Watch the latest videos on YouTube.com

| Cryptome DVDs are offered by Cryptome. Donate $25 for two DVDs of the Cryptome 12-and-a-half-years collection of 47,000 files from June 1996 to January 2009 (~6.9 GB). Click Paypal or mail check/MO made out to John Young, 251 West 89th Street, New York, NY 10024. The collection includes all files of cryptome.org, cryptome.info, jya.com, cartome.org, eyeball-series.org and iraq-kill-maim.org, and 23,100 (updated) pages of counter-intelligence dossiers declassified by the US Army Information and Security Command, dating from 1945 to 1985.The DVDs will be sent anywhere worldwide without extra cost.

Web | cryptome.org | cryptome.info | jya.com | eyeball-series.org | cryptome.cn

7 May 1999

    See parts 2, 3, 4 and 5:
    http://jya.com/hr106-117-p2.htm
    http://jya.com/hr106-117-p3.htm
    http://jya.com/hr106-117-p4.htm
    http://jya.com/hr106-117-p5.htm

    Source: http://www.access.gpo.gov/su_docs/aces/fr-cont.html

    -----------------------------------------------------------------------

    [DOCID: f:hr117p1.106]
    From the House Reports Online via GPO Access
    [wais.access.gpo.gov]

    106th Congress                                            Rept. 106-117
      1st Session           HOUSE OF REPRESENTATIVES              Part 1

    =======================================================================

               SECURITY AND FREEDOM THROUGH ENCRYPTION (SAFE) ACT

                                    _______

                     April 27, 1999.--Ordered to be printed

                                    _______

    Mr. Coble, from the Committee on the Judiciary, submitted the following

                                  R E P O R T

                                 together with

                                ADDITIONAL VIEWS

                            [To accompany H.R. 850]

          [Including cost estimate of the Congressional Budget Office]

      The Committee on the Judiciary, to whom was referred the bill
    (H.R. 850) to amend title 18, United States Code, to affirm the
    rights of United States persons to use and sell encryption and
    to relax export controls on encryption, having considered the
    same, report favorably thereon without amendment and recommend
    that the bill do pass.

                                    CONTENTS

                                                                       Page
    Purpose and Summary..............................................     2
    Background and Need for Legislation..............................     2
     I. Background...................................................     2
            A. What is Encryption?...................................     2
            B. Issues in the Encryption Debate.......................     3
              1. Arguments Relating to the Domestic Use of Encryption     3
              2. The White House Initiative..........................     4
              3. Arguments Relating to Export Controls on Encryption
                  Products...........................................     6
              4. Recent Litigation...................................     6
    II. Need for Legislation.........................................     7
            A. Sections 2 and 4--Domestic Use of Encryption..........     7
            B. Section 3--Export Controls............................     8
    Hearings.........................................................     9
    Committee Consideration..........................................     9
    Vote of the Committee............................................     9
    Committee Oversight Findings.....................................     9
    Committee on Government Reform Findings..........................     9
    New Budget Authority and Tax Expenditures........................     9
    Congressional Budget Office Cost Estimate........................     9
    Constitutional Authority Statement...............................    12
    Section-by-Section Analysis......................................    12
    Agency Views.....................................................    14
    Changes in Existing Law Made by the Bill, as Reported............    23
    Additional Views.................................................    30

                              Purpose and Summary

        The widespread use of strong encryption to encode digital
    communications will prevent crime, economic espionage, and
    information warfare. Unfortunately, this country's current
    encryption policy discourages the use of encryption. H.R. 850,
    the ``Security and Freedom Through Encryption (SAFE) Act,''
    makes a series of changes to U.S. encryption policy which will
    facilitate the use of encryption.
        Current policy does not restrict the domestic use, sale, or
    import of encryption. Section 2 of H.R. 850 generally codifies
    that policy by affirmatively prohibiting restrictions on the
    domestic use and sale of encryption. It also prohibits the
    government from imposing a mandatory key escrow system,
    allowing voluntary systems to develop in the marketplace, and
    provides criminal penalties for the knowing and willful use of
    encryption to avoid detection of other federal felonies.
        At the same time, however, the export of strong encryption
    products is tightly restricted under the export control laws.
    Section 3 of H.R. 850 significantly relaxes those export
    controls. In addition, section 4 requires that the Attorney
    General compile statistics on instances in which these new
    policies may interfere with the enforcement of federal criminal
    laws.

                    Background and Need for the Legislation

    I. Background

                A. What is Encryption?
        Encryption is the process of encoding data or
    communications in a form that only the intended recipient can
    understand. Until fairly recently, society generally considered
    encryption to be the exclusive domain of national security and
    law enforcement agencies. However, with the advent of computers
    and digital electronic communications, encryption's importance
    to persons and companies in the private sector has increased
    because they want to transmit data securely. Many people feel
    that the Internet has not succeeded as a commercial medium as
    well as it might because those who want to use it do not feel
    the data transmitted is secure. For example, people do not want
    to transmit their credit card numbers when hackers may steal
    those numbers.
        To understand the issues involved, one must understand some
    basic terminology. In the digital world, data are communicated
    in a string of ones and zeroes that computers understand, but
    the average person does not. An encryption scheme converts ones
    to zeroes and zeroes to ones according to an algorithm or
    mathematical formula. The intended recipient knows the formula
    or ``key'' which he uses to decode the encrypted data.
        The complexity and quality of an encryption scheme
    determines how difficult it is to break the code and therefore
    how well the scheme protects the data. One factor determining
    the complexity of the encryption scheme is the length of the
    key. The length of the key is usually expressed as a number
    known as the ``bit length.'' A bit is one digit in the key. A
    bit length of 40 is considered relatively weak, whereas a bit
    length of 128 is considered very strong.
        However, a bit length of 40 is not 3.2 times weaker than a
    bit length of 128 because this is an exponential scale, not an
    arithmetic one. A bit length of 40 has 2 \40\ possible keys,
    whereas a bit length of 128 has 2 \128\ possible keys. To give
    some practical sense of the difference, one researcher
    estimated that a relatively inexpensive computer attempting a
    ``brute force'' effort to decode--i.e. simply trying all the
    mathematical possibilities--could on average decode a 40-bit
    scheme in a few seconds, whereas a 128-bit scheme would on
    average take millions of years. Although there is no assurance
    that this estimate is accurate, it does give a general sense of
    the exponential differences in complexity that flow from an
    increase in bit length.
                B. Issues in the Encryption Debate
        The encryption debate encompasses two main issues. The
    first issue is whether the domestic use and sale of encryption
    products should be restricted, and in particular, whether
    domestic users should be required to place their keys in escrow
    with the government or some other neutral third party, e.g. an
    existing computer company or an entity created solely for the
    purpose of holding keys. Current law does not have any such
    restrictions.
        The second issue is whether the export of encryption
    products should be restricted. As discussed in more detail
    below, current law regulates the export of encryption products
    under two statutes: (1) the Arms Export Control Act (``AECA''),
    22 U.S.C. Sec. 2751 et seq., and its accompanying International
    Trafficking in Arms Regulations (``ITAR''), 22 C.F.R. Sec. 120
    et seq., and (2) the Export Administration Act (``EAA''), 50
    U.S.C. App. Sec. 2401 et seq., and its accompanying Export
    Administration Regulations (``EAR''), 15 C.F.R. Sec. 730 et
    seq. Although the EAA expired in 1994, President Clinton kept
    its provisions in force by invoking his powers under the
    International Emergency Economic Powers Act, 50 U.S.C.
    Sec. 1701 et seq. Executive Order 12924 (August 19, 1994); 59
    Fed. Reg. 43437 (August 23, 1994).
                1. Arguments Relating to the Domestic Use of Encryption
        Law enforcement and national security agencies believe that
    they need some form of key escrow system to maintain their
    ability toperform legitimate wiretaps and to read computer data
    seized through lawful means. They have argued that widespread use of
    strong encryption without key escrow would end the use of wiretapping
    as a tool for fighting crime. For example, they have argued that
    instances occur when law enforcement agencies learn in the course of a
    wiretap that someone is about to commit a serious crime. If strong
    encryption prevented a contemporaneous understanding of this
    information, the agencies would not be able to prevent the crime.
    Likewise, if strong encryption prevented the reading of lawfully seized
    computer data, it could unreasonably delay criminal investigations.
    They further have argued that a key escrow system would have the
    salutary side effect of providing a backup for those users who might
    lose their keys. Although they contend that they only favor a voluntary
    key escrow system, many believe that the use of export controls as
    leverage to encourage the use of a key escrow system effectively
    amounts to making such a system mandatory.
        The computer industry, the American business community, and
    privacy groups vehemently oppose any mandatory key escrow
    system. They argue that a mandatory system would unnecessarily
    invade the privacy of users and that the market should develop
    any voluntary key escrow system. They believe that law
    enforcement can gain access to keys through traditional means
    for obtaining evidence and that those with criminal intent will
    not use key escrow products, thus defeating the purpose of the
    Administration's policy. They argue that our law and tradition
    do not require private citizens to take positive action to
    assist the government in surveilling them in any other
    instance.
        Moreover, they contend that private citizens should not be
    required to give access to their most precious assets to anyone
    else regardless of whether it is the government or a third
    party. In the digital age, information is often the most
    valuable property that a company owns. They further argue that
    the good that widespread use of encryption can do in preventing
    crime far outweighs the harm done by the relatively few
    instances in which the use of encryption hampers law
    enforcement.
                2. The White House Initiative
        Until 1996, encryption products were treated as munitions
    for export purposes. The State Department has jurisdiction over
    the export of munitions under AECA and ITAR, and it had, as a
    matter of practice, generally only allowed the export of
    encryption products with bit lengths of 40 or less. The State
    Department treated these relatively weak encryption products as
    non-defense products subject to the jurisdiction of the
    Department of Commerce under the Export Administration Act, 50
    U.S.C. App. Sec. 2401 et seq. Beyond that level, any export of
    encryption products required a special license.
        On October 1, 1996, Vice President Gore announced the
    Administration's intention to develop a new policy on the
    export of encryption products. The Vice President's
    announcement stated in part:

