Interesting People mailing list archives
IP: French law encouraging key escrow encryption
From: Dave Farber <farber () central cis upenn edu>
Date: Tue, 7 May 1996 08:53:08 -0400
Date: Tue, 07 May 96 08:30:54 EST From: "Stewart Baker" <sbaker () mail steptoe com> To: farber () central cis upenn edu Dave: I attach my firm's translation of Article 12 of France's proposed telecommunications law. It's from the Steptoe "Law and the Net" web page (www.us.net/~steptoe/pubtoc.htm#net). The law would appear to restrict the import, sale, or use of encryption products unless a key to the product is escrowed in France with an escrow agent certified by the French government. This draft law indicates that France is seriously considering mandatory key escrow. One possible concern is the law's import provisions, which impose no barriers to imports of European products while imposing restrictions on imports of products from other countries. Read literally, this could violate France's obligations under the most-favored-nation provisions of the World Trade Organization agreements. It is possible that this provision will not in fact favor German and Finnish products over Japanese and U.S. products because the European-preference provisions apply only to importation of encryption products, and the law's restrictions on use and supply seem to apply irrespective of product source. The apparent import preference for European products may simply reflect France's obligation to allow the free flow of goods within the European Union. Stewart Baker Art. 12 Article 28 of the Law No. 90-1170 dated December 29, 1990, on telecommunications regulation is hereby amended as follows: I - Section I is hereby amended as follows: 1) The first paragraph shall be completed by the following phrase: "Secret coding method denotes all materials or programs conceived or modified for the same purpose." 2) The second and third paragraphs are hereby replaced by the following provisions: "To preserve the interests of national defense and the internal or external security of the State, while permitting the protection of information and the development of secure communications and transactions, 1) the use of a secret coding method or service shall be: a) allowed freely: - if the secret coding method or service does not allow the assurance of confidentiality, particularly when it can only be used to authenticate a communication or ensure the integrity of the transmitted message; - or if the method or the service assures confidentiality and uses only coding conventions managed according to the procedures and by an organization approved under the conditions defined in Section II; b) subject to the authorization of the Prime Minister in other cases. 2) the supply, importation from countries not belonging to the European Community, and exportation of secret coding methods as well as services: a) shall require the prior authorization of the Prime Minister when they assure confidentiality; the authorization may require the supplier to reveal the identity of the purchaser; b) shall require declaration in other cases." 3) A decree sets the conditions under which the declarations are signed and the authorizations approved. This decree provides for: a) a simplified system of declaration or authorization for certain types of methods or services or for certain categories of users; b) the substitution of the declaration for the authorization, for transactions concerning secret coding methods or services whose technical characteristics or conditions of use, while justifying a certain attention being paid with regard to the aforementioned interests, do not require the prior authorization of these transactions; c) the waiver of all prior formalities for transactions concerning secret coding methods or services whose technical characteristics or conditions of use are such that the transactions are not capable of damaging the interests mentioned at the beginning of this paragraph. II - Section II is hereby replaced by the following provisions: "II - Organizations responsible for managing, on behalf of others, the coding conventions for secret coding methods or services that allow the assurance of confidentiality must be approved in advance by the Prime Minister. They are obligated to maintain professional confidentiality in the exercise of their approved activities. The approval shall specify the methods and services that they may use or supply. They shall be responsible to preserve the coding conventions that they manage. Within the framework of application of the Law No. 91-646 dated July 10, 1991, concerning the confidentiality of correspondence sent via telecommunications, and within the framework of investigations made under the rubric of Articles 53 et seq. and 75 et seq. of the Code of Criminal Procedure, they must release them to judicial authorities or to qualified authorities, or implement them according to their request. They must exercise their activities on domestic soil. A decree in the Council of State sets the conditions under which these organizations shall be approved, as well as the guarantees which the approval shall require; it specifies the procedures and the technical provisions allowing the enforcement of the obligations indicated above. III - a) Without prejudice to the application of the Customs Code, the fact of supplying, importing from a country not belonging to the European Community, or exporting, a secret coding method or service, without having obtained the prior authorization mentioned in I or in violation of the conditions of the granted approval, shall be punishable by six months imprisonment and a fine of FF 200,000. The fact of managing, on behalf of others, the coding conventions for secret coding methods or services that allow the assurance of confidentiality, without having obtained the approval mentioned in II or in violation of the conditions of this approval, shall be punishable by two years imprisonment and a fine of FF 300,000. The fact of supplying, importing from a country not belonging to the European Community, or exporting, a secret coding method or service, in order to facilitate the preparation or commission of a felony or misdemeanor, shall be punishable by three years imprisonment and a fine of FF 500,000. The attempt to commit the infractions mentioned in the preceding paragraphs shall be punishable by the same penalties. b) The natural persons guilty of the infractions mentioned under a) shall incur the complementary penalties provided for in Articles 131-19, 131-21, and 131-27, as well as, either indefinitely or for a period of five years or longer, the penalties provided for in Articles 131-33 and 131-34 of the Criminal Code. c) Judicial persons may be declared criminally responsible for the infractions defined in the first paragraph under the conditions provided for in Article 121-2 of the Criminal Code. The penalties incurred by judicial persons are: 1) the fine according to the modalities provided for by Article 131-38 of the Criminal Code; 2) the penalties mentioned in the Article L. 131-39 of the same code. The prohibition mentioned in 2) of this article L. 131-39 concerns activities, during the exercise of which, or on the occasion of the exercise of which, the infraction was committed." III - Section III becomes IV. Its last paragraph is hereby replaced by the following provisions: "The fact of refusing to supply information or documents, or of obstructing the progress of the investigations mentioned in this section IV, shall be punishable by six months imprisonment and a fine of FF 200,000." IV - Section IV becomes V. After the word "authorizations," the words "and declarations" are hereby inserted. V - A section VI is hereby added, formulated as follows: "VI - The provisions of this article shall not hinder the application of the Decree dated April 18, 1939, establishing the regulation of war materials, arms, and munitions, to those secret coding methods which are specially conceived or modified to allow or facilitate the use or manufacture of arms." VI - This article is applicable to overseas territories and to the territorial commonwealth of Mayotte. Copyright 1996 Steptoe & Johnson LLP Steptoe & Johnson LLP grants permission for the contents of this publication to be reproduced and distributed in full free of charge, provided that: (i) such reproduction and distribution is limited to educational and professional non-profit use only (and not for advertising or other use); (ii) the reproductions or distributions make no edits or changes in this publication; and (iii) all reproductions and distributions include the name of the author(s) and the copyright notice(s) included in the original publication.
Current thread:
- IP: French law encouraging key escrow encryption Dave Farber (May 07)