Encouraging News - France

From <http://www.ft.com/hippocampus/8e46a.htm>

>Encryption technology: French boost for internet software

>MONDAY SEPTEMBER 1 1997
>By Andrew Jack in Paris

>France is poised to liberalise regulations on computer encryption 
>technology which could boost its efforts to encourage development of the 
>internet.

>The government is shortly to publish an official decree which would for 
>the first time allow easy access to and use of software which encodes 
>sensitive information in order to protect it from unauthorised 
>interception.

>The move could prove especially important for companies attempting to 
>sell products and services over the internet, but which have been 
>concerned about their protection of credit card numbers and other 
>financial information provided by their customers.
>
>France remains one of the few western countries to impose such 
>restrictive legislation on encryption, with only certain categories of 
>users currently allowed to use the software.

>Other nations which continue to restrict the use of cryptography tightly 
>in order to control the transfer of sensitive information include Iraq, 
>Libya, Singapore and China.

>While many more countries - including EU member states and the US - 
>restrict the export of sophisticated encryption technology as a product 
>important to national security, most have more liberal guidelines 
>concerning the circulation and application of software within their own 
>borders.

>The new decree in France follows a 1996 telecommunications regulation 
>law, which opened the way to liberalisation of encryption software but 
>which has so far not led to publication of any details of how the 
>measures could be applied.

>The latest move comes after Lionel Jospin, the prime minister, made a 
>speech last week highlighting the "delay" in France of uptake of the 
>internet and promising initiatives to give it a higher priority.
>---------


Brian B. Riley --> http://www.macconnect.com/~brianbr
        For PGP Keys -  Send Email Subject "Get PGP Key"
  "One of the deep mysteries to me is our logo, the symbol of lust
   and knowledge, bitten into, all crossed with in the colors of the
   rainbow in the wrong order. You couldn't dream of a more 
   appropriate logo: lust, knowledge, hope, and anarchy."
   -- Gassee - Apple Logo

I'm extremely skeptical that France will truly liberalize crypto use by its
citizen-units. Rather, I expect they will just be falling in line with the
OECD/Wasenaar/New World Order "trusted third party" key recovery approach
that the United States, Britain, and other European and Asian countries are
behind-the-scenes adopting.

At 10:16 AM -0700 9/1/97, Brian B. Riley wrote:
> From <http://www.ft.com/hippocampus/8e46a.htm>
>
>>Encryption technology: French boost for internet software
>
>>MONDAY SEPTEMBER 1 1997
>>By Andrew Jack in Paris
>
>>France is poised to liberalise regulations on computer encryption
>>technology which could boost its efforts to encourage development of the
>>internet.

Does anyone think this means: "Hey, use whatever crypto program you want.
Use something SDECE cannot break!"?

Given the monopoly France Telecom has on Internet access, I'd expect a
"solution" that involves FT issuing keys, or something equally brain dead
as that.

(I gave an invited talk on crypto anarchy at a conference in Monaco a few
years ago, and spoke to several France Telecom representatives. They made
it quite clear that France was not going to tolerate independent ISPs, and
that France Telecom would administer any crypto ever to be used by the
populace. Maybe this policy has changed, but I doubt it. Whatever France's
charms, open debate is not one of them.)


>>The government is shortly to publish an official decree which would for
>>the first time allow easy access to and use of software which encodes
>>sensitive information in order to protect it from unauthorised
>>interception.

I'll bet 1000 francs that this will not mean citizens can use PGP openly.
(I know some Frenchies who are already using PGP, of course.)



>>The new decree in France follows a 1996 telecommunications regulation
>>law, which opened the way to liberalisation of encryption software but
>>which has so far not led to publication of any details of how the
>>measures could be applied.

One wag put it this way: "Any Frenchman may apply for a permit to use
strong cryptography. The same way any Frenchman may apply for a permit for
an Exocet missile."

