IP: Re: those French again -- IMPORTANT NOTE...

[Dave Farber <farber () cis upenn edu>]

Date: Wed, 22 Oct 1997 03:13:37 -0400
From: "K. N. Cukier" <100736.3602 () compuserve com>
Subject: re: IP: those French again -- IMPORTANT NOTE...
Sender: "K. N. Cukier" <100736.3602 () compuserve com>
To: "farber () cis upenn edu" <farber () cis upenn edu>


Dave,


Re the msg "FRANCE PROPOSES KEY ENCRYPTION LAW," the posts repeats an
inaccuracy that the WSJE reporter makes... namely, there is no news to the
story. It was written as a "trend piece" on *corporate reaction* to the law
(they don't like it, we're told).


It's important to clarify this, since the French laws will be enacted in
upcoming days or weeks and this story is a major distraction to what is a
closely watched event internationally. Professionals and observers waiting
for the French laws to be enacted should understand that the laws are still
unenacted.


A bit of background: The new French crypto laws, that have been called a
"liberalization" simply sets out publically certain principles for the
conditions of crypto use. Generally it says: "use a cypher, give us the key
first or go to jail." The laws were passed by the Assemble Nationale in the
summer of 1996.=20


Laws in France are not "enacted" until they are signed by the prime
minister. The laws are shells of a policy, with which certain
implementation factors can be determined by the PM, who signs the "decrees
d'applications" and publishes it in the "Journal Official" -- then the laws
take effect.


Thus: We've known for sometime (over a year) what the laws are -- but the
all-important decrees d'application have not yet arrived.


Why not? For one, the new Juppe government needed time to learn about the
issue. Secondly, the OECD crypto guidelines were still underway, and it's
possible the government wanted to see how that was resolved before moving
forward on a national policy. Then, Chirac declared snap elections and the
Juppe government became the Jospin government, with a new set of leaders to
get educated.


All this time, EC bureaucrats were sending signals that the French laws --
which require that Trusted Third Party entities that hold users private
keys be majority-owned French entities -- are a violation of EC open market
rules. The Commission has power to enforce competition in the EC; it is
prohibited from treating issues of national security. So what's crypto:
commerce or security? That's what is now getting hammered out behind the
scenes in Brussels.


Jospin, speaking to a special conference at the French Senate two weeks ago
said that the decrees would be signed in a matter of days. So far they
haven't been. He also said that 40-bit encryption would be legalized. (I
asked him as he was left the room=A0 to give more details on the laws, but=
 he
just said "non, non, non" and took flight from reporters....)


That's what the story is: we're in a holding pattern, but expect some
excitement real soon. And keep this in mind: the French position is that
the national policy is not behind, but rather AHEAD of the world on the
issue. And then French crypto execs point to what happened last month in
the US and tell me: "See, your country is moving in our direction too."
Finally, the WSJE article doesn't talk to any software vendors. That's
convenient, since it means they aren't asked how many of them have
developed software to meet a draconian version of French key escrow laws so
that they can sell in the country?=20


A reporters cynicism? Alors, Netscape and MatraNet (a subsidiary of the
huge defense contractor Matra / Lagardere Group) announced three weeks ago
the creation of a joint venture to sell secure intranet services.... The
head of the SCSSI, France's NSA, was sitting in the room during the news
conference. Hmmm....


Kenneth Neil Cukier
Paris=20






**************************************************
"Photons have neither morals nor visas"  --  Dave Farber 1994
**************************************************