Authored by Bruce Schneier, Kathleen Seidel, and Saranya Vijayakumar
In this paper, which is modeled on a similar effort in 1999 by researchers from George Washington University, Berkman Fellow Bruce Schneier and collaborator Kathleen Seidel together with Harvard College student Saranya Vijayakuma identify and survey 865 encryption products from 55 different countries, 546 of them from outside the United States. In contrast, the 1999 survey found 805 encryption products from outside the US. Very few products from the earlier survey appear in the new one, indicating much change in this market over the last 17 years. The new survey also identified 587 entities that sell or give away encryption products, and of those, two-thirds are outside the US.
Schneier argues in the paper that the survey findings call into question the efficacy of any US mandates forcing backdoors for law-enforcement access. He asserts that they show that anyone who wants to avoid US surveillance has hundreds of competing products to choose from. The report findings indicate that foreign products offer a wide variety of secure applications—voice encryption, text message encryption, file encryption, network-traffic encryption, anonymous currency—providing the same levels of security as US products do today.
Additional findings include:
The most common non-US country for encryption products is Germany, with 112 products. This is followed by the United Kingdom, Canada, France, and Sweden, in that order.
The five most common countries for encryption products—including the US—account for two-thirds of the total. But smaller countries like Algeria, Argentina, Belize, the British Virgin Islands, Chile, Cyprus, Estonia, Iraq, Malaysia, St. Kitts and Nevis, Tanzania, and Thailand each produce at least one encryption product.
Of the 546 foreign encryption products we found, 56% are available for sale and 44% are free. 66% are proprietary, and 34% are open source. Some for-sale products also have a free version.
At least 587 entities—primarily companies—either sell or give away encryption products. Of those, 374, or about two-thirds, are outside the US.
Of the 546 foreign encryption products, 47 are file encryption products, 68 e-mail encryption products, 104 message encryption products, 35 voice encryption products, and 61 virtual private networking products.