14 December 1998

Ottawa to regulate software exports; Permits required for more powerful technology
By Robert Cribb
Toronto Star Business Reporter

This article was excerpted from "The Toronto Star" issue of 8 December 1998.

Canada has joined 33 other countries around the world in imposing new export controls on computer encryption software designed to protect consumers' anonymity online. At a meeting in Vienna on Thursday, the countries belonging to the Wassenaar Arrangement -- including Canada, Japan and Britain — agreed to limit exports of the most powerful data scrambling technologies, said Andre LeBlanc, a spokesperson for the ... Department of Foreign Affairs and International Trade. The Wassenaar pact was originally an agreement to limit arms exports.

For the first time, Canadian companies will have to acquire government-issued permits to export mass market software with more than 64 bits of encryption. Encryption, the process of converting data into code, is used to secure electronic transmission of information stored on computer systems and networks such as the Internet. The most powerful and most commercially popular software has 128-bit encryption.

The restrictions have angered some developers who want no limits on their ability to sell programs to protect such things as health information, electronic commerce transactions and the identity of children online.

``It's not good for Canada and it's not good four our industry,'' said Austin Hill, president of Montreal-based Zero-Knowledge Systems, which is about to release a sophisticated fee-based service called Freedom which will allow Net users to mask their identity online. ``It inhibits our ability to become leaders. And, it will lead to the export of jobs instead of software.''

Hill said that companies like his may choose to avoid export restrictions by relocating to Caribbean countries, for example, where encryption levels are not regulated. The United States, which has been pushing the international community to adopt its 64-bit encryption export restrictions, is treating the international agreement as a significant victory.

The U.S. Commerce Department issued a statement [on 3 December] welcoming the decision ``to modernize and improve multilateral encryption export controls.'' The export of stronger 128-bit encryption is seen as a security risk by some. The U.S. government has attempted to keep the technology out of the hands of international criminals and terrorists who could use it to conduct money laundering operations or transmit pornography.

While Canada will place limitations on software exports, permits will be issued quickly and fairly, said an Industry Canada spokesperson who asked not to be named. And that assurance has calmed some in the encryption industry such as Brian O'Higgins, chief technology officer for Ottawa-based Entrust Technologies Ltd. ``I'm disappointed the U.S. forced this change on all the countries but we believe (the federal government) will co-operate with us,'' said O'Higgins, whose company makes encryption software for Internet banking and secure credit card transactions.