Tumbleweed Establishes Federal Team in Response to Increasing Demand for Secure Communications Solutions.

REDWOOD CITY, Calif. -- New Team Already Delivering E-Mail, File Transfer, and PKI Security to 40 Federal Government Organizations

Tumbleweed(R) Communications Corp. (NASDAQ:TMWD), a leading provider of secure messaging, secure file transfer and identity validation products, today announced the launch of the Tumbleweed Federal Team aimed at providing secure Internet communications solutions to the Federal market. To date, more than 40 Federal government organizations use Tumbleweed's proven, battle-tested, and government compliant solutions to achieve the utmost trust in communications and network protection.

The New Tumbleweed Federal Team

In a time of growing security threats, budgetary pressures, competing information technology standards, and numerous government mandates, Tumbleweed's Federal Team offers the Federal government a trusted and proven resource for secure communications requirements. The team's information security professionals, engineers, sales, and technical support personnel are committed to successfully developing and deploying solutions that help Federal customers block security threats, protect mission critical information assets, and ensure the safe exchange of data, messages and files.

Ann Smith, Tumbleweed's vice president, Federal sales, brings more than 18 years of experience working with government agencies and systems integrators to deliver secure communications solutions tailored to Federal requirements. Ms. Smith has also established a Federal Advisory Board to support continued evolution of government-focused secure communications solutions. Advisors include Steven T. Schanzer, President of S2 and Associates and former director of the Defense Security Service at the US Department of Defense, (DoD), and Brian D. Dilley, president/CEO of eValid8 Corporation. Mr. Dilley brings extensive experience in Federal IT acquisition and deployment activities, and is the US Department of the Treasury's technical point of contact to the Federal PKI Policy Authority and associated working groups.

Defending the Federal ID

Recent surveys of Federal Chief Information Security Officers (CISOs) revealed that these officials consider security information management tools for network security, intrusion detection and prevention, and authentication among the top three most important products and services to their agencies. Driving these priorities are numerous government initiatives adding to agency compliance obligations in cyber-security, such as the DoD Directives 8500.1 (information assurance) and 8100.2 (wireless devices), the recently enacted Homeland Security Presidential Directive 12 (HSPD-12), and the Health Insurance Portability and Accountability Act (HIPAA).

Tumbleweed solutions provide the innovative encryption, authentication, policy enforcement, and tracking capabilities the Federal government requires for securing online communications channels. These solutions help organizations defend e-mail infrastructure at the Internet gateway, filter content to prevent leaks of classified information, and dynamically encrypt and digitally sign confidential messages to protect sensitive information in compliance with government regulations. They also enable agencies to use the Internet for secure delivery of high value transactions and confidential documents, while validating public key infrastructure (PKI) credentials in real-time in compliance with defense and homeland security directives.

USPTO Gets Patented Protection for Web-based File Transfer

The US Department of Commerce's United States Patent and Trademark Office (USPTO) uses Tumbleweed SecureTransport to enable the secure enterprise-wide exchange of valuable and sensitive patent information over the Internet. Consistent with the USPTO's 21st Century Strategic Plan, the organization was looking for a way to transport patent data collected at its Horsham, Pennsylvania facility electronically over the Internet for processing, rather than running the data to tape and shipping it to headquarters by truck. Tumbleweed SecureTransport's multi-tier security architecture, multi-protocol file transfer, guaranteed file delivery, and powerful encryption capabilities are providing the security and reliability the USPTO requires for ensuring the protection of intellectual property.

A Prescription for Encryption at FDA

The Food & Drug Agency's Center for Biologics Evaluation and Research (CBER) selected Tumbleweed's Email Firewall and Secure Messenger solutions to meet its needs for securely, managing electronic regulatory submissions of drug approval applications and testing results from pharmaceutical and biotechnology firms. The solution is providing CBER and the drug research firms a secure, efficient, and cost-effective system for exchanging submission information via encrypted e-mail. The ability to securely exchange submissions information is producing significant savings in time and money over the previous paper based process while providing keeping CBER's infrastructure safe from virus, spam, and denial-of-service attacks.

Keeping DOE Spam & Virus Free

The US Department of Energy (DOE) is using Tumbleweed Email Firewall(TM) to eliminate spam and email-borne viruses and encrypt internal and external e-mail communications. Before selecting Tumbleweed, the DOE spent significant resources fending off spam and email-based virus attacks and would not risk sending sensitive information by e-mail. The DOE's Carlsbad Area Office (CBFO) is representative of the spam and virus challenges facing the agency. The CBFO serves more than 1,000 users onsite and at remote locations, and spam comprises 50 percent of the 25,000 e-mail messages the organization receives per day. "Tumbleweed's Dynamic Anti-spam Service has been a lifesaver for both the CBFO and IT organization," said Paul DeVito, CBFO's Information System Site Security Manager. "Tumbleweed's Email Firewall has really helped the DOE to minimize email communications risks and reduce email management costs."

