Policing Internet might be impossible
Government access would be costly, study says

By Marcia Stepanek
Examiner Washington Bureau

WASHINGTON A Clinton administration plan to let law enforcement
authorities eavesdrop on private Internet use from personal email to
sensitive banking, medical, legal and business data would be
"extraordinarily costly, risky and probably wouldn't work as intended,"
according to a report issued Wednesday.

In the 19page report, 11 computer security experts said the technology
needed to enable secret government access to the Internet would require
the creation of a new global law enforcement system "mindboggling in
size and scale, and extraordinarily expensive and difficult, if not
impossible, to design, implement and manage."

The target of the report is the Clinton administration proposal to give
government law enforcement agencies access to the secret codes, or
encryption, being used by increasing numbers of Americans to

keep their daytoday Internet transmissions private. The administration
wants the government to have access to decoding keys that would crack the
codes and enable government officials to read the decoded messages.

Encryption was once the sole _ domain of the military and diplomatic
corps. Now everything from banking systems and stock markets to air
traffic control systems and schools use some form of encryption to
safeguard their corn puterized information.

The growing use of electronic data "leaves our society increasingly
vulnerable to curious neighbors industrial spies, rogue nations, or
ganized crime and terrorist organizations," the report issued Wednesday
said.

Cheap, easytouse, virtually unbreakable encryption is emerging as a
popular way to protect privacy on the Internet the global network of
computer networks with an estimated 60 million users.

But because cryptography shields the lawabiding and the lawless
equally, law enforcement and intelligence agencies say their efforts to
protect the public would be paralyzed if ultrastrong codes become widely
available.

To fight back, the Clinton administration wants the FBI and other
government agencies to be able to override private codes by using the
"key escrow" approach.

Two parties using normal cryptography can communicate in privacy, with
both of them using a digital key to encrypt and decipher the conversation
or message. A potential eavesdropper lacks that key and thus cannot crack
the code.

The Clinton administration wants to be able to have access to everyone's
code keys. To achieve that, the administration wants encryption users to
turn over spare code keys to a third party, such as a bank or a private
key collection firm. These keys would be available to federal officials
only under a set of rules administered by the U.S. Commerce Department.

But that's precisely what rankles the government's critics on the
issue.

Aside from their concerns about protecting privacy, the authors of the
report said the government's proposed sparekey system "would be nearly
impossible to build, far beyond the experience and current competency of
the field."

Authors of the report were Matt Blaze, chief security research sci

entist for AT&T Research; Peter Neumann, the principal scientist in the
Computer Science Lab at Stanford Research Institute; Josh Benaloh, chief
cryptographer for Microsoft Corp.; Ronald Rivest, associate director of
MIT's Laboratory for Computer Science; Jeffrey Schiller, computer
network manager at MIT; Bruce Schneier, president of Counterpane System,
a Minneapolisbased

firm specializing in cryptography and computer security, and Harold
Abelson, a professor of electrical engineering and computer science at
MIT.