Encouraging News - France
From <http://www.ft.com/hippocampus/8e46a.htm>
Encryption technology: French boost for internet software
MONDAY SEPTEMBER 1 1997 By Andrew Jack in Paris
France is poised to liberalise regulations on computer encryption technology which could boost its efforts to encourage development of the internet.
The government is shortly to publish an official decree which would for the first time allow easy access to and use of software which encodes sensitive information in order to protect it from unauthorised interception.
The move could prove especially important for companies attempting to sell products and services over the internet, but which have been concerned about their protection of credit card numbers and other financial information provided by their customers.
France remains one of the few western countries to impose such restrictive legislation on encryption, with only certain categories of users currently allowed to use the software.
Other nations which continue to restrict the use of cryptography tightly in order to control the transfer of sensitive information include Iraq, Libya, Singapore and China.
While many more countries - including EU member states and the US - restrict the export of sophisticated encryption technology as a product important to national security, most have more liberal guidelines concerning the circulation and application of software within their own borders.
The new decree in France follows a 1996 telecommunications regulation law, which opened the way to liberalisation of encryption software but which has so far not led to publication of any details of how the measures could be applied.
The latest move comes after Lionel Jospin, the prime minister, made a speech last week highlighting the "delay" in France of uptake of the internet and promising initiatives to give it a higher priority. ---------
Brian B. Riley --> http://www.macconnect.com/~brianbr For PGP Keys - Send Email Subject "Get PGP Key" "One of the deep mysteries to me is our logo, the symbol of lust and knowledge, bitten into, all crossed with in the colors of the rainbow in the wrong order. You couldn't dream of a more appropriate logo: lust, knowledge, hope, and anarchy." -- Gassee - Apple Logo
I'm extremely skeptical that France will truly liberalize crypto use by its citizen-units. Rather, I expect they will just be falling in line with the OECD/Wasenaar/New World Order "trusted third party" key recovery approach that the United States, Britain, and other European and Asian countries are behind-the-scenes adopting. At 10:16 AM -0700 9/1/97, Brian B. Riley wrote:
From <http://www.ft.com/hippocampus/8e46a.htm>
Encryption technology: French boost for internet software
MONDAY SEPTEMBER 1 1997 By Andrew Jack in Paris
France is poised to liberalise regulations on computer encryption technology which could boost its efforts to encourage development of the internet.
Does anyone think this means: "Hey, use whatever crypto program you want. Use something SDECE cannot break!"? Given the monopoly France Telecom has on Internet access, I'd expect a "solution" that involves FT issuing keys, or something equally brain dead as that. (I gave an invited talk on crypto anarchy at a conference in Monaco a few years ago, and spoke to several France Telecom representatives. They made it quite clear that France was not going to tolerate independent ISPs, and that France Telecom would administer any crypto ever to be used by the populace. Maybe this policy has changed, but I doubt it. Whatever France's charms, open debate is not one of them.)
The government is shortly to publish an official decree which would for the first time allow easy access to and use of software which encodes sensitive information in order to protect it from unauthorised interception.
I'll bet 1000 francs that this will not mean citizens can use PGP openly. (I know some Frenchies who are already using PGP, of course.)
The new decree in France follows a 1996 telecommunications regulation law, which opened the way to liberalisation of encryption software but which has so far not led to publication of any details of how the measures could be applied.
One wag put it this way: "Any Frenchman may apply for a permit to use strong cryptography. The same way any Frenchman may apply for a permit for an Exocet missile." --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."
Tim May <tcmay@got.net> writes:
I'm extremely skeptical that France will truly liberalize crypto use by its citizen-units. Rather, I expect they will just be falling in line with the OECD/Wasenaar/New World Order "trusted third party" key recovery approach that the United States, Britain, and other European and Asian countries are behind-the-scenes adopting.
I think it's been mis-reported. My understanding of the situation in France is that the "crypto use" regulations have changed, or are changing at this moment. The change is from "no crypto without a permit" to "crypto provided it is GAKked". So, you guessed right.
The government is shortly to publish an official decree which would for the first time allow easy access to and use of software which encodes sensitive information in order to protect it from unauthorised interception.
I'll bet 1000 francs that this will not mean citizens can use PGP openly. (I know some Frenchies who are already using PGP, of course.)
Depends on your definition of openly. Jerome Thorel, at the time a French free-lance journalist, interviewed the head of SCSSI, he asked "can individuals use PGP?" and the answer was "if you asked us for permission we'd say no, but if you use it we won't do anything about it". Jerome had this revelvation as his .sig for a while. Jerome Thorel uses PGP. I usually encrypt email to him.
One wag put it this way: "Any Frenchman may apply for a permit to use strong cryptography. The same way any Frenchman may apply for a permit for an Exocet missile."
That ties up with Jeromes interview with the SCSSI person. Adam -- Have <I>you</I> exported RSA today?
Adam Back wrote:
Depends on your definition of openly. Jerome Thorel, at the time a French free-lance journalist, interviewed the head of SCSSI, he asked "can individuals use PGP?" and the answer was "if you asked us for permission we'd say no, but if you use it we won't do anything about it". Jerome had this revelvation as his .sig for a while.
