A code-red issue in communications; Congressional debate on encryption technology, which protects data during electronic transmission, will affect small firms

Nation's Business, Dec, 1997 by Tim McCollum

Congressional debate on encryption technology, which protects data during electronic transmission, will affect small firms.

It's common these days for small firms to send sensitive data to their business partners and customers using various electronic delivery mechanisms, including the Internet, online services, and telephone or private data networks.

And it's certainly not unheard-of for business data to be waylaid by hackers. But business information transmitted to others can be protected from prying eyes through use of a technology called encryption.

In the simplest terms, encryption provides a secure transmission envelope for private communications such as electronic mail and financial transactions. It allows the sender to scramble data and voice signals by using a code called a digital key. The data and voice signals then can be unscrambled and read only by someone who possesses the key.

Security experts say that strong encryption using 128-bit digital keys--can help small companies protect vital information inside and outside their businesses. Sixty percent of companies that responded to a 1995 survey conducted by a telecommunications task force of the U.S. Chamber of Commerce said they planned to use confidentiality-ensuring technologies, such as encryption, in the next five years.

This technology is also the subject of congressional debate on whether export of encryption technology should be legal and whether law-enforcement agencies should have access to the digital keys that unscramble encrypted data.

It is illegal to export encryption technology without permission of the U.S. Department of Commerce, which approves only technology with keys no larger than 56 bits. Such keys have been broken before.

In addition, the Clinton administration has proposed a key-escrow system in which users would deposit a copy of their digital key with a government-approved third party; the key could be retrieved by law-enforcement agencies acting with a warrant.

Advocates And Critics

Export restrictions and a key-escrow system are necessary, according to the Justice Department and other law-enforcement and national-security agencies, for investigation of crimes such as drug trafficking and terrorism.

"The problem is that the bad guys abuse this [technology]," says Scott Charney, chief of the Justice Department's section on computer crime and intellectual property. "Our notion is, you put very robust encryption out there, but you also make it possible for law enforcement to get access to it when legally required."

Critics of restrictions on the export of strong encryption technology say the policy makes communications and transactions between companies less secure by sidelining the strongest available means to protect business data.

Critics add that because the policy prevents U.S. software firms from building strong encryption into software they sell overseas, market opportunities are lost to foreign firms without similar restrictions.

"We're hampered in our ability to export products," says John Murray, chief operating officer of The Internet Factory Inc. in Pleasanton, Calif. The 12-employee firm makes electronic-commerce software for World Wide Web sites. Murray says his firm nearly lost a deal with a French telecommunications company last year because of the export restrictions.

"The export requirements are particularly onerous for a small business," he says. "What we ended up doing was delivering the product without any security, and the customer had to purchase security technology from a foreign firm."

In a similar move, Sun Microsystems Inc., a Mountain View, Calif., company that develops and makes hardware and software for computer networks, announced in May that it would license encryption software from a Russian firm, Elvis Co., near Moscow, for use with the server software it sells to customers overseas.

In Court And In Congress

Companies such as Sun Microsystems and The Internet Factory stand to gain from an August ruling by the U.S. District Court in San Francisco that declared the export restrictions to be unconstitutional. The court has stayed its ruling, however, pending review by a federal appeals court.

Congress has been wrestling with the encryption issue this year with mixed results. Rep. Robert W. Goodlatte, R-Va., is sponsoring a bill called the SAFE Act, which would lift restrictions on the sale and use of encryption and impose stiff penalties on criminal misuse of the technology. A Senate bill sponsored by Sen. John McCain, R-Ariz., would restrict exports and require a key-escrow system for international communications. Neither bill has been scheduled for floor action.