The Key to DoD PKI

The DoD PKI Program Management Office (DoD PKI PMO) recently selected the Tumbleweed Validation Authority(TM) (VA) to provide digital certificate validation to more than 1.3 million users worldwide. Based on the open standard Online Certificate Status Protocol (OCSP, RFC 2560), VA validates the status of digital certificates in real time, ensuring that revoked credentials cannot be used for secure e-mail, smart card login, web access, wireless, VPN or other electronic transactions. DoD selected Tumbleweed after an extensive independent evaluation of digital certificate validation solutions offered by nine vendors. With a Common Access Card issued to almost 3.5 million users, the DOD PKI is the largest PKI deployment worldwide. "The creation of trusted relationships represents the core of a successful PKI program," said Gil Nolte, director of the DoD's PKI PMO. "The Tumbleweed validation solution's highly scalable architecture, transparent delivery, and ability to distinguish friend from foe in real time online in low bandwidth environments will provide a vital component of the Department's solution for creating the utmost trust in mission critical communications."

Securing the Supply Line at DLA

The Defense Logistics Agency (DLA) selected Tumbleweed VA to provide enterprise-wide digital certificate validation to more than 30,000 users. As DoD's largest combat support agency, DLA sought a PKI solution that could meet its information assurance requirements and align with the DoD PKI PMO's identity validation objectives. "The Tumbleweed VA solution enables applications to allow properly credentialed individuals to exchange sensitive information, process high value transactions, and otherwise access the network systems critical to our worldwide logistics operations," said Pat Edwards, Chief, Information Assurance J6R and DLA PKI Program Manager. "Tumbleweed's technology, JITC certification, and extensive deployments with other DoD services and departments will provide the assurance required for protecting sensitive e-mails, Web sites, file transfers, transactions, and facilities from unauthorized access."

Tumbleweed Federal Government Solutions

--  Tumbleweed MailGate(TM)-- Email Security, Content Filtering
        and Data Leakage Prevention

        --  The choice of more than 16 Federal defense and civilian
            agency customers

        --  Representative customers include the US Air Force, the US
            Army, and the US Department of Health & Human Services

    --  Tumbleweed SecureTransport(TM)-- Secure File Exchange and
        Transactions

        --  The choice of more than 12 Federal defense and
            civilian agency customers

        --  Representative customers include the Defense Finance and
            Accounting Service, the Naval Sea Systems Command, the US
            Postal Service, and the Internal Revenue Service

    --  Tumbleweed Validation Authority(TM)--PKI Infrastructure and
        Identity Validation

        --  The choice of more than 19 Federal defense and civilian
            agency customers

        --  Representative customers include all branches of the US
            military, the US Coast Guard, and the US Department of
            Justice

"We are very pleased to formally introduce the Tumbleweed Federal Team," said, John Thielens, Tumbleweed's Chief Technology Officer. "We have managed an impressive portfolio of more than 40 Federal customers in the team's first year, and look forward to building on our team's success. The DoD PKI PMO's selection of VA demonstrates that Tumbleweed is at the forefront of Federal PKI, and we are committed to extending our leadership and commitment to innovation in all areas of secure communications to the Federal market."

About Tumbleweed

Tumbleweed provides security solutions for email protection, file transfers, and identity validation that allow organizations to safely conduct business over the Internet. Tumbleweed offers these solutions in three comprehensive product suites: MailGate, SecureTransport, and Validation Authority. MailGate provides protection against spam, viruses, and attacks, and enables policy-based message filtering, encryption, and routing. SecureTransport enables business to safely exchange large files and transactions without proprietary software. Validation Authority is the world-leading solution for determining the validity of digital certificates. Tumbleweed's enterprise and government customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the US Food and Drug Administration, the US Department of Defense, and all four branches of the US Armed Forces. Tumbleweed was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call 650-216-2000.

SAFE HARBOR STATEMENT

Tumbleweed cautions that forward-looking statements contained in this press release are based on plans and expectations as of the date of the press release, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to Tumbleweed products and Tumbleweed's Federal Government business. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 16, 2005.

Tumbleweed assumes no obligation to update information contained in this press release, which represents the Company's expectations only as of the date of this release and should not be viewed as a statement about the Company's expectations after such date. Although this release may remain available on the Company's website or elsewhere, its continued availability does not indicate that the Company is reaffirming or confirming any of the information contained herein.