The White House today announced revised controls on the export of encryption products used to protect security online. While a step in the right direction, the new policy leaves major individual privacy concerns unanswered.

The revisions released today would allow export of moderately stronger encryption and allow certain industry segments to use even more secure products. However, the Administration policy does not address the needs of individuals online, human rights groups, or other non-commercial users. It continues to use export controls as a club to force the adoption of risky "key recovery" systems without addressing the privacy concerns raised by backdoor government access to our most sensitive data.

According to CDT Executive Director Jerry Berman, "The Administration has given us half a loaf in the encryption debate. Unfortunately, the other half a loaf is the part that deals with individual privacy."

Major features of today's announcement include:

• Decontrol of 56-bit (DES-level) encryption -- would permit export of 56-bit products and their equivalent (including 1024-bit asymmetric systems) to most countries, after a one-time governmental review .
• Export relief for specific industry segments -- would permit export of stronger products to subsidiaries of U.S companies, health and insurance industries, and unspecified "electronic commerce" users.
• Exemptions for "recoverable" products -- would permit export of encryption products of unlimited strength if those products include backdoor access to plaintext, use key recovery, or allow access to plaintext through a system administrator or other person independent of the user.

CDT welcomes these efforts to address the concerns raised about current U.S policy. However, the new regulations leave significant privacy concerns unanswered:

• 56 bit (DES level) encryption will not adequately protect online privacy and security. Expert cryptographers have argued for years that 56-bit encryption is not sufficient to protect privacy online. Just this summer, a group of California researchers created a "DES Cracker" that broke a 56 bit-length encrypted message in just 56 hours, using minimal resources.

• Granting export relief for industry groups leaves the little guy out.
  Individuals, human rights workers, or other non-commercial groups who have a compelling interest in using strong encryption, without backdoor access built-in, will not get relief under the new proposal.

• Administration policy continues to use export controls to force the adoption of vulnerable key recovery systems. The new regulations would continue the Administration's efforts to require "key recovery" or other plaintext access features in the encryption products that most individuals use. An experts report on "The Risks of Key Recovery" (http://www.cdt.org/crypto/risks98) recently argued that such recovery technologies introduce new security risks.

• Standards for government access are not specified. Privacy cannot be protected under a "recovery" system without a clear understanding of the legal protection governing access to plaintext -- a discussion that is absent from this proposal.

The extent to which the proposed new regulations will actually provide export relief will depend a great deal on the fine print. The new regulations are expected to be published in the late fall, and CDT will be monitoring these rules as they are published to ensure that they protect privacy.

CDT believes that the only way to protect individual security online as well as the nation’s critical infrastructure is through the widespread availability of strong encryption, without backdoors. We will continue to work with members of Congress to push for reforms that preserve the rights of individuals and businesses to protect sensitive personal information.

The Administration announcement is available on CDT's Web site at here.

For more information on how to get involved in the crypto debate, sign up for CDT's "Adopt Your Legislator" campaign to be informed when your representative is voting on encryption issues. Visit CDT's crypto policy web site at http://www.cdt.org/votes/