[House Report 106-117]
[From the U.S. Government Publishing Office]
106th Congress Rept. 106-117
HOUSE OF REPRESENTATIVES
1st Session Part 5
======================================================================
ENCRYPTION FOR THE NATIONAL INTEREST ACT
_______
July 23, 1999.--Committed to the Committee of the Whole House on the
State of the Union and ordered to be printed
_______
Mr. Goss, from the Permanent Select Committee on Intelligence,
submitted the following
R E P O R T
[To accompany H.R. 850]
[Including cost estimate of the Congressional Budget Office]
The Permanent Select Committee on Intelligence, to whom was
referred the bill (H.R. 850) to amend title 18, United States
Code, to affirm the rights of United States persons to use and
sell encryption and to relax export controls on encryption,
having considered the same, report favorably thereon with an
amendment and recommend that the bill as amended do pass.
The amendment is as follows:
Strike out all after the enacting clause and insert in lieu
thereof the following:
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Encryption for the
National Interest Act''.
(b) Table of Contents.--The table of contents is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Statement of policy.
Sec. 3. Congressional findings.
TITLE I--DOMESTIC USES OF ENCRYPTION
Sec. 101. Definitions.
Sec. 102. Lawful use of encryption.
Sec. 103. Unlawful use of encryption.
TITLE II--GOVERNMENT PROCUREMENT
Sec. 201. Federal purchases of encryption products.
Sec. 202. Networks established with Federal funds.
Sec. 203. Government contract authority.
Sec. 204. Product labels.
Sec. 205. No private mandate.
Sec. 206. Exclusion.
TITLE III--EXPORTS OF ENCRYPTION
Sec. 301. Exports of encryption.
Sec. 302. License exception for certain encryption products.
Sec. 303. Discretionary authority.
Sec. 304. Expedited review authority.
Sec. 305. Encryption licenses required.
Sec. 306. Encryption Industry and Information Security Board.
TITLE IV--LIABILITY LIMITATIONS
Sec. 401. Compliance with court order.
Sec. 402. Compliance defense.
Sec. 403. Good faith defense.
TITLE V--INTERNATIONAL AGREEMENTS
Sec. 501. Sense of Congress.
Sec. 502. Failure to negotiate.
Sec. 503. Report to Congress.
TITLE VI--MISCELLANEOUS PROVISIONS
Sec. 601. Effect on law enforcement activities.
Sec. 602. Interpretation.
Sec. 603. FBI technical support.
Sec. 604. Severability.
SEC. 2. STATEMENT OF POLICY.
It is the policy of the United States to protect public computer
networks through the use of strong encryption technology, to promote
the export of encryption products developed and manufactured in the
United States, and to preserve public safety and national security.
SEC. 3. CONGRESSIONAL FINDINGS.
The Congress finds the following:
(1) Information security technology, encryption, is--
(A) fundamental to secure the flow of intelligence
information to national policy makers;
(B) critical to the President and national command
authority of the United States;
(C) necessary to the Secretary of State for the
development and execution of the foreign policy of the
United States;
(D) essential to the Secretary of Defense's
responsibilities to ensure the effectiveness of the
Armed Forces of the United States;
(E) invaluable to the protection of the citizens of
the United States from fraud, theft, drug trafficking,
child pornography; kidnapping, and money laundering;
and
(F) basic to the protection of the nation's critical
infrastructures, including electrical grids, banking
and financial systems, telecommunications, water
supplies, and transportation.
(2) The goal of any encryption legislation should be to
enhance and promote the global market strength of United States
encryption manufacturers, while guaranteeing that national
security and public safety obligations of the Government can
still be accomplished.
(3) It is essential to the national security interests of the
United States that United States encryption products dominate
the global market.
(4) Widespread use of unregulated encryption products poses a
significant threat to the national security interests of the
United States.
(5) Leaving the national security and public safety
responsibilities of the Government to the marketplace alone is
not consistent with the obligations of the Government to
protect the public safety and to defend the Nation.
(6) In order for the United States position in the global
market to benefit the national security interests of the United
States, it is imperative that the export of encryption products
be subject to a dynamic and constructive export control regime.
(7) Export of commercial items are best managed through a
regulatory structure which has flexibility to address
constantly changing market conditions.
(8) Managing sensitive dual-use technologies, such as
encryption products, is challenging in any regulatory
environment due to the difficulty in balancing competing
interests in national security, public safety, privacy, fair
competition within the industry, and the dynamic nature of the
technology.
(9) There is a widespread perception that the executive
branch has not adequately balanced the equal and competing
interests of national security, public safety, privacy, and
industry.
(10) There is a perception that the current encryption export
control policy has done more to disadvantage United States
business interests than to promote and protect national
security and public safety interests.
(11) A balance can and must be achieved between industry
interests, national security, law enforcement requirements, and
privacy needs.
(12) A court order process should be required for access to
plaintext, where and when available, and criminal and civil
penalties should be imposed for misuse of decryption
information.
(13) Timely access to plaintext capability is--
(A) necessary to thwarting potential terrorist
activities;
(B) extremely useful in the collection of foreign
intelligence;
(C) indispensable to force protection requirements;
(D) critical to the investigation and prosecution of
criminals; and
(E) both technically and economically possible.
(14) The United States Government should encourage the
development of those products that would provide a capability
allowing law enforcement (Federal, State, and local), with a
court order only, to gain timely access to the plaintext of
either stored data or data in transit.
(15) Unless law enforcement has the benefit of such market
encouragement, drug traffickers, spies, child pornographers,
pedophiles, kidnappers, terrorists, mobsters, weapons
proliferators, fraud schemers, and other criminals will be able
to use encryption software to protect their criminal activity
and hinder the criminal justice system.
(16) An effective regulatory approach to manage the
proliferation of encryption products which have dual-use
capabilities must be maintained and greater confidence in the
ability of the executive branch to preserve and promote the
competitive advantage of the United States encryption industry
in the global market must be provided.
TITLE I--DOMESTIC USES OF ENCRYPTION
SEC. 101. DEFINITIONS.
For purposes of this Act:
(1) Attorney for the government.--The term ``attorney for the
Government'' has the meaning given such term in Rule 54(c) of
the Federal Rules of Criminal Procedure, and also includes any
duly authorized attorney of a State who is authorized to
prosecute criminal offenses within such State.
(2) Authorized party.--The term ``authorized party'' means
any person with the legal authority to obtain decryption
information or plaintext of encrypted data, including
communications.
(3) Communications.--The term ``communications'' means any
wire communications or electronic communications as those terms
are defined in paragraphs (1) and (12) of section 2510 of title
18, United States Code.
(4) Court of competent jurisdiction.--The term ``court of
competent jurisdiction'' means any court of the United States
organized under Article III of the Constitution of the United
States, the court organized under the Foreign Intelligence
Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), or a court
of general criminal jurisdiction of a State authorized pursuant
to the laws of such State to enter orders authorizing searches
and seizures.
(5) Data network service provider.--The term ``data network
service provider'' means a person offering any service to the
general public that provides the users thereof with the ability
to transmit or receive data, including communications.
(6) Decryption.--The term ``decryption'' means the
retransformation or unscrambling of encrypted data, including
communications, to its readable plaintext version. To
``decrypt'' data, including communications, is to perform
decryption.
(7) Decryption information.--The term ``decryption
information'' means information or technology that enables one
to readily retransform or unscramble encrypted data from its
unreadable and incomprehensible format to its readable
plaintext version.
(8) Electronic storage.--The term ``electronic storage'' has
the meaning given that term in section 2510(17) of title 18,
United States Code.
(9) Encryption.--The term ``encryption'' means the
transformation or scrambling of data, including communications,
from plaintext to an unreadable or incomprehensible format,
regardless of the technique utilized for such transformation or
scrambling and irrespective of the medium in which such data,
including communications, occur or can be found, for the
purposes of protecting the content of such data, including
communications. To ``encrypt'' data, including communications,
is to perform encryption.
(10) Encryption product.--The term ``encryption product''
means any software, technology, commodity, or mechanism, that
can be used to encrypt or decrypt or has the capability of
encrypting or decrypting any data, including communications.
(11) Foreign availability.--The term ``foreign availability''
has the meaning applied to foreign availability of encryption
products subject to controls under the Export Administration
Regulations, as in effect on July 1, 1999.
(12) Government.--The term ``Government'' means the
Government of the United States and any agency or
instrumentality thereof, or the government of any State, and
any of its political subdivisions.
(13) Investigative or law enforcement officer.--The term
``investigative or law enforcement officer'' has the meaning
given that term in section 2510(7) of title 18, United States
Code.
(14) National security.--The term ``national security'' means
the national defense, intelligence, or foreign policy interests
of the United States.
(15) Plaintext.--The term ``plaintext'' means the readable or
comprehensible format of that data, including communications,
which has been encrypted.
(16) Plainvoice.--The term ``plainvoice'' means communication
specific plaintext.
(17) Secretary.--The term ``Secretary'' means the Secretary
of Commerce, unless otherwise specifically identified.
(18) State.--The term ``State'' has the meaning given that
term in section 2510(3) of title 18, United States Code.
(19) Telecommunications carrier.--The term
``telecommunications carrier'' has the meaning given that term
in section 3 of the Communications Act of 1934 (47 U.S.C. 153).
(20) Telecommunications system.--The term
``telecommunications system'' means any equipment, technology,
or related software used in the movement, switching,
interchange, transmission, reception, or internal signaling of
data, including communications over wire, fiber optic, radio
frequency, or any other medium.
(21) United states person.--The term ``United States person''
means--
(A) any citizen of the United States;
(B) any other person organized under the laws of any
State; and
(C) any person organized under the laws of any
foreign country who is owned or controlled by
individuals or persons described in subparagraphs (A)
and (B).
SEC. 102. LAWFUL USE OF ENCRYPTION.
Except as otherwise provided by this Act or otherwise provided by
law, it shall be lawful for any person within any State and for any
United States person to use any encryption product, regardless of
encryption algorithm selected, encryption bit length chosen, or
implementation technique or medium used.
SEC. 103. UNLAWFUL USE OF ENCRYPTION.
(a) In General.--Part I of title 18, United States Code, is amended
by inserting after chapter 123 the following new chapter:
``CHAPTER 125--ENCRYPTED DATA, INCLUDING COMMUNICATIONS
``Sec.
``2801. Unlawful use of encryption in furtherance of a criminal act.
``2802. Privacy protection.
``2803. Court order access to plaintext or decryption information.
``2804. Notification procedures.
``2805. Lawful use of plaintext or decryption information.
``2806. Identification of decryption information.
``2807. Definitions.
``Sec. 2801. Unlawful use of encryption in furtherance of a criminal
act
``(a) Prohibited Acts.--Whoever knowingly uses encryption in
furtherance of the commission of a criminal offense for which the
person may be prosecuted in a district court of the United States
shall--
``(1) in the case of a first offense under this section, be
imprisoned for not more than 5 years, or fined under this
title, or both; and
``(2) in the case of a second or subsequent offense under
this section, be imprisoned for not more than 10 years, or
fined under this title, or both.
