Encryption: Protecting the Web

How do we ensure the privacy of our electronic data? How can we prevent hackers from accessing our homes and offices? How will America prevent terrorists from acquiring defense secrets?

Federal officials are working to answer these questions. Electronic communications have been a national security concern ever since private citizens, businesses and the government began relying heavily on computers.

"The Information Age has brought us the Internet, an interconnected global economy and the promise of connecting us all to the same vast world of knowledge, but with that exciting promise comes new challenges," Vice President Al Gore said at the White House Sept. 16 while announcing a new federal encryption policy. He said the policy dramatically increases privacy and security for families and businesses while protecting national security.

Encryption involves scrambling access codes to computer programs and systems to prevent intruders from entering and taking control. Federal officials and private industry are developing strong encryption products that enable law-abiding citizens to protect the privacy of their communications and electronically stored data. At the same time, the programs don't affect law enforcement officials' ability to ensure public safety when criminals use these products.

"We must ensure that the sensitive financial and business transactions that now cruise along the information superhighway are 100 percent safe in cyberspace," Gore said. "We must ensure that new technology does not mean new and sophisticated criminal and terrorist activity which leaves law enforcement outmatched. We can't allow that to happen.

"We will give law enforcement the ability to fight 21st century crimes with 21st century technology, so our families and businesses are safe, but on-line outlaws are not," Gore said.

Deputy Defense Secretary John Hamre hailed the new policy as an "enormous step forward." He said encryption and computer security programs are vital to the Defense Department. Hackers during the last year successfully accessed several defense systems, he said, and such intrusions will undoubtedly increase in the future.

The new policy covers four main areas:

• American companies will be able to use encryption programs of unlimited strength when communicating between most countries.
• Health, medical and insurance companies will be able to use far stronger electronic protection for personal records and information.
• Law enforcement will still have access to crime-related information under strict and appropriate legal procedures. A federal technical support center will provide federal, state and local law enforcement officials with the resources and technical capabilities needed to fulfill investigative responsibilities.
• The federal government will maintain full ability to fight terrorism and monitor terrorist activity that poses a grave danger to Americans.

Hamre said the military needs encryption because it sends 95 percent of its communications over public networks -- public telephone lines and switches, computers and so forth.

Under a proposed new DoD web site policy, DoD plans to review its 1,000 or so Web sites to remove such sensitive information as building and installation plans, operations programs, research and development objectives and personnel data. A Pentagon spokesman said the goal is to provide site visitors useful information without going so far as to aid potential malefactors.

Web security is also a top Defense Department priority because of DoD's electronic commerce activities, Hamre said. "We're the largest company in the world," he noted. "Every month we write about 10 million paychecks. We write about 800,000 travel vouchers. One of our finance centers disburses $45 million an hour. We are a major, major force in business. Electronic commerce is essential for us."

Another department objective is to protect the national infrastructure -- power, water and transportation systems, and others. Homeland defense is also an emerging national security challenge, Hamre said. "We must have strong encryption in order to do that, because most of this infrastructure now is being managed through distributed, computer-based management systems.

The new federal policy will also help the Defense Department and law enforcement officials battle terrorism, Hamre said. "Terrorists and rogue nations are increasingly using [encryption] tools to communicate with each other and to lay their plans. We must have the ability to deal with that."