Greg
============================================================================
http://www.wired.com/news/news/politics/story/15362.html
Wired News
Thursday, October 1, 1998
11:46am
Canada Frees Up Crypto
by Matt Friedman, mwf@total.net
In a move that will almost certainly create friction between the US and
Canada, the Canadian government has released a new cryptography policy that
encourages the proliferation of powerful data-scrambling technologies.
The policy, announced Thursday by John Manley, the minister of industry,
makes it clear that Canadians will not have to submit to mandatory key
recovery, which would give the government access to all scrambled
communications. The document also heads off the establishment of a national
public key infrastructure.
"In terms of domestic policy, it couldn't be better", says David Jones,
president of Electronic Frontier Canada. "Industry Canada is essentially
saying that, domestically, you can pretty much do whatever you want with
cryptography."
An American civil liberties advocate was similarly impressed.
"It is great. It's a policy for the 21st century, as opposed to the US
government's policy update from last week, which is too little, too late",
said Susan Landau, a cryptography policy expert and the co-author of Privacy
on the Line: The Politics of Wiretapping and Encryption.
Canada's new policy is a setback to the country's "signals intelligence" spy
agencies. Industry Canada had been under considerable pressure from the
intelligence and law-enforcement communities, both at home and in the United
States, to establish domestic crypto controls.
"The US has sent a number of delegations to Canada, a number of times, to
try and convince [the Canadian government], to go with a restrictive view",
said David Banisar, policy director of the Electronic Privacy Information
Center in Washington, DC.
"The Canadians clearly said they were not interested."
Last winter, when Ottawa published a public white paper on cryptography and
solicited comments from the public and other branches of government, the
Canadian Security Intelligence Service said that it was pushing for a public
key-recovery plan.
The CSIS is concerned both with domestic and foreign intelligence, sort of a
combination of the FBI and CIA.
"The ability to decrypt messages and data has a significant impact on our
ability to monitor security threats to Canadians", said CSIS spokeswoman
Marcia Wetherup at the time. Reached for comment Thursday morning, Wetherup
said, "That continues to be the service's main concern at this time."
While the Canadian government has rejected controls on domestic crypto, it
is taking a wait-and-see attitude on exports. In the US, cryptography
exports are strictly regulated, on the grounds that the technology might be
used to conceal the communications of terrorists or hostile nations.
"The Commerce Department is not going to be happy", Landau said. A Commerce
Department official declined comment.
Under the new policy, Ottawa will continue to work within the framework of
the Wassenaar agreement. That document, an international treaty limiting the
spread of munitions technologies, is currently being renegotiated.
Sunny Handa, a cyberlaw specialist with the Montreal law firm Martineau
Walker, points out that the new policy will not alter existing regulations
governing the export of Canadian crypto technology or the re-export of
technology originating in the United States.
"The real issue now is export", he says. "That hasn't changed."
The new policy does, however, make the point that the Canadian government
will "deter the use [of crypto] in the commission of a crime," and in the
concealment of evidence. Moreover, existing search-and-seizure laws will
apply to encrypted messages. But Handa says that Industry Canada is simply
"throwing a bone to the police".
"Our search-and-seizure laws are pretty good right now", he says. "Citizens'
rights are protected, and law enforcement officials can do their jobs. If
Industry Canada has signaled that it's happy with them, we probably won't
see new legislation in this area for years."
"One way to view the issue of cryptography is as an issue of crime
prevention, rather than crime detection", said Landau. "As we enter the
wired world, cryptography will become extremely important to crime
prevention, and the Canadians recognize that."
--------------------------------------------------
Minister Manley Outlines Canadian Cryptography Policy
OTTAWA, October 1, 1998 -- John Manley, Minister of Industry, today
announced the elements of Canada's Cryptography Policy. Cryptography is a
set of technologies used to provide security for electronic transmissions
and of information stored on computer systems and networks such as the
Internet. This policy is an essential component of the Canadian Electronic
Commerce Strategy, designed to make Canada a world leader in the use of
electronic commerce by the year 2000. The policy allows Canadians to
develop, import and use whatever cryptography products they wish and does
not impose mandatory key recovery requirements or a licensing regime.
"This policy is good for the Canadian economy," said Minister Manley. "It
supports the increased use of electronic commerce products and services in
Canada, as well as the export of Canadian information technologies to other
countries." In announcing this Cryptography Policy for Canada, the
Government believes that a balanced approach has been achieved that
encourages the growth of electronic commerce while maintaining the
capability of law enforcement and national security agencies to ensure
public safety.
"Law enforcement agencies recognize the benefits of cryptography in
protecting sensitive information," noted Solicitor General Andy Scott.
"However, cryptography can also be used to shield criminal activities. This
policy highlights the development of a framework to help law enforcement
agencies deal with the challenges posed by advanced communications and
information technologies, including cryptography."
Cryptography allows users to authenticate credit card numbers,
electronically signed documents, e-mail or other information stored in
computers or transmitted over networks such as the Internet. It protects
sensitive information such as communications, bank accounts, medical
records and intellectual property. Cryptography is also an important tool
in crime prevention, protecting against economic espionage and safeguarding
the computer systems which support Canada's vital communications,
transportation and other critical infrastructures.
The Canadian Electronic Commerce Strategy is an element of the Government
of Canada's Connecting Canadians Agenda which aims to make Canada the most
connected nation in the world by the year 2000. A summary of Canada's
Cryptography Policy is attached to this press release.
For further information, please contact: Jennifer Sloan Press Secretary
Office of the Minister of Industry (613) 995-9001 Helen McDonald Director
General, Policy Development Electronic Commerce Task Force (613) 990-4732
SUMMARY OF CANADA'S CRYPTOGRAPHY POLICY
http://com-e.ic.gc.ca/english/fastfacts/43d7.htm
BACKGROUNDER
The Government is implementing a cryptography policy that:
· encourages the growth of electronic commerce;
· allows Canadian producers to export their products globally within the
framework of international arrangements; and
· contains measures to maintain the capability of law enforcement
agencies to ensure public safety.
Support for Electronic Commerce Canadians are free to develop, import and
use whatever cryptography products they wish.
The Government will not implement mandatory key recovery requirements or
licensing regimes.
The Government encourages industry to establish responsible practices, such
as key recovery techniques for stored data.
The Government will act as a model user of cryptography through the
practices of the Government of Canada Public Key Infrastructure (GOC PKI).
The Government encourages and supports industry-led accreditation of
private sector certification authorities.
Export / International Agreements Canada will continue to implement
cryptography export controls in keeping with the framework of the
international Wassenaar Arrangement.
Canada will take into consideration the export practices of other countries
and the availability of comparable products when rendering export permit
decisions.
The export permit application process will be made more transparent and
procedures will be streamlined to ensure the least regulatory intervention
necessary.
Public Safety The Government proposes amendments to the Criminal Code and
other statutes as necessary to:
· criminalize the wrongful disclosure of keys;
· deter the use of encryption in the commission of a crime;
· deter the use of cryptography to conceal evidence;
· apply existing interception, search and seizure and assistance
procedures to cryptographic situations and circumstances.
Release Number: 8099-e