``(b) Consecutive Sentence.--Notwithstanding any other provision of
law, the court shall not place on probation any person convicted of a
violation of this section, nor shall the term of imprisonment imposed
under this section run concurrently with any other term of imprisonment
imposed for the underlying criminal offense.
``(c) Probable Cause Not Constituted by Use of Encryption.--The use
of encryption by itself shall not establish probable cause to believe
that a crime is being or has been committed.
``Sec. 2802. Privacy protection
``(a) In General.--It shall be unlawful for any person to
intentionally--
``(1) obtain or use decryption information without lawful
authority for the purpose of decrypting data, including
communications;
``(2) exceed lawful authority in decrypting data, including
communications;
``(3) break the encryption code of another person without
lawful authority for the purpose of violating the privacy or
security of that person or depriving that person of any
property rights;
``(4) impersonate another person for the purpose of obtaining
decryption information of that person without lawful authority;
``(5) facilitate or assist in the encryption of data,
including communications, knowing that such data, including
communications, are to be used in furtherance of a crime; or
``(6) disclose decryption information in violation of a
provision of this chapter.
``(b) Criminal Penalty.--Whoever violates this section shall be
imprisoned for not more than 10 years, or fined under this title, or
both.
``Sec. 2803. Court order access to plaintext or decryption information
``(a) Court Order.--(1) A court of competent jurisdiction shall issue
an order, ex parte, granting an investigative or law enforcement
officer timely access to the plaintext of encrypted data, including
communications, or requiring any person in possession of decryption
information to provide such information to a duly authorized
investigative or law enforcement officer--
``(A) upon the application by an attorney for the Government
that--
``(i) is made under oath or affirmation by the
attorney for the Government; and
``(ii) provides a factual basis establishing the
relevance that the plaintext or decryption information
being sought has to a law enforcement, foreign
counterintelligence, or international terrorism
investigation then being conducted pursuant to lawful
authorities; and
``(B) if the court finds, in writing, that the plaintext or
decryption information being sought is relevant to an ongoing
lawful law enforcement, foreign counterintelligence, or
international terrorism investigation and the investigative or
law enforcement officer is entitled to such plaintext or
decryption information.
``(2) The order issued by the court under this section shall be
placed under seal, except that a copy may be made available to the
investigative or law enforcement officer authorized to obtain access to
the plaintext of the encrypted information, or authorized to obtain the
decryption information sought in the application. Such order shall,
subject to the notification procedures set forth in section 2804, also
be made available to the person responsible for providing the plaintext
or the decryption information, pursuant to such order, to the
investigative or law enforcement officer.
``(3) Disclosure of an application made, or order issued, under this
section, is not authorized, except as may otherwise be specifically
permitted by this section or another order of the court.
``(b) Record of Access Required.--(1) There shall be created an
electronic record, or similar type record, of each instance in which an
investigative or law enforcement officer, pursuant to an order under
this section, gains access to the plaintext of otherwise encrypted
information, or is provided decryption information,without the
knowledge or consent of the owner of the data, including
communications, who is the user of the encryption product involved.
``(2) The court issuing the order under this section may require that
the electronic or similar type of record described in paragraph (1) is
maintained in a place and a manner that is not within the custody or
control of an investigative or law enforcement officer gaining the
access or provided the decryption information. The record shall be
tendered to the court, upon notice from the court.
``(3) The court receiving such electronic or similar type of record
described in paragraph (1) shall make the original and a certified copy
of the record available to the attorney for the Government making
application under this section, and to the attorney for, or directly
to, the owner of the data, including communications, who is the user of
the encryption product, pursuant to the notification procedures set
forth in section 2804.
``(c) Authority To Intercept Communications Not Increased.--Nothing
in this chapter shall be construed to enlarge or modify the
circumstances or procedures under which a Government entity is entitled
to intercept or obtain oral, wire, or electronic communications or
information.
``(d) Construction.--This chapter shall be strictly construed to
apply only to a Government entity's ability to decrypt data, including
communications, for which it has previously obtained lawful authority
to intercept or obtain pursuant to other lawful authorities, which
without an order issued under this section would otherwise remain
encrypted.
``Sec. 2804. Notification procedures
``(a) In General.--Within a reasonable time, but not later than 90
days after the filing of an application for an order under section 2803
which is granted, the court shall cause to be served, on the persons
named in the order or the application, and such other parties whose
decryption information or whose plaintext has been provided to an
investigative or law enforcement officer pursuant to this chapter, as
the court may determine is in the interest of justice, an inventory
which shall include notice of--
``(1) the fact of the entry of the order or the application;
``(2) the date of the entry of the application and issuance
of the order; and
``(3) the fact that the person's decryption information or
plaintext data, including communications, has been provided or
accessed by an investigative or law enforcement officer.
The court, upon the filing of a motion, may make available to that
person or that person's counsel, for inspection, such portions of the
plaintext, applications, and orders as the court determines to be in
the interest of justice.
``(b) Postponement of Inventory for Good Cause.--(1) On an ex parte
showing of good cause by an attorney for the Government to a court of
competent jurisdiction, the serving of the inventory required by
subsection (a) may be postponed for an additional 30 days after the
granting of an order pursuant to the ex parte motion.
``(2) No more than 3 ex parte motions pursuant to paragraph (1) are
authorized.
``(c) Admission Into Evidence.--The content of any encrypted
information that has been obtained pursuant to this chapter or evidence
derived therefrom shall not be received in evidence or otherwise
disclosed in any trial, hearing, or other proceeding in a Federal or
State court, other than the court organized pursuant to the Foreign
Intelligence Surveillance Act of 1978, unless each party, not less than
10 days before the trial, hearing, or proceeding, has been furnished
with a copy of the order, and accompanying application, under which the
decryption or access to plaintext was authorized or approved. This 10-
day period may be waived by the court if the court finds that it was
not possible to furnish the party with the information described in the
preceding sentence within 10 days before the trial, hearing, or
proceeding and that the party will not be prejudiced by the delay in
receiving such information.
``(d) Construction.--The provisions of this chapter shall be
construed consistent with--
``(1) the Classified Information Procedures Act (18 U.S.C.
App.); and
``(2) the Foreign Intelligence Surveillance Act of 1978 (50
U.S.C. 1801 et seq.).
``(e) Contempt.--Any violation of the provisions of this section may
be punished by the court as a contempt thereof.
``(f) Motion To Suppress.--Any aggrieved person in any trial,
hearing, or proceeding in or before any court, department, officer,
agency, regulatory body, or other authority of the United States or a
State, other than the court organized pursuant to the Foreign
Intelligence Surveillance Act of 1978, may move to suppress the
contents of any decrypted data, including communications, obtained
pursuant to this chapter, or evidence derived therefrom, on the grounds
that --
``(1) the plaintext was decrypted or accessed in violation of
this chapter;
``(2) the order of authorization or approval under which it
was decrypted or accessed is insufficient on its face; or
``(3) the decryption was not made in conformity with the
order of authorization or approval.
Such motion shall be made before the trial, hearing, or proceeding
unless there was no opportunity to make such motion, or the person was
not aware of the grounds of the motion. If the motion is granted, the
plaintext of the decrypted data, including communications, or evidence
derived therefrom, shall be treated as having been obtained in
violation of this chapter. The court, upon the filing of such motion by
the aggrieved person, may make available to the aggrieved person or
that person's counsel for inspection such portions of the decrypted
plaintext, or evidence derived therefrom, as the court determines to be
in the interests of justice.
``(g) Appeal by United States.--In addition to any other right to
appeal, the United States shall have the right to appeal from an order
granting a motion to suppress made under subsection (f), or the denial
of an application for an order under section 2803, if the attorney for
the Government certifies to the court or other official granting such
motion or denying such application that the appeal is not taken for
purposes of delay. Such appeal shall be taken within 30 days after the
date the order was entered on the docket and shall be diligently
prosecuted.
``(h) Civil Action for Violation.--Except as otherwise provided in
this chapter, any person described in subsection (i) may, in a civil
action, recover from the United States Government the actual damages
suffered by the person as a result of a violation described in that
subsection, reasonable attorney's fees, and other litigation costs
reasonably incurred in prosecuting such claim.
``(i) Covered Persons.--Subsection (h) applies to any person whose
decryption information--
``(1) is knowingly obtained without lawful authority by an
investigative or law enforcement officer;
``(2) is obtained by an investigative or law enforcement
officer with lawful authority and is knowingly used or
disclosed by such officer unlawfully; or
``(3) is obtained by an investigative or law enforcement
officer with lawful authority and whose decryption information
is unlawfully used to disclose the plaintext of the data,
including communications.
``(j) Limitation.--A civil action under subsection (h) shall be
commenced not later than 2 years after the date on which the unlawful
action took place, or 2 years after the date on which the claimant
first discovers the violation, whichever is later.
``(k) Exclusive Remedies.--The remedies and sanctions described in
this chapter with respect to the decryption of data, including
communications, are the only judicial remedies and sanctions for
violations of this chapter involving such decryptions, other than
violations based on the deprivation of any rights, privileges, or
immunities secured by the Constitution.
``(l) Technical Assistance by Providers.--A provider of encryption
technology or network service that has received an order issued by a
court pursuant to this chapter shall provide to the investigative or
law enforcement officer concerned such technical assistance as is
necessary to execute the order. Such provider may, however, move the
court to modify or quash the order on the ground that its assistance
with respect to the decryption or access to plaintext cannot be
performed in fact, or in a timely or reasonable fashion. The court,
upon notice to the Government, shall decide such motion expeditiously.
``(m) Reports to Congress.--In May of each year, the Attorney
General, or an Assistant Attorney General specifically designated by
the Attorney General, shall report in writing to Congress on the number
of applications made and orders entered authorizing Federal, State, and
local law enforcement access to decryption information for the purposes
of reading the plaintext of otherwise encrypted data, including
communications, pursuant to this chapter. Such reports shall be
submitted to the Committees on the Judiciary of the House of
Representatives and of the Senate, and to the Permanent Select
Committee on Intelligence for the House of Representatives and the
Select Committee on Intelligence for the Senate.
``Sec. 2805. Lawful use of plaintext or decryption information
``(a) Authorized Use of Decryption Information.--
``(1) Criminal investigations.--An investigative or law
enforcement officer to whom plaintext or decryption information
is provided may only use such plaintext or decryption
information for the purposes of conducting a lawful criminal
investigation, foreign counterintelligence, or international
terrorism investigation, and for the purposes of preparing for
and prosecuting any criminal violation of law.
``(2) Civil redress.--Any plaintext or decryption information
provided under this chapter to an investigative or law
enforcement officer may not be disclosed, except by court
order, to any other person for use in a civil proceeding that
is unrelated to a criminal investigation and prosecution for
which the plaintext or decryption information is authorized
under paragraph (1). Such order shall only issue upon a showing
by the party seeking disclosure that there is no alternative
means of obtaining the plaintext, or decryption information,
being sought and the court also finds that the interests of
justice would not be served by nondisclosure.
