The US State Department has given approval to Netscape to distribute its 128-bit encryption software over the Internet -- but only to American citizens, the company has announced. In order to verify whether users attempting to download the software are American citizens, Netscape will check the country domain name and Internet address of each individual, as well as employ a database to track names and addresses of downloaders. In addition, Netscape will require all individuals to sign online affidavits affirming that they are legitimate American citizens residing in the US, says a Netscape spokesperson.
The 128-bit encryption software, which it is illegal to export to foreign countries under US law, is based on technology from RSA Data Security. It requires vastly more computing power to break than does Netscape's 40- bit encryption, the legal limit imposed by the US government for export.
The US fears that foreign terrorists and criminals could use 128-bit encryption to threaten national security. But most US companies, including Netscape, support a lifting of the export ban, claiming that it hurts US competition in the global market where other countries are freely developing and selling such software. "We're not claiming everyone who downloads the software is a US citizen. Whether people mess with the process of downloading is not our concern, it's the State Department's," says Jeff Treuhaft, Netscape's director of security.
"This was a big event on the 'net, but it doesn't mean we'll let up on our efforts to try to change the laws that exist," he says. Up until now, Netscape customers in the US who wanted to use 128-bit encryption had to order the product by mail and could only download the 40-bit version from Netscape's Web site at http://www.netscape.com.
Currently, a US cabinet committee is reviewing an encryption proposal that would ease export restrictions but would require a third party to keep a copy of a key to encrypted data. That key could be used by law enforcement officials to investigate suspicious activity if necessary. The Clinton Administration is also considering allowing unregulated export of 128-bit and higher encryption software in certain industries and may transfer export licensing of encryption software from the State Department, which treats such software as munitions, to the Commerce Department.