------- Forwarded Message Date: Fri, 01 Aug 1997 18:13:20 -0700 From: kalliste@aci.net (J. Orlin Grabbe) To: snetnews@world.std.com Subject: SNET: [Fwd: Another torpedo slams into Clinton crypto policy] - -> SearchNet's SNETNEWS Mailing List Path: news.alt.net!news1.alt.net!news-chi-13.sprintlink.net!news-east.sprintlink.net!news-dc-26.sprintlink.net!news-peer.sprintlink.net!news-pull.sprintlink.net!news-in-east.sprintlink.net!news.sprintlink.net!Sprint!205.185.79.4!zdc!super.zippo.com!lotsanews.com!szdc!newsp.zippo.com!news1 From: jqp@globaldialog.com Newsgroups: alt.current-events.clinton.whitewater,alt.politics.clinton Subject: Another torpedo slams into Clinton crypto policy Date: Fri, 01 Aug 1997 00:21:25 -0500 Organization: None Message-ID: <33E17255.18BB@globaldialog.com> Reply-To: jqp@globaldialog.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 3.0Gold (Win95; I) Xref: news.alt.net alt.current-events.clinton.whitewater:189839 alt.politics.clinton:338125 NY Times August 1, 1997 Canadian Product Puts New Spin on Encryption Debate By PETER WAYNER Canadian company's recent release of a new encryption product and subsequent announcement that it had received a license from Canada to export the product has surprised many companies and U.S. officials. The release was startling because the United States and Canada historically regulated the encryption- exporting issue in synchrony. The company, Entrust Technologies Ltd., released a free version of its Entrust/Solo software on Tuesday, and announced that they had received a license from the Canadian government to export it to almost all of the world. - -=- [TABLE] -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= THE MOVE BY ENTRUST SEEMS TO EXPLOIT A DIFFERENCE IN THE REGULATIONS BETWEEN THE UNITED STATES AND CANADA. - -=- [TABLE] -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This decision by Canada could signal a major rift developing between two allies over an issue that is becoming increasingly important to the computer software industry. In fact, the move seemed to startle the [*]Bureau of Export Affairs at the U.S. Department of Commerce. James Lewis, director of strategic trade at the bureau, would only issue a one-sentence statement through a spokeswoman: "This is under review as a potential enforcement matter." He offered no insight into which American laws were being violated. Shauna White, a spokeswoman for the company, said "We believe we are in full compliance with all the Canadian laws that apply." In the past, the United States and Canada enforced their encryption regulations with such cooperation that most controlled products are shipped in boxes announcing, "For U.S. and Canada only." The U.S. government was certain that Canadian regulations would block anyone from shipping the product out of Canada. Those regulations are still in place and there has been no change in the effect on products built in the United States. Programs written by Canadians, however, are another matter. Entrust was able to qualify for a license because their software contained what John Ryan, the company president and chief executive, said was "100 percent Canadian content." That is, it was developed in Canada by Canadian citizens. Entrust Technologies Inc. was spun off on Jan. 2, 1997, from Nortel (Northern Telecom) after Nortel developed the Entrust product. Entrust Technologies Inc. is based in Dallas, but most of the development work is done in Ottawa, Ontario, where the Canadian subsidiary, Entrust Technologies Ltd. has its offices. Ryan, for instance, is a Canadian citizen. The move by Entrust seems to exploit a difference in the regulations between the United States and Canada. Both countries are members of the Wassenar Arrangement on Arms Export Controls, a set of loosely controlled rules that took the place of Cold War- era regulations designed to reign in conventional arms and dual-use technologies. The arrangement regulates the export of encryption software but provided an exemption for general- use software that was freely available through either the public domain or widespread public channels like stores. Ryan explained: "Many countries have chosen to 'to turn that part off.' Canada has not chosen to turn that part off." The existence of this regulatory difference may have come as a surprise to many people in the United States because the Canadian software industry has not yet produced a top-rank international competitor. The academic computer science departments at colleges like the University of Toronto are first rate, but there are no companies with the same public presence as Microsoft or IBM. But Entrust Technology's emergence shows how quickly the public perception can become obsolete in the swiftly moving world of technology. The company is clearly hoping that its free version of the Entrust/Solo software will build acceptance for the commercial versions, which are also freely exportable. Many other companies follow the same strategy of releasing free versions to the public in order to publicize the commercial versions, which usually come with more features. Entrust allows people to download free copies of Entrust/Solo for personal use from their Web site, but they block requests from seven restricted countries: Libya, Iran, Iraq, Cuba, Angola, Syria and North Korea. France and Singapore are also blocked because they have restrictions on the import of technology. Entrust is already in heavy competition against a U.S. company, [*]Pretty Good Privacy Inc., which is circulating a free version of its encryption package, PGP 5.0. This version is available for home and non-commercial use without charge. The software, however, was developed in the United States and can't be exported without a license. The company has worked closely with the U.S. Commerce Department to smooth licenses for major U.S. companies seeking to use the software with their subsidiaries, but an individual license must still be granted in each case. Kelly Huebner Blough, director of government relations for Pretty Good Privacy, said: "Well, of course we would like the U.S. to license exports more liberally. Most of the other countries in the world license encryption software more freely. They may