SPEAKING NOTES

FOR THE HONOURABLE JOHN MANLEY
MINISTER OF INDUSTRY
TO THE NATIONAL PRESS CLUB

CANADA'S CRYPTOGRAPHY POLICY

OTTAWA
OCTOBER 1, 1998

Check Against Delivery
Date: 10/01/98

INTRODUCTION

Thank you for your kind introduction, and thank you, ladies and gentlemen, for this opportunity to talk to you this morning about the next step in the Government of Canada's Electronic Commerce Strategy - our policy on cryptography.

As some of you are no doubt aware, this morning's announcement is one in a series we've made over the past couple of weeks. On September 22nd, at the Softworld Convention in St. John's, the Prime Minister announced the Canadian Electronic Commerce Strategy. Two days ago, my colleague Herb Dhaliwal and I met the media to outline our response to the Advisory Committee report on Electronic Commerce and Canada's Tax Administration.

Later today, in the House of Commons, I will introduce legislation to protect personal data in the private sector. The legislation will also enable the use of electronic signatures and documents in federal government transactions and service delivery.

And next Wednesday, Ministers from all 29 member countries of the Organization for Economic Development and Cooperation (OECD), as well as 12 observer countries, will gather here in Ottawa for a two day conference on electronic commerce. We are hoping to reach a consensus on some key issues and thereby begin to lay some of the groundwork for an international system of electronic commerce.

ELECTRONIC COMMERCE

Electronic commerce is at the leading edge of technological forces that are shaping the world economy. These forces are related and mutually reinforcing: improvements in information and communications technologies, globalization of markets and investment, and a shift to an economy based on knowledge.

Electronic commerce has the potential to transform the way we work, the way we shop and the way we interact with government. We view the move to electronic commerce as inevitable.

Estimates vary widely on the speed with which electronic commerce is growing, but most observers predict that it will become a common way to do business within the next ten years.

A conservative estimate for worldwide electronic commerce is US$400 billion by 2002. Estimates such as these understate its impact on other sectors of the economy. The smart use of these technologies and services can cut costs, provide channels to reach new markets, and reduce the challenges of size and location for small and medium sized businesses.

But before we can capitalize on the opportunities of electronic commerce, we must address significant challenges. If we move fast, if we remove the uncertainties holding back electronic commerce on open networks, we can create a global centre of excellence for electronic commerce in Canada. In short, with the right framework, electronic commerce has phenomenal growth prospects.

ELECTRONIC COMMERCE STRATEGY

The Canadian Electronic Commerce Strategy addresses four broad areas.

The first is building trust in the digital economy. As it stands, less than one in five North America Internet users are willing to make purchases on-line. This reflects overriding concerns about the security of transactions, privacy, and consumer redress.

Businesses are also concerned about security and the confidentiality of corporate information, consistency and predictability of rules, and the reliability of the information infrastructure. Security, privacy and consumer protection are all required to instill trust in electronic commerce, for both business and consumers. The cryptography policy is designed to increase security, and I will return to this in a minute.

The second is clarification of marketplace rules. A body of rules governing the paper-based marketplace has evolved over time. We need to examine and update these rules to adapt them to meet future requirements. The objective is to create a level playing field where the rules are predictable and consistent for all kinds of commerce.

A third thrust is to strengthen the information infrastructure. The existing Internet networks must be able to support the exponential growth of electronic commerce. The Electronic Commerce Strategy encourages increased capacity through vigorous competition and open technical standards.

The fourth area we are addressing is realizing the opportunities. Electronic commerce is part of a broader process of economic, social and cultural change. It's part of an emerging, global, knowledge-based economy. The Electronic Commerce Strategy proposes ways we can ensure that jobs and growth created by electronic commerce will be distributed as widely as possible among citizens, consumers and business.

Our strategy is being implemented through partnerships between the private and public sectors. It is consumer demand, and business innovation and investment, that will drive the development of global electronic commerce.

Governments will support industry and consumers in the development and use of electronic commerce in three key ways:

• First, in providing the right domestic policy framework;
• Second, working with other governments and international organizations to establish a truly global regime;
• Third, acting as model users of electronic commerce technologies and services.

CRYPTOGRAPHY

This is the broad outline of our Electronic Commerce Strategy. Now let me narrow the focus to the issue of cryptography.

Cryptography is the transformation of data by a mathematical formula, so that it is not intelligible if you don't have the right formula or key. Cryptographic technologies provide a foundation for establishing trust in electronic commerce because they safeguard information, protect communications, and authenticate parties to transactions.

CURRENT POLICY

Canada does not restrict or control the import, production or use of any strength of cryptographic products within Canada. We are a member of the 33-nation Wassenaar Arrangement under which we are obliged to control the export of hardware and some software cryptography products, as well as products that use cryptography.

Let me emphasize that, although there have been no restrictions on the use of cryptography in Canada, the export restrictions that have been in place have had a major impact on a very dynamic industry that is emerging in Canada.

Canada's export control regulations are designed to prevent the movement of certain goods that may not be in the strategic interest of Canada or its allies. However, while we continue to support and work within this multilateral arena, we also want to ensure that products which are not considered to be controversial, such as cryptographic products used for electronic signatures, can be exported with little or no restrictions.