              Under this initiative, the export of 56-bit key
            length encryption products will be permitted under a
            general license after one-time review, and contingent
            upon industry commitments to build and market future
            products that support key recovery. This policy will
            apply to hardware and software products. The relaxation
            of controls will last up to two years.
              Exporters of 56-bit DES or equivalent encryption
            products would make commitments to develop and sell
            products that support the key recovery system that I
            announced in July. That vision presumes that a trusted
            party (in some cases internal to the user's
            organization) would recover the user's confidentiality
            key for the user or for law enforcement officials
            acting under proper authority. Access to keys would be
            provided in accordance with destination country
            policies and bilateral understandings. No key length
            limits or algorithm restrictions will apply to exported
            key recovery products.
              Under the relaxation, six-month general export
            licenses will be issued after one-time review,
            contingent on commitments from exporters to explicit
            benchmarks and milestones for developing and
            incorporating key recovery features into their products
            and services, and for building the supporting
            infrastructure internationally. Initial approval will
            be contingent on firms providing a plan for
            implementing key recovery. The plan will explain in
            detail the steps the applicant will take to develop,
            produce, distribute, and/or market encryption products
            with key recovery features. The specific commitments
            will depend on the applicant's line of business.
              The government will renew the licenses for additional
            six-month periods if milestones are met. Two years from
            now, the export of 56-bit products that do not support
            key recovery will no longer be permitted. Currently
            exportable 40-bit mass market software products will
            continue to be exportable. We will continue to support
            financial institutions in their efforts to assure the
            recovery of encrypted financial information. Longer key
            lengths will continue to be approved for products
            dedicated to the support of financial applications.

    Statement of the Vice President dated October 1, 1996 (emphasis
    added).
        On November 15, 1996, President Clinton issued Executive
    Order 13026, 61 Fed. Reg. 58767 (November 19, 1996), and an
    accompanying Presidential Memorandum which began the
    implementation of the policy outlined in the October 1
    statement. Among other things, the executive order and the
    memorandum transferred all non-military encryption products to
    the Commerce Control List, meaning that their licensing for
    export would be overseen by the Department of Commerce under
    the EAA. The order and memorandum also gave the Department of
    Justice a significant voice in such licensing decisions. On
    December 30, 1996, the Department of Commerce promulgated
    regulations that implemented the new policy. 61 Fed. Reg. 68572
    (December 30, 1996).
        On September 16, 1998, the Administration announced an
    update to its encryption policy. Among its provisions, the new
    policystates U.S. firms can export any level of encryption to
    their foreign subsidiaries, except for certain terrorist states. The
    policy will also permit export of encryption products over 56-bit to 46
    countries without a license to certain industries including banks,
    insurance companies, hospitals, HMO's, medical labs, civilian
    government agencies, non military health organizations, and online
    merchants (for example, communications between merchants and customers,
    like buying a book or clothes from an online catalog). A Tech Center
    will be created whose stated purpose is to help law enforcement
    understand technology. Under the updated policy, exports to countries
    other than the 46 specific countries require a license, although the
    application has a presumption of approval; 56-bit encryption can be
    exported without restriction after a one-time review. The policy fails
    to codify the current right of all Americans to use any type of
    encryption they choose. This omission opens the door for the
    Administration to change its domestic encryption policy in the future
    without congressional authorization. For key recovery products, the
    policy directs proponents will need a license to export to foreign
    commercial firms but not for export to telecommunications companies or
    Internet service providers. The new Administration policy will be
    reviewed after one year.
                3. Arguments Relating to Export Controls on Encryption
                        Products
        The Administration has to date opposed any lifting of
    export controls beyond that in its recent initiatives. It
    argues that the controls are still effective and that our
    allies would dislike the negative effect on law enforcement
    efforts if we lifted the controls. It also argues that the
    lifting of the controls might not help business because other
    countries would impose import controls. Finally, the
    Administration argues that it is making efforts under its new
    policy to find ways to relax the controls on a case by case
    basis.
        The computer industry and the privacy groups argue that the
    Administration ought to substantially relax, if not eliminate
    the controls. They argue that wrongdoers can easily evade them
    because many encryption products are available to anyone over
    the Internet. At least one estimate contends that over 650
    strong and reliable products are available worldwide. They also
    argue that the controls are easily evaded because as a
    practical matter, anyone can come into the United States, buy
    encryption products, and take them out of the country with
    little risk of detection. Because the controls are so easily
    evaded, they further argue that the controls serve only to put
    American companies at a competitive disadvantage and to
    discourage investment in the development of better encryption
    products. If the situation does not change, they believe that
    American companies will no longer dominate this field.
        In addition, they contend that the Administration's new
    policy is a backdoor attempt to force the domestic use of
    encryption with key escrow. Under the policy, a company that
    wants both to sell encryption products here and abroad must
    either make two versions of its product or sell only a product
    the meets the export restrictions. They also question whether
    the carrot and stick approach the new policy takes is a
    legitimate and logical use of export controls. Current
    encryption products of the 56-bit strength are either safe to
    export or they are not--a company's compliance or noncompliance
    with the Administration's directives regarding future products
    will not change that.
                4. Recent Litigation
        At least two plaintiffs have challenged the
    Administration's policies regarding encryption. In one case,
    the United States District Court for the District of Columbia
    ruled that the government's decision to designate an encryption
    product as a munition, and therefore restrict its export, was
    not subject to judicial review. Karn v. Department of State,
    925 F.Supp. 1 (D.D.C. 1996), remanded, 1997 U.S. App. Lexis
    3123 (D.C. Cir. 1997). The Court further held that the export
    restriction on the product was content neutral and narrowly
    tailored and therefore did not violate the First Amendment. The
    District of Columbia Circuit Court of Appeals remanded the case
    for further consideration in light of the Administration's new
    policy.
        In the other case, the United States District Court for the
    Northern District of California ruled that the export
    restrictions on encryption products were unconstitutional prior
    restraints on free speech because they did not have adequate
    procedural safeguards. Bernstein v. Department of State, 945
    F.Supp. 1279 (N.D. Cal. 1996). Upon further review, the Court
    concluded that the regulation of encryption products is not
    prohibited by law and that the First Amendment does not remove
    encryption technology entirely from all government regulation.
    However, the Court ruled in favor of the plaintiff as it
    applied to his publishing of scientific papers, algorithms, or
    computer programs. Bernstein v. Department of State, 974
    F.Supp. 1288 (N.D. Cal. 1997).

    II. Need for the Legislation

                A. Sections 2 and 4--Domestic Use of Encryption
        The Committee believes that sections 2 and 4 of H.R. 850,
    as reported by the Committee, will significantly aid the fight
    against crime. Both sides of the debate agree that the use of
    strong encryption will help users to prevent crimes before they
    happen. As we increasingly depend on computers to control our
    national infrastructure, the danger of information warfare and
    economic espionage also increase. The use of strong encryption
    diminishes that terrifying prospect.
        The affirmative statements in new sections 2802 and 2803
    that it is legal for persons in the United States and for
    United States persons abroad to use, and for persons in the
    United States to sell, encryption will encourage the use of
    encryption to fight crime. These sections only state what the
    Committee understands to be existing law, and therefore they
    should not worsen any law enforcement and national security
    concerns. By making these affirmative statements of positive
    law, the bill will prevent any reduction of the existing right
    to use or sell encryption domestically by administrative
    action, state law, or other means.
        New section 2804 effectively prohibits the imposition of
    any mandatory key escrow system. The Committee believes that
    Americans should not be forced to surrender the keys to their
    data withoutproper justification any more than they should be
    forced to surrender the keys to their homes. The limited circumstances
    under which law enforcement and national security officers may obtain
    access to the private spaces of Americans have stood the test of time.
    They exist for good reasons that are well understood by all. The advent
    of a new technology is not a sufficient justification for diminishing
    these historic protections.
        At the same time, however, new section 2804 preserves
    existing authorities for law enforcement and national security
    officers to obtain keys for legitimate purposes. Just as new
    technology should not take away the longstanding rights of
    citizens against government, it also should not take away the
    traditional means for legitimate law enforcement and national
    security investigations. However, the Committee does not
    believe that the advance of technology warrants a system of
    forcing people to deposit their keys with any third party
    without proper justification. Thus, new section 2804 prohibits
    any such system.
        Despite the Committee's opposition to any mandatory key
    escrow system, nothing in section 2804 should be construed to
    prevent or hinder the development of a voluntary key escrow
    system if the market demands it. Such a system may have many
    benefits so long as users are allowed to choose freely whether
    to join. If enough users desire it, the Committee believes that
    the market will develop it.
        In addition to the preservation of existing law enforcement
    authorities to obtain keys for legitimate purposes in new
    section 2804, new section 2805 further aids law enforcement and
    national security by making it a crime to avoid detection of
    another federal felony through the knowing and willful use of
    encryption. This section gives the government another tool with
    which to fight the misuse of encryption; however, it also
    states that the mere use of encryption alone cannot be the
    basis for establishing probable cause with respect to a search
    warrant or in a criminal investigation.
        Section 4 requires the Attorney General to compile and make
    available to Congress information on instances in which
    encryption interferes with the enforcement of the federal
    criminal law. This requirement will assist the Committee in
    determining whether to make any further changes to encryption
    policy. It will also foster a continuing dialogue between the
    Congress and the executive branch on these matters. Through all
    of these means, the Committee believes that it has carefully
    balanced the needs of law abiding citizens against those of the
    law enforcement and national security agencies as to the
    matters within its jurisdiction.
                B. Section 3--Export Controls
        Section 3 of H.R. 850 significantly relaxes existing export
    controls on encryption products. Because Section 3 amends the
    Export Administration Act of 1979, it falls within the
    jurisdiction of the House Committee on International Relations.
    The International Relations Committee has been given a
    secondary referral of H.R. 850 for consideration of Section 3.
        For that reason, the Committee on the Judiciary did not
    address Section 3 during its consideration of H.R. 850.
    However, the Committee realizes that export controls must be
    addressed as part of any comprehensive national encryption
    policy. The Committee believes that it has carefully balanced
    the interests involved in the matters under its jurisdiction.
    It stands ready to work with the Committee on International
    Relations, the Administration, and all other interested parties
    in an effort to develop a similar, but more comprehensive,
    balancing of all the interests, including those relating to
    export controls, as this legislation moves forward.

