[House Report 105-108]
[From the U.S. Government Publishing Office]



105th Congress                                            Rept. 105-108
                        HOUSE OF REPRESENTATIVES

 1st Session                                                     Part 2
_______________________________________________________________________


 
           SECURITY AND FREEDOM THROUGH ENCRYPTION (SAFE) ACT

                                _______
                                

                 July 25, 1997.--Ordered to be printed

_______________________________________________________________________


 Mr. Gilman, from the Committee on International Relations, submitted 
                             the following

                              R E P O R T

                             together with

                            DISSENTING VIEWS

                        [To accompany H.R. 695]

    The Committee on International Relations, to whom was 
referred the bill (H.R. 695) to amend title 18, United States 
Code, to affirm the rights of United States persons to use and 
sell encryption and to relax export controls on encryption, 
having considered the same, report favorably thereon with an 
amendment and recommend that the bill as amended do pass.
    The amendment is as follows:
  Strike out all after the enacting clause and insert in lieu 
thereof the following:

SECTION 1. SHORT TITLE.

  This Act may be cited as the ``Security and Freedom Through 
Encryption (SAFE) Act''.

SEC. 2. SALE AND USE OF ENCRYPTION.

  (a) In General.--Part I of title 18, United States Code, is amended 
by inserting after chapter 121 the following new chapter:

        ``CHAPTER 122--ENCRYPTED WIRE AND ELECTRONIC INFORMATION

``2801. Definitions.
``2802. Freedom to use encryption.
``2803. Freedom to sell encryption.
``2804. Prohibition on mandatory key escrow.
``2805. Unlawful use of encryption in furtherance of a criminal act.

``Sec. 2801. Definitions

  ``As used in this chapter--
          ``(1) the terms `person', `State', `wire communication', 
        `electronic communication', `investigative or law enforcement 
        officer', `judge of competent jurisdiction', and `electronic 
        storage' have the meanings given those terms in section 2510 of 
        this title;
          ``(2) the terms `encrypt' and `encryption' refer to the 
        scrambling of wire or electronic information using mathematical 
        formulas or algorithms in order to preserve the 
        confidentiality, integrity, or authenticity of, and prevent 
        unauthorized recipients from accessing or altering, such 
        information;
          ``(3) the term `key' means the variable information used in a 
        mathematical formula, code, or algorithm, or any component 
        thereof, used to decrypt wire or electronic information that 
        has been encrypted; and
          ``(4) the term `United States person' means--
                  ``(A) any United States citizen;
                  ``(B) any other person organized under the laws of 
                any State, the District of Columbia, or any 
                commonwealth, territory, or possession of the United 
                States; and
                  ``(C) any person organized under the laws of any 
                foreign country who is owned or controlled by 
                individuals or persons described in subparagraphs (A) 
                and (B).

``Sec. 2802. Freedom to use encryption

  ``Subject to section 2805, it shall be lawful for any person within 
any State, and for any United States person in a foreign country, to 
use any encryption, regardless of the encryption algorithm selected, 
encryption key length chosen, or implementation technique or medium 
used.

``Sec. 2803. Freedom to sell encryption

  ``Subject to section 2805, it shall be lawful for any person within 
any State to sell in interstate commerce any encryption, regardless of 
the encryption algorithm selected, encryption key length chosen, or 
implementation technique or medium used.

``Sec. 2804. Prohibition on mandatory key escrow

  ``(a) Prohibition.--No person in lawful possession of a key to 
encrypted information may be required by Federal or State law to 
relinquish to another person control of that key.
  ``(b) Exception for Access for Law Enforcement Purposes.--Subsection 
(a) shall not affect the authority of any investigative or law 
enforcement officer, acting under any law in effect on the effective 
date of this chapter, to gain access to encrypted information.

``Sec. 2805. Unlawful use of encryption in furtherance of a criminal 
                    act

  ``Any person who willfully uses encryption in furtherance of the 
commission of a criminal offense for which the person may be prosecuted 
in a court of competent jurisdiction--
          ``(1) in the case of a first offense under this section, 
        shall be imprisoned for not more than 5 years, or fined in the 
        amount set forth in this title, or both; and
          ``(2) in the case of a second or subsequent offense under 
        this section, shall be imprisoned for not more than 10 years, 
        or fined in the amount set forth in this title, or both.''.
  (b) Conforming Amendment.--The table of chapters for part I of title 
18, United States Code, is amended by inserting after the item relating 
to chapter 33 the following new item:

``122. Encrypted wire and electronic information............    2801''.

SEC. 3. EXPORTS OF ENCRYPTION.

  (a) Amendment to Export Administration Act of 1979.--Section 17 of 
the Export Administration Act of 1979 (50 U.S.C. App. 2416) is amended 
by adding at the end thereof the following new subsection:
  ``(g) Certain Consumer Products, Computers, and Related Equipment.--
          ``(1) General rule.--Subject to paragraphs (2), (3), and (4), 
        the Secretary shall have exclusive authority to control exports 
        of all computer hardware, software, and technology for 
        information security (including encryption), except thatwhich 
is specifically designed or modified for military use, including 
command, control, and intelligence applications.
          ``(2) Items not requiring licenses.--No validated license may 
        be required, except pursuant to the Trading With The Enemy Act 
        or the International Emergency Economic Powers Act (but only to 
        the extent that the authority of such Act is not exercised to 
        extend controls imposed under this Act), for the export or 
        reexport of--
                  ``(A) any consumer product commercially available 
                within the United States or abroad which--
                          ``(i) includes encryption capabilities which 
                        are inaccessible to the end user; and
                          ``(ii) is not designed for military or 
                        intelligence end use;
                  ``(B) any component or subassembly designed for use 
                in a consumer product described in subparagraph (A) 
                which itself contains encryption capabilities and is 
                not capable of military or intelligence end use in its 
                condition as exported;
                  ``(C) any software, including software with 
                encryption capabilities--
                          ``(i) that is generally available, as is, and 
                        is designed for installation by the purchaser;
                          ``(ii) that is in the public domain for which 
                        copyright or other protection is not available 
                        under title 17, United States Code, or that is 
                        available to the public because it is generally 
                        accessible to the interested public in any 
                        form; or
                          ``(iii) that is customized for an otherwise 
                        lawful use by a specific purchaser or group of 
                        purchasers;
                  ``(D) any computing device solely because it 
                incorporates or employs in any form--
                          ``(i) software (including software with 
                        encryption capabilities) that is exempted from 
                        any requirement for a validated license under 
                        subparagraph (C); or
                          ``(ii) software that is no more technically 
                        complex in its encryption capabilties than 
                        software that is exempted from any requirement 
                        for a validated license under subparagraph (C) 
                        but is not designed for installation by the 
                        purchaser;
                  ``(E) any computer hardware that is generally 
                available, solely because it has encryption 
                capabilities; or
                  ``(F) any software or computing device solely on the 
                basis that it incorporates or employs in any form 
                interface mechanisms for interaction with other 
                hardware and software, including hardware, and 
                software, with encryption capabilities.
          ``(3) Software with encryption capabilities.--The Secretary 
        shall authorize the export or reexport of software with 
        encryption capabilities for nonmilitary end uses in any country 
        to which exports of software of similar capability are 
        permitted for use by financial institutions not controlled in 
        fact by United States persons, unless there is substantial 
        evidence that such software will be--
                  ``(A) diverted to a military end use or an end use 
                supporting international terrorism;
                  ``(B) modified for military or terrorist end use; or
                  ``(C) reexported without any authorization by the 
                United States that may be required under this Act.
          ``(4) Hardware with encryption capabilities.--The Secretary 
        shall authorize the export or reexport of computer hardware 
        with encryption capabilities if the Secretary determines that a 
        product offering comparable security is commercially available 
        outside the United States from a foreign supplier, without 
        effective restrictions.
          ``(5) Definitions.--As used in this subsection--
                  ``(A) the term `encryption' means the scrambling of 
                wire or electronic information using mathematical 
                formulas or algorithms in order to preserve the 
                confidentiality, integrity, or authenticity of, and 
                prevent unauthorized recipients from accessing or 
                altering, such information;
                  ``(B) the term `generally available' means--
                          ``(i) in the case of software (including 
                        software with encryption capabilities), 
                        software that is offered for sale, license, or 
                        transfer to any person without restriction, 
                        whether or not for consideration, including, 
                        but not limited to, over-the-counter retail 
                        sales, mail order transactions, phone order 
                        transactions, electronic distribution, or sale 
                        on approval; and
                          ``(ii) in the case of hardware with 
                        encryption capabilities, hardware that is 
                        offered for sale, license, or transfer to any 
                        person without restriction, whether or not for 
                        consideration, including, but not limited to, 
                        over-the-counter retail sales, mail order 
                        transactions, phone order transactions, 
                        electronic distribution, or sale on approval;
                  ``(C) the term `as is' means, in the case of software 
                (including software with encryption capabilities), a 
                software program that is not designed, developed, or 
                tailored by the software publisher for specific 
                purchasers, except that such purchasers may supply 
                certain installation parameters needed by the software 
                program to function properly with the purchaser's 
                system and may customize the software program by 
                choosing among options contained in the software 
                program;
                  ``(D) the term `is designed for installation by the 
                purchaser' means, in the case of software (including 
                software with encryption capabilities) that--
                          ``(i) the software publisher intends for the 
                        purchaser (including any licensee or 
                        transferee), who may not be the actual program 
                        user, to install the software program on a 
                        computing device and has supplied the necessary 
                        instructions to do so, except that the 
                        publisher may also provide telephone help line 
                        services for software installation, electronic 
                        transmission, or basic operations; and
                          ``(ii) the software program is designed for 
                        installation by the purchaser without further 
                        substantial support by the supplier;
                  ``(E) the term `computing device' means a device 
                which incorporates one or more microprocessor-based 
                central processing units that can accept, store, 
                process, or provide output of data; and
                  ``(F) the term `computer hardware', when used in 
                conjunction with information security, includes, but is 
                not limited to, computer systems, equipment, 
                application-specific assemblies, modules, and 
                integrated circuits.''.
  (b) Continuation of Export Administration Act.--For purposes of 
carrying out the amendment made by subsection (a), the Export 
Administration Act of 1979 shall be deemed to be in effect.

