Encryption Exports: Small Step Forward, Big Step Back

Kathleen Ellis, editor of the Privacy News Portal, attended yesterday's press briefing about a proposed loosening of export restrictions, and wrote the following feature article about the current situation. Click below for more.

Actually, let me hit you with a few links before you get started:

• EPIC's page on the proposed Cyberspace Electronic Security Act
• Proposed text of the bill
• White House analysis of the bill - really an executive summary
• Wired coverage, by Declan McCullagh
• Update: Press statements, including briefing transcript

Encryption Exports: Small Step Forward, Big Step Back
by Kathleen Ellis
September 17, 1999

Prominent U.S. Government representatives yesterday announced at a White House press briefing that the President was proposing legislation on encryption policy, and that the Department of Commerce was revising its export restrictions on some encryption products. Last year, Vice President Al Gore vowed to further loosen restrictions and propose a solution to the encryption issue, which has been the subject of contentious debate for the past decade.

The legislation, known as the Cyberspace Electronic Security Act of 1999 (CESA), has been transmitted to Congress by President Clinton. The bill purports to strike a "compromise" between the needs of law enforcement for access to data and the needs of Internet users to secure and their e-mail, web transactions, and stored data from hackers or thieves. According to the text of the bill, "society's increasing reliance on information systems in this new environment exposes U.S. citizens, institutions, and their information to unprecedented risks." Despite this acknowledgement, the bill clearly gives consideration to the needs of law enforcement and intelligence agencies first; "The failure to provide law enforcement with the necessary ability to obtain the plaintext version of the evidence makes existing authorities useless."

One of the major provisions of CESA is to allocate $80 million dollars for an FBI "Technical Support Center", which would provide assistance to federal, state, and local law enforcement officials. The bill also reinforces the confidentiality of law enforcement intelligence techniques used to gather information about suspected criminals. "The Department of Justice has developed this legislation with the assistance of agencies in government," said Attorney General Janet Reno. "Law enforcement has tools at its disposal to fight crime, but those tools are rendered useless when encryption gets involved". Reno said that CESA "balances the needs of privacy and public safety".

Perhaps most the most noteworthy provision of the bill is the resurrection of key escrow, a solution long considered insufficient, insecure and obsolete by experts. Key escrow is a technology that entails entrusting one's private keys with a trusted third party, so that theoretically, a law enforcement official would be able to present that third party with a warrant in order to gain access to the plaintext of the encrypted data. Although the bill does not require domestic users to utilize an escrowed cryptosystem, the bill provides a legal framework to protect users from disclosure of their decryption keys by their trusted third party without a court order. The bill also proposes to implement strict guidelines outlining the circumstances under which a law enforcement agent may be granted access to a decryption key held by the third party.

This mention of key escrow worries privacy activists, who have heard the use of such language by the administration before. "This raises the specter of collusion between law enforcement and industry to build back door access into encryption products," says David Sobel, General Counsel for the Electronic Privacy Information Center. According to EPIC's statement, the bill will eventually "provide a legal framework for access to decryption keys," a prospect which worries many activists and internet users alike.

Sobel would rather see the Security and Freedom through Encryption Act determine the U.S. Government's encryption policy. Authored by congressman Bob Goodlatte, SAFE would essentially force the government to reverse its stance on the encryption issue. Unfortunately, passage of the SAFE Act now seems unlikely, in light of Deputy Secretary of Defense John Hamre's remark during the briefing that if the SAFE Act passes the House and Senate, "the Department of Defense will ask the President to veto it".

Also announced at the press conference were revisions to the Department of Commerce's encryption export policy. According to a report released at the briefing, the export requirements will be revised to allow software exports of products of any key length, after the product is first submitted for review by the Commerce Department, and as long as the manufacturer of the product meets strict guidelines for post-export reporting of any user or distributor who obtains the software directly from the licensee. Secretary of Commerce William Daley announced that that the Bureau of Export Administration would streamline the revision and reporting process, but was unclear about specific changes to the current procedure.

Two prominent industry groups are very enthusiastic about this proposal. "Today's decision articulates a policy that is good for America, good for our nation's high-tech industry, and good for the tens of millions of Americans who use computers and want them to be secure" says a press release from Americans for Computer Privacy, a group that has lobbied for legislative reform and is funded primarily by technology companies. In a statement published by the Computer Systems Policy Project, Sun Microsystems President and CEO Scott McNealy (who made headlines on Slashdot for his remarks telling reporters that the privacy issue was a "red herring" and that "you have zero privacy anyway...get over it") said "we applaud the Administration's recognition that the universal use of strong encryption will promote the benefits of a networked world while protecting Americans' privacy, safety and security,". CSPP is comprised of eleven CEOs from major Information Technology companies, such as IBM, Dell, and Intel.

James Steinberg, Deputy Assistant for National Security Affairs, opened the briefing by praising both groups for thier assistance in authoring the proposal, so it's no surprise that they're eager to ingratiate themselves to the Clinton Administration, while at the same time self-importantly emphasizing their effectiveness by declaring a victory. EPIC's David Sobel says "it appears that the FBI and large computer companies have reached an agreement on encryption, but that is not necessarily in the interest of the average computer user." Any compromise reached by these two groups could result in "less security than advertised, with hidden vulnerabilities the government can exploit".