                                    Hearings

        On Thursday, March 4, 1999, the Subcommittee on Courts and
    Intellectual Property held a hearing on H.R. 850, the
    ``Security and Freedom Through Encryption (SAFE) Act.'' The
    following individuals testified at the March 4th hearing:
    William Reinsch, Undersecretary of Commerce for Export
    Administration, United States Department of Commerce; Ronald D.
    Lee, Associate Deputy Attorney General, United States
    Department of Justice; Barbara McNamara, Deputy Director,
    National Security Administration; Tom Parenty, Data and
    Communications Security, Sybase, Incorporated; Craig
    McLaughlin, Chief Technology Officer, Privada, Incorporated;
    Grover Norquist, President, Americans for Tax Reform; Professor
    Dorothy E. Denning, Georgetown University; Alan B. Davidson,
    Staff Counsel, Center for Democracy and Technology; Ed
    Gillespie, Executive Director, Americans for Computer Privacy;
    and Dave McCurdy, President, Electronic Industries Alliance.

                            Committee Consideration

        On March 11, 1999, the Subcommittee on Courts and
    Intellectual Property met in open session and ordered reported
    the bill H.R. 850 without amendment, by a voice vote, a quorum
    being present. On March 24, 1999, the Committee met in open
    session and ordered reported favorably the bill H.R. 850
    without amendment, by a voice vote, a quorum being present.

                             Vote of the Committee

        During their consideration of H.R. 850, the Committee and
    the Subcommittee took no rollcall votes.

                          Committee Oversight Findings

        In compliance with clause 3(c)(1) of rule XI of the Rules
    of the House of Representatives, the Committee reports that the
    findings and recommendations of the Committee, based on
    oversight activities under clause 2(b)(1) of rule X of the
    Rules of the House of Representatives, are incorporated in the
    descriptive portions of this report.

             Committee on Government Reform and Oversight Findings

        No findings or recommendations of the Committee on
    Government Reform and Oversight were received as referred to in
    clause 3(c)(4) of rule XIII of the Rules of the House of
    Representatives.

                   New Budget Authority and Tax Expenditures

        Clause 3(c)(2) of House rule XIII is inapplicable because
    this legislation does not provide new budgetary authority or
    increased tax expenditures.

                   Congressional Budget Office Cost Estimate

        In compliance with clause 3(c)(3) of rule XIII of the Rules
    of the House of Representatives, the Committee sets forth, with
    respect to the bill, H.R. 850, the following estimate and
    comparison prepared by the Director of the Congressional Budget
    Office under section 402 of the Congressional Budget Act of
    1974:

                                         U.S. Congress,
                                   Congressional Budget Office,
                                        Washington, DC, April 21, 1999.
    Hon. Henry J. Hyde,
    Chairman, Committee on the Judiciary,
    House of Representatives, Washington, DC.
        Dear Mr. Chairman: The Congressional Budget Office has
    prepared the enclosed cost estimate for H.R. 850, the Security
    and Freedom Through Encryption (SAFE) Act.
        If you wish further details on this estimate, we will be
    pleased to provide them. The CBO staff contacts are Mark
    Grabowicz (for costs of the Justice Department) and Mark Hadley
    (for costs of the Commerce Department), Hester Grippando (for
    revenues), and Leo Lex (for the state and local impact).
                Sincerely,
                                              Dan L. Crippen, Director.
        Enclosure.

    H.R. 850--Security and Freedom Through Encryption (SAFE) Act
                Summary
        H.R. 850 would allow individuals in the United States to
    use and sell any form of encryption and would prohibit states
    or the federal government from requiring individuals to
    relinquish the key to encryption technologies to any third
    party. The bill also would prevent the Bureau of Export
    Administration (BXA) in the Department of Commerce from
    restricting the export of most nonmilitary encryption products.
    H.R. 850 would establish criminal penalties and fines for the
    use of encryption technologies to conceal incriminating
    information relating to a felony from law enforcement
    officials. Finally, the bill would require the Attorney General
    to maintain data on the instances in which encryption impedes
    or obstructs the ability of the Department of Justice (DOJ) to
    enforce the criminal laws.
        Assuming appropriation of the necessary amounts, CBO
    estimates that implementing H.R. 850 would result in additional
    discretionary spending, by DOJ, of $3 million to $5 million
    over the 2000-2004 period. (The department's spending for
    activities related to encryption exports is negligible under
    current law.) Enacting H.R. 850 also would affect direct
    spending and receipts, beginning in fiscal year 2000, through
    the imposition of criminal fines and the resulting spending
    from the Crime Victims Fund. Therefore, pay-as-you-go
    procedures would apply. CBO estimates, however, that the
    amounts of additional direct spending and receipts would not be
    significant.
        H.R. 850 contains no new private-sector mandates as defined
    in the Unfunded Mandates Reform Act (UMRA). The bill would
    preempt state laws that require the use of encryption products
    or services in a number of circumstances. These preemptions
    would be intergovernmental mandates as defined in UMRA, but the
    cost to states would be small and would not exceed the
    threshold established in UMRA ($50 million in 1996, adjusted
    annually for inflation).
                Estimated Cost to the Federal Government
        The expense of compiling and maintaining data on the
    instances in which encryption impedes or obstructs the ability
    of the department to enforce the criminal laws is difficult to
    ascertain because the number of such instances is unknown--but
    DOJ believes that if H.R. 850 were enacted they would be
    numerous. CBO estimates that such efforts would cost DOJ
    between $500,000 and $1 million a year, assuming appropriation
    of the necessary amounts. These costs would fall within budget
    function 750 (administration of justice).
        Under current policy, BXA would likely spend about $500,000
    a year reviewing exports of encryption products, pursuant to a
    November 1996 executive order and memorandum that authorized
    BXA to control the export of all nonmilitary encryption
    products. If H.R. 850 were enacted, BXA would still be required
    to review requests to export most computer hardware and
    software with encryption capabilities. Thus, enacting H.R. 850
    would not significantly affect BXA's spending.
        CBO estimates that the collections from criminal fines
    established by the bill--for the use of encryption technologies
    to conceal incriminating information relating to a felony--
    would not be significant.
                Pay-As-You-Go Considerations
        The Balanced Budget and Emergency Deficit Control Act sets
    up pay-as-you-go procedures for legislation affecting direct
    spending or receipts. H.R. 850 would affect direct spending and
    receipts by imposing criminal fines for encrypting
    incriminating information related to a felony. Collections from
    such fines are likely to be negligible, however, because the
    federal government would probably not pursue many additional
    cases under the bill. Any such collections would be recorded in
    the budget as governmental receipts, or revenues. They would be
    deposited in the Crime Victims Fund and spent the following
    year. Because the increase in direct spending would be the same
    as the amount of fines collected with a one-year lag, the
    additional direct spending would also be negligible.
                Estimated Impact on State, Local, and Tribal Governments
        H.R. 850 would preempt state laws that require encryption
    keys to be built into computer systems or to be registered with
    anoutside entity or retained by the owner. The bill would also
    preempt state laws that require the use of encryption for
    authenticating documents or for ensuring their confidentiality. Both
    preemptions would be mandates as defined in UMRA. The preemptions of
    state law would apply to all entities in the state, but they would also
    prevent the states themselves from using certain types of encryption
    technology. The direct impact on state budgets would depend upon the
    degree to which they are using and will use such technology. Most
    states have not implemented electronic systems that use encryption, so
    the impact of the bill on current operations would be small.
        CBO has no basis for predicting the degree to which states
    would use encryption technology in the future in the absence of
    this legislation. Encryption that is prohibited by the bill
    includes the scrambling of electronically stored or transmitted
    information in order to preserve confidentiality, integrity, or
    authenticity. Thus, the bill may preclude states from using
    digital signatures to send or receive legal documents
    electronically. Digital signatures consist of a stream of
    electronically coded text that uses the body of the document
    itself, along with unique identifying information about the
    sender, to authenticate the document and its sender. They are
    generated through the use of mathematical algorithms, and they
    can be validated by using electronic keys.
        The use of digital signatures would provide options to
    states and other entities that wish to send legal documents
    electronically, rather than as hard copies. Resulting
    reductions in paperwork and distribution costs could lead to
    cost savings. However, CBO estimates that any lost savings or
    other costs of the mandates to states would not exceed the
    threshold established in UMRA ($50 million in 1996, adjusted
    annually for inflation).
                Estimated Impact on the Private Sector
        This bill would impose no new private-sector mandates as
    defined in UMRA.
                Estimate Prepared By:
        Federal Costs: Mark Grabowicz for DOJ and Mark Hadley for
    BXA.
        Revenues: Hester Grippando.
        Impact on State, Local, and Tribal Governments: Leo Lex.
                Estimate Approved By:
        Robert A. Sunshine, Deputy Assistant Director for Budget
    Analysis.
        [See Additional Views, Statement of Representative Bob
    Goodlatte disagreeing with the CBO letter.]