``(b) Limitation.--An investigative or law enforcement officer may
not use decryption information obtained under this chapter to determine
the plaintext of any data, including communications, unless it has
obtained lawful authority to obtain such data, including
communications, under other lawful authorities.
``(c) Return of Decryption Information.--An attorney for the
Government shall, upon the issuance of an order of a court of competent
jurisdiction--
``(1)(A) return any decryption information to the person
responsible for providing it to an investigative or law
enforcement officer pursuant to this chapter; or
``(B) destroy such decryption information, if the court finds
that the interests of justice or public safety require that
such decryption information should not be returned to the
provider; and
``(2) within 10 days after execution of the court's order to
return or destroy the decryption information--
``(A) certify to the court that the decryption
information has either been returned or destroyed
consistent with the court's order; and
``(B) if applicable, notify the provider of the
decryption information of the destruction of such
information.
``(d) Other Disclosure of Decryption Information.--Except as
otherwise provided in section 2803, decryption information or the
plaintext of otherwise encrypted data, including communications, shall
not be disclosed by any person unless the disclosure is--
``(1) to the person encrypting the data, including
communications, or an authorized agent thereof;
``(2) with the consent of the person encrypting the data,
including pursuant to a contract entered into with the person;
``(3) pursuant to a court order upon a showing of compelling
need for the information that cannot be accommodated by any
other means if--
``(A) the person who supplied the information is
given reasonable notice, by the person seeking the
disclosure, of the court proceeding relevant to the
issuance of the court order; and
``(B) the person who supplied the information is
afforded the opportunity to appear in the court
proceeding and contest the claim of the person seeking
the disclosure;
``(4) pursuant to a determination by a court of competent
jurisdiction that another person is lawfully entitled to hold
such decryption information, including determinations arising
from legal proceedings associated with the incapacity, death,
or dissolution of any person; or
``(5) otherwise permitted by law.
``Sec. 2806. Identification of decryption information
``(a) Identification.--To avoid inadvertent disclosure of decryption
information, any person who provides decryption information to an
investigative or law enforcement officer pursuant to this chapter shall
specifically identify that part of the material that discloses
decryption information as such.
``(b) Responsibility of Investigative or Law Enforcement Officer.--
The investigative or law enforcement officer receiving any decryption
information under this chapter shall maintain such information in a
facility and in a method so as to reasonably assure that inadvertent
disclosure does not occur.
``Sec. 2807. Definitions
``The definitions set forth in section 101 of the Encryption for the
National Interest Act shall apply to this chapter.''.
(b) Conforming Amendment.--The table of chapters for part I of title
18, United States Code, is amended by inserting after the item relating
to chapter 121 the following new item:
``125. Encrypted data, including communications............. 2801''.
TITLE II--GOVERNMENT PROCUREMENT
SEC. 201. FEDERAL PURCHASES OF ENCRYPTION PRODUCTS.
(a) Decryption Capabilities.--The President may, consistent with the
provisions of subsection (b), direct that any encryption product or
service purchased or otherwise procured by the United States Government
to provide the security service of data confidentiality for a computer
system owned and operated by the United States Government shall include
recoverability features or functions that enable the timely decryption
of encrypted data, including communications, or timely access to
plaintext by an authorized party without the knowledge or cooperation
of the person using such encryption products or services.
(b) Consistency With Intelligence Services and Military Operations.--
The President shall ensure that all encryption products purchased or
used by the United States Government are supportive of, and consistent
with, all statutory obligations to protect sources and methods of
intelligence collection and activities, and supportive of, and
consistent with, those needs required for military operations and the
conduct of foreign policy.
SEC. 202. NETWORKS ESTABLISHED WITH FEDERAL FUNDS.
The President may direct that any communications network established
for the purpose of conducting the business of the Federal Government
shall use encryption products that--
(1) include features and functions that enable the timely
decryption of encrypted data, including communications, or
timely access to plaintext, by an authorized party without the
knowledge or cooperation of the person using such encryption
products or services; and
(2) are supportive of, and consistent with, all statutory
obligations to protect sources and methods of intelligence
collection and activities, and supportive of, and consistent
with, those needs required for military operations and the
conduct of foreign policy.
SEC. 203. GOVERNMENT CONTRACT AUTHORITY.
The President may require as a condition of any contract by the
Government with a private sector vendor that any encryption product
used by the vendor in carrying out the provisions of the contract with
the Government include features and functions that enable the timely
decryption of encrypted data, including communications, or timely
access to plaintext, by an authorized party without the knowledge or
cooperation of the person using such encryption products or services.
SEC. 204. PRODUCT LABELS.
An encryption product may be labeled to inform Government users that
the product is authorized for sale to or for use by Government agencies
or Government contractors in transactions and communications with the
United States Government under this title.
SEC. 205. NO PRIVATE MANDATE.
The United States Government may not require the use of encryption
standards for the private sector except as otherwise authorized by
section 204.
SEC. 206. EXCLUSION.
Nothing in this title shall apply to encryption products and services
used solely for access control, authentication, integrity,
nonrepudiation, digital signatures, or other similar purposes.
TITLE III--EXPORTS OF ENCRYPTION
SEC. 301. EXPORTS OF ENCRYPTION.
(a) Authority To Control Exports.--The President shall control the
export of all dual-use encryption products.
(b) Authority To Deny Export for National Security Reasons.--
Notwithstanding any provision of this title, the President may deny the
export of any encryption product on the basis that its export is
contrary to the national security.
(c) Decisions Not Subject to Judicial Review.--Any decision based on
national security that is made by the President or his designee with
respect to the export of encryption products under this title shall not
be subject to judicial review.
SEC. 302. LICENSE EXCEPTION FOR CERTAIN ENCRYPTION PRODUCTS.
(a) License Exception.--Upon the enactment of this Act, any
encryption product with an encryption strength of 64 bits or less shall
be eligible for export under a license exception if--
(1) such encryption product is submitted for a 1-time
technical review;
(2) such encryption product does not require licensing under
otherwise applicable regulations;
(3) such encryption product is not intended for a country,
end user, or end use that is by regulation ineligible to
receive such product, and the encryption product is otherwise
qualified for export;
(4) the exporter, within 180 days after the export of the
product, submits a certification identifying--
(A) the intended end use of the product; and
(B) the name and address of the intended recipient of
the product, where available;
(5) the exporter, within 180 days after the export of the
product, provides the names and addresses of its distribution
chain partners; and
(6) the exporter, at the time of submission of the product
for technical review, provides proof that its distribution
chain partners have contractually agreed to abide by all laws
and regulations of the United States concerning the export and
reexport of encryption products designed or manufactured within
the United States.
(b) One-Time Technical Review.--(1) The technical review referred to
in subsection (a) shall be completed within no longer than 45 days
after the submission of all of the information required under paragraph
(2).
(2) The President shall specify the information that must be
submitted for the 1-time technical review referred to in this section.
(3) An encryption product may not be exported during the technical
review of that product under this section.
(c) Periodic Review of License Exception Eligibility Level.--(1) Not
later than 180 days after the date of the enactment of this Act, the
President shall notify the Congress of the maximum level of encryption
strength, which may not be lower than 64-bit, that may be exported from
the United States under license exception pursuant to this section
consistent with the national security.
(2) The President shall, at the end of each successive 180-day period
after the notice provided to the Congress under paragraph (1), notify
the Congress of the maximum level of encryption strength, which may not
be lower than that in effect under this section during that 180-day
period, that may be exported from the United States under a license
exception pursuant to this section consistent with the national
security.
(d) Factors Not To Be Considered.--A license exception for the
exports of an encryption product under this section may be allowed
whether or not the product contains a method of decrypting encrypted
data.
SEC. 303. DISCRETIONARY AUTHORITY.
Notwithstanding the requirements of section 305, the President may
permit the export, under a license exception pursuant to the conditions
of section 302, of encryption products with an encryption strength
exceeding the maximum level eligible for a license exception under
section 302, if the export is consistent with the national security.
SEC. 304. EXPEDITED REVIEW AUTHORITY.
The President shall establish procedures for the expedited review of
commodity classification requests, or export license applications,
involving encryption products that are specifically approved, by
regulation, for export.
SEC. 305. ENCRYPTION LICENSES REQUIRED.
(a) United States Products Exceeding Certain Bit Length.--Except as
permitted under section 303, in the case of all encryption products
with an encryption strength exceeding the maximum level eligible for a
license exception under section 302, which are designed or manufactured
within the United States, the Presidentmay grant a license for export
of such encryption products, under the following conditions:
(1) There shall not be any requirement, as a basis for an
export license, that a product contains a method of--
(A) gaining timely access to plaintext; or
(B) gaining timely access to decryption information.
(2) The export license applicant shall submit--
(A) the product for technical review;
(B) a certification, under oath, identifying--
(i) the intended end use of the product; and
(ii) the expected end user or class of end
users of the product;
(C) proof that its distribution chain partners have
contractually agreed to abide by all laws and
regulations of the United States concerning the export
and reexport of encryption products designed or
manufactured within the United States; and
(D) the names and addresses of its distribution chain
partners.
(b) Technical Review for License Applicants.--(1) The technical
review described in subsection (a)(3)(A) shall be completed within 45
days after the submission of all the information required under
paragraph (2).
(2) The information to be submitted for the technical review shall be
the same as that required to be submitted pursuant to section
302(b)(2).
(3) An encryption product may not be exported during the technical
review of that product under this section.
(c) Post-Export Reporting.--
(1) Unauthorized use.--All exporters of encryption products
that are designed or manufactured within the United States
shall submit a report to the Secretary at any time the exporter
has reason to believe any such exported product is being
diverted to a use or a user not approved at the time of export.
(2) Pirating.--All exporters of encryption products that are
designed or manufactured within the United States shall report
any pirating of their technology or intellectual property to
the Secretary as soon as practicable after discovery.
(3) Distribution chain partners.--All exporters of encryption
products that are designed or manufactured within the United
States, and all distribution chain partners of such exporters,
shall submit to the Secretary a report which shall specify--
(A) the particular product sold;
(B) the name and address of--
(i) the ultimate end user of the product, if
known; or
(ii) the name and address of the next purchaser
in the distribution chain; and
(C) the intended use of the product sold.
(d) Exercise of Other Authorities.--The Secretary, the Secretary of
Defense, and the Secretary of State may exercise the authorities they
have under other provisions of law, including the Export Administration
Act of 1979, as continued in effect under the International Emergency
Economic Powers Act, to carry out this title.
(e) Waiver Authority.--
(1) In general.--The President may by Executive order waive
any provision of this title, or the applicability of any such
provision to a person or entity, if the President determines
that the waiver is necessary to advance the national security.