Secretary Daley was repeatedly asked during the briefing what purpose the one-time review served, and under what circumstances an export license exception would be granted or denied; no clear answer was given. The U.S. Government may wish to allow exports only of flawed or escrowed encryption products using encryption above a certain key length, but have given up on explicitly pursuing that as a goal. Large software companies, the kind represented by ACP and CSPP, have lost a lot of business because of the export restrictions, and with each year that passes they may become less likely to object to making a few changes to their crypto modules in order to finally gain access to the foreign market.

In some ways, this proposal is good for the companies who have existed for so long without the ability to export their stronger security products at all until now, but for the rest of us, the proposal is neutral at best and abysmal at worst. As larger, wealthier proponents of crypto liberalization get what they want and contentedly back out of the debate on this issue (as American banks did when they were granted license exception to export security software to their overseas offices), further positive alterations to export policy start to seem less and less likely to happen. This is bad for American cryptographers who wish to discuss their work with their colleagues on the Internet. It's even worse for users, who may end up using insecure products without knowing it.

It's unclear what will happen at this point. The current congressional climate suggests that CESA will not pass without a significant push from the Clinton Administration. Even if the bill is defeated, however, Internet users around the world should continue to be cautious about purchasing commercial encryption products that originate inside the U.S.; you never know what may be lurking within.

Comments

Re:WTF? Confidentiality of method of decryption?

[Anonymous Coward]

That is a good point. I can assure you that the NSA doesn't care about J. Random Hacker. They only appeared on their radar screens in the early 80s. I know. I was one of them and had an ongoing relationship with them for several years because, frankly, I feel a lot more at home with them that with three-bong-hit revolutionaries who never bathe. I was struck then by a fact that made me grow up a lot, quickly. That is the fact that most people are, by definition, normal (yeah, really profound, I know), and that the curve that defines the vast majority of behavior is quite often steep and has very thin tails. This never varies. Never. Not across nations, cultures, or any other normal distribution. Never. The NSA, the FBI, the DPS -- whomever -- just don't care about 96-99% of all people because they don't and won't (ever) do anything really weird. Hackers fit into that same area, albeit with fatter tails on the curves. The NSA doesn't care because they know damned well that they don't have to. The CIA doesn't care because ... well, the CIA has its own problems, many of which they are having a hard time getting themselves out of. Suffice it to say that they aren't bugging your house either. That mathematical immutability of human behavior, apart from making the isolation of adolescence earier to cope with (I realized that I wasn't special, and that perverse fact made me feel much less isolated), is very well known to the spook community at large. They depend on it. They know it well. They also fear it because they know damned well that when they have a whole lot of people moving in one direction they are close to impossible to stop unless you use napalm. And that isn't very spooky.

The average cop on the beat (J. Random Officer), on the other hand, is not a math PhD. He probably has some college courses, possibly an undergraduate degree, limited classical education, and quite a bit of continuing education as a cop. The smart ones tend to move up -- the average cop has an IQ of 100-115, the average detective 130+, so most cops, generally, aren't too dumb, at leas these days, in larger departments, in larger cities. That does not, however, include cops who have been cops for twenty years, cops in many large cities who were hired for reasons other than competence (the old boy network, racial quotas, sex quotas, or the fact that the department needed people when they were out of work as a fry cook), cops in small town who never passed any formal screening, county/sherrif/constanble personnel, and that is still a lot of cops who will be in the system for years. That load of people for whom concepts like encryption are foreign will be much more of an issue because that, coupled with the fact that cops tend not to spend a lot of time learning (they are trying not to get killed or sued) and that they deeply mistrust anything new and complex due to years of experience with a liberal legal system screwing cops every chance it gets means that you are highly likely to run into someone who considers an encrypted partition to be prima facia evidence of wrongdoing should you ever run afoul of the law. I see this as a far greater issue than Ft. Mead listening to you talking to your love-muffin on your cell phone. The local PD and prosecutor are still easily able to out-spend most people, and defending your rights into bankruptcy is a real problem -- you should be able to, but suing people who have ruined you is hard if they work for the government is pretty tough. And most hackers aren't rich.

It will be interesting to see how this plays out. I would encourage all of you civic-minded hackers to offer to help your local police department. I have offered to help mine and give regular lectures on handling computers that are evidence, how not to handle hackers, and so on. It definitely has changed the attitude of a lot of the more senior and mossybacked cops who now see computers as less of a menace, and that is a good thing. Spread the information widely and offer to take the time to help and you will do a lot more good than if you complain bitterly and use 500000 bit keys, because the more people using encryption then the more chaff to sift, the more messages to log and batch, the more stuff to worry about -- and I can assure you that every cop I have lectured to is using PGP right now. Spread a little sunshine, like Linus did a few years back. It can only help.

