is being asked
to bear some burden in keeping the keys needed to
decrypt confidential communications for a time.
Intelligence and national security officials will be
more dependent than ever before on cooperation with
their allied counterparts. Cooperation on common rules
of the game for encryption at the international level
will have to be carefully negotiated. None of this
will be painless. But it must be done if we are to
balance an important and complex set of interests as
we enter the next century, the age of the information
society.

Kenneth Flamm is a senior fellow in the Brookings
Foreign Policy studies program and the author of
Mismanaged Trade? Strategic Policy and the
Semiconductor Industry (Brookings, 1996). The views
expressed in this Policy Brief are those of the author
and not necessarily those of the trustees, officers,
or other staff members of the Brookings Institution.


-------------------------
Declan McCullagh
Time Inc.
The Netly News Network
Washington Correspondent
http://netlynews.com/