Locking up agency information
- By William Matthews
- Mar 26, 2000
If the CIA had owned PageVault software, the John Deutch scandal never would
have happened, contends PageVault developer Authentica Inc. And if its WebVault
product were available for the Energy Department to use, Wen Ho Lee might
be just another scientist.
Deutch and Lee's sagas are the most recent high-profile examples of
government employees who have violated information security policies. Deutch,
the former CIA director, kept classified information on a nonsecure computer
at home, and Lee, the DOE scientist, transferred secrets to storage tapes.
Both lapses could have been blocked, or at least minimized, if information
owners, including the CIA and DOE, had a way to control information even
after users have transferred it out of agency-owned computers.
That may sound impossible, but Waltham, Mass.-based Authentica says
it has developed three software packages that do just that. The capability
is called "dynamic post-delivery control," said Stevan Vigneaux, Authentica
vice president of marketing.
"That means I can control whether you can print [information], copy
and paste it, save on your disk drive or forward it," he said.
No matter who obtains a copy of information or where it goes even
out on the Internet the owner retains control, Vigneaux said.
PageVault, WebVault and their sister application, MailVault, work by
encrypting information and requiring the user to get the decryption key
from the owner each time he wants to use it. In addition to holding the
access key, the information owner can control varying degrees of use, from
read-only to permitting copying, forwarding or altering information.
Vigneaux called it "persistent control. I will know every time you look
at each page for as long as I choose to," he said.
A House of Representatives committee Vigneaux wouldn't say which one uses PageVault to let members see sensitive material while ensuring that
it cannot be distributed to anyone not authorized to see it. Committee members
can read, but not copy, print or forward, information protected by PageVault.
And the software packages keep a comprehensive audit trail of who reads
what documents and when, Vigneaux said.
The three Vault products go beyond the simple encryption and public-key
infrastructure that many federal agencies are considering to help solve
privacy problems that stand in the way of electronic government.
While encryption and PKI may keep information from being accessed by
unauthorized users, once the infor-mation has been accessed, the provider
loses all control over it. Under these methods, an authorized user such
as Lee, for example can obtain information and then use it for unauthorized
purposes.
With the Authentica software, DOE could have let Lee view the information
but not allowed him to copy it to a tape or forward it. And once Deutch
stepped down as head spy, the CIA could have revoked his access to his decryption
key, thus denying him access to the secret information in his home computer.
More mundane uses are legion. With assured privacy, government agencies
and companies can use World Wide Web sites to distribute important but sensitive
information to their employees.
And for the first time, information can be made available on a rental
basis, Vigneaux said. It is possible for information owners to make it available
over the Internet on a pay-per-view basis.
PageVault has been available since last year. WebVault will begin shipping
this week, while MailVault is expected to begin shipping in May. Prices
range from $40 to $200 per user, depending on the number of licenses. More information is available on the Authenica Web site.