• Recommend:
• 0 Comments

PGP 5 Export: The Low-Tech Loophole

A man in Norway has confounded the United States government by receiving Pretty Good Privacy source code on paper and then posting the encryption software to an international Web site.

By Danny Meisler, PCWorld   

Using the ingenious but low-tech medium of source code printed on paper, a programmer has made the new PGP version 5 freely available for download from a Web site based in Oslo, Norway. Stale Schumacher, using the University of Oslo%squots server and enlisting dozens of volunteers, scanned in the source code and posted a platform-independent version of PGP. The Windows 95 and Mac versions will be completed soon.

There is no piracy involved here--PGP has made a practice of making its code public. %dquotWe publish our code in book form for peer review,%dquot explains Bob Kohn, vice president and general counsel of PGP, %dquotto give other cryptographers access and to ensure that there are no back doors (to breaking the code).%dquot

Schumacher had a copy of the code sent to him in Oslo. He then scanned the code in and posted it on his %dquotInternational PGP Home Page%dquot Web site. Although there are export controls on encryption software--a source of angry debate in Washington these days--they don%squott apply to printed material.

The Justice Department has lobbied intensely for strong encryption export controls, arguing that key management by the government is necessary to prevent terrorists and drug traffickers from using encryption. But the department had no comment on the recent PGP case.

Both Schumacher and Kohn said PGP had nothing to do with giving Schumacher the code or with the site--but PGP is not complaining. %dquotWidespread deployment of software is not a sign of success, but a prerequisite,%dquot Kohn said. He added that PGP will not sue as long as the program is not used for commercial purposes.

%dquotWith 10 million copies in use around the world,%dquot Kohn said, %dquotit will only enable us to make more money in the future.%dquot He said PGP would try to sell key servers to users that get PGP off the Web. These servers help manage the keys that allow encryption to work.

Although PGP claims to have no involvement, Schumacher said he also has posted a copy of the PGP version 5 user manual after receiving assurances that no legal action would be taken against him.

Schumacher said in an e-mail interview that he expected no trouble from the Norwegian government. %dquotBut it will be interesting to see if I%squotm allowed to enter the U.S. next time I go there.%dquot