US eases encryption control

In what is being described as an improvement which doesn't go far enough, the Clinton administration has partially relaxed export controls on secure encryption technology.

Faced with criticism that powerful encryption is necessary for secure e-commerce, the White House announced three areas where restrictions are to be relaxed.

Firstly, encryption software using up to 56-bit keys may be exported from the US to all but a handful of what it considers "rogue" nations, without so-called key-recovery schemes whereby police would have access to the digital keys which unscramble encrypted messages. Previously 40-bit key software had no restrictions, while software using up to 56-bit keys required such key recovery.

Secondly, the existing relief whereby unlimited-strength encryption software could be exported to non-US financial institutions is extended to insurance companies, handlers of medical records, and companies using transaction software for ecommerce.

The final area of relaxation allows US companies to export strong encryption software to their own subsidiaries, provided they do not share it with non-US companies. It excepted subsidiaries in seven countries: Cuba, Libya, Iran, Iraq, North Korea, Sudan and Syria.

While many pro-encryption groups welcomed the changes, several also criticised them for not going far enough. Some of the changes were promised up to two years ago, prompting Mr Barry Steinhardt, president of the Electronic Frontier Foundation, to accuse the administration of throwing industry a bone at a time when it needs friends.

Analysts say the moves are a response to US companies which are losing out to foreign high-security encryption companies, while they ignore individuals' needs for secure encryption.

US Vice-President Mr Al Gore described the move as "an important new action that will protect our national security and our safety, and advance our economic interests and safeguard our basic rights and values in this new information age". The new policy will come into effect when written in to Department of Commerce regulations, and will be reviewed in a year's time.