&
Wired News
Sunday, July 19, 1998
10:25am

FBI Sweet on Crypto Proposal

by James Glave, james@wire.com

An new proposal by a computer networking industry group aims to break a long-standing logjam with the Clinton administration over data-scrambling technologies. The plan would protect the privacy of secret communications sent over the Net while giving law enforcement agencies access to scrambled, or encrypted, information.

The group, led by Cisco Systems (CSCO) and Network Associates (NETA), and including companies such as Sun Microsystems (SUNW) and Hewlett-Packard (HWP), proposes placing a "backdoor" into routers -- the actual boxes that shuffle data across the Internet -- and the software that controls them.

The group characterizes its proposal as a "private doorbell", whereby law enforcement, armed with a court order, can ask a network administrator to place what amounts to a wiretap on data that passes through a switch.

"The approach allows the customer to keep control over the access, and be aware of the access at the network operator level", said Kelly Blough, director of government relations with Network Associates. "It is more of a doorbell approach that gives our customers a little more of a feeling of security", Blough said.

Eight out of the 13 companies in the group have applied for encryption licensing arrangements based on the technology, and two more are expected to apply for those export permits before the end of this week.

The FBI is pleased with the plan.

"If the router is in the possession of a third party such as an Internet service provider, that would very much meet the needs of law enforcement", said FBI spokesman Barry Smith. "As long as we can gain plaintext [or unscrambled] access to encrypted communications that are criminal related ... with a court order ... without relying on the individuals that are engaging in the illegal activity."

But one privacy expert said that exposing sensitive communications at the routers opens up the material to attack by crackers.

"It seems it's just going to make the routers a nice target to attack", says Susan Landau, an encryption policy expert and the co-author of Privacy on the Line. "It pleases the government because it slows down the debate again."

That debate has been long and exhausting for both industry on one side, and the government -- led by the intelligence and law enforcement agencies -- on the other. The FBI and the National Security Agency restrict the export of strong encryption, because they believe it would allow enemies of the US to communicate in secret. The federal government is pushing for key recovery, a scheme that would allow it backdoor access to any message.

So far, industry and privacy activists have resisted that idea. Industry says the policy places the domestic industry at a disadvantage to overseas competitors, who have few limits on export of strong encryption.

The plan can be easily thwarted, however. Users concerned about government access to their secrets can scramble their messages at their desktops with programs such as Pretty Good Privacy, before they even enter the network. Such information would not be accessible to anyone without tremendous supercomputing power.

"Law enforcement still has grave concerns with end-to-end encrpytion solutions in hardware or software", said Smith.

The groups' proposal will appeal to individuals who are primarily concerned about the privacy of their information moving over the Internet.

"If [encryption] is done another way it doesn't matter for law enforcement", Landau said. "They don't care how it's encrypted between two routers now that you have plaintext [or unencrypted information] at the switches."

Privacy experts said the proposal places sensitive data at risk for interception by malicious crackers.

"The security concerns are still exactly the same as they are with older models", said Kathleen Ellis, maintainer of Crypto.org, an online privacy resource.

"If there is a way to way to access the plaintext of ostensibly encrypted data, then you are introducing a flaw in the system. It is like a house of cards: If you pull out one card, it all falls apart."

The steps that allow a network administrator to reveal the transmitted information to law enforcement can be performed remotely, but Doug McGowan from Hewlett-Packard said that was not a security risk.

"Yes, operator action can be performed remotely, and that goes to the question of 'how do we make the networking products secure?' said McGowan. "We are working to make the management of the routers as secure as we can."

Ellis said that the system would not likely be adopted by the parties it is intended to thwart.

"Barring any severe penalty incurred for actually using secure encryption, customers are not going to use any kind of a recovery system, and criminals are certainly not going to use it", she said.

One encryption expert said that the plan will likely only encourage robust data-scrambling at the end-user level.

"Security mechanisms should always be placed as close as possible to the entities that they protect", said Phil Karn, a senior staff engineer with Qualcomm, in an email. "And to prevent conflicts of interest, they should be controlled by the same entities whose data they are protecting.

"In other words", Karn said, "user-controlled, end-to-end encryption is the only way to go, and only a fool trusts someone else to encrypt his data for him. We've always known that."


Copyright © 1998 by Wired Ventures Inc. All Rights Reserved. Reprinted with permission.