The John Marshall Journal of Information Technology & Privacy Law Volume 17 Issue 3 Journal of Computer & Information Law Article 8 - Spring 1999 Spring 1999 The Regulation of the Internet Encryption Technologies: Separating the Wheat from the Chaff, 17 J. Marshall J. Computer & Info. L. 945 (1999) Kurt M. Saunders Follow this and additional works at: https://repository.law.uic.edu/jitpl Part of the Computer Law Commons, Internet Law Commons, Privacy Law Commons, and the Science and Technology Law Commons Recommended Citation Kurt M. Saunders, The Regulation of the Internet Encryption Technologies: Separating the Wheat from the Chaff, 17 J. Marshall J. Computer & Info. L. 945 (1999) https://repository.law.uic.edu/jitpl/vol17/iss3/8 This Article is brought to you for free and open access by UIC Law Open Access Repository. It has been accepted for inclusion in The John Marshall Journal of Information Technology & Privacy Law by an authorized administrator of UIC Law Open Access Repository. For more information, please contact [email protected]. THE REGULATION OF INTERNET ENCRYPTION TECHNOLOGIES: SEPARATING THE WHEAT FROM THE CHAFF by KURT M. SAUNDERSt "His winnowing fork is in his hand ... gathering his wheat.., and burning up the chaff .... ." I. INTRODUCTION Federal efforts to strictly regulate the export of strong digital en- cryption continue to be outpaced by the realities of technological innova- tion and diffusion. The widespread use of computers and networks to facilitate personal communications and commercial transactions 2 has moved the need for strong encryption technology to the forefront. Cryp- tography has a long history as a tool for protecting the secrecy of commu- nications, most typically in the context of military operations. 3 For individuals and businesses, however, its relevance and utility as a means for ensuring security has been underscored with the advent of the infor- mation age. In an effort to stem growing concerns about the integrity and confi- dentiality of electronic proprietary data and communications, and in or- der to prevent theft and industrial espionage, many businesses are turning to robust encryption technologies to secure such information while in storage or in transmission. Likewise, many individuals increas- t Assistant Professor of Business Law, California State University, Northridge. The author wishes to thank Professor Mike Closen and the editors of The John Marshall Jour- nal of Computer & Information Law for the opportunity to be part of this symposium. 1. Matthew 3:12 (King James). 2. Recent estimates as to the size and projected growth of the digital economy are summarized in U.S. Gov'T WORKING GROUP ON ELEC. COMMERCE ANN. REP. 1-2 (1998); see also United States Dept. of Commerce, The Emerging Digital Economy (visited Apr. 18, 1998) <http:ll www.ecommerce.gov/emerging.htm>. 3. For a concise history of cryptography, see Shireen J. Hebert, A Brief History of Cryptography (visited Nov. 11, 1998) <http://www.cybercrimes.net/Cryptography/Articles% 20on%2Cryptography/Briefl-istCrypt.html>. 946 JOURNAL OF COMPUTER & INFORMATION LAW [Vol. XVII ingly use encryption in their private communications to ensure their pri- 4 vacy and to prevent identity fraud. At the same time, however, the growing use of encryption has led to concerns on the part of federal law enforcement and national security authorities that these technologies will be employed for criminal and ter- rorist purposes. 5 Indeed, the government believes that the United States is highly vulnerable to attack electronically. To demonstrate this, the Defense Department recently hired a team of computer hackers to discover how far they could penetrate government and critical infra- structure systems, finding that they were able to get surprisingly far in just three months.6 Nevertheless, current federal restrictions on encryp- tion technologies may, in the long run, critically threaten individual pri- vacy7 and undermine the position of U.S. businesses in the international market for secure software and on-line commercial transactions.8 Indeed, the present encryption regulatory regime is a product of U.S. national security policy and law enforcement strategy. The government has sought to impede the development and diffusion of digital encryption technologies through the use of export controls. As a consequence, the export of cryptography was restricted under the Arms Export Control 4. Identity theft involves the illicit use of another person's identifying facts (e.g., name, birthdate, Social Security number, address, or telephone number) to perpetrate an economic fraud. The personal hardships of the victims and general economic consequences of this misconduct are discussed in The PreparedStatement of the Federal Trade Commis- sion on "Identity Theft" Before the Subcomm. On Technology, terrorism and Government Information of the Senate Comm. on the Judiciary, 105th Cong. (1998) (statement of David Medine, Ass'n. Dir. for Credit Practices, Bureau of Consumer Protection, Federal Trade Commission). The recently enacted Identity Theft and Assumption Deterrence Act, 18 U.S.C. § 1028(a), makes the theft of personal information with the intent to commit an unlawful act a federal crime with penalties of up to fifteen years of imprisonment and a maximum fine of $250,000. The enforcement scheme and likely impact of this statute are more fully considered in Kurt M. Saunders & Bruce Zucker, CounteractingIdentity Fraud in the Information Age: The Identity Theft and Assumption DeterrenceAct, 8 CORNELL J. L. & PUB. POL'Y 20 (1999). 