SEC. 4. SENSE OF CONGRESS REGARDING INTERNATIONAL COOPERATION.

  (a) Findings.--The Congress finds that--
          (1) implementing export restrictions on widely available 
        technology without the concurrence of all countries capable of 
        producing, transshipping, or otherwise transferring that 
        technology is detrimental to the competitiveness of the United 
        States and should only be imposed on technology and countries 
        in order to protect the United States against a compelling 
        national security threat; and
          (2) the President has not been able to come to agreement with 
        other encryption producing countries on export controls on 
        encryption and has imposed excessively stringent export 
        controls on this widely available technology.
  (b) Sense of Congress.--It is the sense of the Congress that the 
President should immediately take the necessary steps to call an 
international conference for the purpose of coming to an agreement with 
encryption producing countries on policies which will ensure that the 
free use and trade of this technology does not hinder mutual security.

                         Background and Purpose

    H.R. 695, the Security and Freedom Through Encryption 
(SAFE) Act, represents a strong bipartisan effort to bring U.S. 
laws on the export of encryption technology into the present 
and future, by looking at the actual technological developments 
taking place on the world stage. The SAFE Act enjoys strong 
support in the House as reflected by the overwhelming number of 
co-sponsors, including a majority of the Members of the 
Committee on International Relations.
    While differences still remain and the debate continues 
between U.S. economic and commercial priorities and individual 
civil liberties, on the one hand, and the needs and concerns of 
law enforcement and national security agencies, the SAFE Act is 
generating the political will to reform the existing regulatory 
process to meet today's realities.
    Encryption has been defined as referring to the use of 
software or hardware to scramble wire or electronic information 
using mathematical formulas or algorithms in order to preserve 
the confidentiality, integrity, or authenticity of, and prevent 
unauthorized recipients from accessing or altering such 
information. While anyone can encrypt a message, only an 
authorized person can convert a scrambled message back into its 
original form.
    The basic idea of modern encryption, or cryptography, is 
that any message can be represented as a set of numbers (the 
plaintext) used to transform the plaintext into a different set 
of numbers (the ciphertext). Simply stated, keys consist of a 
series of ones and zeros (called ``bits'), and are described in 
terms of their ``length'', which is corresponds to the number 
of possible combinations that can be used to decode a 
particular message. A 40-bit key means that the number of 
possible combinations of ones and zeros equals 2 to the 40th 
power. It then follows that a 56-bit key is 2 to the 56th 
power, which means that it is 2 to the 16th power stronger that 
a 40-bit key.
    Once the exclusive domain of the national security and 
intelligence sectors, encryption now has an expanded 
application, impacting the everyday lives of millions of 
Americans. Today, banking systems, stock markets, air traffic 
control systems, credit bureaus, telephone networks, weather 
satellites, social security system, television networks, 
civilian and government payrolls, and the Internet are all 
directly affected by a flow of data managed by countless 
computers and telecommunication networks around the world. 
Computer technology now serves as the nervous system of modern 
society.
    It is increasingly difficult to protect the privacy and 
confidentiality of transactions at all levels, and increasingly 
important to do so. The Justice Department has estimated that 
annual losses related to computer security breaches could be as 
high as $7 billion. If this were adjusted to include the number 
of undocumented cases by companies reluctant to report such 
intrusions, the figure could be even higher. The National 
Counterintelligence Center in their ``Annual Report to Congress 
on Foreign Economic Collection and Industrial Espionage'' 
concluded that such ``specialized technical operations 
(including computer intrusions, telecommunications targeting 
and intercept, and private sector encryption weaknesses) 
account for the largest portion of economic and industrial 
information lost by corporations.''
    Therefore, stronger encryption tools are widely viewed as 
the key to providing security and privacy for the information 
superhighway.
    Current U.S. policy restricts the export of ``strong'' 
encryption hardware or software products with keys greater than 
40 bits long--determined to be gravely inadequate by numerous 
experts. The current Administration proposal, which would allow 
the export of 56-bit encryption, is viewed as not meeting the 
needs of U.S. companies to conduct business in a secure manner 
with their suppliers, their business partners, their customers, 
and even their affiliated companies outside the United States.
    Supporting the need for higher encryption standards is the 
fact that, on the same day that the companion legislation--the 
McCain-Kerrey bill--was introduced in the Senate calling for a 
56-bit limit on encryption exports, a group of independent 
programmers and researchers cracked a 56-bit code using 
computers linked across the Internet. This successful breaking 
of 56-bit encryption clearly demonstrates the anachronistic 
nature of current U.S. law and reflects how out-of-touch the 
Administration's policy is with the needs of the global 
marketplace.
    The Administration's proposal would only allow the export 
of 56-bit encryption for those who promise to build in ``key 
recovery''. ``Key recovery'' or ``key escrow'' essentially 
means that when stored data or electronic communications are 
encrypted, a third party has a copy of the key needed to 
decrypt the information. As presented by proponents of this 
policy, escrowed encryption is intended to provide for 
encryption protection for legitimate uses but also enable law 
enforcement officials to gain access to the key when it is 
necessary to decode the plaintext data as part of an 
investigation.
    This has been interpreted as an attempt to use the export 
control process to manipulate and control the market for and 
expansion of encryption technology, by making it easy to export 
products with key recovery and difficult for those products 
without. The logical basis for this policy is flawed as it is 
rooted in the wrongful assumption that foreign competitors can 
be convinced to alter their policy to parallel what U.S. policy 
is calling for. The current policy is not based on fact but on 
the optimistic view that the U.S. can influence other countries 
not to export strong encryption without an escrow system.
    Speculation does not make for good laws. Individually and 
as a unit, many of our European allies have clearly illustrated 
their commitment to allow market forces andindividual needs to 
dictate the levels of encryption. In its April 1997 proposal entitled, 
``A European Initiative in Electronic Commerce'', the European Union 
stated as key elements of the Initiative to ensure a framework which 
``boosts the trust and confidence of businesses for investments and 
consumers to make use of electronic commerce by dismantling remaining 
legal and regulatory barriers and preventing the creation of new 
obstacles.'' It goes on to say that: ``The use of strong encryption 
which ensures the confidentiality of both sensitive commercial and of 
personal data is one of the foundation stones of electronic commerce . 
. . The Community (European Community) shall work at the international 
level towards the removal of trade barriers for encryption products.''
    Even the more conservative recommendations made in March 
1997 by the Council of the Organization for Economic 
Cooperation and Development, clearly state that: ``Users should 
have access to cryptography that meets their needs, so that 
they can trust in the security of information and 
communications systems, and the confidentiality and integrity 
of data on those systems.'' The Council further underscores 
that: ``Government controls on cryptographic methods . . . 
should respect user choice to the greatest extent possible . . 
. and should not be interpreted as implying that governments 
should initiate legislation which limits user choice.'' 
Finally, they add: ``The development and provision of 
cryptographic methods should be determined by the market in an 
open and competitive environment. Such an approach would best 
ensure that solutions keep pace with changing technology, the 
demands of users and evolving threats to communications systems 
security.''
    While U.S. companies are kept at 40-bit encryption or at 
56-bit with the condition that they commit to develop key 
recovery, non-U.S. exporters, particularly the countries of the 
European Union, are producing packages that include encryption 
technology using 128 bits leaving American companies far behind 
in the race to capture new markets.
    Furthermore, American companies are placed at a competitive 
disadvantage by being forced to create and deploy two separate 
systems to meet two separate standards. Because of the 
nightmare this would create, most U.S. businesses end up making 
their exportable products subject to the same restrictions as 
their domestic products. By not allowing U.S. industries to 
provide secure products in the face of strong foreign 
competitors who are not restricted by outdated export controls, 
current law is hurting U.S. businesses. No one will buy 
encryption products for which the U.S. government can obtain a 
key. A recent report by the CEOs of 13 large American 
technology companies concluded that the U.S. computer industry 
could potentially lose up to $30-60 billion annually by the 
year 2000 due to these export controls.
    At a fundamental level, evaluating the value of key 
recovery systems in and of themselves, eleven of the world's 
top cryptographers concluded that key recovery systems would 
create new vulnerabilities. A key recovery system would create 
serious difficulties as it would require a vast infrastructure 
of recovery agents and oversight entities to manage access to 
the keys. In their May 1997 report entitled, ``The Risks of Key 
Recovery, Key Escrow, and Trusted Third Party Encryption'', 
these experts also determined that ``the field of cryptography 
has no experience in deploying secure systems of this scope and 
complexity'' and that such systems could potentially cost many 
billions of dollars.
    Key recovery systems do not even meet the national security 
needs on which the policy is based on. The Software Publishers 
Association has documented hundreds of foreign encryption 
products already widely available abroad and which criminals, 
terrorists, and foreign governments have access to. It is the 
upstanding, law-abiding citizen who suffers.
    The fact is that strong encryption helps to further the 
goals of law enforcement and national security, more than key 
recovery could ever hope to. In its landmark report on 
encryption policy, the blue-ribbon National Research Council 
concluded the following about the use of strong encryption:

          If cryptography can protect the trade secret and 
        proprietary information of business and thereby reduce 
        economic espionage (which it can), it also supports in 
        a most important manner the job of law enforcement. If 
        cryptography can help protect nationally critical 
        information systems and networks against unauthorized 
        penetration (which it can), it also supports the 
        national security of the United States.

    In summary, if U.S. laws are not changed soon, not as 
mandated by the Administration's policy or its companion 
legislation in the Senate, but as H.R. 695 attempts to do, 
world standards for security technology will shift away from 
the U.S. as customers buy products from foreign manufacturers. 
The U.S. government will not have a view into the security 
technology that replaces U.S. technology as the world 
standards. U.S. industries will lose control of information 
security technologies which are vital to economic security. It 
will cost the U.S. economy billions of dollars and hundreds of 
thousands of jobs.
    On July 7, 1997, German Economics Minister Guenter Rexrodt 
called for the removal of restrictions on encryption technology 
in his opening remarks for a two-day conference on Internet 
commerce attended by 40 government ministers from the European 
union, the United States, Russia, Japan and Canada. ``Users can 
only protect themselves against having data manipulated, 
destroyed or spied on through the use of strong encryption 
procedures,'' Rexrodt said, ``that is why we have to use all of 
our powers to promote such procedures instead of blocking 
them.''
    Individual Americans and U.S. businesses should be afforded 
the same protection and the same opportunities as other 
countries provide their own people and industries.H.R. 695--the 
SAFE Act--does just that. It is aimed at correcting the unfair and 
unsafe situation that currently exists under current law as it: 
prohibits export controls on ``generally available'' commercial 
encryption except for military end-users or to identified individuals 
or organizations in specific foreign countries; does not require 
reporting for companies after export; prohibits mandatory use of key 
recovery; denies liability protection and penalties for key holders; 
denies foreign government access to keys under specified conditions if 
key holder is used voluntarily; prohibits U.S. government and law 
enforcement access to keys by court order if key holder is used 
voluntarily; codifies existing domestic use policy; gives the Secretary 
of Commerce exclusive jurisdiction over export of commercial encryption 
except for military end-uses or to identified individuals or 
organizations in specific foreign countries.
    In essence, H.R. 695 prevents economic espionage while 
protecting hundreds of thousands of American jobs by affording 
all Americans the freedom to use any type of encryption 
anywhere in the world; by allowing any type of encryption to be 
sold in the United States; and creates a level playing field by 
permitting the export of the generally available software, 
hardware, and other encryption-related computer products.
    The Committee hopes that other Members realize the need, 
value, and importance of H.R. 695 as it works its way through 
the legislative process. In the interest of the American 
people, of U.S. economic leadership and growth, and of national 
security, the Committee hopes that the House will pass the SAFE 
Act.

                            Committee Action

    H.R. 695 was introduced by Representative Goodlatte on 
February 12, 1997, and referred to the Committee on Judiciary 
and in addition to the Committee on International Relations for 
a period subsequently to be determined by the Speaker. It was 
reported to the House by the Committee on the Judiciary, 
amended, on May 22, 1997 (H. Rept. 105-108). On May 22, 1995, 
the referral to the Committee on International Relations was 
extended through July 11, 1997, and on June 26, 1997, the 
referral to the Committee on International Relations was 
extended for a period ending not later than July 25, 1997.
    On June 26, 1997, the bill was referred, in addition, to 
Committees on Commerce, National Security, and the Permanent 
Select Committee on Intelligence for a period ending not later 
than September 5, 1997, for consideration of such provisions of 
the bill and the amendment reported by the Committee on the 
Judiciary as fall within the jurisdiction of those committees 
pursuant to clause 1(3) and (k), rule X and rule XLVIII, 
respectively.
    On May 8, 1997, the Subcommittee on International Economic 
Policy and Trade held a hearing entitled: ``Encryption: 
Individual Right to Privacy vs. National Security.'' Witnesses 
for this hearing included: Hon. William Reinsch, Under 
Secretary of Commerce, Bureau of Export Administration; Hon. 
William Crowell, Deputy Director, National Security Agency; 
Hon. Robert Litt, Deputy Assistant Attorney General, Criminal 
Division, U.S. Department of Justice; Mr. John Gage, Director, 
Science Office, Sun Microsystems, Inc.; Mr. Humphrey Polanen, 
General Manager, Network Security Products Group, Sun 
Microsystems, Inc.; Jerry Berman, Executive Director, Center 
for Democracy and Technology; Tom Parenty, Director of 
Security, Sybase Corporation; and Stephen T. Walker, President 
and CEO, Chairman of the Board of Directors, Trusted 
Information Systems.
    On May 29, 1997, the Full Committee held a Members briefing 
on H.R. 695, ``the Security and Freedom through Encryption 
(SAFE) Act.'' Speakers for the briefing included Hon. Louis 
Freeh, Director, Federal Bureau of Investigation and Hon. 
William Crowell, Deputy Director, National Security Agency.
    On June 4, 1997, the Subcommittee on International Economic 
Policy and Trade held a Members Briefing on the future of U.S.-
European trade relations. Speakers for the briefing included: 
Hon. David L. Aaron, U.S. Ambassador to the Organization for 
Economic Cooperation and Development (OECD); H.E. Hugo Paemen, 
Head of the Delegation to the United States of the Commission 
of the European Union; and Dr. Dominique vanderMensbrugghe, 
Senior Economist, OECD Development Center.
    On June 24, 1997, the Subcommittee on International 
Economic Policy and Trade held a mark-up of H.R. 695, ``the 
Security and Freedom through Encryption (SAFE) Act''. Witnesses 
included: Congressman Bob Goodlatte.
    Amendment.--An en bloc amendment was offered by Ros-
Lehtinen, Gejdenson, Campbell and Sherman. The amendment 
removes the distinction between mass market and customized 
software thus ensuring that customized software is also subject 
to liberalized export controls. It expands section 3 on exports 
of encryption by including consumer products which do not 
necessarily fall under the umbrella of ``computing'' products 
but which also require and use encryption. It broadens the 
scope and definition of ``generally available'' to include 
hardware with encryption capabilities. The amendment also adds 
a fourth section to the bill in the form of a sense of Congress 
regarding international cooperation. The amendment passed by 
voice vote.
    A motion to report the bill, as amended, to the Full 
Committee passed by a roll call vote, as follows:
    Voting yes: Ros-Lehtinen, Manzullo, Chabot, Campbell, 
Blunt, Brady, Rohrabacher, Gejdenson, Danner, Hilliard, 
Sherman, Rothman, Clement, Luther.
    Voting no: Bereuter.
    Passed: 14-1.
    On June 26, 1997, the Full Committee held a classified 
Members briefing on the impact of H.R. 695, ``the Security and 
Freedom through Encryption (SAFE) Act'' on national security 
and law enforcement activities. Speakers for the briefing 
included: Hon. Louis Freeh, Director, Federal Bureau of 
Investigation; Hon. William Crowell, Deputy Director, National 
Security Agency; Hon. William Reinsch, Under Secretary of 
Commerce, Bureau of Export Administration.
    On July 22, 1997, the Full Committee marked up the bill in 
open session, pursuant to notice. The Committee first adopted 
the amendment recommended by the Subcommittee on International 
Economic Policy by unanimous consent, as original text for the 
purposes of amendment. Representatives Goodlatte and Lofgren 
and representatives of the Administration (The Hon. William 
Reinsch, Under Secretary of Commerce; Mr. Jim Kallstrom, 
Federal Bureau of Investigation; Mr. James R. Taylor, National 
Security Agency; and Mr. Anthony Bocchichio of the Drug 
Enforcement Agency) responded to questions from members during 
the course of the markup.
    After further consideration, on that date, a quorum being 
present, the Full Committee by voice vote ordered the bill 
reported to the House with the recommendation that the bill, as 
amended, do pass.