                       Constitutional Authority Statement

        Pursuant to clause 3(d)(1) of rule XIII of the Rules of the
    House of Representatives, the Committee finds the authority for
    this legislation in Article I, section 8 of the Constitution.

                          Section-by-Section Analysis

    Section 1. Title

        This section states that the title of the bill is the
    Security and Freedom Through Encryption (SAFE) Act.

    Section 2. Domestic use and sale of encryption; prohibition on
            mandatory key escrow; use of encryption in furtherance of a
            federal felony

        This section creates a new chapter in title 18 of the U.S.
    Code regarding the use and sale of encryption within the United
    States, the prohibition of a mandatory key escrow system, and
    the unlawful use of encryption in furtherance of a criminal
    act.
        New section 2801 contains a series of definitions relating
    to encryption. New section 2802 states that it is legal for any
    person in the United States or any United States person in a
    foreign country to use any form of encryption.
        New section 2803 states that it is legal for any person in
    the United States to sell any type of encryption product in
    interstate commerce. New section 2804 prohibits the federal
    government or a state from requiring or conditioning approval
    on a requirement that encryption products be built with a
    third-party access feature (also known as ``key escrow'' or
    ``key recovery'') or that persons with control over decryption
    keys provide access to someone other than the key owner. This
    section also prohibits the federal government or a state from
    establishing conditions, ties, or links between encryption
    products and the issuance of certificate authorities or digital
    signatures. Exceptions to this section exist for law
    enforcement or intelligence officers seeking access to
    encrypted information and where the federal government or a
    state wishes to use key escrow/key recovery encryption for its
    own systems.
        New section 2805 makes it a crime to use encryption
    unlawfully in furtherance of some other crime. This new crime
    is punishable with a sentence of 5 years for a first offense
    and 10 years for a second or subsequent offense. To trigger the
    provisions of this section, a person must be convicted of or
    plead guilty to a federal felony in which the person knowingly
    and willfully used encryption to conceal that felony for the
    purpose of avoiding detection by law enforcement. This section
    also states that the use of encryption cannot, by itself, be
    the basis for establishing probable cause with respect to a
    criminal offense or a search warrant.

    Section 3. Exports of encryption

        This section makes a series of changes to the export of
    encryption products. Subsection (a) amends the Export
    Administration Act of 1979 by creating a new subsection (g)
    regarding encryption products and products containing
    encryption or encryption capabilities.
        New subsection (g)(1) places all encryption products,
    except those specifically designed or modified for military
    use, under the jurisdiction of the Secretary of Commerce. New
    subsection (g)(2) states that after a one-time, 15-day
    technical review by the Secretary, no export license may be
    required for generally available encryption software and
    hardware products, generally available products containing
    encryption, generally available products with
    encryptioncapabilities, technical assistance and data used to install
    or maintain generally available encryption products, products
    containing encryption, and products with encryption capabilities, and
    encryption products not used for confidentiality purposes.
        New subsection (g)(3) states that after a one-time, 15-day
    technical review by the Secretary, the Secretary shall allow
    the export of custom-designed encryption products and custom-
    designed products with encryption capabilities if those
    products are permitted for use by banks or if comparable
    products are commercially available outside the U.S. An
    exception to this subsection exists if there is substantial
    evidence that these products will be diverted or modified for
    military or terrorist use or reexported without authorization.
        New subsection (g)(4) creates a series of definitions
    relating to encryption products, products containing
    encryption, products containing encryption capabilities, and
    the export of such products for this subsection.
        Subsection (b) states that encryption products that do not
    require an export license as of the date of enactment of this
    Act shall not require an export license on or after that date.
        Subsection (c) states that nothing in this Act shall limit
    the authority of the President to prohibit the export of
    encryption products to terrorist nations or nations that have
    been determined to repeatedly support acts of international
    terrorism, or to impose an embargo on exports to and imports
    from a specific country. This subsection also allows the
    Secretary of Commerce to prohibit the export of specific
    encryption products to specific individuals or organizations in
    specific foreign countries, if the Secretary determines that
    there is substantial evidence that such products will be used
    for military or terrorist purposes.
        Subsection (d) deems that the Export Administration Act of
    1979 be in effect for the purpose of carrying out the amendment
    contained in this section of the bill.

    Section 4. Study on the effect of encryption on law enforcement
            activities

        This section requires the Attorney General to compile
    information on the instances in which encryption has interfered
    with, impeded, or obstructed the ability of the Justice
    Department to enforce the criminal laws of the United States.

                                  Agency Views

                                 Department of Justice,
                               Federal Bureau of Investigation,
                                         Washington, DC, March 3, 1999.
    Hon. Howard Coble,
    Chairman, Subcommittee on Courts and Intellectual Property, Committee
            on the Judiciary, House of Representatives, Washington, DC.
        Dear Mr. Chairman:  Enclosed please find copies of
    resolutions and letters from various law enforcement
    associations and groups which set forth their positions
    concerning encryption. Even though these letters were prepared
    during the last Congress, the positions set forth in them
    remain unchanged. You and the Members of the Subcommittee may
    find this information helpful as you begin consideration of
    H.R. 850, the ``Security and Freedom Through Encryption (SAFE)
    Act,'' a bill to relax existing export controls on encryption.
        Encryption is becoming a fact of everyday life in today's
    information age and a natural consequence of technology.
    Encryption is extremely beneficial when used legitimately to
    protect sensitive electronically stored information and the
    privacy of communications. But the use of strong, unbreakable
    encryption by hostile governments and by criminals and
    terrorists for illegal purposes poses a significant and
    unacceptable threat to our national security capabilities.
        As you know, export controls on encryption products exist
    primarily to protect national security and foreign policy
    interests. On occasion, U.S. law enforcement is provided with
    valuable criminal-related information obtained through our
    Nation's intelligence gathering efforts. Law enforcement
    believes that such intelligence gathering capabilities derived,
    in part, from export controls on encryption should be
    preserved.
        The law enforcement community continues to support the
    adoption of a balanced encryption policy. Such a balanced
    policy must satisfy the needs of commerce and communications
    privacy, the national security needs of the Intelligence
    Community as well as the public safety needs of law
    enforcement. We look forward to working with the Subcommittee
    and the Congress in an effort to develop a balanced encryption
    policy that effectively addresses all parties' concerns
    regarding this most important privacy, commerce, national
    security and public safety issue.
                Sincerely yours,
                                   John E. Collingwood,
                                  Assistant Director, Office of
                                      Public and Congressional Affairs.
                                    ------

                 International Association of Chiefs of Police

                                   Encryption

                      Submitted by: Legislative Committee

                                    L006.a96

        Whereas, the introduction of digitally-based
    telecommunications technologies, as well as the widespread use
    of computers and computer networks having encryption
    capabilities are facilitating the development and production of
    affordable and robust encryption products for private sector
    use; and
        Whereas, on one hand encryption is extremely beneficial
    when used legitimately to protect commercially sensitive
    information and communications. On the other hand, the
    potential use of such encryption products by a vast array of
    criminals and terrorists to conceal their criminal
    communications and information from law enforcement poses an
    extremely serious threat to public safety; and
        Whereas, the law enforcement community is extremely
    concerned about the serious threat posed by the use of robust
    encryption products that do not allow for law enforcement
    access and its timely decryption, pursuant to lawful
    authorization (court-authorized wiretaps or court-authorized
    search and seizure); and
        Whereas, law enforcement fully supports a balanced
    encryption policy that satisfies both the commercial needs of
    industry for robust encryption while at the same time
    satisfying law enforcement's public safety needs; and
        Whereas, law enforcement has found that robust key-escrow
    encryption is clearly the best way, and perhaps the only way,
    to achieve both the goals of industry and law enforcement; and
        Whereas, government representatives have been working with
    industry to encourage the voluntary development, sale, and use
    of key-escrow encryption in its pursuit of a balanced
    encryption policy; now, therefore, be it
        Resolved, That the International Association of Chiefs of
    Police, duly assembled at its 103rd annual conference in
    Phoenix, Arizona, supports and encourages the development and
    adoption of a key-escrow encryption policy, which we believe
    represents a policy that appropriately addresses both the
    commercial needs of industry while at the same time satisfying
    law enforcement's public safety needs and that we oppose any
    efforts, legislative or otherwise, that would under cut the
    adoption of such a balanced encryption policy.
                                    ------

                         National Sheriffs' Association

                                   Resolution

                     Digital Telecommunications Encryption

        Whereas, the introduction of digitally-based
    telecommunications technologies as well as the widespread use
    of computers and computer networks having encryption
    capabilities are facilitating the development and production of
    affordable and robust encryption products for private sector
    use; and
        Whereas, on one hand encryption is extremely beneficial
    when used legitimately to protect commercially sensitive
    information and communications. On the other hand, the
    potential use of such encryption products by a vast array of
    criminals and terrorists to conceal their criminal
    communications and information from law enforcement poses an
    extremely serious threat to public safety; and
        Whereas, the law enforcement community is extremely
    concerned about the serious threat posed by the use of robust
    encryption products that do not allow for court authorized law
    enforcement access and its timely decryption, pursuant to
    lawful authorization; and
        Whereas, law enforcement fully supports a balanced
    encryption policy that satisfies both the commercial needs of
    industry for robust encryption while at the same time
    satisfying law enforcement's public safety needs; and
        Whereas, law enforcement has found that robust key-escrow
    encryption is clearly the best way, and perhaps the only way,
    to achieve both the goals of industry and law enforcement; and
        Whereas, government representatives have been working with
    industry to encourage the voluntary development, sale, and use
    of key-escrow encryption in its pursuit of a balanced
    encryption policy; and
        Therefore be it resolved, That the National Sheriff's
    Association supports and encourages the development and
    adoption of a key-escrow encryption policy which we believe
    represents a policy that appropriately addresses both the
    commercial needs of industry while at the same time satisfying
    law enforcement's public safety needs and that we oppose any
    efforts, legislatively or otherwise, that would undercut the
    adoption of such a balanced encryption policy.