The President shall, not later than 15 days after making such
determination, submit a report to the committees referred to in
paragraph (2) that includes the factual basis upon which such
determination was made. The report may be in classified format.
(2) Committees.--The committees referred to in paragraph (1)
are the Committee on International Relations, the Committee on
Armed Services, and the Permanent Select Committee on
Intelligence of the House of Representatives, and the Committee
on Foreign Relations, the Committee on Armed Services, and the
Select Committee on Intelligence of the Senate.
(3) Decisions not subject to judicial review.--Any
determination made by the President under this subsection shall
not be subject to judicial review.
SEC. 306. ENCRYPTION INDUSTRY AND INFORMATION SECURITY BOARD.
(a) Encryption Industry and Information Security Board Established.--
There is hereby established an Encryption Industry and Information
Security Board. The Board shall undertake an advisory role for the
President.
(b) Purposes.--The purposes of the Board are--
(1) to provide a forum to foster communication and
coordination between industry and the Federal Government on
matters relating to the use of encryption products;
(2) to enable the United States to effectively and
continually understand the benefits and risks to its national
security, law enforcement, and public safety interests by
virtue of the proliferation of strong encryption on the global
market;
(3) to evaluate and make recommendations regarding the
further development and use of encryption;
(4) to advance the development of international standards
regarding interoperability and global use of encryption
products;
(5) to promote the export of encryption products manufactured
in the United States;
(6) to recommend policies enhancing the security of public
networks;
(7) to encourage research and development of products that
will foster electronic commerce;
(8) to promote the protection of intellectual property and
privacy rights of individuals using public networks; and
(9) to evaluate the availability and market share of foreign
encryption products and their threat to United States industry.
(c) Membership.--(1) The Board shall be composed of 12 members, as
follows:
(A) The Secretary, or the Secretary's designee.
(B) The Attorney General, or his or her designee.
(C) The Secretary of Defense, or the Secretary's designee.
(D) The Director of Central Intelligence, or his or her
designee.
(E) The Director of the Federal Bureau of Investigation, or
his or her designee.
(F) The Special Assistant to the President for National
Security Affairs, or his or her designee, who shall chair the
Board.
(G) Six representatives from the private sector who have
expertise in the development, operation, marketing, law, or
public policy relating to information security or technology.
Members under this subparagraph shall each serve for 5-year
terms.
(2) The six private sector representatives described in paragraph
(1)(G) shall be appointed as follows:
(A) Two by the Speaker of the House of
Representatives.
(B) One by the Minority Leader of the House of
Representatives.
(C) Two by the Majority Leader of the Senate.
(D) One by the Minority Leader of the Senate.
(e) Meetings.--The Board shall meet at such times and in such places
as the Secretary may prescribe, but not less frequently than every four
months. The Federal Advisory Committee Act (5 U.S.C. App.) does not
apply to the Board or to meetings held by the Board under this section.
(f) Findings and Recommendations.--The chair of the Board shall
convey the findings and recommendations of the Board to the President
and to the Congress within 30 days after each meeting of the Board. The
recommendations of the Board are not binding upon the President.
(g) Limitation.--The Board shall have no authority to review any
export determination made pursuant to this title.
(h) Foreign Availability.--The consideration of foreign availability
by the Board shall include computer software that is distributed over
the Internet or advertised for sale, license, or transfer, including
over-the-counter retail sales, mail order transactions, telephone order
transactions, electronic distribution, or sale on approval and its
comparability with United States products and its use in United States
and foreign markets.
(i) Termination.--This section shall cease to be effective 10 years
after the date of the enactment of this Act.
TITLE IV--LIABILITY LIMITATIONS
SEC. 401. COMPLIANCE WITH COURT ORDER.
(a) No Liability for Compliance.--Subject to subsection (b), no civil
or criminal liability under this Act, or under any other provision of
law, shall attach to any person for disclosing or providing--
(1) the plaintext of encrypted data, including
communications;
(2) the decryption information of such encrypted data,
including communications; or
(3) technical assistance for access to the plaintext of, or
decryption information for, encrypted data, including
communications.
(b) Exception.--Subsection (a) shall not apply to a person who
provides plaintext or decryption information to another in violation of
the provisions of this Act.
SEC. 402. COMPLIANCE DEFENSE.
Compliance with the provisions of sections 2803, 2804, 2805, or 2806
of title 18, United States Code, as added by section 103(a) of this
Act, or any regulations authorized by this Act, shall provide a
complete defense for any civil action for damages based upon activities
covered by this Act, other than an action founded on contract.
SEC. 403. GOOD FAITH DEFENSE.
An objectively reasonable reliance on the legal authority provided by
this Act and the amendments made by this Act, authorizing access to the
plaintext of otherwise encrypted data, including communications, or to
decryption information that will allow the timely decryption of data,
including communications, that is otherwise encrypted, shall be an
affirmative defense to any criminal or civil action that may be brought
under the laws of the United States or any State.
TITLE V--INTERNATIONAL AGREEMENTS
SEC. 501. SENSE OF CONGRESS.
It is the sense of Congress that--
(1) the President should conduct negotiations with foreign
governments for the purposes of establishing binding export
control requirements on strong nonrecoverable encryption
products; and
(2) such agreements should safeguard the privacy of the
citizens of the United States, prevent economic espionage, and
enhance the information security needs of the United States.
SEC. 502. FAILURE TO NEGOTIATE.
The President may consider a government's refusal to negotiate
agreements described in section 501 when considering the participation
of the United States in any cooperation or assistance program with that
country.
SEC. 503. REPORT TO CONGRESS.
(a) Report to Congress.--The President shall report annually to the
Congress on the status of the international effort outlined by section
501.
(b) First Report.--The first report required under subsection (a)
shall be submitted in unclassified form no later than September 1,
2000.
TITLE VI--MISCELLANEOUS PROVISIONS
SEC. 601. EFFECT ON LAW ENFORCEMENT ACTIVITIES.
(a) Collection of Information by Attorney General.--The Attorney
General shall compile, and maintain in classified form, data on--
(1) the instances in which encryption has interfered with,
impeded, or obstructed the ability of the Department of Justice
to enforce the laws of the United States; and
(2) the instances where the Department of Justice has been
successful in overcoming any encryption encountered in an
investigation.
(b) Availability of Information to the Congress.--The information
compiled under subsection (a), including an unclassified summary
thereof, shall be submitted to Congress annually beginning October 1,
2000.
SEC. 602. INTERPRETATION.
Nothing contained in this Act or the amendments made by this Act
shall be deemed to--
(1) preempt or otherwise affect the application of the Arms
Export Control Act (22 U.S.C. 2751 et seq.), the Export
Administration Act of 1979 (50 U.S.C. App. 2401 et seq.), or
the International Emergency Economic Powers Act (50 U.S.C. 1701
et seq.) or any regulations promulgated thereunder;
(2) affect foreign intelligence activities of the United
States; or
(3) negate or diminish any intellectual property protections
under the laws of the United States or of any State.
SEC. 603. FBI TECHNICAL SUPPORT.
There are authorized to be appropriated for the Technical Support
Center in the Federal Bureau of Investigation, established pursuant to
section 811(a)(1) of the Antiterrorism and Effective Death Penalty Act
of 1996 (Public Law 104-132)--
(1) $25,000,000 for fiscal year 2000 for building and
personnel costs;
(2) $20,000,000 for fiscal year 2001 for personnel and
equipment costs;
(3) $15,000,000 for fiscal year 2002; and
(4) $15,000,000 for fiscal year 2003.
SEC. 604. SEVERABILITY.
If any provision of this Act or the amendments made by this Act, or
the application thereof, to any person or circumstances is held invalid
by a court of the United States, the remainder of this Act or such
amendments, and the application thereof, to other persons or
circumstances shall not be affected thereby.
Purpose
The House Permanent Select Committee on Intelligence sought
referral of H.R. 850, the ``Security and Freedom through
Encryption (SAFE) Act,'' as reported by the House Committee on
the Judiciary, because the bill impacts directly upon matters
relating to the intelligence and intelligence-related
activities and national security capabilities of the
Intelligence Community. Specifically, the bill will have a
profound effect on the intelligence, counter-intelligence, and
counter-terrorism responsibilities of the Department of
Defense, the National Security Agency, the Department of
Justice, and the Federal Bureau of Investigation, to name but a
few of those Intelligence Community agencies within this
Committee's jurisdiction. The legislation as introduced or
reported by the Committees on the Judiciary, International
Relations, and Commerce, raises serious issues of great
significance to our national security and public safety.
Because of the significant risk to the intelligence and
intelligence-related activities and capabilities of the United
States the Committee determined that it needed to act in a
comprehensive manner.
The paramount duty of government is to protect its citizens
from harm to their persons or property. Fundamental to a free
society, however, is a delicate balance between the need to
defend the nation's security and preserving the liberties of
the people endowed by their Creator. The balance achieved in
the Constitution and the Bill of Rights provides a clear
backdrop against which the Committee's legislative action
should be considered.
During the Committee's consideration of H.R. 850 it was
determined that the SAFE Act did not adequately address the
national security and public safety interests at stake in the
public policy debate over encryption legislation. Government
official, after government official, advised the Committee that
strong encryption is being used to facilitate drug trafficking,
child pornography, terrorism, espionage, and myriad other
crimes. Proponents of the SAFE Act urged the Committee to
ignore the concern of these witnesses and to leave the
management of encryption policy to the marketplace. They argued
that it was too late to do anything about the widespread use of
strong encryption. They asserted that the ``genie was out of
the bottle'' and could not be put back in. They claimed that
any effort to continue control of encryption technology would
be a losing proposition that would harm industry. They rejected
the enormous consequences described by the government officials
charged with the duty to protect the national security and
defend the public safety.
The Committee considered the arguments of the SAFE Act
proponents and the administration officials and struck a
balance. The Committee's amendment, the ``Encryption for the
National Interest Act,'' gives the government the authority:
To access the plaintext of encrypted
information, through the use of court orders, during
lawful criminal, foreign intelligence, and
international terrorist investigations;
To control encryption exports in defense of
the national security;
To procure and use encryption products with
recoverability features; and
To improve their technical capabilities
against the widespread use of strong encryption.
But, at the same time, the Encryption for the National
Interest Act assures the industry and the cyber-libertarians
that their concerns have too been heeded. The bill provides
that:
U.S. persons can use any encryption product
of any strength regardless of whether it contains
access to plaintext capabilities;
All access to plaintext or decryption
information will be upon the order of a judge after an
appropriate showing by the government;
Civil and criminal sanctions can be imposed
upon those who misuse the decryption information of any
other person; and
Electronic audit trails are required
whenever law enforcement accesses the plaintext or
decryption information of an encryption user.