                      Rollcall votes on amendments

    In compliance with clause (2)(l)(2)(B) of rule XI of the 
Rules of the House of Representatives, the record of committee 
roll call votes on final passage or amendments during the full 
committee's consideration of H.R. 695 is set out below, as is a 
report of the full committee's final action on the bill.

Description of Amendment, Motion, Order, or Other Proposition (votes 
        during markup of H.R. 695--July 22, 1997)

    Vote No. 1.--Gilman amendment provide that certain items 
could not be exported if in the opinion of the President they 
would endanger the national security.
    Voting Yes: Gilman, Leach, Bereuter, Gallegly, Fox, 
Hamilton, Berman, Menendez, Brown, Danner, Rothman, Clement, 
and Davis.
    Voting No: Smith, Ros-Lehtinen, Ballenger, Rorhabacher, 
Manzullo, Royce, King, Chabot, Sanford, Houghton, Campbell, 
Blunt, Moran, Brady, Gejdenson, Ackerman, Hastings, Hilliard, 
Capps, Sherman, Wexler, and Luther.
    Ayes, 13. Noes, 22.
    Note: The bill was subsequently ordered reported favorably, 
amended, by voice vote, a quorum being present, on July 22, 
1997.

                      Section-by-Section Analysis

                         Section 1. Short Title

    This section states that this Act may be cited as the 
``Security and Freedom Through Encryption (SAFE) Act''.

                 Section 2. Sale And Use Of Encryption

    This section states that, in general, Part I of Title 18, 
United States Code, is amended by adding a new chapter after 
chapter 121.
    This section also creates ``Chapter 122-Encrypted Wire And 
Electronic Information'' which includes sections; 2801. 
Definitions., 2802. Freedom To Use Encryption., 2803. Freedom 
to Sell Encryption., 2804. Prohibition On Mandatory Key 
Escrow., 2805. Unlawful Use Of Encryption in the furtherance of 
a criminal act.
    Section 2801 is titled ``Definitions'' and provides 
definitions for ``person'' ``State'' ``wire communication'' 
``electronic communication'', ``investigative or law 
enforcement officer'', judge of competent jurisdiction'', 
``electronic storage'', ``encrypt'', ``encryption'', ``key'', 
and ``United States person''. Many of these definitions were 
taken explicitly from 18 U.S.C. 2810.
    New section 2802 states that it is legal for any person in 
the United States or any United States person in a foreign 
country, to use any form of encryption regardless of the 
algorithm, key length, or technique used in the encryption.
    New section 2803 states that it is legal for any person in 
the United States to sell in interstate commerce encryption 
products using any form of encryption regardless of the 
algorithm, key length, or technique used. The Committee intends 
that Sections 2802 and 2803 be read as limitations on 
government power. They should not be read as overriding 
otherwise lawful employer policies concerning employee use of 
the employers computer system, nor as limiting the employer's 
otherwise lawful means for remedying violations of those 
policies.
    New section 2804 specifically prohibits requiring any 
person in lawful possession of an encryption key to turn that 
key over to another person. This section prevents any form of 
mandatory key escrow system with an exception for any law 
enforcement personnel or a member of the intelligence 
community.
    New section 2805 make it a crime to use encryption 
unlawfully in furtherance of some other crime. This new crime 
is punishable with a sentence of 5 years for a first offence 
and 10 years. This section requires that for a person to 
violate this section that person must be found guilty of some 
other federal felony crime and was deliberately using 
encryption to avoid detection of that other federal felony 
crime.
    Subsection 2(b) of H.R. 695 provides for a conforming 
amendment to the table of chapters in Title 18.

                    Section 3. Export of Encryption

    Subsection 3(a) of H.R. 695 amends the Export 
Administration Act by creating a new subsection (g) entitled 
``Computers and Related Equipment,'' to 50 U.S.C. App. 2416.
    New subsection (g)1 place all encryption products, except 
those specifically designed or modified for military use, under 
the jurisdiction of the Secretary of Commerce.
    New subsection (g)2 allows encryption software that is 
generally available or in the public domain, like mass-market 
software products, to be exported freely except pursuant to the 
Trading With The Enemy Act or the International Emergency 
Economic Powers Act (but only to the to the extent that the 
authority of such Act is not exercised to extend controls 
imposed under this Act.). The Subcommittee on International 
Economic Policy and Trade, on an amendment offered by Chair 
Ros-Lehtinen and Ranking Member Gejdenson, and others, amended 
Subsection (g)2 on a voice vote in Subcommittee to include 
certain other consumer products, or component or subassembly 
(provided those components are not capable of military or 
intelligence end use in its condition as exported.), which have 
encryption capabilities that are inaccessible to the end user 
and which are commercially available within the United States 
or abroad. These product as discussed by the Subcommittee are 
consumer products such as small dish satellite receivers, 
digital video disk players, smart cards, Web TV, etc. These 
products, which are commercially available within the United 
States or abroad, were viewed by the Subcommittee as being 
clearly and purely for consumer end-use and not for military 
purposes. The Ros-Lehtinen amendment also amended (g)2 to 
include customized software for an otherwise lawful purpose by 
a specific purchaser or group of purchasers.
    New subsection (g)3 requires the Secretary of Commerce to 
allow other encryption software to be exported unless there is 
substantial evidence that will be put to military or terrorist 
uses or that it will be reexported without U.S. authorization.
    New subsection (g)4 requires the Secretary to allow the 
export of hardware with encryption capabilities when the 
Commerce Department finds that it is commercially available 
from foreign suppliers without effective restrictions.
    New subsection (g)5 provides definitions for this 
subsection. The subcommittee amendment offered by Chair Ros-
Lehtinen, and others also amended this subsection to include 
the same consumer products added to subsection (g)2.
    As the Ros-Lehtinen amendment adopted in the Subcommittee 
on International Economic Policy and Trade stated, the 
Committee would like to reiterate that, with the ever 
increasing use of computer technology and computer information 
(hardware and software) in consumer product lines for 
protection of privacy, information security, and intellectual 
property interests, it intends this legislation to cover all 
devices--whether traditional computing devices or convergent 
consumer products that incorporate encryption. The applications 
covered by this legislation include video, audio, and data 
communications systems and telecommunication equipment. 
Hardware and software containing encryption, such as encoders, 
decoders, and network terminals, which are essential to protect 
the video signal, are therefore included under section 3(a) of 
this Act. As well as video, audio, data communications systems 
containing encryption and decryption capability are used by 
cable, satellite, and wireless delivery systems. This 
legislation is also intended to include set-top devices and 
other terminals where the encryption is not directly available 
to the user but is used for purposes such as pay per view, and 
hardware such as network computers, telephones or cable modems, 
satellite uplinks and downlinks.
    Subsection 3(b) of H.R. 695 provides that for the purposes 
of carrying out the amendment made by subsection 3(a), the 
Export Administration Act shall be deemed to be in effect. This 
statement is necessary because Congress failed to reauthorize 
the Export Administration Act and it expired in 1994. The 
Administration maintains the Export Administration Act policies 
by executive order. The Committee plans to reauthorize the 
Export Administration Act in this Congress.

