Electronic Commerce
by Jonathan Rosenoer

For many years, the public has worked with communication tools that transport information effectively,
but do not offer high degrees of privacy or confidentiality. Postcards, for example, are not a good medium
for sending private messages. The limitations of earlycordless telephones were not hard to discern, particularly when you could hear your neighbours’ cordlesscalls piped through your own cordless handset. The
public generally adjusted its behaviour in recognitionof the risks involved. Where the risks have not been wellunderstood, law enforcement has been able to exploit
the opportunity. US courts allowed law enforcement
unrestrained eavesdropping where the circumstances
showed the parties involved had no reasonable expectation of privacy. Courts have also allowed communication surveillance in cases where the cause shown wassufficient to meet constitutional protections regarding
searches, seizures and privacy.
Recently, three technologies arrived in the marketplace — e-mail, the Internet and public-key encryption— together promising widespread, secure, public communication. Law enforcement has reacted with alarmat the prospective loss of access to private communications and lobbied against relaxation of controls on theuse of strong encryption. The government has also
introduced systems and schemes, such as “key recovery,” that would guarantee access to the unencrypted(plain) text of communications.
These efforts have been met by a range of opponents,
including computer software companies, the computer
security industry and civil libertarians. Critics ofencryption controls and regulation blame the government for retarding the growth of electronic commerce
and for driving the development of an overseas encryption and security industry.
The debate between the parties is polarized andhighly vocal. Unfortunately, it seems unlikely that anacceptable US cryptography policy will emerge in thenear term. By framing the debate in terms of a feared
inability to detect and prosecute drug dealers, terrorists
and child pornographers, the government has made itvery difficult for anybody to present a contrary view
without running the risk of being viewed as naive and“unpatriotic.” This remains the case despite indications
that encryption is not obstructing a large number ofinvestigations, and, to the contrary, that communication weaknesses is enabling crime — accounting for thelargest portion of economic and industrial information
lost by US corporations, to the benefit of foreign governments and corporate intelligence collectors, as wellas others.
The problem is exacerbated by the government’s
repeated calls for “key-recovery” systems. Technologists seem to agree that the key recovery focus is notsustainable, if for no other reason than deployment ofsuch systems is beyond the experience and current
competency in the field. They also point out that thereis no viable economic model to account for the cost ofkey recovery systems.

GETTINGTO DIGITALSIGNATURESAND ELECTRONICCOMMERCE
Aux États-Unis, aucun système decryptage n’a pu, jusqu’à présent,rallier l’assentiment des autorités
publiques et de l’industrie à la fois.
On croit souvent, mais à tort, quec’est à cette absence de consensus
qu’il faut attribuer le retard dudéveloppement du commerceélectronique. Pour prospérer surl’Internet, les entreprises ont besoind’une « signature » numérique
puissante bien plus que d’un systèmeà toute épreuve de protection de laconfidentialité.
It is widely accepted that the US government has
been unable to forge a national consensus around an
encryption policy acceptable to law enforcement(including intelligence agencies) and industry. This failure is holding up the development of electronic commerce. Businesses are uncomfortable working in anenvironment where they cannot be sure of the identityof the other party and that an agreement they make canbe enforced. Although the key to removing this certainty
is strong public-key cryptography, resolution of thecommerce issue does not depend on prior determination of a national encryption policy. To succeed andgenerate online revenues, businesses need strong digital signatures more than bulletproof confidentiality.

POLICY OPTIONSJUNE 199821

Le commerce électroniqueby Jim Carroll

Washington insiders recognize substantive problems with the government’s stance. But there has beenno significant change in the government’s position,even in the face of bipartisan, concerted and significant
opposition by industry, supported by demonstrated,
resulting economic loss.
If national consensus cannot be achieved on theglobal issue of strong encryption, it is important to recognize the fact and concentrate on areas where agreement can be reached. And for electronic commerce tosucceed, there is one required element that depends
upon strong cryptography, but not necessarily confidentiality: the digital signature.
Without digital signatures, companies are hardpressed to engage in electronic commerce. Businesses
require assurance that an electronically signed document can be enforced against the sender. At present,
there is no definitive court decision ruling that an electronic document can be “signed” electronically in legal
systems and in circumstances where the signatureremains as a formal requirement of law.
This “signature” issue is intimately related to a technical, legal issue of proof. In a court case, a party seeking to enforce a contract has the burden of proving that(1) the document was signed by the person who it purports to have come from, and (2) that the document presented is, in fact, the one that was signed. In the context of electronic communications, the burden can be
carried if the parties used strong public-key algorithms(1024 bit key sizes or better), providing user authentication and data integrity checks.
Widespread acceptance and availability of standardized, digital signature and identification software
would resolve the repudiation issue. Such software
could be strong enough to assure that documents
signed in one year would be secure for many years tocome. Courts and businesses would have a known andstable platform on which to base their respective legal
and business decisions.
The US Secretary of Commerce has blamed bothindustry and law enforcement for the failure to find areasonable compromise between the need to monitor
criminal activity and the need to offer consumers strong
security for on-line transactions. As the national interest supports reaching a compromise, the government
should actively encourage the development of an
acceptable, international digital signature and identification standard by a trusted implementer.

ELECTRONICCOMMERCE AND
THE PAPERLESSECONOMYL’Internet sera l’épine dorsale del’économie du XXIe siècle. Il reliera
l’ensemble des systèmes
informatiques et des puces
d’ordinateurs à travers le monde. Or,le commerce électronique est uneextension logique et inéluctable durôle des ordinateurs au sein del’économie, les transactions surpapier cédant graduellement le pas
aux transactions électroniques.
It is one of those phrases that seems to have suddenly
appeared on the scene, and which is used in almost reverent tones by the “digerati.” The truly trendy use thephrase “e-commerce,” while IBM has gone so far as tocustomize it to the more palatable word “e-business.”
Even given the sudden prominence of the concept, I
find that many executives seem to be either mystified
or skeptical of the concept of e-commerce. For many, it
is yet another complex invention by the so-called “gods”
of the computer revolution, one that is worthy of thedisdain of those who have been burned by so many illfated computer promises of the past. For others, theunrelenting hype that surrounds the concept meansthat it is simply another tantalizing opportunity thatwill go the way of so many magical promises of the past.
There is little appreciation among the executive crowd,even given the incessant focus on the topic Internet, as
to what electronic commerce is really all about.
To me, the whole concept of e-commerce is quite
simple — it is merely but the second phase of mankind’s
relationship with computer technology. The first phase,

Jonathan Rosenoer is Managing Director — Strategic Alliances, Arthur Andersen Knowledge Enterprises,
San Francisco, California.

OPTIONS POLITIQUESJUIN 1998

22