The Encryption for the National Interest Act asserts that
the nation's security and the protection of its citizens are
worthy objectives of the federal government and its principal
obligation. The Encryption for the National Interest Act also,
however, seeks to establish a dynamic and constructive
framework for continued cooperation between government and
industry to achieve a workable solution to this extremely
vexing issue facing the nation. It does not preclude continued
American competitiveness in an increasingly competitive global
market, yet secures the right of the Commander-in-Chief to
defend our interests against those who wish us harm. It does
not turn national security and public security over to the
random behavior of the marketplace.
The Encryption for the National Interest Act achieves a
compromise in the best interests of all protagonists in this
public debate: industry, national security, public safety, and
privacy. The Committee's amendment was adopted upon a unanimous
voice vote of the Committee, and H.R. 850 was ordered reported
favorably to the House, as amended by the Committee.
Summary
SECTION-BY-SECTION ANALYSIS
Section 1.--Short title and table of contents
This section provides the title of the bill as the
``Encryption for the National Interest Act'' and a table of
contents.
Section 2.--Statement of policy
This section sets forth the policy of the United States
with respect to encryption technology.
Section 3.--Congressional findings
This section sets forth the findings of Congress as to the
important role information security technology, encryption,
plays in relaying and protecting intelligence information,
linking policy makers, establishing an effective foreign
policy, protecting United States banking and financial systems
and critical infrastructure, and citizens from such crimes as
fraud, theft, drug trafficking, espionage, terrorism, money
laundering, and child pornography, among other serious
offenses.
TITLE I--DOMESTIC USE OF ENCRYPTION
Section 101.--Definitions
This section establishes the definitions of specific terms
used throughout the bill.
Section 102.--Lawful use of encryption
This section makes clear that, except as otherwise
provided, it is lawful to use encryption products, regardless
of algorithm length selected, encryption key length chosen, or
implementation technique or medium used.
Section 103.--Unlawful use of encryption
This section amends Title 18, United States Code, by new
sections 2801 through 2807 within new chapter 122, which bears
the heading, ``Chapter 122-Encrypted Data, Including
Communications.''
New section 2801 of Title 18, United States Code, would
make it a criminal offense to use encryption in furtherance of
the commission of a federal crime. The penalties attached to
such crimes would be in addition to any sentence imposed for
the underlying offense. For first time offenders, a fine under
Title 18, United States Code, or both. For repeat offenders of
this provision, the jail time is potentially no more than 10
years. This section also makes clear that merely using
encryption, without additional facts, cannot be the basis for a
probable cause determination.
New section 2802 creates several new crimes. First, it
makes it illegal to intentionally obtain or use decryption
information without lawful authority in order to decrypt data,
including information. In addition, it makes it a criminal
offense to exceed lawful authority in decrypting data,
including communications. This new section would make the
breaking of encryption code of another without lawful authority
and with the purpose of violating that person's privacy or
security, or for the purpose of depriving that person of his or
her property a criminal violation of law. Furthermore this
section would make it a criminal offense to assist in the
encryption of data knowing that such data, including
communications are to be used in furtherance of a crime.
New section 2803 sets forth the standards and procedures
for the issuance of a court order granting an investigative or
law enforcement officer timely access to the plaintext of
otherwise encrypted data, including communications, or
compelling the provision of decryption information to an
investigative or law enforcement officer that has a lawful
basis to obtain that data. The application for such order must
be made by an attorney for the government. That application
must establish facts supporting the finding that the plaintext
of decrypted information is relevant to an on-going lawful law
enforcement, foreign counterintelligence, or international
terrorist investigation. The application and any order issued
thereon shall be made ex parte and placed under seal.
Disclosure of the application or order is not authorized,
except as may be otherwise permitted by this section or another
order of the court.
This section also requires that the court granting access
to plaintext or the disclosure of decryption information, shall
also ensure that a verifiableaudit trail of any access to
plaintext or decrypted information be maintained.
The record will be tendered to the court upon an order of
the court.
Subsection (d) clarifies that nothing in this new chapter
shall be read to expand or modify any other constitutional or
statutory requirement under which a government entity is
entitled to intercept or obtain oral, wire, or electronic
communications or information.
Subsection (e) mandates a strict construction of this new
chapter so that it is read only to apply to a government
entity's ability to decrypt or otherwise gain access to the
plaintext data, including communications, for which it
previously obtained lawful authority to intercept or obtain.
New section 2804 provides the users of encryption products
with a statutory right to be notified when their decryption
information is provided to law enforcement, or when law
enforcement is granted access to the plaintext of their data,
including communications. This section provides for a delayed
notification to the user so as not to jeopardize the integrity
of the on-going criminal investigation, foreign
counterintelligence, or international terrorist investigation.
Basically, the user must be notified within 90 days after the
filing of an application for the decryption information, or for
access to the plaintext, unless the judge finds good cause
warranting delay. Specifically, however, neither any of the
decrypted contents of the encrypted information that has been
obtained, nor any evidence derived therefrom may be used in any
proceeding unless the user has been furnished with a copy of
the order, application, and the data, including communications.
The user may move to suppress the use of any of the plaintext
or evidence derived therefrom in any proceeding on the grounds
that the plaintext or the decryption information was unlawfully
obtained. This section also provides aggrieved persons with a
civil cause of action for any violations of this new chapter.
New section 2805 limits the lawful uses of plaintext or
decryption information obtained under this chapter. It may be
used for the purposes of conducting a lawful criminal or
foreign counterintelligence or terrorist investigation and for
the purposes of preparing for and prosecuting any criminal
violation of law. It may not be disclosed to any party to a
civil suit that does not arise from criminal investigation or
prosecution, unless a court finds that there is no alternative
means of obtaining the plaintext, or decryption information and
that the interests of justice would not be served by
nondisclosure. This section further clarifies that decryption
information may not be used to determine the plaintext unless
the officer possesses other lawful authority to plaintext.
This section also outlines the procedures for returning or
destroying any decryption information upon the conclusion of
the investigation, trial, or proceeding. This section also
places limitations upon any person acting as a key recovery
agent. It specifies whom and under what circumstances a key
recovery agent may provide decryption information to another
person.
New section 2806 requires those who are providing
decryption information to an investigative or law enforcement
officer to so identify that information in order to avoid any
inadvertent disclosure. The officer is responsible for
maintaining the decryption information in such a manner so as
reasonably to ensure against inadvertent disclosure.
New section 2807 states that the same definitions set forth
in section 101 of the ``Encryption for the National Interest
Act'' shall apply to this chapter.
TITLE II--GOVERNMENT PROCUREMENT
Section 201.--Federal purchases of encryption products
This section permits the United States government to
purchase encryption products enabling the timely decryption by
an authorized party, without the knowledge or cooperation of
the person using the encryption product. This requirement only
applies to those products or services purchased or procured by
the United States government for data confidentiality for
computer systems armed or operated by the United States.
The Committee believes that a ``National Information
Assurance Plan'' is needed to ensure that the data, including
communications, of the United States government are secure. To
this end the Committee requests that the President submit to
the Permanent Select Committee on Intelligence and the
Committee on Armed Services of the House of Representatives and
the Select Committee on Intelligence and the Committee on Armed
Services of the Senate within 120 days after enactment of this
Act a report that outlines the national information assurance
plan and policy for the United States government.
The Committee believes that any plan or policy developed
should include the following goals, which should be addressed
in the report to be submitted to the congressional committees:
(1) The protection of the Federal Government's
information infrastructure against hostile penetration
by ensuring the Federal Government's use of the
strongest possible information assurance products,
including encryption, in secure configurations and
applications;
(2) A requirement that the Federal Government use
products designed or manufactured in the United States
enabling the recovery of information pursuant to lawful
authority; and
(3) A requirement that the Federal Government use
reliable authentication products designed or
manufactured in the United States so that the Federal
Government knows who is accessing its systems.
Section 202.--Networks established with federal funds
This section permits the President to require that any
communications network that is established for the purpose of
conducting the business of the Federal Government must use
encryption products that include techniques enabling the timely
decryption of data, including communications, without the
knowledge or cooperation of the person using the encryption
product or service. It is not intended that private
communications networks that might benefit from federal grants
fall within this requirement. Nor is it intended that this
section include the Internet, although it is understood that
there may be government business that is conducted via the
Internet.
Section 203.--Government contract authority
This section grants to the President of the United States
the authority to require, as a condition of any contract by the
United States government with a private vendor that any
encryption product used by the vendor in carrying out the
provisions of the contract include features and functions that
enable the decryption of encrypted data, including
communications, or timely access to plaintext by an authorized
party without the knowledge or cooperation of the person using
such encryption products or services.
Section 204.--Product labels
This section allows for the labeling of encryption products
so that purchasers and users are aware that the product is
authorized for sale to, or for use in transactions with, the
United States government.
Section 205.--No private mandate
This section specifies that the United States government
may not require the use of encryption standards for the private
sector except as otherwise authorized by section 203.
Section 206.--Exclusion
This section clarifies that nothing in this title shall
apply to encryption products and services used solely for
access control, authentication, integrity, non-repudiation,
digital signatures, or other similar purposes.
TITLE III--EXPORTS OF ENCRYPTION
Section 301.--Exports of encryption
Subsection (a) authorizes the President to control the
export of all dual-use encryption products.
Subsection (b) grants the President the authority to deny
the export of any encryption product on the basis that its
exportation would be contrary to the national security
interests of the United States.
Subsection (c) specifies that all national security
decisions made by the President, or his designee, under this
title shall not be subject to judicial review.
Section 302.--License exception for certain encryption products
Subsection (a) sets forth criteria for the export of those
encryption products with an encryption strength of 64 bits or
less under a license exception. The product must be submitted
for a 1-time technical review, not require licensing under
otherwise applicable regulations, and not be intended for a
country, end-user, or end use that is otherwise ineligible to
receive such products. In addition, the exporter must within
six months after export supply the names and addresses of its
distribution chain partners, and identify the intended end user
(if available) or use of the product. The exporter must provide
proof that its distribution chain partners have contractually
agreed to abide by all laws and regulations of the United
States regarding export and re-export of encryption products.
Subsection (b) sets a time limit of 45 days after
submission for all information required for the technical
review for the completion of the review referred to in
subsection (a).
Subsection (c) requires that the President notify Congress
every six months of the maximum strength level encryption that
may be exported under a license exception pursuant to this
section without harm to national security. The initial maximum
bit level for which products can be exported under this
exception shall not be less than 64 bits. This brings U.S.
policy in line with Waasenaar Arrangement commitments. At the
end of each successive 180-day period, the President shall
notify Congress of the maximum encryption bit level that may be
exported under license exception. The levels cannot be reduced
once raised by the President. This report will ensure that the
Administration review on a regular, short-term basis, which is
necessary given the dynamic nature of technology, the
appropriate level to allow products out under a license
exception.
Subsection (d) enables the export of a product under a
license exception that meets the criteria set forth in section
302(a), regardless of whether the product contains a method of
decrypting encrypted data. There is no requirement that
recoverability features be included in the product for this
section to apply.
