In a move that will almost certainly create friction between the US and Canada, the Canadian government has released a new cryptography policy that encourages the proliferation of powerful data-scrambling technologies.
The policy, announced Thursday by John Manley, the minister of industry, makes it clear that Canadians will not have to submit to mandatory key recovery, which would give the government access to all scrambled communications. The document also heads off the establishment of a national public key infrastructure.
"In terms of domestic policy, it couldn't be better", says David Jones, president of Electronic Frontier Canada. "Industry Canada is essentially saying that, domestically, you can pretty much do whatever you want with cryptography."
An American civil liberties advocate was similarly impressed.
"It is great. It's a policy for the 21st century, as opposed to the US government's policy update from last week, which is too little, too late", said Susan Landau, a cryptography policy expert and the co-author of Privacy on the Line: The Politics of Wiretapping and Encryption.
Canada's new policy is a setback to the country's "signals intelligence" spy agencies. Industry Canada had been under considerable pressure from the intelligence and law-enforcement communities, both at home and in the United States, to establish domestic crypto controls.
"The US has sent a number of delegations to Canada, a number of times, to try and convince [the Canadian government], to go with a restrictive view", said David Banisar, policy director of the Electronic Privacy Information Center in Washington, DC.
"The Canadians clearly said they were not interested."
Last winter, when Ottawa published a public white paper on cryptography and solicited comments from the public and other branches of government, the Canadian Security Intelligence Service said that it was pushing for a public key-recovery plan.
The CSIS is concerned both with domestic and foreign intelligence, sort of a combination of the FBI and CIA.
"The ability to decrypt messages and data has a significant impact on our ability to monitor security threats to Canadians", said CSIS spokeswoman Marcia Wetherup at the time. Reached for comment Thursday morning, Wetherup said, "That continues to be the service's main concern at this time."
While the Canadian government has rejected controls on domestic crypto, it is taking a wait-and-see attitude on exports. In the US, cryptography exports are strictly regulated, on the grounds that the technology might be used to conceal the communications of terrorists or hostile nations.
"The Commerce Department is not going to be happy", Landau said. A Commerce Department official declined comment.
Under the new policy, Ottawa will continue to work within the framework of the Wassenaar Arrangement. That document, an international treaty limiting the spread of munitions technologies, is currently being renegotiated.
Sunny Handa, a cyberlaw specialist with the Montreal law firm Martineau Walker, points out that the new policy will not alter existing regulations governing the export of Canadian crypto technology or the re-export of technology originating in the United States.
"The real issue now is export", he says. "That hasn't changed."
The new policy does, however, make the point that the Canadian government will "deter the use [of crypto] in the commission of a crime," and in the concealment of evidence. Moreover, existing search-and-seizure laws will apply to encrypted messages. But Handa says that Industry Canada is simply "throwing a bone to the police".
"Our search-and-seizure laws are pretty good right now", he says. "Citizens' rights are protected, and law enforcement officials can do their jobs. If Industry Canada has signaled that it's happy with them, we probably won't see new legislation in this area for years."
"One way to view the issue of cryptography is as an issue of crime prevention, rather than crime detection", said Landau. "As we enter the wired world, cryptography will become extremely important to crime prevention, and the Canadians recognize that."