Crypto firm circumvents rules

Skirting U.S. encryption export regulations, Network Associates (NETA) said its Dutch subsidiary is selling a 128-bit version of its Pretty Good Privacy encryption software outside the United States.

Network Associates, formerly McAfee, hired Swiss firm Cnlab Software to create an international version of its PGP strong crypto product, a move designed to get around U.S. encryption export rules requiring Commerce Department approval before selling software that uses strong encryption algorithms to overseas markets.

Network Associates said it has provided no technical assistance to Cnlab Software. Source code for PGP was published on the Internet several years ago.

More coverage on CNET Radio

"We believe we are the first and only U.S. company to operate in this manner," said Peter Watkins, Network Associates' vice president. "In many respects, this is not radically different from what anyone else could have done."

Richard Hornstein, Network Associates chief counsel, noted that overseas developers have created and marketed cloned versions of PGP with strong encryption. But he said Network Associates now holds PGP's copyrights and may pursue companies that are marketing PGP clones.

"We have concerns that [companies] internationally are selling PGP products they don't own or are violating copyrights for," he said. "In the second quarter, we will start to make contact with various Web sites internationally to make sure that the PGP brand name will not be violated."

But Network Associates, which bought encryption pioneer PGP last year, is not the first to think about a similar end run around U.S. regulations. RSA Data Security had planned to fund a group in China for a similar effort but never carried out the plan.

In May 1997, Sun Microsystems (SUNW) announced similar plans, working with Russian firm Elvis-Plus, which was working from Sun's published specification called Simple Key management for Internet Protocols or SKIP.

But Sun's effort has stalled as the Commerce Department investigates how closely Sun worked with Elvis-Plus in its efforts. Sun owns a 10 percent interest in the firm, which may complicate the issue.

Sun complied with a request for its SKIP source code from the National Security Agency, a top spy organization that, along with the FBI, leads government opposition to exporting strong encryption. The NSA wants to compare Sun's code to that of Elvis-Plus, but Sun said last week that had not heard back from the government agency.

Network Associates said it began shipping Cnlab's encryption software today and will market it in the United Kingdom, Germany, Australia, Japan, and other countries that do not restrict encryption imports.

Network Associates said it had met with Commerce Department officials several times in recent months and that no objections were raised to Network Associates' plan.

But the Commerce Department is signaling that it is unhappy with Network Associates' plan.

"I'm disappointed with it," William Reinsch, undersecretary of Commerce for export administration, told CNET Radio. "We are trying to promote key recovery products in the marketplace. We are trying to get our friends and allies, particularly in Europe, to pursue polices similar to ours. Every time someone like this comes along, it makes it more difficult."

"I'm unfortunately very surprised," Hornstein said of the Commerce Department's comments, noting that his company had had conversations with Commerce for months and had informed officials this week of the planned announcement.

Reinsch disagreed about the nature of Commerce's understanding of Network Associates' plan.

"They were kind enough to send me a press release about their intentions along with a proposed comment for me to make," he said. "My people tell me we heard about this a day or so ago, but I don't think it's been quite as long a consultation as they [Network Associates] think it has been."

"We have been very up front with them. We asked for their proposed changes to the structure, and we heard back no comments," Hornstein said.

Network Associates's stock fell more than 7 percent in trading today to end at 64-1/2, down 4-15/16 from yesterday's close of 69-7/16.