12 MAY 95 FM AMEMBASSY MOSCOW SUBJECT: PRESIDENTIAL DECREE ON DATA ENCRYPTION: FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION (FAPSI) GIVEN NEW POWERS ------- SUMMARY ------- 1. A NEW PRESIDENTIAL DECREE ON DATA ENCRYPTION, DECREE NO. 334 ISSUED APRIL 3, DECLARES ILLEGAL ANY ENCRYPTION SOFTWARE OR HARDWARE DEVICE NOT APPROVED BY THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION (FAPSI). THE DECREE PLACES ON FAPSI WORRYING NEW POWERS OF CONTROLLING THE APPROVAL OF ALL ENCRYPTION EQUIPMENT USED IN RUSSIA IN THE NAME OF NATIONAL SECURITY AND INTENSIFYING THE STRUGGLE AGAINST ORGANIZED CRIME. WHILE IT IS AT PRESENT DIFFICULT TO SAY EXACTLY WHAT METHODS OF ENCRYPTION FAPSI WILL AUTHORIZE, THE DECREE, NEVERTHELESS, IMMEDIATELY INSTRUCTS: -- ALL COMMERCIAL BANKS TO CONFORM TO THE DECREE IN THEIR DEALINGS WITH THE CENTRAL BANK OF RUSSIA; AND -- THE RUSSIAN FEDERATION CUSTOMS COMMITTEE TO BAN THE IMPORT OF "ENCRYPTION FACILITIES" THAT LACK A FAPSI APPROVED LICENSE. THE DECREE ALSO STIPULATES CREATING A FEDERAL CENTER FOR PROTECTION OF ECONOMIC INFORMATION AT FAPSI WITHIN TWO MONTHS. LOCAL DATA NETWORKS, HOWEVER, ARGUE THAT IT WOULD BE IMPOSSIBLE TO GUARANTEE CUSTOMERS ABSOLUTE DATA SECURITY, GIVEN THE FACT THAT FAPSI WAS FORMERLY A DEPARTMENT OF THE KGB. AN UNOFFICIAL ENGLISH TRANSLATION OF THE DECREE FOLLOWS IN PARA THREE. END SUMMARY. ---------------------------- LOCAL RESPONSE TO THE DECREE ---------------------------- 2. MANY PRESIDENTIAL DECREES HAVE BEEN ISSUED SINCE 1992, BUT IMPLEMENTATION IS A DIFFERENT STORY. STILL MANY LOCAL DATA NETWORK COMPANIES BELIEVE THAT THE DECREE RAISES SOME VERY DISTURBING QUESTIONS. THEIR MAIN CONCERNS: -- LACK OF GUARANTEE FOR CONFIDENTIALITY: ALTHOUGH PARA 8 OF THE DECREE MANDATES CREATION OF A FEDERAL CENTER CHARGED WITH DEVELOPMENT AND IMPLEMENTATION OF OVERALL PROGRAMS FOR ASSURING THE SAFETY OF THE ECONOMIC INFORMATION OF RUSSIA'S CREDIT AND FINANCIAL ORGANIZATIONS AND OTHER ECONOMICALLY SIGNIFICANT INSTITUTIONS, FEW IN RUSSIA FEEL COMFORTABLE ABOUT THIS DECREE, GIVEN WIDESPREAD BELIEF THAT GOVERNMENT DATA HAVE FALLEN INTO THE HANDS OF CRIMINALS, NOT TO MENTION POSSIBLE "BACKDOOR" DECODING BY LAW- ENFORCEMENT BODIES THEMSELVES. -- SOFTWARE DEVELOPMENT DONE IN RUSSIA BY FOREIGN COMPANIES WOULD BECOME MUCH LESS ATTRACTIVE SINCE NONE WOULD BE ABLE TO TRANSFER SOURCE CODES AND RETAIN CONFIDENCE IN THEIR SECURITY. -- SOME OF THE LOCAL CRITICS ARGUE EVEN FURTHER THAT THE DECREE SENDS A SIGNAL TO THE WORLD COMPUTER SOFTWARE INDUSTRY THAT THE RUSSIAN GOVERNMENT PLANS TO MAKE THE PROTECTION OF A COMPANY'S OWN INTELLECTUAL PROPERTY ITS BUSINESS. ---------------------------------------- ENGLISH TRANSLATION OF THE DECREE NO.334 ---------------------------------------- 3. ON MEASURES TO OBSERVE LEGALITY IN THE AREA OF DEVELOPMENT, PRODUCTION, IMPLEMENTATION AND OPERATION OF ENCRYPTION FACILITIES, AS WELL AS PROVISION OF SERVICES IN THE AREA OF DATA ENCRYPTION APRIL 3, 1995, #334 FOR THE PURPOSE OF ASSURING DEFINITE COMPLIANCE WITH THE RUSSIAN FEDERATION LAW "ON FEDERAL STRUCTURES OF GOVERNMENT COMMUNICATION AND INFORMATION", AS WELL AS INTENSIFYING THE STRUGGLE AGAINST ORGANIZED CRIME AND INCREASING THE SECURITY OF THE INFORMATION AND TELECOMMUNICATION SYSTEMS USED BY STATE BODIES, RUSSIA'S CREDIT AND FINANCIAL STRUCTURES, ENTERPRISES AND ORGANIZATIONS, I DECREE: -- 1. THE PROGRAM OF CREATION AND DEVELOPMENT OF THE SPECIAL-PURPOSE INFORMATION AND TELECOMMUNICATIONS SYSTEM IN THE INTEREST OF STATE BODIES IS TO BE GIVEN THE STATUS OF PRESIDENTIAL PROGRAM. THE CENTER FOR PRESIDENTIAL PROGRAMS OF THE ADMINISTRATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION TOGETHER WITH THE FEDERAL AGENCY FOR GOVERNMENTAL COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION ARE TO ENSURE ITS UPDATING AND IMPLEMENTATION. -- 2. PROHIBIT THE USE OF ENCRYPTION FACILITIES IN INFORMATION AND TELECOMMUNICATIONS SYSTEMS BY STATE ORGANIZATIONS AND ENTERPRISES, INCLUDING CRYPTOGRAPHIC FACILITIES FOR ENSURING INFORMATION AUTHENTICITY (DIGITAL SIGNATURE), AND SHIELDED EQUIPMENT FOR INFORMATION STORAGE, PROCESSING AND TRANSMISSION, UNLESS SUCH FACILITIES HAVE A CERTIFICATE OF THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION, AS WELL AS PROHIBIT THE PLACEMENT OF STATE ORDERS WITH ENTERPRISES AND ORGANIZATIONS USING SUCH EQUIPMENT AND ENCRYPTION FACILITIES NOT HAVING A CERTIFICATE OF THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION. -- 3. REQUIRE THE CENTRAL BANK OF THE RUSSIAN FEDERATION AND THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION TO TAKE THE NECESSARY MEASURES AGAINST THE COMMERCIAL BANKS OF THE RUSSIAN FEDERATION THAT EVADE THE REQUIRED USE OF SHIELDED EQUIPMENT FOR INFORMATION STORAGE, PROCESSING AND TRANSMISSION HAVING A CERTIFICATE OF THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION DURING THEIR INFORMATION EXCHANGES WITH DIVISIONS OF THE CENTRAL BANK OF THE RUSSIAN FEDERATION. -- 4. IN THE INTERESTS OF THE INFORMATION SECURITY OF THE RUSSIAN FEDERATION AND INTENSIFYING THE STRUGGLE AGAINST ORGANIZED CRIME, PROHIBIT LEGAL AND PHYSICAL PERSONS FROM THE ACTIVITIES CONNECTED TO THE DEVELOPMENT, PRODUCTION, IMPLEMENTATION AND OPERATIONS OF ENCRYPTION FACILITIES, AS WELL AS SHIELDED EQUIPMENT FOR INFORMATION STORAGE, PROCESSING AND TRANSMISSION, WITHOUT LICENSES ISSUED BY THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION IN ACCORDANCE WITH THE RUSSIAN FEDERATION LAW "ON FEDERAL STRUCTURES OF GOVERNMENT COMMUNICATION AND INFORMATION". -- 5. THE STATE CUSTOMS COMMITTEE OF THE RUSSIAN FEDERATION IS TO TAKE MEASURES FOR BANNING THE IMPORTATION OF TO THE TERRITORY OF THE RUSSIAN FEDERATION OF ENCRYPTION FACILITIES MANUFACTURED ABROAD WITHOUT A LICENSE OF THE MINISTRY OF EXTERNAL ECONOMIC RELATIONS OF THE RUSSIAN FEDERATION ISSUED IN COORDINATION WITH THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION. -- 6. THE FEDERAL COUNTERINTELLIGENCE SERVICE OF THE RUSSIAN FEDERATION AND THE MINISTRY OF INTERNAL AFFAIRS OF THE RUSSIAN FEDERATION TOGETHER WITH THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION, THE STATE TAXATION SERVICE OF THE RUSSIAN FEDERATION, AND THE DEPARTMENT OF TAXATION POLICE OF THE RUSSIAN FEDERATION IMPLEMENT THE IDENTIFICATION OF THE LEGAL AND PHYSICAL PERSONS VIOLATING THE REQUIREMENTS OF THE DECREE. -- 7. REQUIRE THE PROSECUTOR GENERAL OF THE RUSSIAN FEDERATION TO STRENGTHEN THE ENFORCEMENT OF COMPLIANCE WITH THE RUSSIAN FEDERATION LAW "ON FEDERAL STRUCTURES OF GOVERNMENT COMMUNICATIONS AND INFORMATION" WITH RESPECT TO THE DEVELOPMENT, PRODUCTION, IMPLEMENTATION AND USE OF ENCRYPTION FACILITIES, AS WELL AS TO THE PROVISION OF SERVICES IN THE AREA OF DATA ENCRYPTION IN THE RUSSIAN FEDERATION THAT ARE SUBJECT TO LICENSING AND CERTIFICATION BY THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION. -- 8. CREATE THE FEDERAL CENTER FOR PROTECTION OF ECONOMIC INFORMATION OF THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION (WITHIN THE AGENCY'S STAFF), CHARGING IT WITH THE DEVELOPMENT AND IMPLEMENTATION OF OVERALL PROGRAMS FOR ASSURING THE SAFETY OF THE ECONOMIC INFORMATION OF RUSSIA'S CREDIT AND FINANCIAL AND OTHER ECONOMICALLY SIGNIFICANT STRUCTURES OF THE COUNTRY. THE GENERAL DIRECTOR OF THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION IS TO APPROVE A CHARTER OF THE SAID CENTER WITHIN 2 MONTHS. -- 9. THE DECREE IS IN FORCE FROM THE DAY OF ITS PUBLICATION. PRESIDENT OF THE RUSSIAN FEDERATION B. YELTSIN