Another Federal Code to Crack


The debate over how--and whether--the overseas sales of devices that can turn computer transmissions into eavesdropper- proof gibberish should be regulated has never been short of complications. And now, thanks to new export regulations published by the Commerce Department, it's about to become positively byzantine. What's more, some analysts assert that the controversy may result in still another face-off between the White House and Congress over the limits, and proper uses, of presidential authority.

In simple terms, the debate centers on the question of whether American companies will be allowed to sell ``strong''-- that is, military-grade--data-scrambling computer programs beyond the borders of the United States. For years the answer has been a straightforward (and, by and large, unchallenged) ``no.'' Federal export regulations devised during the Cold War barred the sale of these programs overseas on the ground that they are weapons.

In the wrong hands, encryption programs could be as deadly as a missile or a tank, the drafters of the old export rules argued. Modern computers can indeed scramble messages into codes so complex that deciphering the data the messages contain is impossible without a ``key'' that has also been generated by computer. If American software companies--long the acknowledged international leaders in the encryption game--were allowed to sell their strong encryption programs throughout the world, the argument went, then rogues of all stripes would be able to communicate freely, shielded by an electronic barrier no law enforcement or national security force could penetrate.

Technological advances have overtaken that argument, however, according to the computer industry. As the Internet expands, computer users can use electronic mail, or ``e-mail,'' to zip encryption programs across borders in seconds, the industry contends. A military-grade encryption program called Pretty Good Privacy, or PGP--developed by Phil Zimmerman, a Denver-based programmer--has been freely available on the Internet for years. Last year Hitachi Ltd., a Japanese firm, produced an encryption program that is reportedly five times more powerful than anything American firms are allowed to sell in international markets.

For two years or so, U.S. software companies and computer equipment makers have been negotiating with the Clinton Administration over proposals to ease the export restrictions on encryption software. Early last month, it seemed that an agreement had finally been reached that everybody could live with. But the new regulations, which were published by Commerce on Dec. 30, shocked much of the industry. Among other stipulations, the rules require software makers to entrust to a government-approved third party--an individual with a government- issued security clearance, for instance--the key to any encryption program sold abroad.

The Business Software Alliance, a Washington-based trade association that represents most of the big U.S. computer software and hardware firms, has vigorously fought similar ``key escrow'' proposals. With the publication of the new regulations, ``our worst fears have been confirmed,'' said Robert W. Holleyman II, the group's executive director. ``This is a top-down, government-designed industrial policy, and it's bad.''

Here's where the issue gets complicated, however. A few of the major players in the computer industry aren't all that unhappy with the regulations. Take International Business Machines Corp. (IBM), which last fall organized an alliance of companies to support its proposal for a two-step process that would allow law enforcement officials to recover and unscramble encrypted data without using a key.

The European Commission is currently considering a similar ``key recovery'' scheme that, if implemented, would make the placing of code keys in the hands of trusted third parties the industry standard in Europe, some American companies believe. If that happens, the federal government is likely to impose a similar standard.

IBM supports the new regulations because ``we had to have something we thought would be consistent with where the U.S. government is going,'' said Aaron W. Cross, IBM's Washington- based public policy director. As for those U.S. firms that oppose the new regulations, Cross added, ``we would prefer they take a more global focus.''

Industry opponents of the new regulations plan to appeal to Congress for help, as they have in the past. Bills designed to override the government's encryption policy never reached the floor last year, but this time the opponents may have extra ammunition.

On Nov. 15, President Clinton issued an executive order that transferred oversight of encryption software exports from the State Department to the Commerce Department. The order was part of Administration efforts to strike a compromise on encryption policy with the computer industry, which views Commerce as more sympathetic to its interests than State.

The order, however, gives the Justice Department authority to consult with Commerce officials over the issuance of encryption export licenses on a case-by-case basis. This is an entirely new--and unwelcome--role for law enforcement in the encryption controversy, many industry executives and some privacy activists maintain. (A further complication is a Dec. 18 ruling by a U.S. District Court judge in California that struck down parts of the old regulations.)

``This executive order ups the stakes in Congress because it involves the assertion of presidential authority to make law,'' said Marc Rotenberg, executive director of the Washington- based Electronic Privacy Information Center. ``A lot of people on Capitol Hill will oppose it just on principle, even if they're sympathetic to law enforcement's concerns. I don't believe Congress will be satisfied that this is an adequate way to make policy.''

Stay up-to-date with federal news alerts and analysis — Sign up for GovExec's email newsletters.
Close [ x ] More from GovExec

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Sponsored by G Suite

    Cross-Agency Teamwork, Anytime and Anywhere

    Dan McCrae, director of IT service delivery division, National Oceanic and Atmospheric Administration (NOAA)

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

  • Sponsored by One Identity

    One Nation Under Guard: Securing User Identities Across State and Local Government

    In 2016, the government can expect even more sophisticated threats on the horizon, making it all the more imperative that agencies enforce proper identity and access management (IAM) practices. In order to better measure the current state of IAM at the state and local level, Government Business Council (GBC) conducted an in-depth research study of state and local employees.

  • Sponsored by Aquilent

    The Next Federal Evolution of Cloud

    This GBC report explains the evolution of cloud computing in federal government, and provides an outlook for the future of the cloud in government IT.

  • Sponsored by LTC Partners, administrators of the Federal Long Term Care Insurance Program

    Approaching the Brink of Federal Retirement

    Approximately 10,000 baby boomers are reaching retirement age per day, and a growing number of federal employees are preparing themselves for the next chapter of their lives. Learn how to tackle the challenges that today's workforce faces in laying the groundwork for a smooth and secure retirement.

  • Sponsored by Hewlett Packard Enterprise

    Cyber Defense 101: Arming the Next Generation of Government Employees

    Read this issue brief to learn about the sector's most potent challenges in the new cyber landscape and how government organizations are building a robust, threat-aware infrastructure

  • Sponsored by Aquilent

    GBC Issue Brief: Cultivating Digital Services in the Federal Landscape

    Read this GBC issue brief to learn more about the current state of digital services in the government, and how key players are pushing enhancements towards a user-centric approach.


When you download a report, your information may be shared with the underwriters of that document.