21 May 1998
Thanks to RH

    Investor's Business Daily

    NATIONAL ISSUE

    THE ENCRYPTION EXPORT DEBATE

    U.S. Controls On Technology Could Cost $9 Billion

    Date: 5/21/98

    Author: Reinhardt Krause

    Is the Clinton administration finally ready to relax controls on exports of
    computer-security technology?

    Signs that the White House is rethinking its policy is stirring some hope in
    the high-tech industry, after more than five years of frustration.

    Others warn, however, that the White House is leaving the door open to
    imposing tighter encryption controls within the U.S., as well as restricting
    exports.

    Encryption scrambles computer data to provide security and privacy. It plays
    a key role in electronic commerce over the Internet by protecting digital
    communications - such as corporate e-mail and credit- card and bank-account
    data - from tampering.

    Computer companies want the U.S. to ease export controls on advanced
    encryption hardware and software so they can take part in the booming market
    in global e-commerce.

    That stance puts them at odds with law enforcement agencies. They say
    rolling back controls could let criminals, terrorists or computer hackers
    conceal illegal activities.

    It's high time to hammer out a compromise, Commerce Department Secretary
    William Daley said last month.

    "While our policy goal - balance -is the right one, our implementation has
    been a failure," Daley said. "The global market is rendering our
    (encryption) policy obsolete. And I fear that will soon make our products
    obsolete as well."

    U.S. firms could lose out on $9 billion in encryption-product sales over the
    next five years if export policy isn't revised, says a study released last
    month by the Economic Strategy Institute in Washington.
    It pegs overall cost to the economy at a minimum of $35 billion through
    2002.

    The government now restricts U.S. companies to selling what many experts
    regard as low-level encryption. For high-level encryption sales, the policy
    requires the use of ''key recovery'' systems.

    These systems give law enforcement agencies access to special keys -through
    third parties - that unscramble data so they can be read.

    If you look at encrypted, or protected, data, all you see is a soup of
    letters, numbers and symbols. To make sense of it, you need a set of
    instructions called a key. The longer the key, the stronger the encryption.

    A strong encryption key is 128 digital bits long. It's virtually impossible
    for government agents to break, which is why the administration wants to
    control its sale and use.

    But in March, Vice President Al Gore left some wriggle room in a letter to
    Sen. Tom Daschle, D-S.D., the Democratic leader in the Senate.
    "The administration is not wedded to any single technology solution," Gore
    wrote.

    The high-tech industry hopes Daley's frank admission that encryption policy
    isn't working and Gore's letter point to new flexibility.

    But some leading encryption firms are wary.

    "The National Security Agency and Federal Bureau of Investigation are still
    orchestrating the administration's position behind the scenes," said Jim
    Bidzos, president of RSA Data Security, a Redwood City, Calif.- based unit
    of Security Dynamics Technologies Inc.

    Administration officials "continually play this game of offering some
    meaningless relief, promising more and never delivering," Bidzos added.
    "They're gridlocked. When pressed to make concessions, the NSA and FBI
    never find any compromises acceptable."

    Still, Congress is set to review several encryption bills this year. And a
    new high-tech-backed group, Americans for Computer Privacy, plans to spend
    several million dollars on lobbying and ads to change encryption policy.

    "We need a more creative approach," said ACP's executive director, Ed
    Gillespie. "The policy is outdated and ineffective. You're not going to
    stop demand for encryption technology or its spread."

    The computer industry has been let down before, says Kenneth Dam, a
    University of Chicago law professor. He headed a study released by the
    National Research Council two years ago that urged the government to relax
    its export controls on encryption products.

    "There's been no leadership at the center of the government to resolve
    this," Dam said. "There hasn't been enough high-level staff attention to
    knock heads together and get a resolution. The administration doesn't have a
    really clear position."

    In '93, the administration's "clipper chip" proposal would have required
    every computer to include an encryption chip whose keys - or code to unlock
    encrypted data - would have been held by the government. That proposal fell
    flat with civil libertarians.

    Two years later, the administration proposed that a third party control the
    keys to encrypted data and the government could gain access to them with
    proper warrants.

    There are basically two ways to set up third- party control. One is similar
    to giving a neighbor a copy of a house key. The other is like giving parts
    of a treasure map to different people.

    Often, the third parties are makers of encryption products.

    The Justice Department went further last year, pushing for the use of key
    recovery systems within the U.S. And Sens. John McCain, R-Ariz., and Robert
    Kerrey, D-Neb., drafted bills for tighter domestic controls over encryption
    products.

    In March of this year, Justice appeared to soften its stance. Gore's letter,
    though, implies that the administration may yet support domestic encryption
    controls if a new compromise isn't reached, warn some in the high-tech
    industry.

    "We're dead set against domestic controls," said Aaron Cross, public
    policy director at International Business Machines Corp.

    "We need to get a new dialogue started," Cross added. "As long as there
    is posturing by law enforcement on one side and people advocating total
    freedom to use and export strong encryption on the other, you're going to
    end up in this area of paralysis."

    To make matters worse, U.S. firms stand to lose business to foreign rivals
    that are able to sell advanced encryption products with no strings attached.

    "Our policy encourages the growth of foreign producers at the same time it
    retards growth here," said Commerce's Daley.

    The Economic Strategy Institute figures that at the end of '97, 653
    encryption products were being made in 29 countries outside the U.S. Major
    producers are in Germany, Ireland, Canada, Israel and Great Britain.

    "Encryption policy is severely hampering the competitiveness of U.S.
    companies, especially software suppliers," said Carl Howe, an analyst at
    consultancy Forrester Research Inc. in Cambridge, Mass. "We need to relax
    our export policy, or see that business go overseas."

    Manufacturers second that.

    "The driving force (behind loosening export limits) is electronic commerce,
    which creates a demand for encryption technology," said Douglas McGowan,
    Hewlett-Packard Co.'s director of Internet business development. "We have
    customers overseas that want access to the same kind of technology our U.S.
    customers can buy. That's why it's an important issue to us."

    Many other high-tech companies also have a stake in the encryption debate.
    Encryption code is embedded in much software used in e-commerce and Net
    browser software to protect engineering diagrams and proprietary data.

    [End]