    Section 4. Sense of Congress Regarding International Cooperation

    This section asks on the President to call an international 
conference for the purpose ofachieving an agreement among the 
encryption producing countries on policies which will ensure that the 
free use and trade of this technology does not hinder mutual 
technology.

                      Committee Oversight Findings

    In compliance with clause 2(l)(3)(A) of rule XI of the 
Rules of the House of Representatives, the Committee reports 
the findings and recommendations of the Committee, based on 
oversight activities under clause 2(b)(1) of rule X of the 
Rules of the House of Representatives, are incorporated in the 
descriptive portions of this report.

         Committee on Government Reform and Oversight Findings

    No findings or recommendations of the Committee on 
Government Reform and Oversight were received as referred to in 
clause 2(l)(3)(D) of rule XI of the Rules of the House of 
Representatives.

                      Advisory Committee Statement

    No advisory committees within the meaning of section 5(b) 
of the Federal Advisory Committee Act were created by this 
legislation.

                Applicability to the Legislative Branch

    The Committee finds that the legislation does not relate to 
the terms and conditions of employment or access to public 
services or accommodations within the meaning of section 
102(b)(3) of the Congressional Accountability Act.

                   Constitutional Authority Statement

    In compliance with clause 2(l)(4) of rule XI of the Rules 
of the House of Representatives, the Committee cites the 
following specific powers granted to the Congress in the 
Constitution as authority for enactment of H.R. 695 as reported 
by the Committee: Article I, section 8, clause 1 (relating to 
providing for the common defense and general welfare of the 
United States); and Article I, section 8, clause 18 (relating 
to making all laws necessary and proper for carrying into 
execution powers vested by the Constitution in the government 
of the United States).

New Budget Authority and Tax Expenditures, Congressional Budget Office 
                             Cost Estimate

    The Committee expects to adopt a cost estimate of the 
Congressional Budget Office as its submission of any new 
required information on new budget authority, new spending 
authority, new credit authority, or an increase or decrease in 
the national debt, which it expects to provide in a 
supplemental report.

                       Federal Mandates Statement

    The Committee adopts as its own the estimate of Federal 
mandates prepared by the Director of the Congressional Budget 
Office pursuant to section 423 of the Unfunded Mandates Reform 
Act.

                                     U.S. Congress,
                               Congressional Budget Office,
                                     Washington, DC, July 25, 1997.
Hon. Benjamin Gilman,
Chairman, Committee on International Relations,
House of Representatives, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed mandates statement for H.R. 695, the 
Security and Freedom Through Encryption (SAFE) Act. CBO's 
analysis of the bill's federal costs will be sent to you as 
soon as it is completed.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contacts are Pepper 
Santalucia (for the state and local impact) and Matt Eyles (for 
the private-sector impact).
            Sincerely,
                                         Jane E. O'Neill, Director.
    Enclosure.

             congressional budget office mandates statement

H.R. 695--Security and Freedom Through Encryption (SAFE) Act

    H.R. 695 would allow individuals in the United States to 
use and sell any form of encryption and would prohibit states 
or the federal government from requiring individuals to 
relinquish the key to encryption technologies to any third 
party. The bill also would prevent the Bureau of Export 
Administration in the Department of Commerce from restricting 
the export of most nonmilitary encryption products. Finally, 
H.R. 695 would establish criminal penalties and fines for the 
willful use of encryption technologies in committing criminal 
offenses.
    The bill would prohibit states from requiring persons to 
make encryption keys available to another person or entity. 
This prohibition would be an intergovernmental mandate as 
defined in the Unfunded Mandates Reform Act of 1995 (UMRA). 
However, states would bear no costs as a result of this mandate 
because none currently require the registration or availability 
of such keys. H.R. 695 contains no private-sector mandates as 
defined in UMRA.

         Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3 of rule XIII of the Rules of the 
House of Representatives, changes in existing law made by the 
bill, as reported, are shown as follows (new matter is printed 
in italic and existing law in which no change is proposed is 
shown in roman):

                      TITLE 18, UNITED STATES CODE

          * * * * * * *

                             PART I--CRIMES

Chap.                                                               Sec.
1.     General provisions.........................................     1
     * * * * * * *
122.  Encrypted wire and electronic information...................  2801
          * * * * * * *

         CHAPTER 122--ENCRYPTED WIRE AND ELECTRONIC INFORMATION

2801. Definitions.
2802. Freedom to use encryption.
2803. Freedom to sell encryption.
2804. Prohibition on mandatory key escrow.
2805. Unlawful use of encryption in furtherance of a criminal act.

Sec. 2801. Definitions

  As used in this chapter--
          (1) the terms ``person'', ``State'', ``wire 
        communication'', ``electronic communication'', 
        ``investigative or law enforcement officer'', ``judge 
        of competent jurisdiction'', and ``electronic storage'' 
        have the meanings given those terms in section 2510 of 
        this title;
          (2) the terms ``encrypt'' and ``encryption'' refer to 
        the scrambling of wire or electronic information using 
        mathematical formulas or algorithms in order to 
        preserve the confidentiality, integrity, or 
        authenticity of, and prevent unauthorized recipients 
        from accessing or altering, such information;
          (3) the term ``key'' means the variable information 
        used in a mathematical formula, code, or algorithm, or 
        any component thereof, used to decrypt wire or 
        electronic information that has been encrypted; and
          (4) the term ``United States person'' means--
                  (A) any United States citizen;
                  (B) any other person organized under the laws 
                of any State, the District of Columbia, or any 
                commonwealth, territory, or possession of the 
                United States; and
                  (C) any person organized under the laws of 
                any foreign country who is owned or controlled 
                by individuals or persons described in 
                subparagraphs (A) and (B).

Sec. 2802. Freedom to use encryption

  Subject to section 2805, it shall be lawful for any person 
within any State, and for any United States person in a foreign 
country, to use any encryption, regardless of the encryption 
algorithm selected, encryption key length chosen, or 
implementation technique or medium used.

Sec. 2803. Freedom to sell encryption

  Subject to section 2805, it shall be lawful for any person 
within any State to sell in interstate commerce any encryption, 
regardless of the encryption algorithm selected, encryption key 
length chosen, or implementation technique or medium used.

Sec. 2804. Prohibition on mandatory key escrow

  (a) Prohibition.--No person in lawful possession of a key to 
encrypted information may be required by Federal or State law 
to relinquish to another person control of that key.
  (b) Exception for Access for Law Enforcement Purposes.--
Subsection (a) shall not affect the authority of any 
investigative or law enforcement officer, acting under any law 
in effect on the effective date of this chapter, to gain access 
to encrypted information.

