EPIC Releases Survey of Encryption Policies Worldwide

(April 3, 2000) The EPIC released its third annual international study of encryption policies on April 3. It found that e-commerce and privacy protection concerns have led governments to relax regulations.

The report, titled Cryptography and Liberty 2000: An International Survey of Encryption Policy, was written by the Electronic Privacy Information Center, and released at an event in Washington DC on Monday afternoon, April 3.

The report concluded that:

"The international relaxation of regulations concerning encryption has largely succeeded. The rise of electronic commerce and the recognition of the need to protect privacy and increase the security of the Internet has resulted in the development of policies that favor the spread of strong encryption worldwide. Governments attempting to develop e-commerce are recognizing that encryption is an essential tool for transactions, and are reversing decades old restrictions based on national security concerns. An increasing number of countries have developed policies, based on the OECD guidelines."

The report rated countries on a three point scale. A "Green" designation signified that the country imposed few controls on encryption in the country. A "Yellow" designation signified that the country had significant domestic controls such as requirements for lawful access, excessive export or import controls in law or have proposed new domestic cryptography controls. A "Red" designation denotes countries that have instituted sweeping controls on cryptography, including domestic use controls. However, many countries were rated as borderline, and given ratings of Green/Yellow or Yellow/Red.

The United States reflected the trend. EPIC rated the U.S. as Yellow/Red in 1998, Yellow in 1999, and Green/Yellow in 2000.

"The United States Government has long been the leader in efforts to limit the development and dissemination of encryption," the report noted. However, "In the past several years, as electronic commerce has become an important aspect of the American economy, the US government has begun backing away from these efforts ..."

The report credited the U.S. for the announcement in January of 2000 of new regulations to relax encryption export controls.

One country which has not followed the trend towards liberalization is the United Kingdom. EPIC rated it Yellow/Green in 1999, and Yellow in 2000.

The report elaborated that the "UK has been the strongest supporter of the US’s efforts to promote limitations on encryption. Since 1996, the government (under both the Conservative and Labour parties) has proposed a series of measures promoting key escrow systems and mandatory escrowing of cryptographic keys by certification authorities. So far, these measures have not been enacted due to public and industry opposition".

The report did find that some countries still have sweeping controls. "There are a small number of countries where strong domestic controls on the use of cryptography exist. These are mostly countries where human rights command little respect, most notably Russia and China. Many of these countries place strict controls on the Internet, satellite dishes and other new communications devices."

Most eastern European states received Green or Green/Yellow ratings. Most offshore and asset protection jurisdictions received Green ratings.

This report was written by Wayne Madsen and David Banisar, Senior Fellows at the EPIC.