              Adopted at a meeting of the Membership on this 19th
            day of June, 1996 in Portland, Oregon
                                    ------

                    National District Attorneys Association

                                   Resolution

                                   Encryption

        Whereas, the introduction of digitally-based
    telecommunications technologies as well as the widespread use
    of computers and computer networks having encryption
    capabilities are facilitating the development and production of
    strong, affordable encryption products and services for private
    sector use; and
        Whereas, on one hand the use of strong encryption products
    and services are extremely beneficial when used legitimately to
    protect commercially sensitive information and communications.
    On the other hand, the potential use of strong encryption
    products and services that do not allow for timely law
    enforcement decryption by a vast array of criminals and
    terrorists to conceal their criminal communications and
    information from law enforcement poses an extremely serious
    threat to public safety; and
        Whereas, the law enforcement community is extremely
    concerned about the serious threat posed by the use of these
    strong encryption products and services that do not allow for
    authorization (court-authorized wiretaps or court-authorized
    search and seizure); and
        Whereas, law enforcement fully supports a balanced
    encryption policy that satisfies both the commercial needs of
    industry for strong encryption while at the same tie satisfying
    law enforcement's public safety needs for the timely decryption
    of encrypted criminal communications and information; and
        Whereas, law enforcement has found that strong key recovery
    encryption products and services are clearly the best way and
    perhaps the only way to achieve both the goals of industry and
    law enforcement; and
        Whereas, government representatives have been working with
    industry to encourage the voluntary development, sale, and use
    of key recovery encryption products and services in its pursuit
    of a balanced encryption policy;
        Be it resolved, That the National District Attorneys
    Association supports and encourages the development and
    adoption ofa balanced encryption policy that encourages the
    development, sale, and use of key recovery encryption products and
    services, both domestically and abroad. We believe that this approach
    represents a policy that appropriately addresses both the commercial
    needs of industry while at the same time satisfying law enforcement's
    public safety needs.
                                    ------

                                           Major Cities Chiefs,
                                            Chicago, IL, July 24, 1997.
    Hon. Orrin G. Hatch,
    Chairman, Judiciary Committee,
    Senate Hart Office Building, Washington, DC.
        Dear Mr. Chairman: The Major Cities Chiefs is a
    professional association of police executives representing the
    largest jurisdictions in the United States. The association
    provides a forum for urban police chiefs, sheriffs and other
    law enforcement chief executives to discuss common problems
    associated with protecting cities with populations exceeding
    500,000 people.
        Congress is considering a variety of legislative proposals
    concerning encryption. Some of these proposals would, in
    effect, make it impossible for law enforcement agencies across
    the country, both on the federal, state and local level, to
    lawfully gain access to criminal telephone conversations or
    electronically stored evidence. Since the impact of these
    proposals would seriously jeopardize public safety, our
    association urges you to support a balanced approach that
    strongly supports commercial and private interests but also
    maintains law enforcements ability to investigate and prosecute
    serious crime.
        While we recognize that encryption is critical to
    communications security and privacy and that commercial
    interests are at stake, we all agree that without adequate
    legislation, law enforcement across the country will be
    severely limited in its ability to combat serious crime. The
    widespread use of non-key recovery encryption ultimately will
    eliminate our ability to obtain valuable evidence of criminal
    activity. The legitimate and lawful interception of
    communications, pursuant to a court order, for the most serious
    criminal acts will be meaningless because of our inability to
    decipher the evidence.
        Encryption is certainly of great importance to the
    commercial interests across this country. However, public
    safety concerns are just as critical and we must not loose
    sight of this. The need to preserve an invaluable investigative
    tool is of the utmost importance in law enforcement's ability
    to protect the public against serious crime.
                Sincerely yours,
                                                Matt Rodriguez,
                                                              Chairman.
                                    ------

                                Office of the Attorney General,
                                         Washington, DC, July 18, 1997.
        Dear Member of Congress: Congress is considering a variety
    of legislative proposals concerning encryption. Some of these
    proposals would, in effect, make it impossible for the Federal
    Bureau of Investigation (FBI), Drug Enforcement Administration
    (DEA), Secret Service, Customs Service, Bureau of Alcohol,
    Tobacco and Firearms, and other federal, state, and local law
    enforcement agencies to lawfully gain access to criminal
    telephone conversations or electronically stored evidence
    possessed by terrorists, child pornographers, drug kingpins,
    spies and other criminals. Since the impact of these proposals
    would seriously jeopardize public safety and national security,
    we collectively urge you to support a different, balanced
    approach that strongly supports commercial and privacy
    interests but maintains our ability to investigate and
    prosecute serious crimes.
        We fully recognize that encryption is critical to
    communications security and privacy, and that substantial
    commercial interests are at stake. Perhaps in recognition of
    these facts, all the bills being considered allow market forces
    to shape the development of encryption products. We, too, place
    substantial reliance on market forces to promote electronic
    security and privacy, but believe that we cannot rely solely on
    market forces to protect the public safety and national
    security. Obviously, the government cannot abdicate its solemn
    responsibility to protect public safety and national security.
        Currently, of course, encryption is not widely used, and
    most data is stored, and transmitted, in the clear. As we move
    from a plaintext world to an encrypted one, we have a critical
    choice to make: we can either (1) choose robust, unbreakable
    encryption that protects commerce and privacy but gives
    criminals a powerful new weapon, or (2) choose robust,
    unbreakable encryption that protects commerce and privacy and
    gives law enforcement that ability to protect public safety.
    The choice should be obvious and it would be a mistake of
    historic proportions to do nothing about the dangers to public
    safety posed by encryption without adequate safeguards for law
    enforcement.
        Let there be no doubt: without encryption safeguards, all
    Americans will be endangered. No one disputes this fact; not
    industry, not encryption users, no one. We need to take
    definitive actions to protect the safety of the public and
    security of the nation. That is why law enforcement at all
    levels of government--including the Justice Department,
    Treasury Department, the National Association of Attorneys
    General, International Association of Chiefs of Police, the
    Major City Chiefs, the National Sheriffs' Association, and the
    National District Attorneys Association--are so concerned about
    this issue.
        We all agree that without adequate legislation, law
    enforcement in the United States will be severely limited in
    its ability to combat the worst criminals and terrorists.
    Further, law enforcement agrees that the widespread use of
    robust non-key recovery encryption ultimately will devastate
    our ability to fight crime and prevent terrorism.
        Simply stated, technology is rapidly developing to the
    point where powerful encryption will become commonplace both
    for routine telephone communications and for stored computer
    data. Without legislation that accommodates public safety and
    national security concerns, society's most dangerous criminal
    will be able to communicate safely and electronically store
    data without fear of discovery. Court orders to conduct
    electronic surveillance and court-authorized search warrants
    will be ineffectual, and the Fourth Amendment's carefully-
    struck balance between ensuring privacy and protecting public
    safety will be forever altered by technology. Technology should
    not dictate public policy, and it should promote, rather than
    defeat, public safety.
        We are not suggesting the balance of the Fourth Amendment
    be tipped toward law enforcement either. To the contrary, we
    only seek the status quo, not the lessening of any legal
    standard or the expansion of any law enforcement authority. The
    Fourth Amendment protects the privacy and liberties of our
    citizens but permits law enforcement to use tightly controlled
    investigative techniques to obtain evidence of crimes. The
    result has been the freest country in the world with the
    strongest economy.
        Law enforcement has already confronted encryption in high-
    profile espionage, terrorist, and criminal cases. For example:
              An international terrorist was plotting to blow up 11
            U.S.-owned commercial airliners in the Far East. His
            laptop computer, which was seized in Manila, contained
            encrypted files concerning this terrorist plot.
              A subject in a child pornography case used encryption
            in transmitting obscene and pornographic images of
            children over the Internet.
              A major international drug trafficking subject
            recently used a telephone encryption device to
            frustrate court-approved electronic surveillance.
    And this is just the tip of the iceberg. Convicted spy Aldrich
    Ames, for example, was told by the Russian Intelligence Service
    to encrypt computer file information that was to be passed to
    them.
        Further, today's international drug trafficking
    organizations are the most powerful, ruthless and affluent
    criminal enterprises we have ever faced. We know from numerous
    past investigations that they have utilized their virtually
    unlimited wealth to purchase sophisticated electronic equipment
    to facilitate their illegal activities. This has included state
    of the art communication and encryption devices. They have used
    this equipment as part of their command and control process for
    their international criminal operations. We believe you share
    our concern that criminals will increasingly take advantage of
    developing technology to further insulate their violent and
    destructive activities.
        Requests for cryptographic support pertaining to electronic
    surveillance interceptions from FBI Field Offices and other law
    enforcement agencies have steadily risen over the past several
    years. There has been an increase in the number of instances
    where the FBI's and DEA's court-authorized electronic efforts
    were frustrated by the use of encryption that did not allow for
    law enforcement access.
        There have also been numerous other cases where law
    enforcement, through the use of electronic surveillance, has
    not only solved and successfully prosecuted serious crimes but
    has also been able to prevent life-threatening criminal acts.
    For example, terrorists in New York were plotting to bomb the
    United Nations building, the Lincoln and Holland Tunnels, and
    26 Federal Plaza as well as conduct assassinations of political
    figures. Court-authorized electronic surveillance enabled the
    FBI to disrupt the plot as explosives were being mixed.
    Ultimately, the evidence obtained was used to convict the
    conspirators. In another example, electronic surveillance was
    used to stop and then convict two men who intended to kidnap,
    molest, and kill a child. In all of these cases, the use of
    encryption might have seriously jeopardized public safety and
    resulted in the loss of life.
        To preserve law enforcement's abilities, and to preserve
    the balance so carefully established by the constitution, we
    believe any encryption legislation must accomplish three goals
    in addition to promoting the widespread use of strong
    encryption. It must establish:
              A viable key management infrastructure that promotes
            electronic commerce and enjoys the confidence of
            encryption users.
              A key management infrastructure that supports a key
            recovery scheme that will allow encryption users access
            to their own data should the need arise, and that will
            permit law enforcement to obtain lawful access to the
            plain text of encrypted communications and data.
              An enforcement mechanism that criminalizes both
            improper use of encryption key recovery information and
            the use of encryption for criminal purposes.
        Only one bill, S. 909 (the McCain/Kerrey/Hollings bill),
    comes close to meeting these core public safety, law
    enforcement, and national security needs. The other bills being
    considered by Congress, as currently written, risk great harm
    to our ability to enforce the laws and protect our citizens. We
    look forward to working to improve the McCain/Kerrey/Hollings
    bill.
        In sum, while encryption is certainly a commercial interest
    of great importance to this Nation, it is not solely a
    commercial or business issue. Those of us charged with the
    protection of public safety and national security, believe that
    the misuse of encryption technology will become a matter of
    life and death in many instances. That is why we urge you to
    adopt a balanced approach that accomplishes the goals mentioned
    above. Only this approach will allow police departments,
    attorneys general, district attorneys, sheriffs, and federal
    authorities to continue to use their most effective
    investigative techniques, with court approval, to fight crime
    and espionage and prevent terrorism.
                Sincerely yours,
                                       Janet Reno,
                                               Attorney General.
                                       Louis Freeh,
                                               Director, Federal Bureau of
                                                   Investigation.
                                       Thomas A. Constantine,
                                               Director, Drug Enforcement
                                                   Administration.
                                       Raymond W. Kelly,
                                               Undersecretary for
                                                   Enforcement, U.S.
                                                   Department of Treasury.
                                       John W. Magaw,
                                               Director, Bureau of Alcohol,
                                                   Tobacco and Firearms.
                                       Barry McCaffrey,
                                               Director, Office of National
                                                   Drug Control Policy.
                                       Lewis C. Merletti,
                                               Director, United States
                                                   Secret Service.
                                       George J. Weise,
                                               Commissioner, United States
                                                   Customs Service.
                                    ------

