The Hamilton Spectator
Tuesday, April 28, 1998
page D2

Net encryption rules challenged

Ottawa under fire for plans to regulate software

by David Akin, dakin@ham.southam.ca

Nearly two dozen civil liberty and human rights organizations from around the world want the Canadian government to liberalize its cryptography policy.

The groups, which include organizations such as the Washington, D.C.-based Centre for Democracy and Technology, and the Internet Society, presented a petition last week opposing any plans by the federal government to regulate encryption software used or manufactured by Canadians.

"(This) will be important to everyone who's using the Internet", McMaster University computer science professor David Jones said yesterday. "(The petition) is significant. It highlights ... the international nature of issues like privacy on the Internet and it also makes it clear that this isn't some small technical matter they don't need to worry about."

Jones, in his capacity as president of Electronic Frontier Canada, presented that international petition to the Industry Canada task force.

Electronic Frontier Canada (EFC) is a non-profit group that seeks to extend Canadian charter rights and civil liberties to cyberspace.

Court Orders

Many Canadian police and security groups think the government ought to restrict the use of some kinds of cryptography products so that law enforcement agencies could, under special court-sanctioned circumstances, eavesdrop on electronic communications and decode encrypted data.

A federal task force studying the issue is expected to make some policy recommendations on the issue this spring.

Ottawa's decision on the matter will affect the ability of Canadian firms to deploy electronic commerce products and services, particularly in international markets.

The petition was signed by 23 groups from Spain, Austria, the United Kingdom, the Netherlands, the U.S., and elsewhere.

The April 20 meeting, held behind closed doors at an Ottawa hotel, was organized by the Industry Canada Task Force on Electronic Commerce.

Groups such as the Canadian Bankers Association, the Canadian Medical Association, and the Consumer Association of Canada were invited to the meeting, along with several government agencies and Electronic Frontier Canada.

Industry Canada is trying to work out a policy that balances some competing interests on the cryptography issue.

Some governments, particularly in the U.S., are worried that criminals and terrorists will be able to hide their activities behind digital codes that are too tough for any computer in the world to crack quickly.

The U.S. government, in fact, bans the export of programs that contain strong encryption capabilities. Canada currently has similar restrictions because of an international treaty known as the Wassenaar Agreement, and there is pressure to continue to follow the U.S. policy in order to preserve access to the giant American market.

That access, though, frequently comes at the expense of access to other global markets. Firms in European and Asian markets want software products with the kind of strong encryption U.S. firms are forbidden to export.

Encryption software allows computer files and digital communications to be scrambled when stored or transmitted. In its scrambled form the information cannot be read. It can, however, be descrambled or decoded using a special digital key.

Encryption technology allows, for instance, Canadians to exchange account information with their bank over the Internet using a Web browser equipped with encryption software. Encryption software can also be incorporated into digital wireless phones so that no one can eavesdrop on a phone conversation between two people using digital cellular services.

"Canadians have the right to speak in codes", said Jones in a press statement issued yesterday by Electronic Frontier Canada. "We have the right to speak in languages the police don't understand, whether it is Inuktitut or Cree or some other digital language."

Some federal agencies, though, believe that they should be able to intercept the exchange of data on the Internet or eavesdrop on digital cellular calls, under the same circumstances in which they are now allowed to open a suspect's mail or listen in on a telephone conversation through a wiretap.

"Law enforcement must be able to maintain its abilities to investigate and prosecute criminal activity, which is increasingly facilitated by technologies including cryptography, without curtailing the ability of law-abiding corporations and citizens to communicate and interact", RCMP commissioner Philip Murray said at the meeting.

Handcuff Police

"Cryptography poses the real potential to eliminate law enforcement agencies' investigative effectiveness. In order to fulfill investigative mandates, law enforcement agencies must be provided a means by which they can decrypt information they gather, which as been encrypted."

The Canadian Association of Chiefs of Police, the Canadian Security and Intelligence Service, and the Communications Security Establishment voiced similar concerns.

One of the options the task force may consider recommending for Canada's lawmakers, is to force manufacturers of encryption software to give the government a skeleton or master key that would allow law enforcement agencies to decode encrypted messages without permission of the owner of the data.

"This is comparable to asking the front-door keys for 10 million Canadian homes be deposited at the local police station, just in case there was a need to execute a search warrant", Electronic Frontier Canada co-founder and University of Waterloo computer science professor Jeffrey Shallit said in yesterday's release. "Canadians are right to reject this as unreasonably intrusive."

Jones agreed: "Mandatory key recovery, as the controversial policy option is called, would create an unnecessary risk that criminals might gain access to encryption keys and this would undermine public trust in financial transactions conducted electronically."



Related Web Sites:

Industry Canada: A Cryptography Policy Framework for Electronic Commerce
http://strategis.ic.gc.ca/SSG/cy00005e.html

Global Internet Liberty Campaign: Statement on Canadian Cryptography Policy
http://www.efc.ca/pages/crypto/gilc-letter.20apr98.html


Copyright © 1998 by The Hamilton Spectator. All Rights Reserved. Reprinted with permission.