have strong policies on the books, but when it comes to implementation, the U.S. is the most restrictive." - -=- [TABLE] -=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ALL OF THE MAJOR SOFTWARE COMPANIES LIKE MICROSOFT, IBM AND SUN CONTINUE TO PRESS THE U.S. GOVERNMENT FOR RELIEF OF THE EXPORT CONTROL LAWS, ARGUING THAT BETTER AND BETTER SOFTWARE IS EMERGING THROUGHOUT THE WORLD. - -=- [TABLE] -=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Other companies will also be feeling the pressure. Ray Ozzie, the president of Iris, the developer of Lotus Notes, which is now owned by IBM, said: "This is further proof that easy-to-use, high-grade encryption products are available worldwide, and that U.S. companies continue to be at a disadvantage in the world marketplace. U.S. policy needs to change in order to take these realities into account." One of the most vexing parts of the regulatory equation involves unraveling whether the U.S. government can exert any pressure on Entrust Technologies Ltd. through its U.S.-based corporate parent, Entrust Technologies Inc. The current version of the regulations restrict U.S. companies from providing "technical assistance" to their foreign companies--a rule that would seemingly not apply to a product developed completely by Canadians. Earlier drafts were more vague and seemed to target any relationship or aid, but the final version focused on technical assistance. Companies with close relationships with the U.S. government are still circumspect. Steve Walker, president of the Glenwood, Md.-based [*]Trusted Information Systems, works closely with the Commerce Department to seek approval for all of its work done in Europe. They ask for a license for all of the software being developed by their subsidiary in Britain. "We've tried to be very careful about this, perhaps more careful about it than we need to be," Walker said and then pointed out, "We're getting approval." [*]Sun Microsystems is pursuing a strategy with a different corporate structure. The company bought a minority stake in a Russian network software company in 1993 and recently asked them to develop encryption software for the world market. The deal is undergoing scrutiny from the U.S. Department of Commerce, but no announcement has been made about the resolution. Sun announced that they hope to ship the software on August 15. Still, the range of a government is hard to measure. Greg Katsas, a lawyer in the Washington office of Jones, Day, Reavis, and Pogue, said: "Generally, the rules of jurisdiction of the place of incorporation apply, but there are cases where U.S. law reaches outside the boundaries. For instance, anti-trust law can cover acts done outside the U.S. intended to have an impact inside the U.S." All of the major software companies like Microsoft, IBM and Sun continue to press the U.S. government for relief of the export control laws, arguing that better and better software is emerging throughout the world. In the House of Representatives, legislation sponsored by Representative Bob Goodlatte, a Republican from Virginia, to liberalize export laws has found wide support, while similar legislation in the Senate has died. One of the major initiatives offered by the Clinton administration would ease export licenses for software that made it possible for law enforcement officials to obtain the software's keys with a court order. They propose lifting the restrictions for exporting the software using 56-bit keys with DES. A number of businesses have joined together what they call the Key Recovery Alliance to help negotiate with the government about the final implementation of this plan. Most major software vendors, including Entrust and Sun, are part of the alliance. While the companies are committed to producing software that helps recover encryption keys in emergencies, there is a great deal of debate about how this will be carried out. Entrust's product for office groups does offer key recovery, but it is a far cry from what the U.S. government would like to see implemented. Copies of the keys are only stored on the hard disk of the employee responsible for overseeing the network. There is no capability right now for interfacing with trusted third parties who would serve as recovery agents for the police. Still, Entrust also seems to be working to meet U.S. regulations. Their enterprise-wide system for larger companies has been granted a license for U.S. export even though it uses 56-bit keys. This license was recently granted as part of the United States' push for key recovery. It signifies that the U.S. Commerce Department felt that Entrust was moving toward compliance with the policy of smoothing access for the police. In two years, Entrust may integrate their key recovery system with licensed recovery agents or it could face losing its U.S. license. In the long run, this strategy continues to receive heavy resistance. While many businesses welcome key-recovery solutions for internal use, they seem to resist making it too easy for the police to access their documents. Corporations, after all, can be found guilty as well. The same rules apply to countries, which are finding themselves in an increasingly brutal worldwide competition for dominance. Countries with the most liberal export laws may be rewarded with a strong fraction of the market share and this is the crucial time when the decisions about product acceptance are being decided. Many MIS managers may choose Entrust's products simply because they don't need to fill out forms with the U.S. government in order to supply it to all of their foreign subsidiaries. Andrew Csinger is the President of Xcert, a Vancouver- based Canadian software company that manufactures encryption technology used for certification authorities. He expects that any difference between U.S. and Canadian encryption laws will be short-lived. "I think that market pressures are going to force the U.S. administration to respond more quickly, " he said. "In reality, cryptography is widely available throughout the world." Copyright 1997 The New York Times Company - -> Send "subscribe snetnews " to majordomo@world.std.com - -> Posted by: kalliste@aci.net (J. Orlin Grabbe) ------- End of Forwarded Message