                 International Association of Chiefs of Police,
                                         Alexandria, VA, July 21, 1997.
        Dear Member of Congress: Enclosed is a letter sent to you
    by the Attorney General, the Director of National Drug Control
    Policy and all the federal law enforcement heads concerning
    encryption legislation being considered Congress. Collectively
    we, the undersigned, represent over 17,000 police departments
    including every major city policy department, over 3,000
    sheriffs departments, nearly every district attorney in the
    United States and all of the state Attorneys General. We fully
    endorse the position taken by our federal counterparts in the
    enclosed letter. As we have stated many times, Congress must
    adopt a balanced approach to encryption that fully addresses
    public safety concerns or the ability of state and local law
    enforcement to fight crime and drugs will be severely damaged.
        Any encryption legislation that does not ensure that law
    enforcement can gain timely access to the plaintext of
    encrypted conversations and information by established legal
    procedures will cause grave harm to public safety. The risk
    cannot be left to the uncertainty of market forces or
    commercial interests as the current legislative proposals would
    require. Without adequate safeguards, the unbridled use of
    powerful encryption soon will deprive law enforcement of two or
    its most effective tools, court authorized electronic
    surveillance and the search and seizure of information stored
    in computers. This will substantially tip the balance in the
    fight against crime towards society's most dangerous criminals
    as the information age develops.
        We are in unanimous agreement that Congress must adopt
    encryption legislation that requires the development,
    manufacture, distribution and sale of only key recovery
    products and we are opposed to the bills that do not do so.
    Only the key recovery approach will ensure that law enforcement
    can continue to gain timely access to the plaintext of
    encrypted conversations and other evidence ofcrimes when
    authorized by a court to do so. If we lose this ability--and the bills
    you are considering will have this result--it will be a substantial
    setback for law enforcement at the direct expense of public safety.
                Sincerely yours,
                                       Darrell L. Sanders,
                                               President, International
                                                   Association of Chiefs of
                                                   Police.
                                       James E. Doyle,
                                               President, National
                                                   Association of Attorneys
                                                   General.
                                       Fred Scoralic,
                                               President, National
                                                   Sheriffs' Association.
                                       William L. Murphy,
                                               President, National District
                                                   Attorneys Association.
                                    ------

                                 Department of Defense,
                                   Deputy Secretary of Defense,
                                        Washington, DC, March 24, 1999.
    Hon. Henry J. Hyde,
    Chairman, Committee on Judiciary,
    House of Representatives, Washington, DC.
        Dear Mr. Chairman: On March 11, 1999 the House Judiciary
    Subcommittee on Courts and Intellectual Property passed the
    Goodlatte Bill (H.R. 850, ``Security and Freedom Through
    Encryption (SAFE) Act''). I am writing to let you know that the
    Defense Department has deep reservations about this
    legislation. We believe that the bill, in its current form,
    threatens our ability to undertake critical national security
    activities.
        Let me say at the outset that the Department strongly
    supports encryption. Indeed, we believe it is essential since
    we increasingly operate critical command and control functions
    over commercial systems. Encryption is critical for us to
    maintain confidentiality of our communications. But at the same
    time, we and the law enforcement community have an obligation
    to protect American security interests through the timely
    delivery of intelligence to decision-makers. The passage of
    legislation that immediately decontrols the export of strong
    encryption will result in the loss or delay of essential
    intelligence reporting because it may take too long to decrypt
    the information--if indeed we can decrypt it at all. Our nation
    cannot have an effective decision-making process, a strong
    fighting force, or a responsive law enforcement community
    unless the required intelligence information is available in
    time to make a difference. H.R. 850 threatens our ability to do
    just that.
        The Department of Defense worked closely with other
    elements of the Administration, with Congress and with the
    software industry last year to craft encryption export
    regulations that provided maximum opportunity to American
    industry while still preserving essential restraints critical
    for national security. H.R. 850 threatens that balance and
    would seriously weaken our national security. I must ask for
    your help in bringing the full picture to bear on your
    deliberations as you review this legislation.
                Sincerely,
                                                         John J. Hamre.

             Changes in Existing Law Made by the Bill, as Reported

      In compliance with clause 3(e) of rule XIII of the Rules of
    the House of Representatives, changes in existing law made by
    the bill, as reported, are shown as follows (new matter is
    printed in italic and existing law in which no change is
    proposed is shown in roman):

                          TITLE 18, UNITED STATES CODE

                                 PART I--CRIMES

    Chap.                                                               Sec.
    1.     General provisions.........................................     1
         * * * * * * *
    2801Encrypted wire and electronic information...................

               *       *       *       *       *       *       *

             CHAPTER 125--ENCRYPTED WIRE AND ELECTRONIC INFORMATION

    2801. Definitions.
    2802. Freedom to use encryption.
    2803. Freedom to sell encryption.
    2804. Prohibition on mandatory key escrow.
    2805. Unlawful use of encryption in furtherance of a criminal act.

    Sec. 2801. Definitions

      As used in this chapter--
              (1) the terms ``person'', ``State'', ``wire
            communication'', ``electronic communication'',
            ``investigative or law enforcement officer'', and
            ``judge of competent jurisdiction'' have the meanings
            given those terms in section 2510 of this title;
              (2) the term ``decrypt'' means to retransform or
            unscramble encrypted data, including communications, to
            its readable form;
              (3) the terms ``encrypt'', ``encrypted'', and
            ``encryption'' mean the scrambling of wire
            communications, electronic communications, or
            electronically stored information, using mathematical
            formulas or algorithms in order to preserve the
            confidentiality, integrity, or authenticity of, and
            prevent unauthorized recipients from accessing or
            altering, such communications or information;
              (4) the term ``key'' means the variable information
            used in a mathematical formula, code, or algorithm, or
            any component thereof, used to decrypt wire
            communications, electronic communications, or
            electronically stored information, that has been
            encrypted; and
              (5) the term ``key recovery information'' means
            information that would enable obtaining the key of a
            user of encryption;
              (6) the term ``plaintext access capability'' means
            any method or mechanism which would provide information
            in readable form prior to its being encrypted or after
            it has been decrypted;
              (7) the term ``United States person'' means--
                      (A) any United States citizen;
                      (B) any other person organized under the laws
                    of any State, the District of Columbia, or any
                    commonwealth, territory, or possession of the
                    United States; and
                      (C) any person organized under the laws of
                    any foreign country who is owned or controlled
                    by individuals or persons described in
                    subparagraphs (A) and (B).

    Sec. 2802. Freedom to use encryption

      Subject to section 2805, it shall be lawful for any person
    within any State, and for any United States person in a foreign
    country, to use any encryption, regardless of the encryption
    algorithm selected, encryption key length chosen, or
    implementation technique or medium used.

    Sec. 2803. Freedom to sell encryption

      Subject to section 2805, it shall be lawful for any person
    within any State to sell in interstate commerce any encryption,
    regardless of the encryption algorithm selected, encryption key
    length chosen, or implementation technique or medium used.

