Tumbleweed PKI Validation Solution Extends Information Sharing Capabilities for Defense Intelligence Agency Task Force; Tumbleweed Validation Authority(TM) Enables Secure, Real-Time Communication And Collaboration.

REDWOOD CITY, Calif. -- Tumbleweed(R) Communications Corp. (NASDAQ:TMWD), a leading provider of email security, managed file transfer, and identity validation appliance and software products, today announced that the Defense Intelligence Agency (DIA) has implemented the Tumbleweed Validation Authority(TM) to expand and enhance the secure information sharing capabilities of the Joint Intelligence Task Force for Combating Terrorism (JITF-CT). JITF-CT members can now more easily and securely communicate, perform real-time collaboration, and share sensitive information to support threat analysis.

Established to support efforts in the global war on terrorism, JITF-CT is the lead national-level intelligence component in the U.S. Department of Defense (DoD) responsible for enhancing the nation's terrorist threat warning and analysis capabilities.

JITF-CT has implemented the Tumbleweed Validation Authority product to support cryptographic logon to an internal portal restricted for use by JITF-CT personnel only. Initially designed to be accessed by username/password authentication, the JITF-CT portal was upgraded to authenticate users via the Intelligence Community PKI (IC-PKI) certificate authorities, using Tumbleweed Validation Authority for performing real-time digital certificate validation. This implementation was initiated two years ago on a Windows based system and continues in operation today.

"One of the most important measures of success for the project was the ability to install, configure, and make the validation process transparent to the user," said Tumbleweed's Vice President, Federal Sales, Ann Smith. "As intended, the solution requires minimal administrator interaction, and was installed on the existing hardware platforms at minimal cost and without any drag on overall system performance. Implementing Validation Authority as an enabling infrastructure component has further enhanced the JITF-CT's ability to provide timely, secure information for combating terrorism to IC partners to support threat analysis."

To enable certificate-based identification and authentication, the task force required a solution that would perform certificate revocation checking against the separate certificate revocation lists (CRLS) from each of the IC-PKI certificate authorities. JITF-CT selected Validation Authority as the solution that would best satisfy requirements for minimizing costs, providing centralized administration of enterprise validation services, and allowing flexible implementation of certificate status checking against the multiple IC-PKI CRLs. Validation Authority also satisfied security and operational considerations because it could be deployed on the same hardware platforms as other components of the JITF-CT PKE architecture with no appreciable impact on overall system performance.

The final design involved the implementation of the Validation Authority solution in a closed environment to achieve the highest level of reliability and availability for JITF-CT personnel to access the portal.

About the Tumbleweed Validation Authority

Tumbleweed Validation Authority (VA) ensures the validity and integrity of highly valued and trusted transactions. Validation Authority is a Certificate Authority (CA) neutral, extensible server that utilizes multiple validation protocols for checking the validity of X.509 certificates within Public Key (PKI) environments. Validation Authority delivers a comprehensive, scalable, and reliable framework for validating digital certificates in real time, and can validate a certificate issued by any CA. It complies with Federal Information Protection Standard (FIPS) 140-l, DOD Joint Interoperability Testing Command, and Identrus standards. Additionally the Validation Authority is completing Common Criteria (ISO/IEC 15408) Evaluation Assurance Level (EAL-3) by the National Information Assurance Partnership (NIAP), a collaboration between the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA).

SAFE HARBOR STATEMENT

Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations as of the date of this press release, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to the functionality and performance of Tumbleweed's products, their ease of use, and their ability to satisfy customer requirements. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 16, 2006 and Form 10-Q filed May 10, 2006.

Tumbleweed assumes no obligation to update information contained in this press release. Although this release may remain available on Tumbleweed's website or elsewhere, its continued availability does not indicate that Tumbleweed is reaffirming or confirming any of the information contained herein.

About the Defense Intelligence Agency

The Defense Intelligence Agency is a Department of Defense combat support agency and an important member of the United States Intelligence Community. With over 8,000 military and civilian employees worldwide, DIA is a major producer and manager of foreign military intelligence. The agency provides military intelligence to warfighters, defense policymakers and force planners, in the Department of Defense and the Intelligence Community, in support of U.S. military planning and operations and weapon systems acquisition. For more information, go to www.dia.mil.

About Tumbleweed Communications Corp.

Tumbleweed provides security solutions for email protection, file transfers, and identity validation that allow organizations to safely conduct business over the Internet. Tumbleweed offers these solutions in three comprehensive product suites: MailGate, SecureTransport(TM), and Validation Authority(TM). MailGate provides protection against spam, viruses, and attacks, and enables policy-based message filtering, encryption, and routing. SecureTransport enables business to safely exchange large files and transactions without proprietary software. Validation Authority is the world-leading solution for determining the validity of digital certificates. Tumbleweed's enterprise and government customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the U.S. Food and Drug Administration, the U.S. Department of Defense, and all four branches of the U.S. Armed Forces. Tumbleweed was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call 650-216-2000.

Tumbleweed, the Arrows logo, MailGate, MailGate Appliance, MailGate Email Firewall, MailGate Secure Messenger, SecureTransport and Validation Authority are either registered trademarks or trademarks of Tumbleweed Communications Corp. in the United States and/or other countries. All other trademarks are the property of their respective owners.