Exactly what happens in India. Dont ask for permission, ask for forgiveness. The govt doesn't want to sanction it. This could be becuase they might want to declare usage illegal at a latter time, or currently dont have the infrastructure to tap into people's communication, or the investment in such infrastructure is not justified at this time or they realize how entirely stupid it would be to legally restrict crypto usage. Whatever such a stand implies it manages to keep venture capitalists away from crypto products. best, Vipul -- Vipul Ved Prakash | - Electronic Security & Crypto vipul@pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces
On lun 01 sept 1997 à 11:18:10AM -0700, Tim May wrote:
I'm extremely skeptical that France will truly liberalize crypto use by its citizen-units. Rather, I expect they will just be falling in line with the OECD/Wasenaar/New World Order "trusted third party" key recovery approach
That's probably true. Given the recent history on the subject in France, I doubt they would do a 180 degree turn...
Does anyone think this means: "Hey, use whatever crypto program you want. Use something SDECE cannot break!"?
Update, SDECE is now called DGSE ;-) Besides, they are our CIA, and therefore not supposed to act within France. But I guess the DST (the french FBI) would handle matters like that. So far France doesn't have a (known) equivalent of the NSA. A department controlled by the prime minister (the SGDN) handles the authorization process for crypto usage, and is assisted for technical issues by the SCSSI (which usually says "no way" for strong cryto). Now, the army has also its own cryto units, and they have quite knowledgeable people... (have a look at http://www.dmi.ens.fr/equipes/grecc/, and all these "ingenieurs de l'Armement" which are linked a way or another to this lab)
Given the monopoly France Telecom has on Internet access, I'd expect a "solution" that involves FT issuing keys, or something equally brain dead as that.
It's not entirely true that FT has a monopoly. They do have a monopoly on the phone lines, yes, which means of course that they can (and do) dictate their own terms to any french internet provider. This won't last forever, as starting january 1st this monopoly will end. This means anybody will be free to switch to another phone provider (and yes, there will be a few of them, which have installed networks, and which currently can only offer phone services to compagnies, say to link to physical locations in France, and are eager to enter the market targeting individuals). Furthermore, it is untrue to say "FT=french governement". Actually, most senior officials at FT wanted the company to be sold to private interests, because they felt they would defend their dominant position better this way. The new governement stopped the process, but anyway FT has its own agenda, which may differ from the gov vues. Of course, this doesn't mean anything good to the end customer, the average french guy who would like to use the internet. FT is catching up on the subject, but they did everything to slow down the internet progression in France, fearing it would dammage their "minitel", which generates high revenues.
(I gave an invited talk on crypto anarchy at a conference in Monaco a few years ago, and spoke to several France Telecom representatives. They made it quite clear that France was not going to tolerate independent ISPs, and that France Telecom would administer any crypto ever to be used by the populace. Maybe this policy has changed, but I doubt it. Whatever France's charms, open debate is not one of them.)
You said everything when saying "a few years ago". I guess they woke up on these issues, and now their key problem is more "how to keep making the huge profits we make currently on the phone when we will have competitors next january". Somehow internet and use of crypto aren't that important in respect to that, even if anybody with half a brain can see how everything is connected. Besides, I will give you an example which illustrate how sometimes FT can be driven by market law rather than gov interests. A few months ago, they started to sell cell-phone cards, with a prepaid amount of time on it. these were anonymous, (they wouldn't ask for an ID or anything), and everything went fine for a couple of weeks, until somebody in the police realized they wouldn't be able to link calls like that to a poor soul. So FT got an order from the govt, and now they ask for an ID when purchasing. Now, I don't know if any of the other 2 cell-phone operators in France offer the same kind of card. I think they don't, unfortunatly, but if they decide to do so, it would take more than a phone call from the governement to make them comply with the police concerns. Well, I hope so...
I'll bet 1000 francs that this will not mean citizens can use PGP openly. (I know some Frenchies who are already using PGP, of course.)
The thing is, currently many individuals use it, for e-mail or file encryption, and I seriously doubt that anybody would be prosecuted just for that. But they (LEAs, gvt, you name it) know that it's a Damocles sword they can use at will. And they want to keep it that way. Unlike in the US, it's rather difficult to challenge a law in France, the way Berstein or Karn or Junger are doing. Therefore the current situation is unlikely to change in the near future.
The new decree in France follows a 1996 telecommunications regulation law, which opened the way to liberalisation of encryption software but which has so far not led to publication of any details of how the measures could be applied.
Well, mainly because they don't know themselves how to enforce their laws. Or simply to interpret them.
One wag put it this way: "Any Frenchman may apply for a permit to use strong cryptography. The same way any Frenchman may apply for a permit for an Exocet missile."
Old technology. We know better ;-) <serious> you don't want to apply for a permit. You just use it. And if later LEAs targets you as a drug dealer, you will get 20 years for drug offences and 3 more months for crypto use. So as an individual, you don't care, but by doing things this way cryto won't be widespred soon, and large corporations or companies won't "just use it" the way a single guy will. Don't misunderstand me, it sucks, but at least when you are in France you don't expect to wake up in front of a SWAT. F. -- Fabrice Planchon (ph) 609/258-6495 Applied Math Program, 210 Fine Hall (fax) 609/258-1735
participants (5)
-
Adam Back -
Brian B. Riley -
Fabrice Planchon -
Tim May -
Vipul Ved Prakash