Sun Sells Encryption Software Overseas, Skirting U.S. Policy

[Igor Chudov @ home]

Tomorrow's Wall Street Journal: 

http://interactive3.wsj.com/edition/current/articles/SB863997652645676500.htm

Sun Sells Encryption Software
           Overseas, Skirting U.S. Policy

           By DAVID BANK 
           Staff Reporter of THE WALL STREET JOURNAL

           MOUNTAIN VIEW, Calif. -- Sun
           Microsystems Inc. plans to sell advanced
           data-security software from a Russian
           supplier to overseas customers, a move that
           skirts U.S. export regulations and is likely to
           receive close U.S. government scrutiny.

           Sun is expected to announce Monday that it
           will sell encryption software licensed from
           Elvis+ Co., a company formed by scientists
           from the former Soviet space program. Sun

I actually think that Elvis+ is mostly composed of the former KGB 
scientists, not space scientists. I may be mistaken though. -- igor



           has a 10% equity stake in the Russian firm.
           The Elvis+ products will be shipped to
           overseas customers from Sun distributors in
           third countries to keep them from falling
           under U.S. jurisdiction.

           Sun's move illustrates how global market
           pressures are making it increasingly difficult
           for U.S. officials to control the spread of
           advanced encryption hardware and software.
           The technology, which scrambles data to
           protect it from computer eavesdroppers, is
           considered vital to the growth of electronic
           commerce. But export of powerful encryption
           products is barred under U.S. export-control
           laws, on grounds that terrorists and others
           will use it to evade surveillance.

           Challenge to U.S. Policy

           The Sun action will cause the Clinton
           administration to face a difficult decision, said
           Jim Bidzos, president and chief executive of
           RSA Data Security Inc., a unit of Cambridge,
           Mass.-based Security Dynamics Technologies
           Inc., a major supplier of encryption
           technology. "The government has to shut this
           down, or else the competitors of Sun probably
           have to say, 'We're going to do the same
           thing,' " he said. Mr. Bidzos, a long-time
           critic of the export controls, praised Sun's
           move as "blatant and in-your-face."

           An administration official said Sunday the
           White House didn't have enough information
           to comment.

           Computer-industry executives, concerned
           that they could lose a valuable market to
           foreign competition, have long discussed
           strategies to exploit loopholes in the export
           laws. But Sun appears to be the first major
           company to use foreign software to supply
           overseas customers. Sun executives said they
           hadn't discussed the plans with U.S.
           government officials but had strictly adhered
           to current laws.

           "This is not being done to subvert
           export-control laws but to deliver solutions to
           customers," said Humphrey Polanen, general
           manager of Sun's network-security products
           group. "Never before have organizations
           outside of the United States had access to
           such advanced security software."

           Privacy advocates said Sun's initiative would
           boost their goal of making high-strength
           encryption widely available. "We think the
           benefit for security outweighs the liability for
           law enforcement," said Jerry Berman,
           executive director of the Center for
           Democracy and Technology in Washington,
           D.C.

           Critical Distinction

           Elvis+ is based in Zelenograd, a Moscow
           suburb that was once known as the "Soviet
           Silicon Valley." The company's products are
           based on a security protocol called SKIP that
           was developed by Sun, but Sun says it
           provided no technical assistance to the
           Russian company. The distinction is crucial;
           the export controls cover any product
           developed with such assistance from a U.S.
           company.

           The product, which will be marketed under
           the name SunScreen SKIP E, employs various
           encryption algorithms, or formulas, including
           so-called three-key triple DES and 128-bit
           ciphers, which security experts consider to be
           virtually unbreakable. The algorithms, in wide
           use within the U.S., are used to scramble
           digital communications; in general, the longer
           the bit length of the encryption key, the more
           difficult the code is to break.

           Current export controls allow the export of
           cryptography keys up to 40 bits, which have
           been cracked by computer hackers in as little
           as 10 minutes. Companies with special
           approval from the Commerce Department
           have recently begun exporting 56-bit
           encryption software, but customers have been
           clamoring for much stronger keys.

           Global Competition

           The restriction on U.S. exports has opened
           market opportunities for strong encryption
           products from foreign competitors, including
           Germany's Brokat Informationssysteme
           GmbH and Siemens Nixdorf
           Informationssysteme AG, a unit of Siemens
           AG.

           "Sun's announcement is further evidence that
           current U.S. policy is forcing companies to
           look overseas to obtain strong encryption,"
           said Edward Black, president of the Computer
           and Communications Industry Association, a
           Washington D.C., trade group that is lobbying
           for relaxation of the export controls.

           Last year, RSA Data Security announced
           plans to fund an effort by Chinese
           government scientists to develop strong
           encryption technology, but the effort has
           stalled, Mr. Bidzos said. RSA now sends
           legally exportable products to its Japanese
           subsidiary, RSA Japan, for bundling with
           Japanese encryption software. "I can't just let
           this world-wide global electronic-commerce
           market take off without participating," Mr.
           Bidzos said.

           Sun's Mr. Polanen said SunScreen SKIP E+
           will work with other products based on the
           SKIP protocols. A commercial version will be
           available in August; evaluation copies are
           available for download from an Elvis+ site on
           the World Wide Web. The software will be
           priced at $99 for versions that run on
           Microsoft Corp.'s Windows 3.1 and Windows
           95 operating systems and at $149 for the
           Windows NT version.