|
Techies Urge Senator To Drop Encryption Key Plan |
by Brian Krebs, Newsbytes (27/09/2001) |
|
A group of technology
and security companies is asking key U.S. senators to reconsider a proposal
that would require encryption makers to register "backdoor keys"
with the federal government.
In a letter to the Sen. Judd Gregg, R-N.H., and other powerful Senate committee heads, technology executives said such a proposal could erode consumer trust in companies that rely on encryption to process e-commerce transactions. "Domestic encryption limitations will hurt American companies because the demand for the technology will not wane and those seeking it will look to foreign companies," reads the letter signed by eight executives affiliated with the Association for Competitive Technology (ACT), a group heavily funded by Microsoft Corp. "In this current financial climate, Congress needs to avoid erecting barriers that will stunt the economic growth we so desperately need," the group wrote. The letter came in response to a floor speech Gregg delivered less than two days after the Sept. 11 terrorist attacks, in which he said encryption companies have "an obligation to allow us to have our people have the technical capability to get the keys to the basic encryption activity. Following a meeting last Thursday to discuss antiterrorism legislation with Attorney General John Ashcroft, Gregg came away with a "loose proposal" calling for a "quasi-judicial entity" appointed by the Supreme Court that would control access to the key repository, said Gregg spokesman Brian Hart. Hart said one proposal being considered calls for the creation of an organization to which law enforcement agencies could submit requests for manufacturer-specific encryption keys. That body would have ultimate authority to decide whether to grant subpoena power to requested key. The Clinton administration tinkered with similar proposals for years but ultimately dropped the idea after considerable opposition from the technology and security community. But ever since it has come to light that the terrorists involved in the Sept. 11 attacks likely used encryption to mask their e-mail communications, Gregg and congressional security hawks have begun revisiting the issue. Responding to published reports that he harbored misgivings about the availability of his brainchild in the wake of the attacks, PGP inventor Phil Zimmermann said he has no regrets. "PGP users should rest assured that I would still not acquiesce to any back doors in PGP," Zimmermann said in a Usenet post on Tuesday. Zimmermann said the question of terrorists using strong encryption was in fact one of the core issues of that debate initiated by the Clinton administration. He noted that aside from the FBI, most groups involved in the discussions decided the nation would be better off with strong encryption that is unencumbered with government backdoors. "Under the present emotional pressure, if we make a rash decision to reverse such a careful decision, it will only lead to terrible mistakes that will not only hurt our democracy, but will also increase the vulnerability of our national information infrastructure. Jeffrey Smith, counsel to the Washington, D.C.-based Americans for Computer Privacy and former counsel for the Central Intelligence Agency (CIA), said proponents of a central key escrow account never fully satisfied the question of what would be done with free and publicly available encryption products such as Pretty Good Privacy (PGP). "So are we going to make it illegal for people to use this product to generate their own keys? That's a question that nobody ever really answered, " Smith said. Smith added that a central repository with backdoor access to all encryption keys would be an enormously rich target for terrorists and crackers. "Even if we're talking about a quasi-judicial body, imagine the millions or billions of keys they'd wind up holding," he said. "If somebody hacks into that repository or someone is bribed into turning it over, you've created an even greater security problem than the one you're trying to address." |
|