IP: Re: - 2 Crypto Policy Developments in Canada (NOW: France!)

[Dave Farber <farber () cis upenn edu>]

Date: Wed, 4 Mar 1998 15:42:37 -0500
From: "K. N. Cukier" <100736.3602 () compuserve com>




Dave,


Re:
> From: "Stewart Baker" <sbaker () steptoe com>
> [...] I was surprised that the
> press, which has given front-page treatment to a variety of nonevents
designed
> to show that crypto controls are about to expire, completely ignored this
> development.  I continue to think that the tech community and tech writers
are
> misleading themselves by only reading (and writing) stories that announce
the
> imminent end of all controls on encryption. 


I think Stewart is spot on. From my perch in Paris, I'm sensing the
pendulum swinging back towards crypto controls. 


Another crypto item completely passed over was France's enactment of its
crypto decrees on 24 February. These were the long-awaited ones (that
you've been following on the IP list). The two decrees cover weak and stong
encryption. A third, on trusted third party key escrow centers, is still to
come. (I'm woking on a translation and analysis of the two decrees, and
will pass along a synopsis for IP soon....)


In short, the prime ministerial decrees enact the July 1996 Telecom Law. It
liberalizes crypto, insofar as any crypto was previously illegal, for the
most part. Now, basic crypto, embedded in systems like garage openers,
cable TV set top boxes, Dick Tracy decoder rings, etc., are freed up. Weak
encryption, at 40-bit key length, is also allowed. 


But that's the limit of the "liberalization." The rest considered by many
as draconian: All users must escrow their keys with special centers so that
government authorities can have immediate access. In this regard, the
decrees are just the opposite of a "liberalization." 


This is the ultimate petrie dish of whether the US's key-recovery position
is feasable -- and what the consequences might be for electronic commerce.
So the message is: Stay tuned.


We've known these decrees were coming -- that's not the news. It's a
historical moment for the crypto debate, and the Net, because of what it
represents. Symbolically, it shows that a country can isolate itself
politically on the issue (as France loves to do in other contexts...) and
adopt whatever crypto policy it choses, provided it's willing to pay the
price. But what's important is that we don't know yet what that price will
be: That, we'll see in time by the French experience.


As a reporter, I'm told by international corporate users that they'll never
surrender their keys, and unless they receive exemptions, all sensitive
work will move outside of, or not enter into, France.


Yet politically, France's move is resonate. Europe is divided on crypto --
the matter is not resolved. Even Germany is divided, though for the moment
the pro-cryto people have vastly more influence on the policy than the
Minitry of the Interior folks. For the most part, the pro-crypto European
position has come out of the European Commission, which, (not
incoincidentally), is packed with Germans working on the crypto issue. Few


nations of Europe have set policies, they just have tendencies. They tend
to be pro-crypto, anti-key recovery, but for crypto activists, that battle
hasn't yet been won.


And that's another reason why the French decrees are important. They'll
have influence, repercussions, outside the country. I suspect key recovery
factions in European nations will point to the French position and export
it into their own national crypto debate as their countries hammer out set
policies. 


Not bad for the little guys in berets, huh! They've made the spotlight once
again! 


Cheers,


Kenn






********************************
See you at INET'98, Geneva 21-24, July 98   <http://www.isoc.org/inet98/>