Internet & Intranet Security Management - Risks & Solutions

Everyone has heard the phrase ''if you're not doing anything wrong, you shouldn't have anything to
hide". That's really Big Brother's DoubleSpeak for "if you're hiding something, then we can't watch
you and protect everybody from everything". Privacy also includes being left alone - freedom from
interference. Cryptography can offer a dimension of both privacy and secrecy. How it is used will
dictate whether the USER is good or bad, not whether cryptography is good or bad.
Conclusions
The use of cryptography offers the opportunity to have real privacy of information and
communications. It can be used to protect stored information (ideal for notebook computers and for
files stored on any computer) as well as live or Internet communications. It can be used to protect
business transactions that are communicated over the Internet (including the protection of credit card
information). But only if it is available and only if it is "strong encryption".
The First Amendment to the United States Constitution guarantees the right to communicate without
government interference: "Congress shall make no law respecting an establishment of religion, or
prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the
right of the people peaceably to assemble, and to petition the government for a redress of
grievances." Encryption software and hardware simply enables one to speak in a language unknown
to the government. The Constitution gives the government no blanket power to demand that we
provide a translation. Speech in the dialect of IDEA should be free around the world.
The important issue to remember is that there is a continuous assault on our privacy and that new
techniques are being developed all the time. Technology using strong cryptographic algorithms
properly implemented can provide real privacy - as long as we are allowed to use them.
Legislation
In the bad old days of ITAR, export of cryptographic products was treated the same way as munitions
and there were very specific restrictions imposed. In the first instance the relative strength of the
algorithm as measured by only one of its attributes was the deciding factor. Keys of forty bits or less
were permitted to be exported, those greater than forty bits were not. With modern computing power
this level of security is trivial to defeat and arguments came from all quarters to relax this deciding
factor. Some movements were made and restrictions were relaxed to the point where products based
on fifty-six bit, sixty-four bit and one hundred and twenty-eight bit algorithms could be exported but
only under license and only to approved parties.
There have been several Bills proposed, however, the two that appear to have some support are
languishing in Congress. These would change the export regulations currently in force (sort of). The