Test` govt crypto site raises hackles everywhere

Johannesburg, 03 Oct 2002

A government test Web site went live this weekend, causing alarm nationally within 20 minutes and internationally within two days.

On Monday, www.aspa.co.za, a Web site of the government Department of Communications, published application forms and rules for providers of authentication services, cryptography products and holders of critical databases to register as required by the recently enacted Electronic Communications and Transactions (ECT) law.

The information on the barebones site includes registration fees: a non-refundable R25 000 application fee to register an authentication product or service and R2 000 to register a cryptography product or service.

The community that spoke out strongly against the registration requirements in the new law when it was drafted, spotted the site within minutes and a local mailing list frequented by Internet professionals reflected renewed condemnation and disbelief at the quoted prices.

Cryptography, authentication and critical database registration were the sections that drew the harshest and most sustained criticism of the ECT Act. Many involved in the Internet industry see the definition of cryptography as dangerously broadly worded, potentially meaning anyone selling computers, or even a library lending out a book on encryption would have to register. They fear introducing such bureaucracy would hamper the entire local IT industry.

Their criticism has led to a virtual cold war between much of the industry and the government.

The Slashdot effect

By Wednesday morning the details had been posted on Slashdot, the American geek site famous for its ability to direct a multitude of users to other Web sites in a short period of time and creating the "Slashdot" effect as Web servers buckle under the unexpected load.

The largely technical American audience had little praise for what they saw.

"More over-zealous governments that think cryptography is the tool of the devil... that`s exactly what the world needs right now," one reader commented. "It`s very simple, really: they simply don`t get enough money from taxes, so they have to keep inventing new taxes to sustain their budget," another posted.

But the government officials responsible for the registration Web site say it is simply a test and are flabbergasted at the speed with which it was condemned.

"We just wanted to check the systems, that everything is up and running," says Envir Fraser, a senior manager in the Internet directorate of the Department of Communications. "After this we know it works but it is not officially up and running yet."

The site, he says, went live without any publicity or notification because the rules for registration are not yet official.

"There is still a requirement for regulations and nothing is official until those are passed by [communications minister Ivy Matsepe-Casaburri]."

Jail time

These regulations are expected to be gazetted within weeks and will lay down the fee structure for registration. Fraser says the published fees hold no water yet and that even gazetted regulations will be subject to change. "We are expecting a lot of amendments, even to the Act itself."

The department has also invited comment on the site, although the published regulations will not be subjected to an official public comment period.

For accreditation service providers, however, fees are likely to remain high as the government will require an official audit of methodology before granting accreditation.

While registering as an accreditation service provider is voluntary, failure to register as a cryptography provider before supplying encryption products or services in SA or to South Africans carries a two-year jail term.

This is not the first time controversy has been caused by ECT Act information leaked online. In June, a Department of Communications statement, published on the central government Web site gov.za, attacked non-profit body Namespace. The government later said the statement had been released by mistake.