Section 303.--Discretionary authority
Section 303 authorizes the President to allow the export,
under a license exception, of encryption products with bit
lengths greater than that level set through operation of
section 302, subject to the conditions of section 302, if the
export would be consistent with the national security interest
of the United States.
This provision ensures that export of those 128-bit
encryption products currently allowed under a license exception
may continue after enactment of the Act.
Section 304.--Expedited authority
This section grants the President authority to establish
procedures for expediting the review of commodity
classification requests, or export license applications
involving encryption products that are specifically approved,
by regulation, for export.
Section 305.--Encryption licenses required
Subsection (a) establishes criteria the President shall
employ in the review and granting of a license for export of
encryption products exceeding the maximum level eligible for
license exception under section 302. Products beingconsidered
for export determinations shall not be required to contain features or
functions for the timely access to plaintext or decryption information.
In addition, any bit length encryption product is eligible for export
under this section. The license applicant is responsible for submitting
the product for technical review, certifying under oath the intended
end user, the end use of the product, and providing the names and
addresses of its distribution chain partners. The exporter must certify
that these distributors are contractually obligated to abide by all
laws and regulations of the United States concerning the export and re-
export of encryption products and services.
Subsection (b) further clarifies that the technical review
described in subsection (a) to be completed within 45 days
after product submission and no export shall occur during the
technical review.
Subsection (c) sets forth post-export reporting
requirements to be submitted to the Secretary of Commerce.
Reports shall be filed specifically when the exporter believes
the exported encryption products or services are being diverted
to a user or use not approved for export, or the exporter has
detected pirating of their technology or intellectual property.
In addition, all exporters and their distribution chain
partners shall report the names and addresses of the next
purchaser in the distribution chain.
Subsection (d) clarifies that the Secretaries of Commerce,
Defense, and State may exercise the authority they have under
other provisions of law, specifically the International
Emergency Economic Powers Act.
Subsection (e) provides the President with the authority to
waive any provision of this title for national security
purposes. Requires the President to report to the relevant
committees of Congress within 15 days after this authority is
used. The determination made by the President shall not be
subject to judicial review.
Section 306.--Encryption industry and information security board
This section establishes an Encryption Industry and
Information Security Board (``EIIS'') to advise the President
on future encryption policy and technological advancements that
might serve to alter the United States policy on encryption
products. This section also defines the purposes of the board.
It further specifies that the Board shall be composed of 12
members, and how those members shall be appointed. In addition
to the Secretary of Commerce, Secretary of Defense, Attorney
General, the Director of Central Intelligence, the Director of
the Federal Bureau of Investigation, and the Special Assistant
to the President for National Security Affairs, or their
designees; six representatives from the private sector who have
expertise in development, operation, marketing, law, and public
policy relating to information security or technology shall be
appointed by Congressional Leadership. The Board will have no
authority to challenge or review an export determination made
pursuant to this Act. The Board will report to the President
and the Congress. This section will cease to be effective 10
years after the date of enactment.
TITLE IV--LIABILITY LIMITATIONS
Section 401.--Compliance with court order
This section states that a person shall not be subject to
civil or criminal liability under this Act, or under any other
provision of law, for acting in compliance with a court order
compelling the disclosure of plaintext or decryption
information.
Section 402.--Compliance defense
This section provides a complete defense for any non-
contract action for damages based upon activities covered by
the Act as long as the person complies with the provisions of
sections 2803, 2804, 2805, and 2806 of Title 18, United States
Code, as amended by section 103(a) of this Act, or any
regulations authorized by this Act.
Section 403.--Good faith defense
This section provides anyone who relies on the legal
authority provided under this Act as the basis for providing an
investigative or law enforcement officer with access to the
plaintext of otherwise encrypted data, including
communications, or for providing such officer with decryption
information, a complete defense to any criminal or civil action
arising therefrom.
TITLE V--INTERNATIONAL AGREEMENTS
Section 501.--Sense of Congress
This section expresses the Sense of Congress that the
President should negotiate with foreign governments to
establish binding export control requirements on nonrecoverable
encryption products. Any agreement should safeguard the privacy
of U.S. persons, prevent economic espionage, and enhance the
information security needs of the United States.
Section 502.--Failure to negotiate
This section permits the President to take a country's
refusal to negotiate into consideration when making decisions
about U.S. participation in any cooperation or assistance
program with that country.
Section 503.--Report to Congress
This section requires an annual report to Congress on the
status of the negotiations, with the first report due September
1, 2000.
TITLE VI--MISCELLANEOUS PROVISIONS
Section 601.--Effect on law enforcement activities
This section requires the Attorney General to compile, and
maintain in classified form, information on those instances
where encryption has posed problems in the enforcement of
federal laws. This information will be available to any Member
of Congress upon request.
Section 602.--Interpretation
This section clarifies the relationship of the bill to the
interpretation of certain laws: the bill does not preempt the
application of other important export control acts, including:
the Arms Export Control Act, the Export Administration Act, or
the International Emergency Powers Act. It shall not affect
foreign intelligence activities of the United States; nor does
it diminish the intellectual property protections provided by
the laws of the U.S. or of any State.
Section 603.--FBI technical support
This section authorizes appropriations totaling $75 million
for fiscal years 2000 through 2003 to the Federal Bureau of
Investigation for the Technical Support Center established
pursuant to section 811(a)(1) of the Antiterrorism and
Effective Death Penalty Act of 1996. (P.L. 104-132)
Section 604.--Severability
This section permits any court reviewing this Act to sever
any provision from the remainder of the Act, so as not to find
the Act invalid in its entirety.
Background and Need for Legislation
benefits of strong encryption
There is little doubt that strong encryption has enormous
benefits for society. For our national security apparatus, it
is invaluable and essential to secure the flow of intelligence
information, enhance our ability to execute foreign policy, and
ensure the protection of the 1.4 million men and women of our
armed forces deployed around the world. It is fundamental to
protecting the Nation's critical infrastructures, such as power
grids, telecommunications, and transportation facilities.
Strong encryption is a remarkable tool that has aided the
advancement of the Internet. It has been one factor in the
explosive growth of on-line commerce, banking, investments,
telemedicine, and legal services, to name only a few areas
where the Internet has changed our daily lives.
Encryption also advances the interests of law enforcement
where it is used for legitimate purposes, because it can and
does shield on-line activities from criminals interested in
stealing personal financial data, credit card information, or
national secrets, for example. But, as crucial as it is to the
protection of information, it can be equally harmful to our
Nation's security and the public's safety.
problems with h.r. 850, as referred to the committee
After all, the benefit that strong encryption provides to
the individual legitimate encryption user is equally provided
to the person with criminal intent. Our laws should not
preclude lawful investigation of criminal activity. Our laws
should enhance the Nation's security and public safety. The
SAFE Act (H.R. 850), as reported by the Committee on the
Judiciary, would deny law enforcement authorities the
opportunity to obtain evidence--evidence to which they are
statutorily authorized to obtain--simply because a criminal
decided to encrypt it. Under that bill, the child pornographer
will be able to operate with impunity. The terrorist will be
able to communicate with his comrades. He will be able to plan
and execute his cowardly acts without fear that he will be
identified or brought to justice. Spies would operate without
fear of discovery. The drug trafficker will be able to arrange
for distribution of his poison and collection of the thousands
or millions of dollars made in the deal. He will be able to
launder his proceeds unconcerned that his activities have
caught the attention of the law enforcement authorities. Those
that engage in the proliferation of weapons of mass destruction
will be able to continue their menacing activities unhindered
by our national security apparatus or intelligence collectors.
Allowing the unchecked export of unbreakable encryption to
all markets and all users across the globe presents a series of
challenges that the national security agencies of the United
States cannot meet or overcome simply by employing faster and
more powerful computers. The consequences of such a policy
would be devastating. Criminals and international thugs wishing
to do harm to the people of the United States would have
available to them an ``electronic sanctuary.''
Legislation that precludes the federal government from
using encryption products that permit the recovery of data or
communications is irresponsible. The SAFE Act has been read to
do just this. With the time it would take to break just one
128-bit encrypted message (many times the age of the universe),
annihilation would be quicker than our ability to protect
ourselves.
Without an ability to undo quickly an encryption code, the
people of this country could suffer unfathomable harm.
Similarly, child pornographers could distribute their filth
unimpeded. Pedophiles could secretly entice the children of
America into their clutches. Drug traffickers will make their
plans to deliver larger and larger amounts of cocaine, heroin,
marijuana, and other narcotics without the slightest concern
that they will be detected. Terrorists and spies can cause
unspeakable damage without even the possibility of being
stopped before it is too late. In a world governed by policies
espoused by the SAFE Act, protecting America, her interests,
and her citizens becomes a far riskier endeavor.
While the SAFE Act does not on its face remove export
controls, the regime it would establish is so fraught with
exceptions and limitations on government authority that control
might as well be non-existent. The SAFE Act does acknowledge,
however, that the nation's security should override an ability
to export on occasion. Yet, the circumstances under which the
SAFE Act would authorize denial of exports are limited only to
those instances where the Secretary of Commerce has
``substantial evidence'' that the product intended for export
was going to Iran, Iraq, North Korea, Libya, Sudan, Cuba, and
Syria, or has ``substantial evidence'' that a specific product
would be used by foreign militaries or terrorists. First, there
is no role under the SAFE Act for the participation of the
national security apparatus of the United States in such
decisions not to export. Secondly, there can be no doubt that
these two factors cover only a fraction of all situations that
present threats to our national security interests. A broader
authority to deny exports must be provided in order to ensure
the nation's security in an age of constantly changing
political realities.
Expert witnesses before the Committee and Congress have
provided compelling and sobering testimony about the lack of
balance in H.R. 850 as reported from the Judiciary Committee.
The administration opposes any encryption legislation that is
not balanced. ``The current version [of H.R. 850] does not
balance the needs of privacy and business, public safety, and
national security, * * *.'' Testimony of Janet Reno, Attorney
General of the United States, before the House Permanent Select
Committee on Intelligence on July 14, 1999. ``The proposed SAFE
Act does not include any provisions aimed at improving law
enforcement's ability to perform its public safety mission in
an encrypted world.'' Id. ``The objective of the legislation is
unfettered encryption which has no concern for public safety
and, in all reality, eliminates any concerns for public safety
in the future.'' Testimony of Thomas A. Constantine, former
Administrator, Drug Enforcement Administration, before the
House Permanent Select Committee on Intelligence on July 14,
1999 (hereinafter ``Constantine Test.''). ``The [SAFE Act] * *
* will harm law enforcement, will harm public safety, will harm
national security, and lives will be lost * * *.'' Testimony of
Louis J. Freeh, Director, Federal Bureau of Investigation,
before the House Committee on Armed Services on July 13, 1999.
``[R]ather than a SAFE Act * * * I would call it the `Drug
Lords Protection Act.' '' Constantine Test. ``[T]he SAFE Act
will harm national security by making [NSA's] job of providing
critical, actionable intelligence to our leaders and military
commanders difficult, if not impossible, thus putting our
nation's security at considerable risk.'' Testimony of Barbara
A. McNamara, Deputy Director, National Security Agency, before
the House Committee on Armed Services on July 13, 1999. ``H.R.