5. See Impact of Encryption on Law Enforcement and Public Safety: HearingsBefore the Senate Comm. on Commerce, Science, and Transportation, 104th Cong. (1996) (state- ment of Louis J. Freeh, Dir., Federal Bureau of Investigation). See also Report of a Special Panel of the ACM U.S. Public Policy Committee (USACM), Codes, Keys and Conflicts: Is- sues in U.S. Crypto Policy, (visited Dec. 8, 1998) <http:// info.acm.org/REPORTS/ ACMCRYPTOSTUDY/_WEB/c-report. html>. 6. See Michael Stutz, No 'Right' to Crypto Export, WINED NEWS (visited Dec. 4, 1998) <www.wired.com/news/news/technology/story/ 14098.html>. 7. See infra text accompanying notes 77-79. 8. The policies of most other countries are more liberal than that of the United States. For a survey of the cryptography policies of over 200 nations and territories around the world, see Wayne Madsen et al., Cryptography and Liberty: An International Survey of Encryption Policy, 16 J. MARsHALL J. COMPUTER & INFO. L. 475 (1998). 1999] INTERNET ENCRYPTION TECHNOLOGIES Act.9 For a while, most encryption software was also categorized as a munition and its export regulated by the State Department.10 In Decem- ber of 1996, control over the export of encryption products was shifted to the purview of the Commerce Department, where they are presently reg- ulated as "encryption items."" Recently, however, Professor Ronald Rivest of the Massachusetts In- stitute of Technology developed a new method of securing the electronic transmission of data, known as chaffing and winnowing,1 2 that evades current federal regulation as an encryption item. The method uses elec- tronic authentication, rather than encryption, to provide security and maintain confidentiality. 13 Because message authentication codes used with this technology are not considered to be encryption, 14 the chaffing 5 and winnowing method may effectively sidestep existing controls.' This article uses Rivest's method as a point of departure for consid- ering the impracticality of U.S. regulatory policy as applied to digital en- cryption. As a prelude, I will outline the technology and then discuss the utility of cryptography and the legal framework used to regulate its use and export abroad. Next, I will examine the chaffing and winnowing method of authentication as a means of ensuring secure date transmis- sion that lies outside the reach of current encryption export controls. The article will then conclude with a critique of the government's ongo- ing attempts to regulate encryption and identify the risks that such ef- forts pose to individual privacy and the competitive position of U.S. businesses in the global marketplace. II. THE TECHNOLOGY OF DIGITAL CRYPTOGRAPHY The basic concept of digital encryption is simple: using a computer program, an encryption algorithm (a mathematical equation) converts a plaintext message and encodes it, using a key, 16 into apparently unintel- 9. Arms Export Control Act of 1976, Pub. L. No. 94-329, title II, § 212(a)(1), 90 Stat. 744 (1976) (codified at 22 U.S.C. § 2778 (1994)) (repealing the Mutual Security Act, ch. 937, 68 Stat. 832 (1954)). 10. See infra text accompanying note 31. 11. See infra text accompanying note 32. 12. Ronald L. Rivest, Chaffing and Winnowing: Confidentiality without Encryption (visited Nov. 11, 1998) <http://theory.lcs.mit.edu/ -rivest/chaffimg.txt> [hereinafter Rivest]. 13. See infra text accompanying notes 61-63. 14. See infra text accompanying note 35. 15. Charles Platt, Encryption, WIRED, July, 1998, at 76 ("Rivest's idea offers the best of both worlds: confidentiality and adherence to the law-while making a mockery of the lat- ter in the process."); Anne Eisenberg, Confidentially Yours, SCIENTIFIC AMERICAN, June, 1998, at 21 ("[Rivest's] new technique to send confidential messages may finally scotch gov- ernment policies restricting the export of encryption technology."). 16. The length of a key is measured in bits, the digits "0" and "1" used to encode com- puter data. The greater the number of bits, the more secure is the key. 948 JOURNAL OF COMPUTER & INFORMATION LAW [Vol. XVII ligible ciphertext. 17 Consider a simple example where the message "Ex- celsior!" is encrypted using a key that shifts the letters of each word by one: EXCELSIOR! FYDFMTJPS! The level of difficulty a third party would have in "breaking the code" determines the strength of a key and the robustness of the encryption system. Typically, the longer the mathematical algorithm employed, the more secure the encryption system.