CONSULTATIONS/CONSIDERATIONS

In developing our cryptography policy, we consulted widely to seek solutions to some very complex issues. Our deliberations on our policy options involved twelve federal departments. A consultation paper was released last February, which elicited over 150 responses. And bilateral and round table discussions were held with industry, users, privacy advocates, and law enforcement and national security agencies. We pursued a very transparent policy process marked by the traditional Canadian hallmarks of openness and consensus.

We learned that business users want to protect their network transactions. They need to protect intellectual property and corporate databases. They want strong, effective security, and something that works globally. They want the freedom to determine their own security solutions - not have them imposed by government.

Consumers want affordable and easy-to-use software. They want freedom of choice among products and suppliers as they now have. They don't want a government-imposed solution.

Civil rights and privacy advocates don't want key escrow or any mandatory, government-imposed solution. They see encryption as a valuable tool for enhancing privacy, and want assurances that their signature keys will not be used by industry to create electronic profiles linking their identity to all their transactions.

Law enforcement and national security agencies want continued, lawful and timely access to the plain text of communications and stored data.

CRYPTOGRAPHY INDUSTRY

Another very important voice in this debate is that of the Canadian cryptography industry.

A conservative estimate is that the core of Canada's cryptography industry consists of roughly 20 companies with an estimated net worth of $1.5 billion. They had sales last year of approximately $300 million. Their share of the global market for cryptography products and services is growing. Canada is a world leader in cryptography. But perhaps most importantly, our expertise lies in the very niches of the industry that are growing fastest, including Public Key Infrastructure software - or PKI. Earlier this year, I was on hand for the opening of the new corporate headquarters of Entrust Technologies, which commands a large share of the world market for PKI technologies.

We do not restrict Canadian exports of strong encryption to the U.S. Not surprisingly, the North American market accounted for over 95 per cent of Canadian cryptography industry revenues in 1997. But market opportunities are growing abroad. Canadian export sales outside of North America grew to approximately 20 per cent of total revenues for the three months ending March 1998.

The cryptography industry can only grow if it has the freedom to export. They want to be first into foreign markets for these new technologies. They want to be able to export the stronger products that the market is demanding, such as 128 bit encryption. They need to tap as many of these overseas markets as possible to keep their highly-paid, high-qualified jobs here in Canada.

THE POLICY

After taking all points of view into consideration, I am pleased to announce today the Government of Canada's cryptography policy:

• First, the Government affirms the freedom of Canadians to develop, import and use whatever cryptography products they wish. We want Canadian businesses and citizens to have access to a wide range of products and services, including the very strongest forms of encryption.

• Second, the Government will not implement mandatory key recovery requirements or licensing regimes for certification authorities or trusted third parties.

• Third, we will encourage industry to establish responsible practices, such as key recovery techniques for stored data and industry-led accreditation of private sector certification authorities. This will build consumer and business confidence in these products and services, and assure business continuity in case of loss or corruption of keys. We will use government procurement to encourage commercial key back-up - it makes sense for us as government using these products, so we know it makes good business sense.

• Fourth, we will continue to implement cryptography export controls within our commitments to the Wassenaar Arrangement; however, we will ensure that Canadian cryptography manufacturers face a level playing field - our controls will take into account the practices of other countries so that Canadian manufactures will not be at a competitive disadvantage.

• Fifth, we will streamline the export permit process and make it more transparent. For many products, users or destinations, after a "one time review" of the product, general or multi-destination, multiuser permits will be issued. Our intention is to simplify and speed up decision making, and significantly reduce the "regulatory drag" on exporters. We do not want them to be late to market.

• Finally, the Government proposes to make legislative amendments which will protect consumers' privacy and will also give law enforcement agencies and national security agencies the legal framework they need to ensure public safety. This includes making it an offence to wrongfully disclose private encryption key information and to use cryptography to commit or hide evidence of a crime. We also need to make it clear that warrants and assistance orders also apply to situations where encryption is encountered - to obtain the decrypted material or decryption keys. Representatives of the Office of the Solicitor General are available today to answer questions on this component of the policy.

CONCLUSION

Ladies and gentlemen, I strongly believe that we have reached a consensus that is good for the Canadian economy.

Our policy supports electronic commerce in Canada and it provides tools for privacy protection that will help implement forthcoming legislation. It encourages the use of information technologies to protect business transactions, critical infrastructures and prevent economic espionage. It better positions Canadian manufacturers of cryptography and cryptography-related products and services to increase their sales and share in global markets. And it addresses the needs of law enforcement and national security agencies in their efforts to continue to ensure the safety of Canadians.

The policy underscores that Canada is open for electronic business. We are encouraging the widespread use of strong encryption, and growth of export markets for Canadian technologies. We want encryption technology suppliers to regard Canada as a preferred location for investment, product development and global marketing.

To conclude, let me emphasize that there will be no mandatory solutions imposed by government. The freedom of choice the private sector has enjoyed in the past will continue in the future.

In this way, we act on our commitment to make Canada a leader in electronic commerce.

We have some industry representatives here with us today and we would be pleased to answer your questions.