850 * * * would be a tidal wave that would crush your national
security and law enforcement agencies that are protecting this
country.'' Testimony of John J. Hamre, Deputy Secretary,
Department of Defense, before the House Committee on Armed
Services on July 13, 1999. ``[T]here are real national security
and law enforcement costs to the policy that is articulated by
the [SAFE Act]. * * *'' Testimony of William Reinsch,
Undersecretary of Commerce for Export Administration,
Department of Commerce (hereinafter ``Reinsch Test.''), before
the House Committee on Armed Services on July 13, 1999. ``[T]he
bill in letter and spirit would destroy the balance we have
worked so hard to achieve and would jeopardize our law
enforcement and national security interests.'' Reinsch Test.
before the House Permanent Select Committee on Intelligence on
June 9, 1999.
Importantly, during his appearance before the HPSCI on June
9, 1999, Mr. Goodlatte, the author of the SAFE Act, conceded
that a balance needed to be achieved on this issue. Mr.
Goodlatte stated that he shared the serious national security
and law enforcement concerns at stake in this debate. Testimony
of Representative Bob Goodlatte (hereinafter ``Goodlatte
Test.'') before the House Permanent Select Committee on
Intelligence on June 9, 1999,at pp. 26, 27, 28, 52. He claimed
his bill was not designed to eliminate all export controls, which was a
significant concession. Goodlatte Test. at pp. 21, 30. It is a
testament to the notion that we cannot place market share and larger
profits ahead of the nation's security and the public's safety. It
further reemphasizes the concept that there must be accommodation in
the encryption export control policy to assure the national security
and the interests of the industry. Mr. Goodlatte's support for export
controls in certain circumstances extends to the foundational concept
that export controls can be used to protect against threats to the
national security of the United States. Goodlatte Test. at pp. 31, 44.
He also testified that it was not the intent of his legislation to deny
law enforcement the ability to gain access to plaintext or decryption
information, where it was available. Goodlatte Test. at pp. 34, 53, 77.
See also Report of the Committee on the Judiciary to Accompany H.R.
850, House Report 106-117, Part 1, at p. 8 (April 27, 1999) (``Just as
new technology should not take away the longstanding rights of citizens
against government, it also should not take away the traditional means
for legitimate law enforcement and national security investigations.'')
He was open to modification of the ``substantial evidence'' standard
his bill uses to preclude an export of encryption to terrorists and
militaries in order to alleviate the risks attendant to the export of
encryption throughout the world. Goodlatte Test. at pp. 38, 43, 44. He
further contended that it was not the intent of his legislative
proposal to preclude the federal government, or state and local
governments, from using encryption products that have features or
functions that permit the recovery of data when those government
entities find it necessary to use such products. Goodlatte Test. at pp.
77. Although not included anywhere in his legislation, Mr. Goodlatte
also supports the provision of more and better resources to federal,
state, and local law enforcement so they can more adequately meet the
challenges of widespread use of strong encryption. Goodlatte Test. at
pp. 25, 28, 53, 54.
BALANCED APPROACH IS NEEDED
The HPSCI reported amendment, the ``Encryption for the
National Interest Act,'' strives to balance the needs of law
enforcement, national security, industry, and privacy. It
advances the interests of all sectors engaged in this debate,
yet requires some sacrifice on the part of each, as well.
The Committee amendment preserves law enforcement's crime
fighting and public safety capabilities by providing clear
authority through judicial processes to access the plaintext or
decryption information, without the target of the
investigation's knowledge or cooperation. It does not, however,
require key escrow, or mandate key recovery. Key recovery is a
non-factor for domestic use and for export considerations.
In addition to laying the framework for a national
information assurance program, the Committee's amendment will
relax the current export control policy of the United States on
encryption products to bring the policy in line with the
government's commitments under the Waasenaar Arrangement. In
other words, where now only those products of 56-bit strength
and lower can be exported under a license exception, upon
enactment of the HPSCI amendment, all products of 64-bit
strength and lower will be allowed for export in this manner.
All products in excess of 64-bits will require a license prior
to export, unless granted a waiver. This will permit the export
of any bit-length encryption product under license exception
conditions to those sectors that pose little or no risk to
national security. Of course, prior to the first export of any
encryption product, the Committee's amendment will still
require a technical review to be conducted.
Furthermore, the Committee's amendment requires the
administration to review its encryption export policies on a
more regularized basis than is currently done. The amendment
requires a semi-annual look at export policy and certifications
to Congress with respect to the results of this review.
The Committee's amendment also streamlines export reporting
requirements in an effort to reduce the burdensome and costly
paperwork that is the bane of the industry. It does not remove
these requirements completely, as the SAFE Act does, because
there is significant national security utility in such
reporting and the Committee determined it should continue in
some form.
Importantly, the Encryption for the National Interest Act
preserves the President's authority to protect national
security by authorizing him, or his designee, to deny an export
of an encryption product based on national security grounds.
This is an acknowledgement that the conduct of foreign policy
and the protection of the citizens of the United States cannot
be tied to only a couple of particular threats. The exigencies
of our role as the world's only superpower must be accommodated
and our export control regime must reflect the need for such
flexibility.
The Committee's amendment permits the federal government to
procure and utilize encryption products with recoverability
features for the conduct of the government's business.
Likewise, the federal government will be permitted to require
that its contractors use recoverable encryption products for
the conduct of the government's business pursuant to the
government contract. This authority does not permit, however,
the government to require contractors to use such products in
the course of their private sector, non-governmental business
activities.
Finally, the Committee's amendment establishes an advisory
board to assist the President in his determination of
appropriate encryption export policies and to foster
government-industry cooperation on this important issue with
significant ramifications for national security and public
safety. Moreover, the Committee's legislative initiative
authorizes the appropriation of $75 million to build, equip,
and maintain the FBI's Technical Support Center. This Center
will help move law enforcement at all levels forward in this
age of high technology. It will help law enforcement meet and
overcome the substantial challenges presented in a world where
strong encryption will be commonplace.
The Committee's Ranking Democrat, Representative Julian C.
Dixon, put the matter succinctly after the Committee adopted
its amendment in the nature of a substitute, when he stated:
The encryption compromise adopted by the Intelligence
Committee achieves two important goals: it recognizes
that government access to information on the electronic
infrastructure--when necessary to protect public safety
and national security--is legitimate within reasonable,
lawful constraints; and, it provides greater certainty
in the export control process while allowing for
regulatory flexibility as technology advances. The
balance between commercial interests and public safety
achieved by the Intelligence Committee substitute has
improved greatly the encryption legislation with which
the Committee was asked to deal.
The Committee believes that the United States government
should encourage the development of encryption products that
are responsive to the needs and obligations of government to
ensure public safety, and that are viable in the commercial
marketplace, without resorting to mandated key recovery or key
escrow. For certain, law enforcement would have no difficulty
obtaining decrypted evidence of criminality were Congress to
impose mandatory requirements on the encryption industry to
develop products with access to plaintext functions or
features. Such an approach, however, does not advance the
debate on comprehensive encryption policy for the United States
in the fast approaching 21st Century.
The Committee determined that the SAFE Act, as reported by
the Judiciary, the International Relations, and the Commerce
Committees did not adequately address national security and
public safety concerns. In fact, the Committee found, based on
the testimony of various witnesses before the Committee, that
the SAFE Act actually would disadvantage our national security
apparatus and federal, state, and local law enforcement in the
conduct of their very serious obligations. To correct these
faults, the Committee decided that an amendment in the nature
of a substitute was necessary rather than merely ``tinkering
around the edges'' of the SAFE Act, in order to ensure that the
appropriate and desired balance could be achieved. Thus, the
Committee adopted by unanimous voice vote the ``Encryption for
the National Interest Act.''
THE ``ENCRYPTION FOR THE NATIONAL INTEREST ACT''
A. Establishes government encryption procurement policies
As noted, the Committee amendment, the Encryption for the
National Interest Act, permits the United States government to
procure and use encryption products that include recoverability
or comparable features to allow authorized parties to have
access to plaintext. The SAFE Act forbids the government and
the States from using such products; and the SAFE Act would
deny the government the opportunity to encourage the
development of products with features that might help catch
spies, thieves, child pornographers, and embezzlers, among
others. Thus, specifically, the Encryption for the National
Interest Act would authorize the United States government to
include as a condition of any government contract a requirement
that any encryption employed by the contractor in the execution
of the contract with the government will include features
permitting access to plaintext or decryption information. This
amendment would not require that federal government contractors
use recoverable encryption products in the conduct of non-
federal government business. The Committee amendment also does
not preclude the States from employing recoverable encryption
products. The SAFE Act, however, includes such a prohibition.
B. Preserves law enforcement's investigative capabilities
The Encryption for the National Interest Act also
establishes definite procedures to be followed by federal,
state, and local law enforcement when seeking access to the
plaintext or decryption information of data, including
communications, that is otherwise encrypted. Without expanding
current wiretap or search and seizure authorities, the
amendment allows law enforcement, through judicially authorized
court orders, to gain access to decryption information, or to
plaintext, where it is available, for use in criminal, foreign
counterintelligence, and international terrorism
investigations. A close reading of the SAFE Act would deny law
enforcement this critical capability. The SAFE Act would deny
law enforcement the ability to decrypt any encrypted
communications that are intercepted through legitimate court
issued wiretap orders.
Many proponents of the SAFE Act routinely assert that
wiretaps are of limited utility to law enforcement, and that
the lack of this capability would cause no egregious harm to
public safety. The Committee's extensive experience and the
testimony on this matter indicate otherwise.
Some have concluded that the effort to enact the SAFE Act
is a not-so- subtle attempt to render the government's wiretap
authority void. As the distinguished Chairman of the House
Committee on the Judiciary, Chairman Henry Hyde wrote in
October 1996, ``Without a remedy, America will effectively
disarm itself of one of its most potent weapons in the fight
against two particularly pernicious crimes: international
terrorism and drug smuggling.'' Washington Times, p. B3,
October 27, 1996. Mr. Hyde made the point that ``efforts to
prevent or eliminate this important law enforcement tool are
both naie and dangerous.'' Id. He concluded, by asserting,
``Our Constitution requires the federal government to provide
for the common security of the people. Wiretaps, used sparingly
and with court authorization, are indispensable in safeguarding
both our liberties and our security in an age of dangerous
uncertainty.'' Id. Although Chairman Hyde was expressing his
concern about digital telephony, his logic and arguments are
entirely apt within the context of this public debate over
encryption policy, and should be heeded.