--Tim May

There's something wrong when I'm a felon under an increasing number of laws.
Only one response to the key grabbers is warranted: "Death to Tyrants!"
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

Tim May <tcmay@got.net> writes:
> I'm extremely skeptical that France will truly liberalize crypto use by its
> citizen-units. Rather, I expect they will just be falling in line with the
> OECD/Wasenaar/New World Order "trusted third party" key recovery approach
> that the United States, Britain, and other European and Asian countries are
> behind-the-scenes adopting.

I think it's been mis-reported.

My understanding of the situation in France is that the "crypto use"
regulations have changed, or are changing at this moment.

The change is from "no crypto without a permit" to "crypto provided it
is GAKked".

So, you guessed right.

> >>The government is shortly to publish an official decree which would for
> >>the first time allow easy access to and use of software which encodes
> >>sensitive information in order to protect it from unauthorised
> >>interception.
> 
> I'll bet 1000 francs that this will not mean citizens can use PGP openly.
> (I know some Frenchies who are already using PGP, of course.)

Depends on your definition of openly.  Jerome Thorel, at the time a
French free-lance journalist, interviewed the head of SCSSI, he asked
"can individuals use PGP?" and the answer was "if you asked us for
permission we'd say no, but if you use it we won't do anything about
it".  Jerome had this revelvation as his .sig for a while.

Jerome Thorel uses PGP.  I usually encrypt email to him.

> One wag put it this way: "Any Frenchman may apply for a permit to use
> strong cryptography. The same way any Frenchman may apply for a permit for
> an Exocet missile."

That ties up with Jeromes interview with the SCSSI person.

Adam
--
Have <I>you</I> exported RSA today?

Adam Back wrote:

> Depends on your definition of openly.  Jerome Thorel, at the time a
> French free-lance journalist, interviewed the head of SCSSI, he asked
> "can individuals use PGP?" and the answer was "if you asked us for
> permission we'd say no, but if you use it we won't do anything about
> it".  Jerome had this revelvation as his .sig for a while.

Exactly what happens in India. Dont ask for permission, ask for 
forgiveness. The govt doesn't want to sanction it. This could 
be becuase they might want to declare usage illegal at a latter time, 
or currently dont have the infrastructure to tap into people's 
communication, or the investment in such infrastructure is 
not justified at this time or they realize how entirely stupid 
it would be to legally restrict crypto usage. Whatever such 
a stand implies it manages to keep venture capitalists away from 
crypto products. 

best,
Vipul

-- 

Vipul Ved Prakash                 | - Electronic Security & Crypto 
vipul@pobox.com 	          | - Web Objects 
91 11 2233328                     | - PERL Development 
198 Madhuban IP Extension         | - Linux & Open Systems 
Delhi, INDIA 110 092              | - Networked Virtual Spaces

On lun 01 sept 1997 à 11:18:10AM -0700, Tim May wrote:
> 
> I'm extremely skeptical that France will truly liberalize crypto use by its
> citizen-units. Rather, I expect they will just be falling in line with the
> OECD/Wasenaar/New World Order "trusted third party" key recovery approach

That's probably true. Given the recent history on the subject in France,
I doubt they would do a 180 degree turn...

> Does anyone think this means: "Hey, use whatever crypto program you want.
> Use something SDECE cannot break!"?

Update, SDECE is now called DGSE ;-) 
Besides, they are our CIA, and therefore not supposed to act within
France. But I guess the DST (the french FBI) would handle matters like
that. So far France doesn't have a (known) equivalent of the NSA. A
department controlled by the prime minister (the SGDN) handles the
authorization process for crypto usage, and is assisted for technical
issues by the SCSSI (which usually says "no way" for strong cryto).
Now, the army has also its own cryto units, and they have quite
knowledgeable people... (have a look at
http://www.dmi.ens.fr/equipes/grecc/, and all these "ingenieurs de
l'Armement" which are linked a way or another to this lab)

> Given the monopoly France Telecom has on Internet access, I'd expect a
> "solution" that involves FT issuing keys, or something equally brain dead
> as that.

