Another US company is challenging government policy on the export of encryption technology, and this one is a heavyweight: Network Associates says that a Dutch subsidiary, cnlab Software, will sell its 128-bit Pretty Good Privacy overseas.
The Commerce Department holds a tight leash on the export of such powerful computer-security software. The department has approved more than a score of high-strength crypto products for sale overseas, but generally on the condition that the companies involved promise to build a third-party data recovery mechanism into the software.
Network Associates, though, like other companies before it, thinks that it can legally sidestep the American regulators.
"Network Associates' PGP encryption products for international markets will be fully developed and compiled in Europe by cnlab Software, based upon widely available published source code that was legally exported from the United States," the company said at the CeBIT '98 gathering in Hannover, Germany.
The company added pointedly that "no United States technical assistance has been, or will be provided to cnlab Software or to international offices of Network Associates, ensuring full compliance with United States export laws."
Under US regulations, printed copies of crypto programs' source code are legal to send overseas. Nonetheless, William Reinsch, undersecretary for export administration, promised close scrutiny of Network Associates' manuever.
"The question of whether or not this product is based on legal or illegal export of US technology is a question to be investigated," Reinsch told The New York Times. "If the government determines that it was illegal, then we'll take appropriate action."
While significant, Network Associates is hardly the only company to sneak around US encryption export laws, nor is this the first instance of PGP technology making its way overseas.