    Sec. 2804. Prohibition on mandatory key escrow

      (a) General Prohibition.--Neither the Federal Government nor
    a State may require that, or condition any approval on a
    requirement that, a key, access to a key, key recovery
    information, or any other plaintext access capability be--
              (1) built into computer hardware or software for any
            purpose;
              (2) given to any other person, including a Federal
            Government agency or an entity in the private sector
            that may be certified or approved by the Federal
            Government or a State to receive it; or
              (3) retained by the owner or user of an encryption
            key or any other person, other than for encryption
            products for use by the Federal Government or a State.
      (b) Prohibition on Linkage of Different Uses of Encryption.--
    Neither the Federal Government nor a State may--
              (1) require the use of encryption products,
            standards, or services used for confidentiality
            purposes, as a condition of the use of such products,
            standards, or services for authenticity or integrity
            purposes; or
              (2) require the use of encryption products,
            standards, or services used for authenticity or
            integrity purposes, as a condition of the use of such
            products, standards, or services for confidentiality
            purposes.
      (c) Exception for Access for Law Enforcement Purposes.--
    Subsection (a) shall not affect the authority of any
    investigative or law enforcement officer, or any member of the
    intelligence community as defined in section 3 of the National
    Security Act of 1947 (50 U.S.C. 401a), acting under any law in
    effect on the effective date of this chapter, to gain access to
    encrypted communications or information.

    Sec. 2805. Unlawful use of encryption in furtherance of a criminal act

      (a) Encryption of Incriminating Communications or Information
    Unlawful.--Any person who, in the commission of a felony under
    a criminal statute of the United States, knowingly and
    willfully encrypts incriminating communications or information
    relating to that felony with the intent to conceal such
    communications or information for the purpose of avoiding
    detection by law enforcement agencies or prosecution--
              (1) in the case of a first offense under this
            section, shall be imprisoned for not more than 5 years,
            or fined in the amount set forth in this title, or
            both; and
              (2) in the case of a second or subsequent offense
            under this section, shall be imprisoned for not more
            than 10 years, or fined in the amount set forth in this
            title, or both.
      (b) Use of Encryption Not a Basis for Probable Cause.--The
    use of encryption by any person shall not be the sole basis for
    establishing probable cause with respect to a criminal offense
    or a search warrant.

               *       *       *       *       *       *       *

                                  ----------

                  SECTION 17 OF THE EXPORT ADMINISTRATION ACT

                              effect on other acts

      Sec. 17. (a) * * *

               *       *       *       *       *       *       *

      (g) Certain Consumer Products, Computers, and Related
    Equipment.--
              (1) General rule.--Subject to paragraphs (2) and (3),
            the Secretary shall have exclusive authority to control
            exports of all computer hardware, software, computing
            devices, customer premises equipment, communications
            network equipment, and technology for information
            security (including encryption), except that which is
            specifically designed or modified for military use,
            including command, control, and intelligence
            applications.
              (2) Items not requiring licenses.--After a one-time,
            15-day technical review by the Secretary, no export
            license may be required, except pursuant to the Trading
            With the Enemy Act or the International Emergency
            Economic Powers Act (but only to the extent that the
            authority of such Act is not exercised to extend
            controls imposed under this Act), for the export or
            reexport of--
                      (A) any computer hardware or software or
                    computing device, including computer hardware
                    or software or computing devices with
                    encryption capabilities--
                              (i) that is generally available;
                              (ii) that is in the public domain for
                            which copyright or other protection is
                            not available under title 17,United
    States Code, or that is available to the public because it is generally
    accessible to the interested public in any form; or
                              (iii) that is used in a commercial,
                            off-the-shelf, consumer product or any
                            component or subassembly designed for
                            use in such a consumer product
                            available within the United States or
                            abroad which--
                                      (I) includes encryption
                                    capabilities which are
                                    inaccessible to the end user;
                                    and
                                      (II) is not designed for
                                    military or intelligence end
                                    use;
                      (B) any computing device solely because it
                    incorporates or employs in any form--
                              (i) computer hardware or software
                            (including computer hardware or
                            software with encryption capabilities)
                            that is exempted from any requirement
                            for a license under subparagraph (A);
                            or
                              (ii) computer hardware or software
                            that is no more technically complex in
                            its encryption capabilities than
                            computer hardware or software that is
                            exempted from any requirement for a
                            license under subparagraph (A) but is
                            not designed for installation by the
                            purchaser;
                      (C) any computer hardware or software or
                    computing device solely on the basis that it
                    incorporates or employs in any form interface
                    mechanisms for interaction with other computer
                    hardware or software or computing devices,
                    including computer hardware and software and
                    computing devices with encryption capabilities;
                      (D) any computing or telecommunication device
                    which incorporates or employs in any form
                    computer hardware or software encryption
                    capabilities which--
                              (i) are not directly available to the
                            end user; or
                              (ii) limit the encryption to be
                            point-to-point from the user to a
                            central communications point or link
                            and does not enable end-to-end user
                            encryption;
                      (E) technical assistance and technical data
                    used for the installation or maintenance of
                    computer hardware or software or computing
                    devices with encryption capabilities covered
                    under this subsection; or
                      (F) any encryption hardware or software or
                    computing device not used for confidentiality
                    purposes, such as authentication, integrity,
                    electronic signatures, nonrepudiation, or copy
                    protection.
              (3) Computer hardware or software or computing
            devices with encryption capabilities.--After a one-
            time, 15-day technical review by the Secretary, the
            Secretary shall authorize the export or reexport of
            computer hardware or software or computing devices with
            encryption capabilities for nonmilitary end uses in any
            country--
                      (A) to which exports of computer hardware or
                    software or computing devices of comparable
                    strength are permitted for use by financial
                    institutions not controlled in fact by United
                    States persons, unless there is substantial
                    evidence that such computer hardware or
                    software or computing devices will be--
                              (i) diverted to a military end use or
                            an end use supporting international
                            terrorism;
                              (ii) modified for military or
                            terrorist end use; or
                              (iii) reexported without any
                            authorization by the United States that
                            may be required under this Act; or
                      (B) if the Secretary determines that a
                    computer hardware or software or computing
                    device offering comparable security is
                    commercially available outside the United
                    States from a foreign supplier, without
                    effective restrictions.
              (4) Definitions.--As used in this subsection--
                      (A)(i) the term ``encryption'' means the
                    scrambling of wire communications, electronic
                    communications, or electronically stored
                    information, using mathematical formulas or
                    algorithms in order to preserve the
                    confidentiality, integrity, or authenticity of,
                    and prevent unauthorized recipients from
                    accessing or altering, such communications or
                    information;
                      (ii) the terms ``wire communication'' and
                    ``electronic communication'' have the meanings
                    given those terms in section 2510 of title 18,
                    United States Code;
                      (B) the term ``generally available'' means,
                    in the case of computer hardware or computer
                    software (including computer hardware or
                    computer software with encryption
                    capabilities)--
                              (i) computer hardware or computer
                            software that is--
                                      (I) distributed through the
                                    Internet;
                                      (II) offered for sale,
                                    license, or transfer to any
                                    person without restriction,
                                    whether or not for
                                    consideration, including, but
                                    not limited to, over-the-
                                    counter retail sales, mail
                                    order transactions, phone order
                                    transactions, electronic
                                    distribution, or sale on
                                    approval;
                                      (III) preloaded on computer
                                    hardware or computing devices
                                    that are widely available for
                                    sale to the public; or
                                      (IV) assembled from computer
                                    hardware or computer software
                                    components that are widely
                                    available for sale to the
                                    public;
                              (ii) not designed, developed, or
                            tailored by the manufacturer for
                            specific purchasers or users, except
                            that any such purchaser or user may--
                                      (I) supply certain
                                    installation parameters needed
                                    by the computer hardware or
                                    software to function properly
                                    with the computer system of the
                                    user or purchaser; or
                                      (II) select from among
                                    options contained in the
                                    computer hardware or computer
                                    software; and
                              (iii) with respect to which the
                            manufacturer of that computer hardware
                            or computer software--
                                      (I) intended for the user or
                                    purchaser, including any
                                    licensee or transferee, to
                                    install the computer hardware
                                    or software and has supplied
                                    the necessary instructions to
                                    do so, except that the
                                    manufacturer of the computer
                                    hardware or software, or any
                                    agent of such manufacturer, may
                                    also provide telephone or
                                    electronic mail help line
                                    services for installation,
                                    electronic transmission, or
                                    basic operations; and
                                      (II) the computer hardware or
                                    software is designed for such
                                    installation by the user or
                                    purchaser without further
                                    substantial support by the
                                    manufacturer;
                      (C) the term ``computing device'' means a
                    device which incorporates one or more
                    microprocessor-based central processing units
                    that can accept, store, process, or provide
                    output of data;
                      (D) the term ``computer hardware'' includes,
                    but is not limited to, computer systems,
                    equipment, application-specific assemblies,
                    smart cards, modules, integrated circuits, and
                    printed circuit board assemblies;
                      (E) the term ``customer premises equipment''
                    means equipment employed on the premises of a
                    person to originate, route, or terminate
                    communications;
                      (F) the term ``technical assistance''
                    includes instruction, skills training, working
                    knowledge, consulting services, and the
                    transfer of technical data;
                      (G) the term ``technical data'' includes
                    blueprints, plans, diagrams, models, formulas,
                    tables, engineering designs and specifications,
                    and manuals and instructions written or
                    recorded on other media or devices such as
                    disks, tapes, or read-only memories; and
                      (H) the term ``technical review'' means a
                    review by the Secretary of computer hardware or
                    software or computing devices with encryption
                    capabilities, based on information about the
                    product's encryption capabilities supplied by
                    the manufacturer, that the computer hardware or
                    software or computing device works as
                    represented.

