Private Security Devices Trigger Public Concerns

THE AT&T Surity 3600, due out later this year, is a small box that is raising big concerns.

The device scrambles telephone signals so that conversations will be more secure. But the Surity 3600 uses government encryption technology that, ironically, makes many people feel less secure. The uproar is the first sign that the public appeal of the information superhighway may give way to serious concerns about new forms of electronic invasion of privacy.

David Banisar, policy analyst for Computer Professionals for Social Responsibility, calls the government's encryption technology ``a miserable failure.... It's like saying we should all live in glass houses so they can see what we're doing.''

The government's encryption chips - called Capstone and Clipper - give law-enforcement officials back-door access to encrypted transmissions. Some groups find the whole idea of official wiretapping distasteful. Others worry that the government will not be able to keep the code-breaking keys from falling into the wrong hands. The backlash has been so strong that some security experts now believe the federal government is backing away from its plan.

``Unofficially, Clipper is dead,'' says Sharon Webb, president of Atlanta-based Secure Systems Group International. ``The industry support isn't there.... And the biggest reason is that our clients won't buy it.''

Another security official at a well-known computer company agrees that the government's technology is in trouble. ``It certainly isn't alive and well,'' he says.

Government officials deny this. ``I have seen nothing that indicates that the policy people have made any decision to go in any different direction,'' says Lynn McNulty, associate director for computer security at the National Institute of Standards and Technology (N.I.S.T.).

The controversy boiled over last April, when the federal government proposed that data-security companies use its Capstone chip to scramble high-speed data transmissions. It suggested they use its Clipper chip for low-speed data and voice conversations. Law-enforcement officials are concerned that new technologies, such as encryption, will become widely available to criminals, making it impossible to tap their conversations.

AT&T's Surity device was especially troubling to federal officials because it is the closest thing yet to encryption for the masses. Priced at $1,195, the unit will cost less than half the price of AT&T's older secure-phone system.

It is also very simple to operate. Users plug the unit into the handsets of their telephones. If they press its ``secure'' button, they can carry on a protected conversation with any other Surity 3600 user.

After talking with worried federal officials, AT&T decided to use the Clipper instead of its own proprietary technology. The company is confident its Surity 3600 will sell well.

``The response we've gotten to the product has been extremely good,'' says David Arneke, a spokesman for AT&T Secure Communications Systems, based in Greensboro, N.C. ``The market for this product is going to be significantly larger than any secure communications product we've put out on the commercial market.''

The company plans to start selling the devices, mostly to corporate executives, by mid-year.

Many security experts say the government does have a right to snoop in some cases. ``There's clearly a need for the government to be able to wiretap or eavesdrop on authorized targets,'' says Robert Bales, executive director of the National Computer Security Association in Carlisle, Pa. ``In a free society, you've got to realize that.''

But as security experts began to ask hard questions of the government's plan, they became increasingly dissatisfied with the Clinton administration's vague responses. For example, privacy groups want to know exactly who will hold the keys to the encryption codes. In a September Capitol Hill staff briefing, federal law-enforcement officials said the administration had tentatively settled on N.I.S.T. and an as-yet undetermined non-law enforcement component of the Treasury Department. But to date, the administration has made no official announcement.

Privacy groups also are skeptical about official promises that the encryption standard will be voluntary. And if it is voluntary, security experts ask, then how will it help police catch criminals? ``It certainly wouldn't work, because no criminal in his right mind would use it,'' Mr. Banisar says.

Security experts also doubt that the high-speed Capstone chip can handle the increasing data speeds that customers are demanding. ``The customer would be able to get [only] 6 percent of our throughput if we had to use the chip,'' says Bill Ferguson, vice president of marketing for Semaphore Communications, a Santa Clara, Calif., security systems firm. ``They don't want to be locked into yesterday's technology.''