Regulation of cryptology products in telecommunications

Over the past fifteen years, wireless and telecommunication networks have become part of our daily lives. The deployment of these networks is subject to various restrictive legal rules.

Most of the equipment used in the deployment of wireless and telecommunications networks incorporates cryptology mechanisms, the supply and import of which are regulated in France.

Wireless networks depend on cryptographic techniques. The first GSM networks already used cryptography, and subsequent protocols are no exception.

In the past, this dependence has acted as a brake on the deployment of these networks. In France, regulations governing the supply, use, import and export of cryptology resources are in place, and failure to comply can result in sanctions.

It's true that since the French law on confidence in the digital economy of June 21, 2004, the use of wireless products has been liberalized. Anyone can use wireless products without having to worry about whether their use is legal or not. What's more, wireless products that use cryptology for signature, authentication and integrity purposes can be marketed without restriction. On the other hand, the supply, import and export of wireless devices that embed confidentiality functions are still controlled by the French National Agency for Information Systems Security (ANSSI): the Agence Nationale de la Sécurité des Systèmes d'Information succeeded the Direction Centrale de la Sécurité des Systèmes d'Information (DCSSI) on July 7, 2009 (decree no. 2009-834). The ANSSI is a department of the General Secretariat for Defense and National Security (Secrétariat Général de la Défense et la Sécurité Nationale), reporting to the Prime Minister. However, decree no. 2007-663 of May 2, 2007 abolishes the authorization system for supply and import, replacing it with a simple declaration. In principle, only the export of confidentiality products remains subject to authorization. However, this operation may also be subject only to declaration, and many wireless products will be able to benefit from this facility.

Before examining the necessary conditions, we need to look at the rules governing the import and sale of wireless products containing cryptographic functions.

At the end of this dossier, readers will find a summary of acronyms and abbreviations (see table 6 ).