It's not entirely true that FT has a monopoly. They do have a monopoly
on the phone lines, yes, which means of course that they can (and do)
dictate their own terms to any french internet provider. This won't last
forever, as starting january 1st this monopoly will end. This means
anybody will be free to switch to another phone provider (and yes, there
will be a few of them, which have installed networks, and which
currently can only offer phone services to compagnies, say to link to
physical locations in France, and are eager to enter the market
targeting individuals). Furthermore, it is untrue to say "FT=french
governement". Actually, most senior officials at FT wanted the company
to be sold to private interests, because they felt they would defend
their dominant position better this way. The new governement stopped the
process, but anyway FT has its own agenda, which may differ from the gov
vues. Of course, this doesn't mean anything good to the end customer,
the average french guy who would like to use the internet. FT is
catching up on the subject, but they did everything to slow down the
internet progression in France, fearing it would dammage their
"minitel", which generates high revenues.

> (I gave an invited talk on crypto anarchy at a conference in Monaco a few
> years ago, and spoke to several France Telecom representatives. They made
> it quite clear that France was not going to tolerate independent ISPs, and
> that France Telecom would administer any crypto ever to be used by the
> populace. Maybe this policy has changed, but I doubt it. Whatever France's
> charms, open debate is not one of them.)

You said everything when saying "a few years ago". I guess they woke up
on these issues, and now their key problem is more "how to keep making
the huge profits we make currently on the phone when we will have
competitors next january". Somehow internet and use of crypto aren't
that important in respect to that, even if anybody with half a brain can
see how everything is connected. Besides, I will give you an example
which illustrate how sometimes FT can be driven by market law rather
than gov interests. A few months ago, they started to sell cell-phone
cards, with a prepaid amount of time on it. these were anonymous, (they
wouldn't ask for an ID or anything), and everything went fine for a
couple of weeks, until somebody in the police realized they wouldn't be
able to link calls like that to a poor soul. So FT got an order from the
govt, and now they ask for an ID when purchasing. Now, I don't know if
any of the other 2 cell-phone operators in France offer the same kind of
card. I think they don't, unfortunatly, but if they decide to do so, it
would take more than a phone call from the governement to make them
comply with the police concerns. Well, I hope so...

> I'll bet 1000 francs that this will not mean citizens can use PGP openly.
> (I know some Frenchies who are already using PGP, of course.)

The thing is, currently many individuals use it, for e-mail or file
encryption, and I seriously doubt that anybody would be prosecuted just
for that. But they (LEAs, gvt, you name it) know that it's a Damocles
sword they can use at will. And they want to keep it that way. Unlike in
the US, it's rather difficult to challenge a law in France, the way
Berstein or Karn or Junger are doing. Therefore the current situation is
unlikely to change in the near future.

> >>The new decree in France follows a 1996 telecommunications regulation
> >>law, which opened the way to liberalisation of encryption software but
> >>which has so far not led to publication of any details of how the
> >>measures could be applied.

Well, mainly because they don't know themselves how to enforce their
laws. Or simply to interpret them.

> One wag put it this way: "Any Frenchman may apply for a permit to use
> strong cryptography. The same way any Frenchman may apply for a permit for
> an Exocet missile."

Old technology. We know better ;-)
<serious> you don't want to apply for a permit. You just use it. And if
later LEAs targets you as a drug dealer, you will get 20 years for drug
offences and 3 more months for crypto use. So as an individual, you
don't care, but by doing things this way cryto won't be widespred soon,
and large corporations or companies won't "just use it" the way a single
guy will.
Don't misunderstand me, it sucks, but at least when you are in France
you don't expect to wake up in front of a SWAT.

                            F.


-- 
Fabrice Planchon                                          (ph) 609/258-6495
Applied Math Program, 210 Fine Hall                      (fax) 609/258-1735