Sec. 2805. Unlawful use of encryption in furtherance of a criminal act

  Any person who willfully uses encryption in furtherance of 
the commission of a criminal offense for which the person may 
be prosecuted in a court of competent jurisdiction--
          (1) in the case of a first offense under this 
        section, shall be imprisoned for not more than 5 years, 
        or fined in the amount set forth in this title, or 
        both; and
          (2) in the case of a second or subsequent offense 
        under this section, shall be imprisoned for not more 
        than 10 years, or fined in the amount set forth in this 
        title, or both.
          * * * * * * *
                              ----------                              


          SECTION 17 OF THE EXPORT ADMINISTRATION ACT OF 1979

  Sec. 17. (a) * * *
          * * * * * * *
  (g) Certain Consumer Products, Computers, and Related 
Equipment.--
          (1) General rule.--Subject to paragraphs (2), (3), 
        and (4), the Secretary shall have exclusive authority 
        to control exports of all computer hardware, software, 
        and technology for information security (including 
        encryption), except that which is specifically designed 
        or modified for military use, including command, 
        control, and intelligence applications.
          (2) Items not requiring licenses.--No validated 
        license may be required, except pursuant to the Trading 
        With The Enemy Act or the International Emergency 
        Economic Powers Act (but only to the extent that the 
        authority of such Act is not exercised to extend 
        controls imposed under this Act), for the export or 
        reexport of--
                  (A) any consumer product commercially 
                available within the United States or abroad 
                which--
                          (i) includes encryption capabilities 
                        which are inaccessible to the end user; 
                        and
                          (ii) is not designed for military or 
                        intelligence end use;
                  (B) any component or subassembly designed for 
                use in a consumer product described in 
                subparagraph (A) which itself contains 
                encryption capabilities and is not capable of 
                military or intelligence end use in its 
                condition as exported;
                  (C) any software, including software with 
                encryption capabilities--
                          (i) that is generally available, as 
                        is, and is designed for installation by 
                        the purchaser;
                          (ii) that is in the public domain for 
                        which copyright or other protection is 
                        not available under title 17, United 
                        States Code, or that is available to 
                        the public because it is generally 
                        accessible to the interested public in 
                        any form; or
                          (iii) that is customized for an 
                        otherwise lawful use by a specific 
                        purchaser or group of purchasers;
                  (D) any computing device solely because it 
                incorporates or employs in any form--
                          (i) software (including software with 
                        encryption capabilities) that is 
                        exempted from any requirement for a 
                        validated license under subparagraph 
                        (C); or
                          (ii) software that is no more 
                        technically complex in its encryption 
                        capabilties than software that is 
                        exempted from any requirement for a 
                        validated license under subparagraph 
                        (C) but is not designed for 
                        installation by the purchaser;
                  (E) any computer hardware that is generally 
                available, solely because it has encryption 
                capabilities; or
                  (F) any software or computing device solely 
                on the basis that it incorporates or employs in 
                any form interface mechanisms for interaction 
                with other hardware and software, including 
                hardware, and software, with encryption 
                capabilities.
          (3) Software with encryption capabilities.--The 
        Secretary shall authorize the export or reexport of 
        software with encryption capabilities for nonmilitary 
        end uses in any country to which exports of software of 
        similar capability are permitted for use by financial 
        institutions not controlled in fact by United States 
        persons, unless there is substantial evidence that such 
        software will be--
                  (A) diverted to a military end use or an end 
                use supporting international terrorism;
                  (B) modified for military or terrorist end 
                use; or
                  (C) reexported without any authorization by 
                the United States that may be required under 
                this Act.
          (4) Hardware with encryption capabilities.--The 
        Secretary shall authorize the export or reexport of 
        computer hardware with encryption capabilities if the 
        Secretary determines that a product offering comparable 
        security is commercially available outside the United 
        States from a foreign supplier, without effective 
        restrictions.
          (5) Definitions.--As used in this subsection--
                  (A) the term ``encryption'' means the 
                scrambling of wire or electronic information 
                using mathematical formulas or algorithms in 
                order to preserve the confidentiality, 
                integrity, or authenticity of, and prevent 
                unauthorized recipients from accessing or 
                altering, such information;
                  (B) the term ``generally available'' means--
                          (i) in the case of software 
                        (including software with encryption 
                        capabilities), software that is offered 
                        for sale, license, or transfer to any 
                        person without restriction, whether or 
                        not for consideration, including, but 
                        not limited to, over-the-counter retail 
                        sales, mail order transactions, phone 
                        order transactions, electronic 
                        distribution, or sale on approval; and
                          (ii) in the case of hardware with 
                        encryption capabilities, hardware that 
                        is offered for sale, license, or 
                        transfer to any person without 
                        restriction, whether or not for 
                        consideration, including, but not 
                        limited to, over-the-counter retail 
                        sales, mail order transactions, phone 
                        order transactions, electronic 
                        distribution, or sale on approval;
                  (C) the term ``as is'' means, in the case of 
                software (including software with encryption 
                capabilities), a software program that is not 
                designed, developed, or tailored by the 
                software publisher for specific purchasers, 
                except that such purchasers may supply certain 
                installation parameters needed by the software 
                program to function properly with the 
                purchaser's system and may customize the 
                software program by choosing among options 
                contained in the software program;
                  (D) the term ``is designed for installation 
                by the purchaser'' means, in the case of 
                software (including software with encryption 
                capabilities) that--
                          (i) the software publisher intends 
                        for the purchaser (including any 
                        licensee or transferee), who may not be 
                        the actual program user, to install the 
                        software program on a computing device 
                        and has supplied the necessary 
                        instructions to do so, except that the 
                        publisher may also provide telephone 
                        help line services for software 
                        installation, electronic transmission, 
                        or basic operations; and
                          (ii) the software program is designed 
                        for installation by the purchaser 
                        without further substantial support by 
                        the supplier;
                  (E) the term ``computing device'' means a 
                device which incorporates one or more 
                microprocessor-based central processing units 
                that can accept, store, process, or provide 
                output of data; and
                  (F) the term ``computer hardware'', when used 
                in conjunction with information security, 
                includes, but is not limited to, computer 
                systems, equipment, application-specific 
                assemblies, modules, and integrated circuits.

