4 July 1997
Source: http://www.access.gpo.gov/su_docs/aces/aaces002.html

-------------------------------------------------------------------------

[Congressional Record: June 27, 1997 (Senate)]
[Page S6724-S6726]
From the Congressional Record Online via GPO Access [wais.access.gpo.gov]
[DOCID:cr27jn97-82]


                        ENCRYPTION POLICY REFORM

  Mr. LOTT. Mr. President, I rise today to thank the junior Senator
from Montana for his leadership on the important issue. Senator Burns
has led a valiant effort to address an area that I believe is in great
need of reform. He has championed the cause of allowing citizens to
protect their information through readily available strong information
security technology. In the 104th Congress, he introduced legislation
that set the stage for our reform efforts in this Congress. Again, last
week, Senator Burns offered a compromise version of his original bill
before the Commerce Committee, but unfortunately this measure did not
pass. I hope that now we can go through a process to bring all parties
together, industry and Government, to try to relieve some of the
problems created by current law. We did not accomplish everything that
I wanted in Committee, but I am confident that there is still time to
improve this legislation. I want to congratulate Senator Burns and
others on the committee like Senator Ashcroft and Senator Dorgan who
have taken the time to understand the technology and to attempt to
effectively guide us through these difficult issues.
  Mr. President, the demand for strong information security will not
abate. Individuals, industry, and governments need the best information
security technology to protect their information. The Administration's
policy and the McCain-Kerrey bill allow export of 56-bit encryption,
with key recovery requirements. How secure is 56-bit encryption? That
question was answered the day before the Senate Commerce Committee
acted. Responding to a challenge, a secret message encoded with 56-bit
encryption was decoded in a brute force supercomputing effort known as
the ``Deschall Effort.'' The message that was decoded said ``Strong
cryptography makes the world a safer place.''
  Now that 56-bit encryption has been cracked by individuals working
together over the Internet, information protected by that technology is
vulnerable. The need to allow stronger security to protect information
is more acute than ever.
  Mr. BURNS. Mr. President, I appreciate the comments of the majority
leader. I too was opposed to the legislation approved by the committee
last week, but know that we still have the opportunity to pass a
meaningful bill that will allow American industry to compete with the
rest of the world in the global information marketplace. I believe that
we can pass a bill that will not compromise our national security or
law enforcement interests. As I sat through the markup last week, it
occurred to me that we had allowed the issue of encryption to be framed
as the

[[Page S6725]]

issue of child pornography or gambling. I want to be sure that all
parties understand that the reform of encryption security standards is
not related to these issues.
  I have often said that encryption is simply like putting a stamp on
an envelope rather than sending a postcard because you don't want
others to read your mail. Encryption is simply about people protecting
their private information, about companies and governments protecting
their information, from medical records to tax returns to intellectual
property from unauthorized access. Hackers, espionage agents, and those
just wanting to cause mischief must be restrained from access to
private information over the Internet.
  When used correctly, encryption can enable citizens in remote
locations to have access to the same information, the same technology,
the same quality of health care, that citizens of our largest cities
have. Perhaps most importantly, it is about ensuring that American
companies have the tools they need to continue to develop and provide
the leading technology in the global marketplace. Without this
leadership, our national security and sovereignty will surely be
threatened.
  Mr. DORGAN. Mr President, I would like to make a few comments to
associate myself with the comments of the majority leader and the
Senator from Montana. These two gentlemen have demonstrated great
leadership on this issue, and I especially admire their dedication to
educate our colleagues about this important issue. I believe that at
the bottom line, if we allow this critical technology to be stifled in
the United States I believe our national interests will be severely
undermined. We must do our best to allow U.S. companies to compete in
the world marketplace, and do so without in any way undercutting our
national security interests.
  I believe that the bill that was reported last week out of the
Commerce Committee does not achieve those objectives. In fact, I fear
that bill may be nothing more than an attempt to ensure that no bill
passes in Congress this year. This would be a victory for the
administration, which has rigorously resisted changes to their outdated
and obsolete policies. I must say that I try to support the
administration on many issues, but on this issue, I have found that
their arguments and policies simply do not withstand scrutiny.
  And, Mr. President, I was an original sponsor of the Burns bill and I
worked very hard with the Senator to help shape the consensus position
that was rejected by the committee. I would like to take a few moments
to set the record straight about the true differences between the
McCain-Kerrey bill and the Burns' approach.

