September 21, 1999

By JERI CLAUSING

New Fight Over Encryption Rules

ASHINGTON -- Last week's surprise change in the Clinton Administration's encryption policy may finally close the long-standing debate over export controls. But civil libertarians are bracing for a renewed fight with law enforcement agencies over access to the keys that can unscramble private data and communications.

The Encryption Debate: Is It About Privacy or Security? Go to Forum Related Articles

The push by law enforcement for legal rights to so-called spare keys to encrypted communications is as old as the fight to lift export controls on the technology. But until now, technology companies, civil libertarians and a host of other groups have stood united against attempts to tie any easing of the export controls to easier access by law enforcement to scrambled data.

Now that the Administration has promised the technology industry a major relaxation of its export controls, privacy and civil libertarian groups may be left to finish the fight over access to encrypted data on their own.

At issue is a bill being pushed by the White House to try to balance the concerns of law enforcement with the new policy of letting companies more freely export strong encryption products.

The proposal would commit $80 million over the next four years to a research center to help law enforcement agencies learn how to crack codes on their own. It would also establish a legal framework that would give investigators access to spare keys to encrypted data that are stored with third parties. In addition, it would guarantee the protection of industry trade secrets when companies assist officers trying to access the encrypted communications of suspected criminals.

Although Attorney General Janet Reno said the bill is needed to update law enforcement tools for the digital age, groups like the American Civil Liberties Union and the Center for Democracy and Technology say they fear the new rules will trample on traditional constitutional protections.

Alan Davidson, a lawyer with the Center for Democracy and Technology, said he was concerned about the impact the proposed legislation would have on the privacy of information that is stored about people on computers other than their own.

After analyzing the proposal, CDT said it was concerned that the bill does not require "the more stringent showing of 'probable cause' and notice of a seizure that the Fourth Amendment would demand of keys taken from a person's own computer or data seized from one's own house."

Barry Steinhardt of the ACLU said he was troubled by provisions of the bill that would protect investigators from having to disclose how they cracked into private computer communications.

"You have to look at that provision in light of the Administration's intentions to continue to do the one-time export review of new products, which I am convinced will become the occasion for the Administration, the FBI and the NSA [National Security Agency] to strong-arm the industry into building trap doors into cryptography, which they then will be required to disclose," Steinhardt said.

Indeed, although the Administration has said it will all but eliminate its cumbersome licensing process for strong encryption products, those products will still be subject to a one-time review by an interagency group before they can be sold overseas.

The ACLU will seek to give individuals the opportunity to fight court-ordered encryption seizures.

"No one knows for sure, but what I presume it will entail is a technical review by the FBI and NSA under the guise of Commerce," Steinhardt said. "They can drag those technical reviews out to the point where in a fast-moving market, industry is likely to agree to compromises and agree to build in trap doors."

Steinhardt said it is also unclear what power the Administration would retain to deny a company the right to export products "and whether that becomes another lever for extorting exterior trap doors out of the industry."

Although the new rules for export are not expected to be detailed for a few months, the proposed legislation on law enforcement access has already been sent to Capitol Hill.

Steinhardt said the ACLU would fight to insure that law enforcement would be required to obtain a court order to gain access to the encryption keys and passwords and that the law would protect individuals from government fishing expeditions. The ACLU said it would also seek to give individuals the opportunity to fight court-ordered encryption seizures.

This week in Washington:

The controversy surrounding the creation of a nonprofit body to take over the administrative functions of the Internet will be the topic of a conference Friday and Saturday sponsored by Computer Professionals for Social Responsibility.

The agenda is loaded with panelists from both sides of the issue, including the interim chairwoman of the Internet Corporation for Assigned Names and Numbers, Esther Dyson. The consumer advocate Ralph Nader will give the keynote address on Saturday.

The CAPITAL DISPATCH column is published weekly, on Tuesdays. Click here for a list of links to other columns in the series.

---

Related Sites
These sites are not part of The New York Times on the Web, and The Times has no control over their content or availability.

• American Civil Liberties Union

• Center for Democracy and Technology

• Computer Professionals for Social Responsibility

---

Jeri Clausing at jeri@nytimes.com welcomes your comments and suggestions.

---