                                ADDITIONAL VIEWS

        H.R. 850, the Security and Freedom Through Encryption
    (SAFE) Act of 1999, accomplishes three critical goals:
    preventing economic crime, promoting electronic commerce, and
    protecting the personal privacy of all law-abiding Americans. I
    am pleased that both the Courts and Intellectual Property
    Subcommittee and the full Judiciary Committee have approved
    this bipartisan legislation without amendment by voice vote. I
    would also like to thank the lead cosponsor of the SAFE Act,
    Rep. Zoe Lofgren (D-CA), for her leadership, support, and
    dedication to this important issue, and to note that the bill
    currently has 250 cosponsors, including a majority of the
    leadership on both sides of the aisle.
        The Congressional Budget Office (CBO)'s April 21, 1999 cost
    estimate, submitted as a part of this Committee Report,
    contains a number of inaccuracies that deserve correction. In
    the section entitled ``Estimated Impact on State, Local, and
    Tribal Governments,'' the CBO letter states that H.R. 850
    ``would also preempt state laws that require the use of
    encryption for authenticating documents or for ensuring their
    confidentiality.'' This statement is false. While the bill
    would preempt state laws (none of which currently exist)
    requiring the use of encryption for authentication or integrity
    as a condition of the use of encryption for confidentiality
    (and vice versa), H.R. 850 does not preempt state laws that
    require the use of encryption for authentication or the use of
    encryption for confidentiality. In other words, the bill would
    only preempt a linkage of these two uses. In fact, one of the
    chief purposes of this legislation is to encourage the use of
    encryption, not to hinder the use of encryption.
        The CBO letter also incorrectly states that H.R. 850
    ``would also prevent the states themselves from using certain
    types of encryption technology.'' Again, the purpose of this
    legislation is to encourage the use of encryption, not to
    hinder the use of encryption. H.R. 850 only prohibits the
    federal government or a state from requiring that only
    recoverable encryption products be used in communications
    between private persons or between private persons and federal
    government or state entities. The bill does not prohibit the
    federal government or a state from using any type of encryption
    product, including a recoverable encryption product, on its own
    networks or systems, provided that such product is
    interoperable with a non-recoverable encryption product. This
    is true whether the federal government or state retains its own
    encryption keys, or uses other public or private entities to
    retain its encryption keys.
        An additional error in the CBO letter is the statement that
    ``Encryption that is prohibited by the bill includes the
    scrambling of electronically stored or transmitted information
    in order to preserve confidentiality, integrity, or
    authenticity.'' Encryption is the scrambling of electronically
    stored or transmitted information in order to preserve
    confidentiality, integrity, or authenticity. Again, the bill
    only prohibits the federal government or a state from linking
    the use of encryption for confidentiality to the use of
    encryption for authenticity or integrity. H.R. 850 does not
    prohibit encryption--in fact, the purpose of the bill is to
    affirm the rights of U.S. persons to use and sell encryption
    and to relax export controls on encryption. With this
    statement, however, CBO is essentially arguing that the bill
    achieves the exact opposite of that which it was intended to
    achieve, which is false.
        Finally, the CBO letter asserts that H.R. 850 ``may
    preclude states from using digital signatures to send or
    receive legal documents electronically.'' To the contrary, the
    bill has no effect whatsoever on state electronic signature
    laws, except in cases in which states require the use of
    recoverable encryption products as a condition of giving legal
    recognition to electronic signatures. However, no such cases
    currently exist. Again, the bill simply prohibits the federal
    government or a state from linking the use of encryption to the
    use of electronic signatures or certificate authorities, not
    from requiring the use of encryption, electronic signatures, or
    certificate authorities themselves (provided that the federal
    government or state doesn't only require the use of recoverable
    encryption).
        In the 105th Congress, similar legislation (H.R. 695) was
    reported by the Judiciary Committee, International Relations
    Committee, Commerce Committee, and National Security Committee
    (since renamed the Armed Services Committee). CBO letters were
    included in each of those reports, and none of those letters
    alleged that the legislation would prevent states from using
    certain types of encryption technology.
        As H.R. 850 will next be considered in the 106th Congress
    by the International Relations Committee, there will be at
    least one more CBO letter regarding this bill. I look foward to
    working with CBO to correct the incorrect statements from its
    April 21 letter as H.R. 850 moves forward through the
    legislative process.

                                                         Bob Goodlatte.

                ADDITIONAL COMMENTS OF CONGRESSWOMAN ZOE LOFGREN

        Following the Subcommittee Hearing I forwarded the
    following correspondence to Associate Deputy Attorney General
    Ron Lee with the enclosed attachment:

                         Congress of the United States,
                                      House of Representatives,
                                        Washington, DC, April 22, 1999.
    Hon. Ron Lee,
    Associate Deputy Attorney General,
    Department of Justice, Washington, DC.
        Dear Mr. Lee: During your testimony on March 4, 1999, you
    testified that there were ``many technologies that aren't,
    strictly speaking, key recovery that do promote the interest of
    law enforcementas well as other government interests.'' I
    therefore asked you to tell me ``specifically'' what these ``many
    technologies'' were.
        When you said, ``very well,'' and that you would supply the
    requested information, our Subcommittee Chairman Howard Coble
    further reinforced my request when he instructed, ``Give that
    to us in detail if you will, Mr. Lee.''
        But more than a month later, I don't know what these many
    technologies are and I have no detail at all from you. I have,
    however, received a letter from the Office of Legislative
    Affairs but that was not responsive at all.
        The letter I've received (and I've attached a copy for your
    convenience) speaks of ``active discussions'' that ``might
    help'' address the problem, and what ``a number of companies
    have suggested to [the Department of Justice]'' and what are
    characterized as ``three possible solutions.''
        This tardy submission by someone on your behalf is totally
    inadequate. Either you got it wrong at the hearing or, for some
    reason I can't fathom, you are withholding the very information
    you promised to supply.
        I therefore respectfully request that you clarify which it
    is, either that you misspoke, or supply the information you
    originally promised to supply.
                Sincerely,
                                                   Zoe Lofgren,
                                                         Congresswoman.
                                    ------

                            U.S. Department of Justice,
                                 Office of Legislative Affairs,
                                        Washington, DC, April 14, 1999.
    Hon. Zoe Lofgren,
    House of Representatives,
    Washington, DC.
        Dear Congresswoman Lofgren: During Associate Deputy
    Attorney General Ron Lee's March 4, 1999 testimony before the
    Subcommittee on Courts and Intellectual Property of the
    Committee on the Judiciary, you asked him to write to you to
    identify those encryption technologies in addition to key
    recovery that promote the interests of law enforcement.
        First, I would like to thank you for your continuing
    interest in this topic. You will recall that you exchanged
    letters on this matter with former Principal Associate Deputy
    Attorney General Robert S. Litt just last summer and fall. In
    his letter to you of September 24, 1998, Mr. Litt indicated
    that what law enforcement needs is, quite simply, access to the
    plaintext of encrypted data and communications when it has
    lawfu1 authority to obtain that plaintext. He also indicated
    that law enforcement was not seeking a one-hundred percent
    solution, but workable solutions that support the continued
    ability of law enforcement to conduct judicially authorized
    searches for data and interceptions of communications.
        Critics of law enforcement openly insist that its demands
    are unattainable. However, there is nothing unattainable about
    industry's developing products and services that protect not
    only the security of encrypted data and communications but also
    the security and safety of the persons using those products and
    the public at large. It is important to remember that the goal
    of providing law enforcement with access to plaintext is the
    safety of the public.
        We recognize, of course, that industry is responsible for
    designing and deploying information technologies, including
    encryption products, and that it must do so in a competitive
    marketplace. Both industry and government have learned that
    there is a market demand for products allowing access to
    plaintext (e.g., businesses that need to ensure the
    availability of data). In addition, creating a technological
    environment that directly, even if inadvertently, supports
    criminal activity by enabling criminals to act with impunity is
    not good for the public, industry, or the marketplace. While we
    are asking that industry use its creative genius to create
    smart solutions, those solutions will, in the long run, promote
    both public safety and commerce.
        In this regard, industry has engaged in active discussions
    with law enforcement about technical solutions that might help
    address law enforcement's concerns. For example, a number of
    companies suggested to us that for some network-based
    encryption products there may be points in the network where
    plaintext exists, or where encryption can be disabled by a
    system administrator in response to a court order. Other
    products, such as corporate encryption systems, by their very
    nature, tend to be operated by corporate computer or network
    administrators, who can otherwise provide law enforcement with
    access to plaintext when such access is lawfully authorized.
    Still other products provide each individual user with the
    option to activate ``recovery'' for stored data, so that if the
    user loses his key, he need not also lose his data (such
    ``recovery-capable'' products tend to use key recovery). Each
    of these types of products helps to meet the needs of law
    enforcement. And these are just three possible solutions out of
    a panoply that are being or may be developed by industry.
        You may recall that the Administration updated its
    encryption export control policy in 1998, taking into account
    the benefits of such products for public safety worldwide. For
    example, ``recoverable'' products are approved for export to
    foreign commercial firms in over 40 countries. A number of
    companies thereafter cited this update as an excellent example
    of how industry and government can work together to find
    workable solutions.
        Of course, the needs of public safety are just one of the
    many interests to be considered in the encryption debate. The
    Department of Justice supports the use of strong encryption for
    legitimate purposes, such as the protection of privacy,
    proprietary and financial information, and intellectual
    property, as well as combating fraud and securing electronic
    commerce. Based on our discussions with industry, we are
    hopeful that it will develop more solutions that meet these
    needs and also protect the safety of the public in general.
        I look forward to continuing to work with you in this
    important area.
                Sincerely,
                                               Dennis K. Burke,
                                     Acting Assistant Attorney General.

                                    <all>