                            DISSENTING VIEWS

    While well-intentioned, this bill's one-dimensional focus 
on the decontrol of encryption products would upset the vital 
balance that U.S. policy seeks to strike between the 
competitiveness of American industry and U.S. national security 
and law enforcement goals. The bill would prohibit any 
licensing or review of exports of encrypted software and 
hardware items. Consequently, its implementation would not only 
hinder our national security efforts but also undermine the 
Administration's ability to forge an international consensus on 
the use and implementation of national key recovery policies.
    While SAFE Act advocates correctly point out that the 
Administration has not yet achieved a multilateral consensus 
endorsing its preference for a key management infrastructure 
approach on encryption issues, it should be noted that recent 
cryptography guidelines adopted by the Organization for 
Economic Cooperation and Development have stressed the need to 
balance privacy, law enforcement, national security concerns, 
and commercial interests. They also underline the fact that 
failure to coordinate these policies could cripple the global 
information network and impede international trade.
    A July policy brief published by the Brookings Institution 
by Kenneth Flamm on ``Deciphering the Cryptography Debate'' 
noted along the same lines that:
    ``A level playing field, with common global rules of the 
game, is needed to avoid giving economic rivals competitive 
advantages over one another. The administration made an 
important and correct decision in seeking an international 
consensus on the key recovery approach to strong encryption and 
must be sure to continue to work hard in seeking this common 
global approach. While it has yet to achieve such a consensus 
within the OECD, many of the key players with the technical 
capability to ship advanced cryptography products and affect 
global markets--Britain, France and (quietly) Japan--are 
supporting the U.S. approach, and if a few more (like Germany 
and Israel) can be brought on board, the critical mass around 
which the core of an international agreement can be assembled 
will exist.''
    If enacted in its current form, this bill would undermine 
any prospects for achieving such consensus and would compel a 
number of the OECD countries to put additional import 
restrictions in place blocking the entry of our strongest 
encryption products.
    We recognize that the development of strong encryption can 
play a vital role in the development of electronic commerce and 
promoting privacy but the development of key recovery policies 
is essential to head off a potential crisis in the years ahead 
for our law enforcement authorities. If strong encryption is in 
widespread use in the near future, it will make it virtually 
impossible to decipher encrypted communications. Brute force 
attacks to crack encryption algorithms in that type of 
environment are not feasible or realistic, especially in the 
time sensitive cases where law enforcement needs access to 
encrypted files to save lives.
    By removing all controls on the export of any software and 
hardware with encryption capabilities, this bill threatens U.S. 
national security and law enforcement interests.
    With respect to U.S. national security, encrypted 
communications make it more difficult for U.S. intelligence 
agencies to monitor communications relating to terrorism, 
weapons proliferation, military operations, and other threats 
to U.S. national security interests. The Administration does 
not dispute the contention of U.S. software manufacturers that 
encryption products are in use around the world.
    But the Administration also points out that these products 
are not yet being widely used by individuals, groups, and 
governments whose activities pose threats to U.S. security and 
safety. As we understand it, the goal of U.S. export control 
policy is not to prevent the spread ofencryption worldwide--
something which clearly cannot be done--but to slow down the spread of 
these products enough to give U.S.-led diplomacy an opportunity to 
achieve increased multilateral cooperation on common export control 
policies and on the adoption of a global key management infrastructure. 
Such an international key management infrastructure would enable U.S. 
intelligence and law enforcement agencies to cooperate with their 
counterparts in friendly countries in gaining access to communications 
that threaten common security and safety interests.
    The elimination of all U.S. controls on encryption exports 
will also jeopardize domestic law enforcement. We recognize 
that encryption is essential to the fulfillment of the promise 
of electronic commerce and to the protection of individual 
privacy in a networked world. But encryption also complicates 
the mission of U.S. law enforcement agencies, because it can 
make it impossible for law enforcement personnel to understand 
data and communications to which they have been granted access 
under court order or other proper legal authority.
    This is why current U.S. policy seeks to promote the 
adoption of key recovery features in encryption products used 
in the United States. Export controls are a key component of 
this policy. Under current practice, U.S. firms are permitted 
to export powerful encryption products if they already include 
key recovery features or if they pledge to develop such 
features during the next two years. If we eliminate all U.S. 
export controls, as this bill would do, the federal government 
will therefore lose one of its most important means for 
promoting the development of key recovery in the U.S. market. 
That will harm U.S. law enforcement.
    Lawful wiretapping and duly authorized court-ordered access 
to information and materials on a timely basis are essential 
tools for police and law enforcement authorities. If this 
legislation were to be enacted in its present form, the 
resultant proliferation of global and interconnected encryption 
has the very real potential to deny our local, state and 
federal authorities the timely access they now enjoy to data 
and other communications, even after a court order has been 
issued.
    More than one half the annual court-ordered wire taps are 
at the state and local level, and of the national total for all 
such wire taps, more than 70% are for drug-related cases. 
Congressional action on this legislation has the potential to 
affect our cities and towns where the devastating impact of 
illicit drugs already causes nearly $70 billion in annual 
societal costs. We ought not to add to that carnage and 
destruction by denying law enforcement one of the most 
effective tools against this scourge, timely access to lawful 
requests for information needed to combat these crimes.
    Attorney General Janet Reno, our nation's chief law 
enforcement officer, urged the members of our Committee to 
consider the effects of this legislation in her July 18, 1997, 
letter to the International Relations Committee. She said that 
``* * * the misuse of encryption technology will become a 
matter of life and death in many instances. That is why we urge 
you to adopt a balanced approach.'' We invite the attention of 
Members to correspondence from our Nation's law enforcement and 
national security leaders, appended below.
    During the full committee's consideration of H. R. 695, 
Chairman Gilman offered an amendment which would have helped to 
create this necessary balance in the bill. It would have 
provided the President the authorities to control the export 
and reexport of encrypted items if he determines that they 
would adversely affect our national security and our ability to 
fight crimes such as drug trafficking, terrorism and espionage. 
This amendment was, unfortunately, not adopted.
    Other Committees of the House including National Security, 
Intelligence and Commerce will now review this legislation 
through September 5 before it is considered by the full House 
later this year. We urge our colleagues on these Committees as 
well as our colleagues on the International Relations and the 
Judiciary Committees to review this legislation very carefully 
and consider its impact on our society and our ability to fight 
terrorism and protect our national security interests.

                                   Benjamin A. Gilman.
                                   Lee H. Hamilton.
                                   Doug Bereuter.
                                ------                                

                            Office of the Attorney General,
                                     Washington, DC, July 18, 1997.
    Dear Member of Congress: Congress is considering a variety 
of legislative proposals concerning encryption. Some of these 
proposals would, in effect, make it impossible for the Federal 
Bureau of Investigation (FBI), Drug Enforcement Administration 
(DEA), Secret Service, Customs Service, Bureau of Alcohol, 
Tobacco and Firearms, and other federal, state, and local law 
enforcement agencies to lawfully gain access to criminal 
telephone conversations or electronically stored evidence 
possessed by terrorists, child pornographers, drug kingpins, 
spies and other criminals. Since the impact of these proposals 
would seriously jeopardize safety and national security, we 
collectively urge you to support a different, balanced approach 
that strongly supports commercial and privacy interests but 
maintains our ability to investigate and prosecute serious 
crimes.
    We fully recognize that encryption is critical to 
communications security and privacy, and that substantial 
commercial interests are at stake. Perhaps in recognition of 
these facts, all the bills being considered allow market forces 
to shape the development of encryption products. We, too, place 
substantial reliance on market forces to promote electronic 
security and privacy, but believe that we cannot rely solely on 
market forces to protect the public safety and national 
security. Obviously, the government cannot abdicate its solemn 
responsibility to protect public safety and national security.
    Currently, of course, encryption is not widely used, and 
most data is stored, and transmitted, in the clear. As we move 
from a plain text world to an encrypted one, we have a critical 
choice to make: we can either (1) choose robust, unbreakable 
encryption that protects commerce and privacy but gives 
criminals a powerful new weapons, or (2) choose robust, 
unbreakable encryption that protects commerce and privacy and 
gives law enforcement the ability to protect public safety. The 
choice should be obvious and it would be a mistake of historic 
proportions to do nothing about the dangers to public safety 
posed by encryption without adequate safeguards for law 
enforcement.
    Let there be no doubt: without encryption safeguards, all 
Americans will be endangered. No one disputes this fact; not 
industry, not encryption users, no one. We need to take 
definitive actions to protect the safety of the public and 
security of the nation. That is why law enforcement at all 
levels of government--including the Justice Department, 
Treasury Department, the National Association of Attorneys 
General, International Association of Chiefs of Police, the 
Major City Chiefs, the National Sheriffs' Association, and the 
National District Attorneys Association--are so concerned about 
this issue.
    We all agree that without adequate legislation, law 
enforcement in the United States will be severely limited in 
its ability to combat the worst criminals and terrorists. 
Further, law enforcement agrees that the widespread use of 
robust non-key recovery encryption ultimately will devastate 
our ability to fight crime and prevent terrorism.
    Simply stated, technology is rapidly developing to the 
point where powerful encryption will become commonplace both 
for routine telephone communications and for stored computer 
data. Without legislation that accommodates public safety and 
national security concerns, society's most dangerous criminals 
will be able to communicate safely and electronically store 
data without fear of discovery. Court orders to conduct 
electronic surveillance and court-authorized search warrants 
will be ineffectual, and the Fourth Amendment's carefully-
struck balance between ensuring privacy and protecting public 
safety will be forever altered by technology. Technology should 
not dictate public policy, and it should promote, rather than 
defeat, public safety
    We are not suggesting the balance of the Fourth Amendment 
be tipped toward law enforcement either. To the contrary, we 
only seek the status quo, not the lessening of any legal 
standard or the expansion of any law enforcement authority. The 
Fourth Amendment protects the privacy and liberties of our 
citizens but permits law enforcement to use tightly controlled 
investigative techniques to obtain evidence of crimes. The 
result has been the freest country in the world with the 
strongest economy.
    Law enforcement has already confronted encryption in high-
profile espionage, terrorist, and criminal cases. For example:
          An international terrorist was plotting to blow up 11 
        U.S.-owned commercial airliners in the Far East. His 
        laptop computer, which was seized in Manila, contained 
        encrypted files concerning this terrorist plot;
          A subject in a child pornography case used encryption 
        in transmitting obscene and pornographic images of 
        children over the Internet; and
          A major international drug trafficking subject 
        recently used a telephone encryption device to 
        frustrate court-approved electronic surveillance.
And this is just the tip of the iceberg. Convicted spy Aldrich 
Ames, for example, was told by the Russian Intelligence Service 
to encrypt computer file information that was to be passed to 
them.
    Further, today's international drug trafficking 
organizations are the most powerful, ruthless and affluent 
criminal enterprises we have ever faced. We know from numerous 
past investigations that they have utilized their virtually 
unlimited wealth to purchase sophisticated electronic equipment 
to facilitate their illegal activities. This has included state 
of the art communication and encryption devices. They have used 
this equipment as part of their command and control process for 
their international criminal operations. We believe you share 
our concern that criminals will increasingly take advantage of 
developing technology to further insulate their violent and 
destructive activities.
    Requests for cryptographic support pertaining to electronic 
surveillance interceptions from FBI Field Offices and other law 
enforcement agencies have steadily risen over the past several 
years. There has been an increase in the number of instances 
where the FBI's and DEA's court-authorized electronic efforts 
were frustrated by the use of encryption that did not allow for 
law enforcement access.
    There have also been numerous other cases where law 
enforcement, through the use of electronic surveillance, has 
not only solved and successfully prosecuted serious crimes but 
has also been able to prevent life-threatening criminal acts. 
For example, terrorists in New York were plotting to bomb the 
United Nations building, the Lincoln and Holland Tunnels, and 
26 Federal Plaza as well as conduct assassinations of political 
figures. Court-authorized electronic surveillance enabled the 
FBI to disrupt the plot as explosives were being mixed. 
Ultimately, the evidence obtained was used to convict the 
conspirators. In another example, electronic surveillance was 
used to stop and then convict two men who intended to kidnap, 
molest, and kill a child. In all of these cases, the use of 
encryption might have seriously jeopardized public safety and 
resulted in the loss of life.
    To preserve law enforcement's abilities, and to preserve 
the balance so carefully established by the Constitution, we 
believe any encryption legislation must accomplish three goals 
in addition to promoting the widespread use of strong 
encryption. It must establish:
          A viable key management infrastructure that promotes 
        electronic commerce and enjoys the confidence of 
        encryption users;
          A key management infrastructure that supports a key 
        recovery scheme that will allow encryption users access 
        to their own data should the need arise, and that will 
        permit law enforcement to obtain lawful access to the 
        plain text of encrypted communications and data; and
          An enforcement mechanism that criminalizes both 
        improper use of encryption key recovery information and 
        the use of encryption for criminal purposes.
    Only one bill, S. 909 (the McCain/Kerrey/Hollings bill), 
comes close to meeting these core public safety, law 
enforcement, and national security needs. The other bills being 
considered by Congress, as currently written, risk great harm 
to our ability to enforce the laws and protect our citizens. We 
look forward to working to improve the McCain/Kerrey/Hollings 
bill.
    In sum, while encryption is certainly a commercial interest 
of great importance to this Nation, it is not solely a 
commercial or business issue. Those of us charged with the 
protection of public safety and national security, believe that 
the misuse of encryption technology will become a matter of 
life and death in many instances. That is why we urge you to 
adopt a balanced approach that accomplishes the goals mentioned 
above. Only this approach will allow police departments, 
attorneys general, district attorneys, sheriffs, and federal 
authorities to continue to use their most effective 
investigative techniques, with court approval, to fight crime 
and espionage and prevent terrorism.
            Sincerely your,
                    Janet Reno, Attorney General; Louis Freeh, 
                            Director, Federal Bureau of Investigation; 
                            Thomas A. Constantine, Director, Drug 
                            Enforcement Administration; Raymond W. 
                            Kelly, Undersecretary for Enforcement, U.S. 
                            Department of Treasury; John W. Magaw, 
                            Director, Bureau of Alcohol, Tobacco and 
                            Firearms; Barry McCaffrey, Director, Office 
                            of National Drug Control Policy; Lewis C. 
                            Merletti, Director, United States Secret 
                            Service; George J. Weise, Commissioner, 
                            United States Customs Service.
                                ------                                

