Another Federal Code to Crack

NATIONAL JOURNAL, Vol. 29, No. 02

he debate over how--and whether--the overseas sales of devices that can turn computer transmissions into eavesdropper- proof gibberish should be regulated has never been short of complications. And now, thanks to new export regulations published by the Commerce Department, it's about to become positively byzantine. What's more, some analysts assert that the controversy may result in still another face-off between the White House and Congress over the limits, and proper uses, of presidential authority.

In simple terms, the debate centers on the question of whether American companies will be allowed to sell ``strong''-- that is, military-grade--data-scrambling computer programs beyond the borders of the United States. For years the answer has been a straightforward (and, by and large, unchallenged) ``no.'' Federal export regulations devised during the Cold War barred the sale of these programs overseas on the ground that they are weapons.

In the wrong hands, encryption programs could be as deadly as a missile or a tank, the drafters of the old export rules argued. Modern computers can indeed scramble messages into codes so complex that deciphering the data the messages contain is impossible without a ``key'' that has also been generated by computer. If American software companies--long the acknowledged international leaders in the encryption game--were allowed to sell their strong encryption programs throughout the world, the argument went, then rogues of all stripes would be able to communicate freely, shielded by an electronic barrier no law enforcement or national security force could penetrate.

Technological advances have overtaken that argument, however, according to the computer industry. As the Internet expands, computer users can use electronic mail, or ``e-mail,'' to zip encryption programs across borders in seconds, the industry contends. A military-grade encryption program called Pretty Good Privacy, or PGP--developed by Phil Zimmerman, a Denver-based programmer--has been freely available on the Internet for years. Last year Hitachi Ltd., a Japanese firm, produced an encryption program that is reportedly five times more powerful than anything American firms are allowed to sell in international markets.

For two years or so, U.S. software companies and computer equipment makers have been negotiating with the Clinton Administration over proposals to ease the export restrictions on encryption software. Early last month, it seemed that an agreement had finally been reached that everybody could live with. But the new regulations, which were published by Commerce on Dec. 30, shocked much of the industry. Among other stipulations, the rules require software makers to entrust to a government-approved third party--an individual with a government- issued security clearance, for instance--the key to any encryption program sold abroad.

The Business Software Alliance, a Washington-based trade association that represents most of the big U.S. computer software and hardware firms, has vigorously fought similar ``key escrow'' proposals. With the publication of the new regulations, ``our worst fears have been confirmed,'' said Robert W. Holleyman II, the group's executive director. ``This is a top-down, government-designed industrial policy, and it's bad.''

Here's where the issue gets complicated, however. A few of the major players in the computer industry aren't all that unhappy with the regulations. Take International Business Machines Corp. (IBM), which last fall organized an alliance of companies to support its proposal for a two-step process that would allow law enforcement officials to recover and unscramble encrypted data without using a key.

The European Commission is currently considering a similar ``key recovery'' scheme that, if implemented, would make the placing of code keys in the hands of trusted third parties the industry standard in Europe, some American companies believe. If that happens, the federal government is likely to impose a similar standard.

IBM supports the new regulations because ``we had to have something we thought would be consistent with where the U.S. government is going,'' said Aaron W. Cross, IBM's Washington- based public policy director. As for those U.S. firms that oppose the new regulations, Cross added, ``we would prefer they take a more global focus.''

Industry opponents of the new regulations plan to appeal to Congress for help, as they have in the past. Bills designed to override the government's encryption policy never reached the floor last year, but this time the opponents may have extra ammunition.

On Nov. 15, President Clinton issued an executive order that transferred oversight of encryption software exports from the State Department to the Commerce Department. The order was part of Administration efforts to strike a compromise on encryption policy with the computer industry, which views Commerce as more sympathetic to its interests than State.

The order, however, gives the Justice Department authority to consult with Commerce officials over the issuance of encryption export licenses on a case-by-case basis. This is an entirely new--and unwelcome--role for law enforcement in the encryption controversy, many industry executives and some privacy activists maintain. (A further complication is a Dec. 18 ruling by a U.S. District Court judge in California that struck down parts of the old regulations.)

``This executive order ups the stakes in Congress because it involves the assertion of presidential authority to make law,'' said Marc Rotenberg, executive director of the Washington- based Electronic Privacy Information Center. ``A lot of people on Capitol Hill will oppose it just on principle, even if they're sympathetic to law enforcement's concerns. I don't believe Congress will be satisfied that this is an adequate way to make policy.''