Re: Clinton Admin. to announce new Crypto regs

-----BEGIN PGP SIGNED MESSAGE-----

At 10:39 PM 5/8/97 +0000, Rick Smith wrote:
>These "new" regulations "to be issued" are scrambling to catch up with
>previous and current practices. It doesn't change things at all.

I disagree. Here's why:

New regs unquestionably do change things for US banks. Right now banks may export nothing stronger than unescrowed DES. Period. So - what do they use the dirt-cheap, insecure Internet for? Nothing terribly important outside the US. One banker from JP Morgan told me yesterday that this was big news for them since they would soon move tons of stuff onto the Net. JPM, you'll recall, does business with huge, multinational institutions. They don't do retail banking. They aren't interested in small deals.

What do you suppose JP Morgan's bill for proprietary network use is each year? How much will they save by moving to the Internet?

It's worth noting, too, that banks and consumer software companies will soon export things like PC banking software with minimal delay.

>This announcement is simply a public acknowledgment that the BXA will look
>favorably on export requests to banks and that someday they'll try to draft
>specific regulations on the subject. Meanwhile you do it by grinding
>through the bureacracy.

It goes beyond banks. It affects any company that writes financial software for use with the banking infrastructire, including companies like CyberCash and Intuit.

Consider this: Last time Cybercash got approval to export it took them 15 months - count 'em - to get approval. OpenMarket had a similar wait. Regs like those may as well prohibit export. Now DOC says similar deals should be routine and take weeks to complete. Regs are supposed to appear soon - within the month, according to Reinsch's deputy. That's a significant change.

Will Rodger
Washington Bureau Chief
Inter@ctive Week
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBM3NA/UcByjT5n+LZAQGMrQf+LYo0Hr1Intna+9yr7E+D0Pmor0G02qxn
tHvyk1SAZI/NF8ps9VncboyxVrTVMRtD+eM+l962XHyjF/+PP2J/u7wZH6AivzV5
CeER7l/J6GoZLCFG4I1+1drHsgfHgR3QOuqehYTUg+CfscYYej7T7FkN6mL7jRZ8
ZDNzqYqrNQVhDJHUQJevUUJvHUELS+btSvo0m6sIyzn2WV8pBVwQZqzBxqf74KXd
FojRLnKwBquMZwLKZ1jVqlrdwY+S2La8r7XDEQI4VMetEPtKnsdczrJwKUDvYMKg
ZqLBR3CCAO50yWw7AcP7YIaAg2drcYJIZKF6DARjfr9eotQfFZ1nmA==
=KVo4
-----END PGP SIGNATURE-----

Will Rodger wrote:
| 
| It's worth noting, too, that banks and consumer software companies
| will soon export things like PC banking software with minima| l delay. 

	Netscape is PC banking software.

	SSL is the banks encryption tool of choice because it saves
you from having to write or support custom software.

	Claiming that this helps a retail operation is newspeak.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

At 11:22 AM -0400 5/9/97, Will Rodger wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>At 10:39 PM 5/8/97 +0000, Rick Smith wrote:
>>These "new" regulations "to be issued" are scrambling to catch up with
>>previous and current practices. It doesn't change things at all.
>
>I disagree. Here's why:
>
>New regs unquestionably do change things for US banks. Right
>now banks may export nothing stronger than unescrowed DES. Period.

Interesting. That's inconsistent with what was said in the NRC crypto
policy report. The report stated or at least implied that any commercial
crypto equipment could be exported for sale to a financial institution,
though it had to get an export license. (sorry for imprecision, I don't
have my copy handy).

You seem to be suggesting that the licenses were consistently denied or
permanently delayed for stronger crypto. I can believe it -- a bureacracy
can hide lots of unwritten rules behind a poorly documented licensing
procedure. I personally don't know of an example of stronger crypto being
exported to an overseas financial institution.

However, you're probably right in saying this is a big improvement for
commercial software doing strictly financial crypto. If the BXA produces
similar rules to those they recently drafted, then some types of products
will indeed be easier to export. OpenMarket et al took a risk when they
took on the bureacracy to try to get an export license based on what looked
like an acceptable practice. I agree it must have been an ugly process to
go through, and would be vastly improved by explicit regulation.

Rick.
smith@securecomputing.com      secure computing corporation