                                  The Secretary of Defense,
                                     Washington, DC, July 21, 1997.
    Dear Member of Congress: Recently you received a letter 
from the nation's senior law enforcement officials regarding US 
encryption policies. I am writing today to express my strong 
support for their views on this important issue.
    As you know, the Department of Defense is involved on a 
daily basis in countering international terrorism, narcotics 
trafficking, and the proliferation of weapons of mass 
destruction. The spread of unbreakable encryption, as a 
standard feature of mass market communication products, 
presents a significant threat to the ability of the US and its 
allies to monitor the dangerous groups and individuals involved 
in these activities. Passage of legislation which effectively 
decontrols commercial encryption exports would undermine U.S. 
efforts to foster the use of strong key recovery encryption 
domestically and abroad. Key recovery products will preserve 
governments' abilities to counter worldwide terrorism, 
narcotics trafficking and proliferation.
    It is also important to note that the Department of Defense 
relies on the Federal Bureau of Investigation for the 
apprehension and prosecution of spies. Sadly, there have been 
over 60 espionage convictions of federal employees over the 
last decade. While these individuals represent a tiny minority 
of government employees, the impact of espionage activities on 
our nation's security can be enormous. As the recent arrests of 
Nicholson, Pitts and Kim clearly indicate, espionage remains a 
very serious problem. Any policies that detract from the FBI's 
ability to perform its vital counterintelligence function, 
including the ability to perform wiretaps, inevitably detract 
from the security of the Department of Defense and the nation.
    Encryption legislation must also address the nation's 
domestic information security needs. Today, approximately 95% 
of DoD communications rely on public networks; other parts of 
government, and industry, are even more dependent on the 
trustworthiness of such networks. Clearly, we must ensure that 
encryption legislation addresses these needs. An approach such 
as the one contained in S. 909 can go a long way toward 
balancing the need for strong encryption with the need to 
preserve national security and public safety. I hope that you 
will work with the Administration to enact legislation that 
addresses these national security concerns as well as the 
rights of the American people.
    I appreciate your consideration of these views.
            Sincerely,
                                                        Bill Cohen.
                                ------                                

             International Association of Chiefs of Police,
                                     Alexandria, VA, July 21, 1997.
    Dear Member of Congress: Enclosed is a letter sent to you 
by the Attorney General, the Director of National Drug Control 
Policy and all the federal law enforcement heads concerning 
encryption legislation being considered by congress. 
Collectively we, the undersigned, represent over 17,000 police 
departments including every major city police department, over 
3,000 sheriffs departments, nearly every district attorney in 
the United States and all of the state Attorneys General. We 
fully endorse the position taken by our federal counterparts in 
the enclosed letter. As we have stated many times, Congress 
must adopt a balanced approach to encryption that fully 
addresses public safety concerns or the ability of state and 
local law enforcement to fight crime and drugs will be severely 
damaged.
    Any encryption legislation that does not ensure that law 
enforcement can gain timely access to the plaintext of 
encrypted conversations and information by established legal 
procedures will cause grave harm to public safety. The risk 
cannot be left to the uncertainty of market forces or 
commercial interests as the current legislative proposals would 
require. Without adequate safeguards, the unbridled use of 
powerful encryption soon will deprive law enforcement of two of 
its most effective tools, court authorized electronic 
surveillance and the search and seizure of information stored 
in computers. This will substantially tip the balance in the 
fight against crime towards society's most dangerous criminals 
as the information age develops.
    We are in unanimous agreement that congress must adopt 
encryption legislation that requires the development, 
manufacture, distribution and sale of only key recovery 
products and we are opposed to the bills that do not do so. 
Only the key recovery approach will ensure that law enforcement 
can continue to gain timely access to the plaintext of 
encrypted conversations and other evidence of crimes when 
authorized by a court to do so. If we lose this ability--and 
the bills you are considering will have this result--it will be 
a substantial set back for law enforcement at the direct 
expense of public safety.
            Sincerely yours,
                                   Darrell L. Sanders,
                                           President, International 
                                               Association of Chiefs of 
                                               Police.
                                   James E. Doyle,
                                           President, National 
                                               Association of Attorneys 
                                               General.
                                   Fred Scoralic,
                                           President, National 
                                               Sheriffs' Association.
                                   William L. Murphy,
                                           President, National District 
                                               Attorneys Association.

                                
