Slashdot Mirror
Germany Frees Crypto
marlon shakespeare writes "The German cabinet today released a policy statement on the unrestricted use of encryption. Unfortunately the article's in German but the rought gist of it is available in English. " Hopefully some certain other countries will follow the German lead on this one.
It is most interesting that ECHELON isn't mentioned at all in the press release. I don't think it's merely coincidence that an inititive like that is started weeks after the STOA-Report and the recent Australian admittace of it existence of the UKUSA spy alliance.
My best bet is, that they don't want to get into diplomatic troubles with the US just now while US trade sactions are discussed regarding the EU import embargo against hormone-infested meat and German troops are fighting under NATO command in the Kosovo.
Note also, that the German goverment is not only allowing but activly encouraging the use of strong crypto, which - in the case of general adoption - would make the ECHELON listing points basically useless.
Last Sunday's New York Times Magazine had an interesting article about Joschka Fischer, the formerly radical politician who is now the German foreign minister. It's worth checking out, particularly for Americans who are generally deprived of any news about the day-to-day political life of other industrial democracies.
Unrestricted use, but not unrestricted distribution. Germany is bound by the wassenaar thingy, so export restrictions will remain. Well, atleast it's a (small) step in the right direction.
I think it's rather funny that the statement harps very much on the economic need for strong crypto. It sounds like some people read the recent report by the EU and din't like what it said. The statement mentions that information is becoming a raw material which needs to be protected and only gives passing note to privacy concerns. I wonder how many of the hard-lobbying German companies have been burnt by inadequate crypto; I remember a few stories about German companies losing technological advantages because their latest and greatest R&D was picked off from insecure emails etc.
It also states that the German government will try to raise crypto awareness, so not only will they allow its development, sell and use but they will actually promote crypto and an understanding of why it is important.
This rocks !
Hopefully this will not be too eagerly embraced by various 'youth organizations' and 'flight clubs'.
After all, in the US, encryption technology is STILL considered a munition. How would people in the surrounding countries (of Germany) feel if various para-military organizations - such as the Boy Scouts - started stockpiling munitions?
IMHO Germany has come a long way singe the 1930's, but I'm sure this is going to ruffle some feathers.
[/paranoid]
-- What you do today will cost you a day of your life.
Well, looks like maybe Europe isn't such a bad place to live, afterall. I kinda like our new Government. The old one would've taken the US policy of Encryption Is Bad, you can be sure of that.
But at any rate, let's see if their deeds speak as loudly as their words.
We can only hope.
Wassenaar has an exception for what they call "public domain" software, and their appendix defines "public domain" in such a way that it includes free software/open source. So governments that have signed Wassenaar can still let their citizens export any free software they want to. They just have to restrict commercial products with strong encryption. The US forgot about this loophole because the Clinton administration is clueless about free software/ open source, and they can't close it unless they get all of the Wassenaar countries to agree.
Aren't bandwidth issues a more serious consideration? Since you are talking about "e-commerce", your customer encryption can only be as good as the software out there (128-bit Netscape isn't good enough?), and censorship probably isn't an issue for you.
--
Business. Numbers. Money. People. Computer World.
France made a similar move March this year, authorising people to use encryption. Let me remind you that before this it was illegal to use ANY kind of encryption (you were not allowed to use ssh for example), which was rarely absurd. The URL (English) is here
--
All I have to say is.. my servers go wherever they will be the most secure. That means that they go where braindead censorship is non-existant, and cryptography is allowed. Well.. I know Australia WAS my first choice. Now it's Germany, or New Zealand. The US is out, for obvious reasons.
Where is your business colocating it's servers?
--
This is a translation by Thomas Roessler, roessler@guug.de, as posted to the ukcrypto mailing list. Many thanks to him.
1. The Federal Government does not plan to limit the free
availability of encryption products in Germany. It considers the
application of secure encryption to be a crucial requirement for
the citizens' privacy, for the development of electronic
commerce, and for the protection of business secrets. The
Federal Government will therfore actively support the
distribution of secure encryption. This includes in particular
increasing the security consciousness of citizens, business, and
administration.
2. The Federal Government strives for strengthening users' trust in
the security of encryption. It will therefore take measures to
create a framework for trustworthy secure encryption, in
particular by improving the possibilities for reviewing
encryption products for their security, and by recommending the
use of reviewed products.
3. For reasons of national security, and the security of business
and society, the Federal Government considers the ability of
German manufacturers to develop and manufacture secure and
efficient encryption products indispensible. It will take
measures to strenghten the international competitiveness of this
sector.
4. The spreading of strong encryption must not undermine the legal
possibilities of prosecution and security authorities [police and
intelligence communities may be a better translation]. The
responsible Federal Ministries will cautiously watch the
development and present a report after two years. Additionally,
the Federal Government will work on improving the technical
skills of prosecution and security authorities.
5. The Federal Government attaches importance to international
cooperation on encryption policy. It encourages market-driven,
open standards and interoperable systems and will work to
strengthen multilateral and bilateral cooperation.
You can upgrade the international versions of Netscape to high grade encryption using Fortify, which is developed outside the US. No need to be stuck with 40 bits.
All other arguments from the U.S. gov. are straw men. The funny thing is that this policy will hurt much more in the long run than it helps in the short run. Quoting Alan Greenspan (unrelatedly) from yesterday's headlines:
``The United States has been in the forefront of the postwar opening up of international markets, much to our, and the rest of the world's, benefit,'' Greenspan said. ``It would be a great tragedy were that process reversed."
It's amazing to me how behind-the-times the U.S. appears at times. Though we claim to be the most technologically advanced, the trendsetters, etc., it's surprising how legally backwards we are when it comes to controlling access and the use of technology. (Try speaking that last sentence aloud and swap out "drugs" for "technology" Amazing how similar the arguments are, no?)
This announcement constitutes _permission_ for Germans to use strong encryption. It's not like the problem in the States -- the US gov't is forbidden to restrict its citizens from using strong crypto (classing strong crypto as munitions means that the "right to bear arms" applies to crypto), but they've chosen to forbid them to export it.
The German gov't is giving _permission_ to use crypto, not acknowledging a right. Tomorrow they may alter the deal -- pray that they do not alter it further (Episode 1 is so devoid of cool quotes!).
I don't like the US system, of course, and I'm fighting for a change -- but don't pretend this is somehow better. It's worse.
Do not stop fighting this stupidity!
-Billy