International Relations

The United States has several long-standing laws and policies designed to prevent strong cryptography from spreading abroad, and even from being widely used at home. Although these may have served to slow the spread of strong cryptography, ultimately they have failed to stop it.

U.S. export control is designed to prevent foreigners from acquiring cryptographic systems that are strong enough to create a serious barrier to traffic analysis, or that are difficult to crack. Most of the effective encryption technology was funded, perfected, or endorsed by the federal government. Since it is very expensive and time consuming to come up with good encryption, it is not surprising that the U.S. government is the only group that has been willing to pay what it costs to develop secure communication gear. After all, we certainly cannot afford to have our military and diplomatic communications read by our adversaries. However, only strong products that lack the capability of being adapted for encryption, or which are designed for specific banking applications, receive official export clearance. If we let our best encryption developments get outside the country, it would be harder to monitor what other countries are doing. As World War II demonstrated, the ability to break an enemies encryption can be a very valuable one.[see NSA article ] also [NSA testimony]

The ITAR have failed to prevent the spread of strong cryptography. The ITAR prohibits the export of cryptographic software, nevertheless software created in the United States routinely and quickly finds its way abroad. As would-be sellers of cryptographic products have frequently testified to Congress, the major effect of the ITAR is to prevent U.S. companies from competing with those foreign companies that sell sophisticated cryptographic software abroad.

On the issue of the Clipper Chip the National Security Council is currently considering under what circumstances, if any, foreign governments would be given the U.S. family key. After all, giving a foreign government the family key puts it one step closer to decrypting all Clipper traffic; this weakens the security that Clipper is supposed to provide. Refusing to share information with foreign law enforcement and intelligence agencies risks disrupting working relationships. Even a compromise solution, in which the U.S. offers to decrypt messages on a case-by-case basis, might be unpopular both with Clipper users and foreign governments. Indeed, some intelligence-sharing treaties may require either that the tools for decrypting EES traffic be shared with some foreign intelligence agencies, or that the U.S. do the decryption on demand.

The proposed Encryption Standards and Procedures Act would have authorized the President to release keys to foreign governments when he determines that such access and use is in the national security and foreign policy interests of the United States. Nothing in the draft legislation would have required that the owner of the chip ever be notified that his security has been permanently compromised.

Unlike other modern encryption products, Clipper-equipped products will be exportable. Presumably, U.S. businesses using Clipper at home will welcome the opportunity to use the same products in their foreign subsidiaries. Whether other foreigners would wish to buy a product that comes with a guarantee that the U.S. government can listen in seems more doubtful.

There are two strategies, however, that the Administration might use to boost foreign sales. The first would be to share the family key with foreign governments and perhaps also allow those governments to be the escrow holders for certain chips. The alternative would be to manufacture some chips with a different family key, perhaps even a different family key for each foreign market. The alternative family key could be disclosed to the foreign government without compromising the security of the U.S. chips, but two chips with different family keys would not be able to communicate in secure mode because they would not recognize each other's LEAFs as valid.

The globalization of commerce means that sensitive commercial (and, increasingly, personal) communications cross national borders. Even if EES becomes the de facto U.S. standard, it is unlikely to meet with wide acceptance abroad as long as the family key and the chip unique keys are held by the U.S. government. Why, after all, should non-U.S. buyers acquire a product designed to make eavesdropping by the U.S. government relatively easy? Whether non-U.S. buyers choose a similar product with a different family key or a different system entirely, the result will be to make secure communications between a U.S. party and a non-U.S. party more difficult. If, as the FBI suggests, the U.S. has the most to lose from industrial espionage, EES may hurt U.S. business more than it hurts anyone else.[see MIT article].

Click on icon to go back to debate.

Click on icon to go back to abstract.

Click on icon to go to Sources and Acknowledgements.