The Defense Logistics Agency Deploys Tumbleweed Validation Authority for Enterprise-Wide PKI Validation in Mission-Critical Operations.

REDWOOD CITY, Calif. -- Tumbleweed's Authentication Solution Proving Real Time Validation for More Than 30,000 Users

Tumbleweed(R) Communications Corp. (NASDAQ:TMWD), a leading provider of e-mail security, file transfer security, and identity validation solutions, today announced the Defense Logistics Agency (DLA), a U.S. Department of Defense (DoD) agency, has deployed the Tumbleweed Validation Authority(TM) (VA) to provide enterprise-wide digital certificate validation to more than 30,000 users. Based on the open standard Online Certificate Status Protocol (OCSP, RFC 2560), VA validates the status of digital certificates in real time, ensuring that revoked credentials cannot be used for secure email, smart card login, web access, wireless, VPN, or other electronic transactions.

As DoD's largest combat support agency, the DLA provides supply support and technical and logistics services to the military services and to several civilian agencies. Headquartered at Fort Belvoir, Virginia, it is the one source for nearly every consumable item, whether for combat readiness, emergency preparedness or day-to-day operations. In 2004, the DLA handled more than 45,000 requisitions per day, managed 5.2 million items, and had $28.7 billion in sales and services. The organization processes nearly 8,200 contracts daily and does business with nearly 24,000 different suppliers.

With the growing complexity of its operations and information assurance requirements, the DLA sought a public key infrastructure (PKI) solution that could ensure the utmost security and trust for its technology infrastructure. DLA was also looking for a solution aligned with the DoD's PKI Program Management Office (DoD PKI PMO) identity validation objectives and plans for enabling expanded use of the DoD Common Access Cards. After conducting an extensive technical evaluation of digital certificate validation products, DLA selected Tumbleweed VA as the PKI validation solution to support these objectives.

"The Tumbleweed VA solution enables applications to allow properly credentialed individuals to exchange sensitive information, process high value transactions, and otherwise access the network systems critical to our worldwide logistics operations," said Pat Edwards, Chief, Information Assurance J6R and DLA PKI Program Manager. "Tumbleweed's technology, JITC certification, and extensive deployments with other DoD services and departments will provide the assurance required for protecting sensitive e-mails, Web sites, file transfers, transactions, and facilities from unauthorized access."

Edwards noted that DLA also deployed the Tumbleweed Server Validator, a plug-in application that simplifies certificate validation processing at the application level for the most widely used Secure Web Servers on multiple OS platforms. "Integrating Tumbleweed VA's Web server validation technology with the DLA's Business Systems Modernization initiative gives us a fault tolerant design with robust fail-over support, ensuring the reliability and continuity of system-wide authentication."

Tumbleweed VA's functionality also satisfied DLA's requirement for a configurable out of the box solution that could operate without external connectivity requirements during periods of heightened alert. This enables DLA to maintain system-wide authentication when alert levels require DLA to restrict all Non-Secure Internet Protocol Router Network (NIPRNET) traffic and continue operations on its enterprise telecommunications network (ETN). The Tumbleweed solution also provided a robust replication system to mirror the Defense Information Systems Agency's (DISA's) generated certificate revocation lists to a location accessible inside the ETN, and a monitoring component that tracks the availability of DISA CRLs and automatically notifies DLA personnel of outages.

About the Tumbleweed Validation Authority

Tumbleweed Validation Authority (VA) ensures the validity and integrity of highly valued and trusted transactions. Validation Authority is a Certificate Authority (CA) neutral, extensible server that utilizes multiple validation protocols for checking the validity of X.509 certificates within Public Key (PKI) environments. Validation Authority delivers a comprehensive, scalable, and reliable framework for validating digital certificates in real time, and can validate a certificate issued by any CA. It complies with Federal Information Protection Standard (FIPS) 140-l, DOD Joint Interoperability Testing Command, and Identrus standards. Additionally the Validation Authority is completing Common Criteria (ISO/IEC 15408) Evaluation Assurance Level (EAL-3) by the National Information Assurance Partnership (NIAP), a collaboration between the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA).

About DLA

The Defense Logistics Agency (DLA) is DOD's largest combat support agency, providing worldwide logistics support in both peacetime and wartime to the military services as well as several civilian agencies and foreign countries. More information about DLA is available at www.dla.mil.

About Tumbleweed

Tumbleweed provides security solutions for email protection, file transfers, and identity validation that allow organizations to safely conduct business over the Internet. Tumbleweed offers these solutions in three comprehensive product suites: MailGate, SecureTransport, and Validation Authority. MailGate provides protection against spam, viruses, and attacks, and enables policy-based message filtering, encryption, and routing. SecureTransport enables business to safely exchange large files and transactions without proprietary software. The Validation Authority is the world-leading solution for determining the validity of digital certificates. Tumbleweed's enterprise and government customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the US Food and Drug Administration, the US Department of Defense, and all four branches of the US Armed Forces. Tumbleweed was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call 650-216-2000.

SAFE HARBOR STATEMENT

Tumbleweed cautions that forward-looking statements contained in this press release are based on plans and expectations as of the date of the press release, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to Tumbleweed products and Tumbleweed's Federal Government business. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 16, 2005.

Tumbleweed assumes no obligation to update information contained in this press release, which represents the Company's expectations only as of the date of this release and should not be viewed as a statement about the Company's expectations after such date. Although this release may remain available on the Company's website or elsewhere, its continued availability does not indicate that the Company is reaffirming or confirming any of the information contained herein.