  The bill that passed the committee certainly represents a victory for
those within the administration opposed to any relaxation of export
controls in this area. In fact, it may be a perfect bill from their
standpoint. It allows them to begin the process of domestic control
while actually freezing exports to a weak enough level of encryption
technology that was actually decoded by amateurs the very day before.
And it is very unclear to me exactly where the McCain-Kerrey reaches a
compromise position.
  The Burns' bill however, merely allows that we would allow export of
56-bit encryption immediately, but we would establish a process for
understanding the level of encryption that is generally available
throughout the world. That review process would include panels and
advisory boards consisting of government and industry representatives
equipped to determine the security strength of particular software that
is available in the world market. Our belief was that it was in the
national interest for American software companies to maintain
leadership in this area. The very notion that we would let foreign
companies get a head start on new technology while forcing American
companies to come to a government entity to plead for the right to
catch up was troubling enough to both Senator Burns and myself. But, we
agreed to this compromise because we thought it represented the
appropriate middle ground.
  As the majority leader reminded us, we did not accomplish what many
of us had hoped that we would while in Committee, but we will continue
to work within the process to improve the legislation. I remain
committed to encryption reform and will do everything possible to try
to educate my colleagues about this issue.
  Mr. ASHCROFT. Mr. President, I would like to add my comments on this
important issue. For over 2 years, I have participated in Commerce
Committee hearings to learn more about on encryption and the technology
issues that it encompasses. Last week, I voted for Senator Burns'
substitute and was disappointed when it was not approved by the
committee.
  I am concerned about the tone of the discussion at last week's
markup. It appeared to me that many on the committee are seeking ways
to outlaw the Internet. We are all troubled by any type of child
pornography or gambling on the Internet. These are not areas where any
member of Congress, any software or hardware vendor, or any member of
the general public I know, argues for anything less than the strictest
legal provisions. These matters are distasteful and wrong, but even if
we eliminated the Internet, we would not eliminate these offensive
concerns.
  As I said during the markup, we all know that cameras are used in
child pornography, but we don't talk of outlawing photography. And, we
also know that rental vehicles are often used in terrorist activities,
but we don't make it illegal to rent a car or truck.
  Mr. President, it appears to me that at the most fundamental level,
this debate is about the relationship of our citizens to our
Government. We all must take steps to insure that the rights of our
citizens are not violated. Our citizens should be able to communicate
privately, without the Government listening in--that is one of our most
basic rights.
  We have to be careful to ensure our law enforcement can have just the
necessary amount of access and then only in a manner consistent with
our Constitution.
  I am persuaded that a number of the new provisions in the McCain-
Kerrey bill are not necessary.
  I believe that many of the provisions will not even succeed at
achieving the end they seek. For example, a false choice has been
offered indicating that if the U.S. continues to enforce the export
policy on encryption that is currently in place, 40 bit and with
special permission up to 56-bit, then law enforcement could apprehend
terrorists, stop illegal gamblers and arrest pornographers. However,
this argument assumes that these criminals cannot find stronger
encryption elsewhere than in the United States. As has been shown
several times, this assumption is false. Robust encryption is
available. Germany, Japan, and the United Kingdom all have companies,
such as Siemens, Nippon and Brokat, that have developed and promote 128
bit encryption. Last week even the supporters of the administration's
approach, as expressed in the current legislation, admitted that
criminals who want the robust encryption can find access and use strong
encryption in their current dealings. This issue is a red herring.
  Moreover, the administration announced Wednesday that they will allow
the export of 128-bit encryption for bank transaction use involving
bank software in an apparent admission of the vulnerability of the 56-
bit strength. Also, the administration has continued to tell us during
the hearings on encryption and in private meetings with the FBI and
NSA, that 128-bit use outside the United States would end in terrible
consequences, and now 128-bit use outside the U.S. is being advocated.
We should remember that the Burns compromise only wanted to export 128-
bit with key recovery for trusted parties. The administration now
advocates 128-bit length encryption without any key recovery device, a
position that goes beyond the Burn's compromise, which they opposed. My
point, Mr. President is that this debate must change. We cannot
continue to focus on the key length since these standards become
obsolete on a daily basis. We need to focus on allowing trustworthy
parties to use robust encryption, not necessarily to sell as encryption
but to use in their transactions and in the development of software and
hardware.

[[Page S6726]]

  No nationwide key recovery system, or a new licensing requirement for
certificate authorities should be brought to the floor without thorough
examination, analysis and understanding. We must further study the
impact of these provisions well before this bill is brought to the
Senate floor.
  Mr. LOTT. Mr. President, I too would like to work with my colleagues
to improve the McCain-Kerrey bill before it is brought to the floor. I
would like to ask my good friend from Missouri to pay special attention
to this bill while it is under consideration by the Judiciary
Committee. I know that I can count on him to work hard to improve this
important legislation.
  Mr. ASHCROFT. Mr President: I want to indicate my willingness to
continue to work on this issue. As the majority leader well knows, I am
privileged to serve on the Senate Judiciary Committee where we will
address this issue after the July recess. I pledge to work with members
on that Committee and with other interested Senators and the leader to
try to move a bill in that committee that will capture the essence of
Burns substitute.
  Mr. LOTT. It remains my hope that we can work with Chairman McCain
and other members of the Committee to produce a bill that more of us
can support. We need to recognize that American industry will have
increased difficulty of competing in the international marketplace
unless we provide some real reform. It is as if we erected a 30-foot
wall between the United States and the rest of the world. The problem
is that in today marketplace, American industry only has a 10-foot
ladder while their foreign competition has a 35-foot ladder. Foreign
firms are able to climb the wall while our American industry faces an
insurmountable obstacle. This is both short-sighted and wrong.
  If we follow our current path, we will rue the day when we allowed
our policies drive world leadership of the important information
security business to shift to Germany, Russia, Japan or China. I fully
intend to work toward a legislative solution that will help solve the
problem while protecting American security interests. We need to create
the mechanisms that will allow American companies to have the same
sized ladders that the rest of the world can use.
  Mr. President, we all appreciate the legitimate law enforcement and
national security issues involved in this debate. Our national security
and law enforcement agencies need to work with industry to ensure that
our interests are protected. I remain convinced that we can do this in
a way that insures that our national security and sovereignty remains
protected.

                          ____________________