Contains no meaningful penalties against misuse

[coats]

Reading through the bill, I see no meaningful penalties for misconduct on the government's part. I'd like to suggest a slashdot write-in suggestion to amend the bill to add a new section 2713(d) which states that for each improper disclosure of recovery information, of information obtained thereby, or for fraudulent testimony pursuant to the obtaining of an order under section 1712, all parties involved shall be individually liable for civil damages of $50,000 or treble damages, whichever is greater, plus court costs.

See how the Administration likes the bill then. As it stands, do you really expect the DOJ to slap its own hand when it breaks the law on this point?

WTF? Confidentiality of method of decryption?

[Tackhead]

I smell a rat here too. I mean, if I, as the prosecution, don't have to reveal to the court how I decrypted the "evidence", doesn't that give me just a wee bit too much power?

Testimony: "Your honor, as you can plainly see, the {kiddie porn, bombmaking instructions, drugmaking instructions, nuclear secrets} is on the client's hard drive. We just can't tell you how we decrypted it."

Reality: "Hey, Officer Crypto-Dude, can you XOR the suspect's scramdisk file of random noise with some {kiddie porn, bombmaking instructions, drugmaking instructions, nuclear secrets}? I really need a conviction, man!"

Hell, why bother creating a bogus one-time pad if you don't have to reveal the method? How about "Hey, Officer Crypto-Dude, gimme the files off the hard drive from the other guy we convicted last month."

If the prosecution doesn't have to disclose how it decrypted your files, the only defence you have against fabricated evidence is to give up your keys and divulge what was really on your hard drive. Damned if you do, damned if you don't.

As I wrote yesterday, I'm far more worried about corrupt cops than corrupt spooks. NSA knows it has better things to do with its time than invade your privacy. I'm not so convinced the same is true of Ms. Reno and Mr. Freeh.

Crytpo as munitions

[Cuthalion]

Does anyone know how crypto's classification as a munition interacts with our constitutional granted right to bear arms?

How's that again?

[Analog]

"The failure to provide law enforcement with the necessary ability to obtain the plaintext version of the evidence makes existing authorities useless."
"Law enforcement has tools at its disposal to fight crime, but those tools are rendered useless when encryption gets involved"

What bothers me most about comments like these is that they are based on the assumption that 'law enforcement' has an implicit right to have access to your information, as long as they feel the need. This is not so. A relevant passage:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated"

Since when does building a back door into all communications qualify as secure? And a promise from law enforcement not to use it improperly is not security, even if they could make such a promise honestly; what happens when someone else figures out how to use the back door (and someone will)?

Another thing that I don't see being brought up much when statements like the above are being thrown about is history. People have been using various types of codes to encrypt sensitive communications for hundreds of years. Has law enforcement been 'useless' for all this time?

I find it (almost) amusing that one of the agencies screaming loudest about their need for this (the FBI) touts as their greatest victory the incarceration of a man who was convicted based on evidence they couldn't decipher. So what did they do? They offered the guy who knew what it meant a deal, and he did it for them. Is there some reason this doesn't work anymore?

This is going to be just as expensive

[konstant]

I work in crypto QA for a major, evil software company. Guess which one. We've been crossing our fingers for legislation like this due to the extreme cost and instability of shipping both a 128 and a 40/56 bit version of every crypto product. Apart from the effort of testing everything four times (once for hi, once for low, once for interactions, once for upgrades) there is the simple fact that as test matrices grow, bugs proliferate. And some are not found.

We used to say, "If only some bolt of light would strike Clinton upside the head and get him to liberate export policies!" Our premise was that the cost and difficulty of testing would drop, and we would be better situated to promote our client overseas.

NOPE. Even if this law passes, the labor of testing may just go up. Implementing a "backdoor" or a key escrow mechanism necessitates cracking the CSP's (oops - gave away which company) and re-writing practically the entire code structure that selects and manages algorithms. Easy? No. In addition, what foreign company would be interested in purchasing a product they know the US Government can abuse like a bitch at its will? I certainly wouldn't tolerate it.

The upshot? My (uninformed) prediction is this: There will still be 40-bit non-escrowed versions of the product going out the door. These will be shipped primarily to other countries and to paranoid individuals like slashdotters. Everyone else will run 128, but it will be a compromised breed of 128.

In other words, this will accomplish nothing other than weakening crypto for US citizens.

This bill is bullshit! Call or email your congressional office today. I'm about to do that very thing.
-konstant

Key escrow by definition is unsafe

[Zigg]

Yet another lovely step back in time by the Clinton administration. I wonder if any of the candidates for the next presidential election have gone on record for crypto policy.

The primary reason that the concept key escrow absolutely petrifies me is that the to be useful, the keys need to travel in one form or another from their central repository (which I would hope would be as tightly locked up as the NSA) to the law enforcement agency responsible for unlocking the message. With the repeated demonstrations by the U.S. Government that they don't understand crypto, what's even going to guarantee the safety of my key (and therefore my data) in transit?

Don't make me hand over my keys. I have them because they protect me. And you can bet that if key escrow becomes a requirement, I will not surrender my stock of open-source crypto software, but only begin to use it more.