To: Wigglesworth who wrote (2200 ) 3/20/1998 11:08:00 PM From: Wigglesworth Respond to of 6021
NETA VP confesses to being clueless ignoramus: Network Associates plays ticklish game with encryption export rules By Jim Kerstetter, PC Week Online 03.20.98 6:15 pm ET Network Associates Inc. is skimming along the edges of encryption export law by licensing encryption technology from a Swiss research lab for sale in Europe. Officials with Network Associates, which in the fall purchased the encryption software company Pretty Good Privacy Inc., said today they really don't know much about the encryption technology they are licensing from cnLabs, of Rapperswil, Switzerland. All they know is what they asked for: the functional equivalent of both PGP's Personal Privacy and business software. The business software, intended for corporate users, has a message recovery scheme but not true key recovery. "I can't know. And I don't want to know," said Peter Watkins, vice president and general manager of Network Associates' security division, in Santa Clara, Calif. cnLabs, in turn, will sell the strong encryption to Network Associates' subsidiary in the Netherlands, where it will be installed on NAI software, Watkins said. "We had no one speaking with them in a technical capacity in any way, shape or form," he added. That would seem to be the key for Network Associates to skirt the U.S. government's current encryption export laws. With some exceptions, the Commerce Department bars export of encryption software that uses keys longer than 40 bits. Keys of 56 bits can be used if a company promises to build in a key recovery mechanism that gives law enforcement officials a "back door" into the encrypted data. Even talking with a foreign company about using strong encryption could be construed as a felony violation. Watkins said Network Associates contacted Commerce officials earlier this week and announced their intent to work out a deal with the Swiss lab. So far, they haven't heard back from the government. "We made this announcement today so everyone will know what we are doing," Watkins said. "We're not trying to hide anything." PGP's founder, Phil Zimmerman, faced federal prosecution several years ago when he posted the PGP encryption scheme on the Internet. Federal prosecutors, who said the posting of the strong encryption violated export laws, have since dropped the suit. Watkins said he doesn't even know if the Swiss lab is working with the data Zimmerman once posted on his site. "I'm just trying to sell software," Watkins said.