Disclaimer: This information comes from sources that cannot be verified. As such, make no assumptions about its completeness or accuracy. We endeavor to keep this information up to date as much as possible. Feel free to send comments/ updates to the Security News Editor.

October 06, 1997, Section: Insights & Incites

If You Water Down Encryption You'll Kill The Golden Goose

By Elliot Kass

If commerce over the Internet is the proverbial golden goose, then the federal government is becoming both hunter and hound.

After gingerly testing the waters for the past couple of years, most businesses appear ready to take the plunge into electronic commerce. Business-to-business transactions are already thriving over the Internet and consumers are warming to the idea. Research houses are routinely upping their estimates of how much gold will eventually fill the online pot. The latest guesstimate from Forrester Research Inc., Cambridge, Mass., is that the total value of goods and services traded among U.S. companies over the Internet will reach $8 billion this year and $327 billion by the year 2002.

But the prerequisite for all this, the key to unlocking these cyber-riches, is the ability to convince would-be buyers and sellers that their online transactions are secure. And the only surefire way to accomplish this is to encrypt those transactions in a manner that cannot be violated. Enter the huntsman: The federal government appears determined to prevent the spread of strong encryption technology at all costs.

For those who gather intelligence for a living, privacy is a peril. And since robust encryption techniques afford pretty good privacy-no plug intended-agencies like the FBI and the NSA are out to squelch any form of strong encryption that does not give them a way to decipher what's being said.

The spooks' latest assault on robust cryptography has taken the form of a series of amendments to the pro-encryption Security and Freedom through Encryption (SAFE) Act, now winding its way through Congress. The SAFE bill was originally conceived to end all government controls on encryption software, including its export overseas.

These so-called "amendments," however, turn the SAFE Act into a kill zone, threatening anyone whose electronic missives cannot be "immediately" accessed by law-enforcement officials with up to five years imprisonment. Other choice revisions would impose sanctions on foreign nations that permit the sale of encryption products without a key recovery system in place and jail terms for anyone even thinking about devising a new encryption algorithm.

To win converts to their anti-cryptography crusade, FBI and NSA lobbyists have taken to haranguing members of Congress with tales of drug dealing, child porno-graphy and terrorist activity on the Internet. Encryption, so the argument goes, would make the perpetrators harder to apprehend. While that's no doubt true, would passing laws against encryption make catching them any easier? Implying that it would brings to mind the old National Rifle Association slogan: "If guns are outlawed, only outlaws will have guns."

Logic notwithstanding, most recent committee votes suggest that the politicians are flocking to the spooks' call. Those congressional representatives supporting the turnabout on SAFE may be inclined to gamble that curtailing online security will not have a chilling effect on online commerce. It's a losing bet. For unlike ordinary mail, unencrypted E-mail can readily be opened, copied and then passed along to the intended recipient without the original sender having a clue that any of this has taken place. And unlike ordinary phone calls, calls conveying E-mail and other files can be intercepted and scanned en masse. It's one thing to give out your credit card number over the phone to someone you don't know-at least you know whom you called. It's quite another to make your card publicly available each time you use it.

That the public recognizes this is obvious to those companies already engaged in online commerce. "There is not one of my customers who would place an order if adequate encryption were not available," says Brian Shane, vice president of marketing for 1-800-BATTERIES, a Reno, Nev., battery-replacement supplier that does about 20 percent of its business on the Web.

If Congress' anti-encryption measures become law, "This would take away 90 percent of our business," concludes Jeffrey Punzel, CEO of the Octagon Technology Group, a Chicago Internet order processor. "This is completely detrimental to electronic commerce as a whole."

Although there is some congressional opposition to these measures, Congress may yield to the policemen and spies, and severe limitations on the use of cryptography will be put into place. At the least, the government will force anyone who offers a strong encryption product (beyond 56K) to provide its agents with the key.

These keys will unlock secrets, but they won't unlock treasures. For in its efforts to keep the world safe for democracy, the government is throwing commerce to the dogs.

Elliot Kass is the editor of InternetWeek.