From: Declan McCullagh <declan@well.com>
Date: Tue, 9 Sep 1997 10:54:07 +0800
To: cypherpunks@toad.com
Subject: Stewart Baker's analysis of administration crypto-proposal
Message-ID: <Pine.GSO.3.95.970908193729.17353F-100000@well.com>
MIME-Version: 1.0
Content-Type: text/plain





---------- Forwarded message ----------
Date: Mon, 8 Sep 1997 19:13:52 -0700 (PDT)
From: Declan McCullagh <declan@well.com>
To: fight-censorship-announce@vorlon.mit.edu
Subject: Stewart Baker's analysis of administration crypto-proposal

[Some folks have asked me why I'm sending so much encryption-related
information recently. The answer is simple: this week will be a crucial
one in deciding how much privacy Americans will enjoy in the digital age.
This proposal is //at least// as important and newsworthy as the original
Clipper Chip was, and ranks up there with the Communications Decency Act.
Thanks to Stewart Baker for forwarding. --Declan]

---------- Forwarded message ----------
Date: Mon, 08 Sep 97 18:19:24 EST
From: Stewart Baker <sbaker@mail.steptoe.com>
To: declan@well.com

         Declan, here is a quick analysis of the latest leaked 
     Administration legislative draft on encryption.  Whether this language ever 
     sees the light of day in this form, however, is open to doubt.  With that 
     disclaimer, here's what the bill seems likely to do.
     
     Stewart Baker
     
     
          THE LANGUAGE
          
                    The draft borrows heavily from the structure and content of 
          the Kerrey/McCain legislation--it even retains the title, the "Secure 
          Public Networks Act".   In fact, the provisions in Titles IV through X 
          of McCain/Kerrey regarding the registration of certificate authorities 
          and key recovery agents, liability, criminal penalties, defenses, 
          international negotiations, authority of the Secretary of Commerce to 
          investigate compliance with the Act, and authority for the Attorney 
          General to bring actions to enjoin violations of the Act are largely 
          unchanged in this draft.  The significant changes are:
          
               --   gone is the section (102) that would prohibit mandatory 
          third party escrow of keys.  In its place is a new section (105) that 
          would prohibit, after January 1, 1999, the provision of encryption 
          services in the U.S., or the manufacture for sale or distribution in 
          the U.S. of encryption products/systems, that do not have a plaintext 
          recovery feature that may be turned on at the option of the user.
          
               --   gone is the exclusive emphasis on key recovery as the 
          technology for assuring plaintext recovery.  Instead, this legislation 
          would require products and systems that permit immediate decryption 
          without the knowledge or cooperation of the user.  The Attorney 
          General is to issue regulations describing these functional criteria, 
          but there is no provision requiring public notice and comment on such 
          regulations.
          
               --   gone is the language requiring key recovery agents to 
          disclose recovery information when presented with a subpoena.  In its 
          place is language that indicates a court order or court authorized 
          warrant is required before a key recovery agent may disclose recovery 
          information.  
          
               --   added is export license exception treatment for products 
          that are access or recovery enabled, regardless of algorithm, key 
          length,  or even whether the access feature is activated.  This would 
          be broader than McCain/Kerrey which would extend license exception 
          treatment to products with over 56-bit key lengths only if the product 
          includes an access feature and the access feature is turned on at the 
          time of export.
          
               --   retained is the provision to decontrol 56-bit encryption 
          after one time review.  However, the bill adds an Encryption Export 
          Advisory Board, composed of industry and government representatives, 
          to, among other things, recommend to the President whether the key 
          length of encryption exports to be decontrolled should be raised 
          beyond 56 bits.  The President retains the final decision making 
          authority, however.
          
               --   gone is the McCain/Kerrey provision that would authorize the 
          Secretary of Commerce to prohibit any exports that could be contrary 
          to U.S. security interests.
          
               --   added is a provision to permit license exceptions for voice 
          products with encryption if the Secretary of Commerce determines that 
          requiring an access feature  would be a competitive disadvantage and 
          permitting the export would be compatible with U.S. foreign and 
          national security policies.
          
               --   retained are the provisions that require the use of 
          accessible encryption products and services on any system used or 
          funded by the Government, but this draft sets a January 1, 1999 date 
          of compliance.
          
               --   contrary to earlier indications, there is no requirement for 
          certificate authorities registered under the Act to ensure recovery 
          information is escrowed with a recovery agent registered under the 
          Act.
          
          ANALYSIS
          
                    Even though expected, the big news with this draft is the 
          introduction of domestic control of encryption products and services 
          available in the U.S.  For many, the idea of such controls is simply 
          an unacceptable infringement on privacy.  But even for those who could 
          be persuaded of the need for such controls, the implementation date 
          provided (January 1, 1999) is unworkable.  Industry must have the time 
          to research and develop access technology appropriate to their 
          products, particularly in the telecommunications industry where the 
          demand for security is increasing, but there is little or no market 
          for key recovery and its associated infrastructure.  Likewise, 
          manufacturers cannot afford to write off the investments they have 
          made in existing security products or services by being compelled to 
          implement new designs before technology turnover would normally be 
          expected to occur.
          
                    A related concern would be to ensure new products with 
          access features may interoperate with products or services that are 
          already in use without such features.  It is unreasonable to expect 
          that users could afford to replace their existing systems with new 
          products that include access features.  The language of this draft 
          would seem to permit such interoperability since the access feature is 
          required only to be an option that may be turned on by the user, or 
          not.  But even if the legislation is understood as permitting such 
          interoperability, the cost to manufacturers and consumers of meeting 
          this new requirement could be substantial.