Several privacy advocacy groups have condemned the recent revision of the Wassenaar Arrangement. The Wassenar Arrangement is a protocol designed to limit the export of strategic military weapons. The revision is being opposed because it includes new controls on encryption software.
Electronic Frontiers Australia yesterday condemned the new restrictions in a statement on its Web site, saying the changes mean "the threat of global surveillance," by governments.
The revision to the Wassenaar Arrangement was signed by 33 countries in Vienna in early December and calls for restrictions on the export of "mass market" encryption software using keys greater than 64 bits, according to numerous sources who participated in the meeting.
However, provisions of the pact exclude restrictions on specific types of software including programs that are: considered generally available to the public since they are in the public domain, or designed for installation by the user without further substantial support by the supplier. Details of the agreement have been posted on the Wassenaar Web site (http://www.wassenaar.org).
These new controls are enough to disturb privacy organizations such as EFA. In a statement posted on its Web site, EFA decried the restrictions, saying that Australia-among the signatories-had knuckled under to U.S. demands, meaning Australian citizens are deprived access to high-strength security products.
Encryption tools are needed to help human rights organizations such as Amnesty International to inform the world of atrocities committed by repressive governments, EFA said. The controls on exporting encryption software defy rational analysis. "Because high quality strong crypto products are freely available in the public domain. The real reasons behind such controls can only be speculated upon," the EFA said.
Encryption software enables people to send electronic messages that are scrambled. This ensures that these messages cannot be read by outside parties before the intended recipient sees it. In the past, the U.S. restricted the export of encryption technology software because it feared that criminals could get their hands on the technology.
Up until this point, many countries have had no restrictions whatsoever on exporting encryption software. It is generally acknowledged that 128-bit software is more secure.
The EFA plans to step up its public awareness campaign on the restrictions and Web sites are now springing up around the world making available high-strength security products for downloading, EFA said.
"At a time when governments are preaching the benefits of e-commerce, it is incredible that security tools should be restricted, " said the EFA in its statement.
The U.S.-based group Zero Knowledge Systems has called for Internet users to protest the Wassenaar arrangement.
The group blames the Department of Commerce under secretary for "taking credit for convincing all other Wassenaar countries to impose these added restrictions over cryptography designed for average citizens." It offers Internet users the chance to fill out a form on its Web site which will go straight to a government representative (http://www.freecrypto.org).
However, several European sources that attended the Wassenaar meeting were at pains to stress that their governments had not merely given in to U.S. demands for tighter controls.
The Wassenaar arrangement actually represents a loosening of export controls, a European diplomatic source, who declined to be identified, told IDG last week, because it also lifts controls on mass market software under 64 bits.
"It is absurd to say that the group (of 33 countries) decided to increase controls," he said.
Software deemed "publicly available" is completely free of restrictions, according to Joachim Wahren, spokesman with Germany's Auffuhramt, the government organization that signed the Wassenaar arrangement. Hardware regulations have also been loosened, he said. For example, companies no longer have to get approval to export hardware encryption devices, according to Wahren. Lastly, the other signatories did not accept the U.S. proposal for instituting key recovery, Wahren said. A key recovery program gives the government the right to hold keys that unlock encrypted communications should they deem the content to be in violation of the law.
He did concede, however, that there is "a certain tightening" of the regulations for software not deemed public.
One IT security analyst sees the move as a definite step backwards. "On balance, this seems retrogressive," said Ken Frasier, security analyst with Dataquest in London. "The Clinton administration has been able to persuade 32 other countries to impose explicit restrictions, whereas before, it was a matter of discretion in each country."
It could be some countries hope that they be able to circumvent the restrictions, he said. "There is an indeterminate time before this can be implemented into local law. And even when countries do so, there may be loopholes or relaxations of the arrangement. This is not an instant cure," Frasier said.
The current Wassenaar signatories are: Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Czech Republic, Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal, Republic of Korea, Romania, Russian Federation, Slovak Republic, Spain, Sweden, Switzerland, Turkey, Ukraine, the U.K. and the U.S.
(Elizabeth de Bony in Brussels contributed to this article.)
RELATED LINKS
Network World, 12/7/98
Cryptography Net Resource: primers and more
Network World Fusion
