[107963] in Cypherpunks
Export ban kills Nexus' WHO deal (fwd)
daemon@ATHENA.MIT.EDU (Max Inux)
Sat Jan 30 01:34:57 1999
Date: Sat, 30 Jan 1999 01:23:42 -0500
From: Max Inux <maxinux@openpgp.net>
To: Multiple recipients of list <cypherpunks@openpgp.net>
Reply-To: Max Inux <maxinux@openpgp.net>
Doesn't need an introduction.
Max <maxinux@openpgp.net> New PGP Keys Available
If crypto is outlawed only outlaws will have crypto.
1960 Ford Falcon Tudor Daily Driver, Dont you just wish you had one?
SillyConValleyNEWS - http://www.sillyconvalley.com
THE AGE
Export ban kills Nexus' WHO deal
By SUELETTE DREYFUS
THE directors of Sydney e-commerce software firm Nexus Solutions
Pty Ltd prepared to pop the champagne corks when they landed a
major deal to sell encryption products to the World Health
Organisation (WHO). They planned to celebrate the company's biggest
financial deal of the year and the fact that its strong crypto
product, NTrust, would be protecting people's private medical
records for a WHO worldwide database project.
Then everything fell apart.
According to Nexus managing director Therese Bateman, the
Department of Defences Signals Directorate (DSD) told them verbally
that it would refuse to grant an export permit for their 448-bit
encryption product.
Former Nexus software development manager Peter Pavlovic said,
``When we spoke to the DSD, they said there was absolutely no way
we were going to be able to export 448-bit encryption.''
Within weeks, the deal was dead.
``It shelved our plans for expansion that year,'' he said.
It was very frustrating dealing with DSD, because the agency only
seemed to discuss things verbally, according to Pavlovic. DSD put
very little in writing, he said.
The export of strong cryptography, which scrambles data to prevent
interception, is banned in Australia without Government
approval. Strong encryption programs prevent anyone - criminals and
Governments - from eavesdropping on data and voice networks or
peering into hard drives.
The following year (1997), Bateman said, the company experienced
deja vu, when the DSD rejected another inquiry for a strong
crypto-product export permit. This one was for a sizeable
Australian company that wanted to secure data in its Philippines
office.
The Government only permitted a weak, 40-bit version of NTrust, to
be exported but, according to Bateman, this was almost pointless
since the whole purpose of buying an encryption product was keep
data secure.
The knock-back cost Nexus a larger deal; the client scrapped its
plans to roll out NTrust across all its international subsidiaries.
It was outrageous that an Australian company was barred from using
an Australian product to protect its own data overseas, she said.
Nexus is about to go through the process again, helping a new
client apply for an export permit. But Bateman is not optimistic,
despite the fact that the client is an American Government
organisation. Without the permit, the deal will collapse.
She said DSD was doing the bidding of the US Government, which has
persistently pushed other countries to adopt its own strict export
regulations, rather than looking after Australia business.
``The US Government says: Jump! And the Australian Government says:
How high?" Ms Bateman said. This attitude is stopping legitimate
businesses. She said she knew of other companies that had had
similar problems dealing with DSD.
Australian companies had no certainty because their export
businesses were in the hands of the bureaucrats whose decisions
were not subject to normal Government systems of accountability
such as FoI, she said.
The Department of Defence declined to comment on the matter, saying
it did not discuss individual cases.
According to the department, only the minister can refuse to grant
a permit. There is no statutory right of administrative appeal
against that decision.
Any dissatisfied company can request a review of the
decision. Also, if they wished, like any Australian citizen they
can write to their local MPs, a DoD spokesman said.
Although the DSD was not required to explain its assessments, it
tried to build a strong relationship with Australian companies that
intended to sell their products overseas, he said.
He said no export applications for strong crypto products (128-bit
or higher) were denied in 1998. However, he refused to answer
questions about how many strong encryption products had been
approved for export in the past four years.
No applications approved for 128-bit or higher were for key-escrow
systems, he said.
The majority of companies which applied for export permits made
products using 56-bit keys, he said.
Software developers needed to get their own export permits and
could not piggy-back on the export permits of toolkit product
companies (such as RSA). Export to all countries, including New
Zealand, required a permit for strong crypto-products, he said.
Government approval is also needed for software with an interface
specially designed for inserting cryptography, even if the program
didn't contain any cryptography. There was no fee for the export
applications.
Most exported encryption products from Australia were used to
protect financial transactions, he said.
The majority of applications were assessed within 20 days, he
said. But he would not reveal how many applications took longer.
--
In compliance with Title 17 U.S.C. section 107,
this material is distributed free without profit
or payment for non-profit research and educational
purposes only.
______________________________________________________________________
To unsubscribe, write to SillyConValleyCOM-unsubscribe@listbot.com
Start Your Own FREE Email List at http://www.listbot.com/
