The Ottawa Citizen
Wednesday, April 1, 1998

Cryptographers give government clear message

Export controls are strangling growing industry, group says

by James Bagnall

The who's who of Canada's burgeoning cryptography industry have a simple message for the federal government: It's time to liberalize the system for approving exports of their products.

Under Canadian rules, foreign sales of cryptographic products, used to secure traffic on electronic networks, must be approved by government officials. But entrepreneurs are growing frustrated by the uneven application of the export regime.

"We explain the policy to customers, noting that approvals will take something like five days", Ron Walker, the chief executive of Nepean-based KyberPass Corp. said yesterday at an industry-sponsored debate on the government's cryptography policy.

"But the delays turn into two months, and that can cost us the sale", Mr. Walker said.

Canada's major cryptography firms generated an estimated $125 million in sales last year, according to a recent federal survey. Most of the revenues were earned abroad.

That doesn't sound like much, but the growth has been terrific. The top dozen or so companies recorded only $10 million in sales in 1996 and, according to the federal survey, are expected to top $750 million in revenues by 2000.

The biggest player in Canada is Ottawa-based Entrust Technologies Inc., which co-ordinated yesterday's roundtable debate. The companies convened to prepare a joint position paper aimed at influencing the federal government's ongoing review of its cryptography policy.

A working group in Industry Canada is accepting submissions from all parties until April 21. The review is considered necessary because the explosive growth of electronic commerce now conflicts with the policy that restricts cryptography exports.

It's called the Wassenaar Arrangement, a 33-nation agreement signed by Canada in 1995 after two years of multilateral talks.

The arrangement is supposed to provide a framework for dealing with security threats in the wake of the fall of the Soviet Union. Cryptography, in the view of its signatories, is considered too valuable to fall into the hands of those who might use it against allied nations, either militarily or through criminal activity.

Until very recently, exports of cryptography weren't really an issue. Most developers of products that encrypt or otherwise disguise electronic information, sold their wares mainly to domestic governments and financial institutions.

But now that global firms are getting serious about doing business electronically with their customers and suppliers, the ability to secure financial transactions and sensitive business intelligence has become vital.

Giant corporations are becoming major buyers of encryption and other cryptographic technologies.

Dozens of firms are now racing to serve this market. Since Canadian companies are among the early leaders, there's a lot at stake.

"With Internet products, the first one in wins", said Brian O'Higgins, chief technology officer for Entrust, a spinoff of Northern Telecom Ltd.

However, the Wassenaar regime has become a straitjacket for Canadian exporters.

Firms such as Entrust can export any product they want to certain markets, such as the U.S. But export approvals are required for European and Asian markets.

Canada could eliminate these controls, but doing so in the absence of a similar move by the U.S. would be risky, the industry group concluded yesterday.

"Canada should liberalize (its export rules) to the extent possible without risking retaliation from the U.S.", said Phil Deck, the chief executive of Mississauga-based Certicom Corp.

Benita Baker, manager of marketing for Ottawa-based Chrysalis-ITS agreed, saying, "The problem isn't so much the controls as how they are interpreted."

This suggests a need for a much clearer set of export guidelines. But the real battle facing these and other cryptography firms is being waged behind closed doors by the country's law enforcement and intelligence communities.

They are very reluctant to relinquish control over how cryptographic technology develops.

They believe they need every weapon at their disposal to combat criminal activities.

Further, cryptography has for decades been considered by the intelligence community to be a strategic national asset, not just a technology with commercial promise.

But the underlying message delivered yesterday was that a new industry called electronic commerce now needs the technology to thrive. If Canada's enforcement agencies prevail in this debate, it's likely the industry will grow up elsewhere.

Copyright © 1998 by The Ottawa Citizen. All Rights Reserved. Reprinted with permission.