Escrow flap in the Wash Post -- in case you missed it

[David Farber <farber () central cis upenn edu>]

                     Copyright 1993 The Washington Post  
                              The Washington Post


                  September  18, 1993, Saturday, Final Edition


SECTION: FINANCIAL; PAGE C1


LENGTH: 784 words


HEADLINE: Encryption Program Draws Fresh Attacks


SERIES: Occasional


BYLINE: John Mintz, John Schwartz, Washington Post Staff Writers


 BODY:
   Computer industry officials and civil-liberties activists are launching new
attacks on the Clinton administration's plan to make the so-called  clipper 
computer chip the national standard for encrypting, or scrambling, data and
voice communications.


   Under the  clipper  plan announced this year by the Clinton White House,
police agencies that receive court authorization for a wiretap to intercept
encrypted communications would then need the technological cooperation of two
independent "escrow" agents to crack the code.


   Earlier this week administration officials told congressional staff members
that the two escrow agents will be officials of two government agencies: the
Commerce Department's National Institute of Standards and Technology (NIST), and
a non-law enforcement section of the Treasury Department that has not been
selected.


   Yesterday industry and civil-liberties groups criticized that selection
because they said NIST and Treasury are not independent, but arms of the same
federal government that could some day be called upon to listen in on their
communications.


   Douglas Miller, government affairs representative of the Software Publishers
Association, made up of U.S. software firms, said his group has "grave doubts"
that foreign corporations will encrypt their communications with the  clipper 
chip because "the U.S. government holds the key."


   A main reason the administration is promoting  clipper  is that the U.S.
National Security Agency, the super-secret code-breaking agency, wants to
discourage use of highly capable, non- clipper  encryption programs that are
becoming increasingly popular but that the NSA can't pierce.


   Industry officials for years have regarded NIST as a stalking horse for the
NSA.


   Jerry  Berman,  director of the Washington office of the Electronic Frontier
Foundation, which promotes public-interest causes in technology-policy areas,
said NIST is "so close to the NSA that it can't give the public comfort that
this is a true escrow system."


   John Podesta, assistant to the president and a key White House staff member
on this issue, said such objections are "a phony issue."


   "We clearly are looking for procedures and escrow agents that would maintain
privacy and confidentiality and security of the keys," Podesta said.
"Cryptography lends itself to a certain degree of paranoia."


   Kate Martin, director of the Center for National Security Studies of the
American Civil Liberties Union, mocked use of the term "escrow" in this case. An
escrow agent is someone who is independent of two parties potentially in
conflict, like a settlement attorney at a real estate closing, she said.


   "As long as the escrow agents are government agencies, it's misleading to
call them that," she said. "The government doesn't have a fiduciary obligation
to the people whose [communications] keys it holds," but only to the government.


   "The whole idea continues to be structurally flawed," said Bruce Heiman,
attorney for the Business Software Alliance, a group of top U.S. software firms,
such as Microsoft, Novell, Lotus and Apple. Companies and individuals who
transmit secure information "will have serious doubts about the integrity of the
system."


   Since the government currently prevents the export of many powerful U.S.-made
encryption techniques, the administration's attempts to promote its  clipper 
chip "will discourage use of encryption, period, or hand over the market for
encryption to foreigners."


   When one listens to an encrypted conversation, it sounds like a crackle or
buzz.


   Under the plan, every law-enforcement agency will have a special personal
computer or "black box" to descramble that crackle, but the device will work
only when they have been given a special key from the escrow agents.


   When police get a judge's permission to intercept an encrypted conversation
or stream of computerized data, they would use the box to determine the special
encryption identifier or label assigned to that particular encryption device.


   A detective would notify NIST and Treasury that he or she has permission to
listen in on the party. NIST and Treasury would have a list of the secret
encryption key numbers -- extremely long lists of 0s and 1s -- for every
encryption device sold in the United States.  NIST and Treasury would find the
appropriate one on the list, and then they would send the needed key number to
the police over telephone lines. The police would then insert that decoder
number into the black box to tap the phone line in question.


   The ACLU's Martin said the government, given lists of secret encryption
numbers, "has an enormously greater ability to eavesdrop than it's ever had."
Government officials deny that.