C. Protects civil liberties
It is apparent to the Committee that the use of encryption
to protect the security of one's data or communications would
be indicative of an individual's heightened expectation of
privacy with respect to that data or communication. Although
this does not raise the search and seizure probable cause
standard of the Fourth Amendment to the Constitution of the
United States, Congress can provide additional procedural
protections that will recognize this heightened expectation of
privacy. In fact, the Encryption for the National Interest Act
does exactly this while allowing law enforcement agencies to
conduct their investigations in this computer age. The
Committee amendment provides a judicially supervised mechanism
for accessing the plaintext or decryption information. It
likewise permits all U.S. persons to purchase and use any
encryption technology that is available anywhere in the world,
whether it contains access to plaintext capabilities, or not.
Most proponents of the SAFE Act speak of the need to
protect our privacy from the ``abuses'' of government,
particularly law enforcement. They assert that any access
capability to the plaintext of communications or stored data
will leave law abiding Americans vulnerable to government
prying and abusive intrusion into our private lives. In making
these claims, the supporters of the SAFE Act ignore the bulwark
of our freedoms, the guarantor of our liberties: the
Constitution.
The Framers, brilliant in their foresight, understood
that--at times--there might happen an occasion where government
misunderstood its mission, where government intruded on the
liberties of its citizenry. It was due to this foresight that
the Constitution requires neutral, detached magistrates to
approve the search or seizure of the people's papers and
effects. The judicial branch protects the people from the
excesses of the state. We cannot forget that there are lawful
processes to redress abuses that might be committed. But,
simply because speculative abuses might occur at some unknown
time in the future under unknowable circumstances is no reason
to deny law enforcement the legal authority to obtain evidence
of criminal activity that might be encrypted today. The
Committee's amendment, in an effort to further encourage the
appropriate handling of one's decryption information, permits
civil and criminal sanctions for those who exceed their lawful
authority, who misuse the information, or who violate any
provision of title I of the Act.
D. Maintains but streamlines export controls on encryption products
The Committee believes that increased market share for
United States industry is a societal good that should be
supported, and that trends in market share for U.S. information
technology products should be one factor--but only one factor--
in the design of export controls for sensitive technologies.
Providing tools to our malefactors, who want to invade our
privacy and confound our law enforcement or intelligence
professionals, makes no sense at any price. Thus, any
legislation on encryption policy must be balanced.
Unfortunately, some in the information technology industry have
argued that anything short of the Judiciary Committee's
approach to encryption export control legislation is
unacceptable.
The Encryption for the National Interest Act maintains a
meaningful export control regime that places national security
as the premium interest to be considered when contemplating the
export of strong encryption products from the United States.
But, at the same time, it relaxes current export control
policies where appropriate and streamlines end use and end user
reporting. Although it authorizes the President to control
exports of encryption products, and to deny an export on
national security grounds, it allows for more products to be
exported under license exceptions and under specially granted
Presidential waivers for products above 64-bit length strength.
It also requires the executive branch to more routinely review
the level at which products can be exported by license
exception. This will add regularity to what has beendescribed
as an inconsistent method by which the executive branch has reviewed
encryption export control policy.
The current policy was issued nearly one year ago, and many
believe it was only produced as a result of pressure brought to
bear upon the executive branch by the industry and Congress.
This seems to be an ad hoc method of addressing a critical
national security issue of this magnitude. So, the Committee
amendment attempts to inject order into the regulatory process
and to create a dynamic and constructive regulatory structure
that will address the needs of industry, though not losing
sight of the serious national security and public safety
implications of any export of encryption products.
The Intelligence Committee amendment seeks to lighten this
burdensome responsibility for industry while at the same time
obtaining important national security information. The
Encryption for the National Interest Act provides for a
meaningful technical review period that will provide the United
States government with an opportunity to make well informed and
rational national security determinations under the Act, when
necessary. Additionally, the Committee amendment would
eliminate recoverability features as a condition for export;
indeed, the amendment would eliminate recovery features as a
factor in reaching any export determination.
The Encryption for the National Interest Act does not try
to return the proverbial ``genie to the bottle,'' but rather
merely seeks to manage the spread of encryption in a manner
that is consistent with national security and public safety
interests and in a way that will foster the continued dominance
of the American encryption industry in the global marketplace.
The Committee believes it would be a mistake of catastrophic
proportions to allow indecipherable encryption to be exported
without restriction. Public safety and national security are
not matters that should be left to the ebb and flow of
technological advances and breakthroughs, or to the random
fluctuations of the marketplace.
It is important to note that no one doubts that U.S.
manufactured encryption products are facing competition from
foreign providers. But, simply because a product of purported
capability is available in a country with dubious reliability
at controlling terrorists or drug traffickers, for instance, is
not a sufficient reason for removing virtually all limitations
on the export of encryption of the strongest sort. Rather, it
seems it would be wise for the President to consider whether
U.S. industry stands to lose market share in a particular
market if not permitted to export to that market and whether
export to that market sector presents undue risks to the
national security. It cannot be overstated: the Committee
shares the concern of American industry that its products could
be replaced by foreign competitors. It notes, however, that the
grip of the U.S. industry on the global market is truly
remarkable. Testimony before the Committee indicates U.S.
industry controls approximately 75-80% of the global encryption
market. Goodlatte Test. at p. 50. This ``full-nelson'' hold by
U.S. encryption manufacturers and designers on the global
market is noteworthy given what many have described as
restrictive export controls. On this point, it is worth
highlighting that in 1997 only 25 of 1,850 applications for
encryption export licenses were denied; in 1998, the numbers
were 13 of 1,895; and thus far in 1999, only 1 of 508
applications has been denied.
Interesting to note, too, is that despite the alarmist
rhetoric put forward in support of the SAFE Act, to wit: ``many
hundreds of thousands of American jobs are at stake here,'' see
Goodlatte Test. at p. 32, Congress last year authorized an
additional 50,000 non-immigrant H-1B work visas, P.L. 105-277,
because there are not enough Americans with the skills needed
to fill the available computer industry jobs. Similarly,
Congress is currently debating another increase to the number
of H-1B work visas to be allowed. The claims that hundred of
thousands of American jobs are at risk appears to be a bit of
hyperbole.
Moreover, all sides of this issue acknowledge that U.S.
encryption technology is the best in the world. There is no
wish on the part of the Committee to undermine that position,
nor diminish the U.S. preeminence in this regard. Indeed, it is
the national security interest for U.S. industry to dominate
this market, but only under proper circumstances and with the
appropriate degree of regulation.
conclusion
The encryption policy of the United States requires a
comprehensive approach that takes into account the interests of
national security; federal, state, and local law enforcement;
industry; and the citizens of the United States. The
Committee's amendment in the nature of a substitute to H.R. 850
as reported by the Committee on the Judiciary, renamed by the
amendment as the Encryption for the National Interest Act,
strikes the well-measured balance that so many have sought
since this national policy debate began.
Committee Proceedings
The Committee met several times in executive session where
it was briefed on the topic of encryption and the serious
national security and public safety consequences resulting from
pending encryption legislation. Witnessesbefore the Committee
at these briefings included: the President's Special Envoy on
Encryption Policy, Ambassador David Aaron; the Honorable Louis J.
Freeh, Director, Federal Bureau of Investigation; the Honorable Thomas
A. Constantine, Administrator, Drug Enforcement Administration; the
Honorable John J. Hamre, Deputy Secretary of Defense; and the Honorable
Barbara A. McNamara, Deputy Director, National Security Agency.
The Committee held three closed briefings for Members of
the Committee and three hearings on H.R. 850. The first
briefing was held on June 8, 1999. That was followed by the
first hearing, which was held on June 9, 1999, in open session.
The second hearing was held on June 15, 1999, in closed
session. The second briefing was held on June 16, 1999. The
final briefing was held on July 13, 1999. The final hearing was
held July 14, 1999, in open session.
On June 8, 1999, the Deputy Director of the NSA, the
Honorable Barbara A. McNamara, briefed the Members of the
Committee in closed session on the equities of the intelligence
community that are impacted by the SAFE Act.
Witnesses before the Committee at the June 9, 1999, hearing
were: the Honorable Bob Goodlatte, United States
Representative, 6th District of Virginia, and author of the
``Security and Freedom through Encryption (SAFE) Act'' (H.R.
80); the Honorable William Reinsch, Under Secretary, Bureau of
Export Administration, Department of Commerce; Mr. Christopher
G. Caine, Vice President of Governmental Affairs, IBM
Corporation; Ms. Elizabeth Kaufman, Senior Director and General
Manager for Security, Cisco Systems, Inc.; Colonel Michael D.
Robinson, First Vice President, International Association of
Chiefs of Police (IACP); Mr. Alan Davidson, Counsel, Center for
Democracy and Technology; Mr. Ramon Marks, Board Member,
Business Executives for National Security (BENS); the Honorable
John Kaye, former President, National District Attorney's
Association; Mr. Richard D. Heideman, President, B'nai B'rith
International. In addition to this testimony presented live to
the Committee, the following submissions for the record were
also received and considered: Statement of Jeffrey H. Smith,
Counsel, Americans for Computer Privacy; Statement of Security
Dynamics Technologies, Inc.; and the Statement of Mr. Patrick
P. Gelsinger, Vice President for Desktop Productions, Intel
Corporation.
At the June 15, 1999, closed hearing on H.R. 850, the
Committee took testimony from the Honorable Louis J. Freeh,
Director, Federal Bureau of Investigation; the Honorable Thomas
A. Constantine, Administrator, Drug Enforcement Administration;
and the Honorable John J. Hamre, Deputy Secretary of Defense.
On June 16, 1999, the Members of the Committee were briefed
by the President's Special Envoy for Encryption Policy,
Ambassador David Aaron, on the administration's efforts to
achieve international agreement or consensus on the appropriate
approach to encryption policy and export controls.
Members of the Committee received another briefing on July
13, 1999, from the Honorable Barbara A. McNamara, Deputy
Director of NSA, concerning the SAFE Act. The focus of the
briefing included the effect of removal of export controls on
national security and intelligence, as well as questions
surrounding the issue of foreign availability and foreign
market share.
The witnesses appearing before the Committee at the July
14, 1999, open hearing were: the Honorable Janet Reno, Attorney
General of the United States; the Honorable Louis J. Freeh,
Director, Federal Bureau of Investigation; Thomas A.
Constantine, former Administrator of the Drug Enforcement
Administration; and the Honorable John J. Hamre, Deputy
Secretary of Defense.
The Committee extensively reviewed additional testimony,
reports, and other written materials relating to encryption
policy in general, and H.R. 850 in particular. Among the
documents reviewed by the Committee are House Report 106-117,
Part 1, Committee on the Judiciary Report on H.R. 850, April
27, 1999; House Report 106-117, Part 2, Committee on Commerce
Report on H.R. 850, July 2, 1999; Senate Report 106-48, Senate
Select Committee on Intelligence Report on Fiscal S. 1009, the
Intelligence Authorization Act for Fiscal Year 2000, May 11,
1999; House Report 105-108, Part 1, Committee on the Judiciary
Report on H.R. 695, May 22, 1997; House Report 105-108, Part 2,
Committee on International Relations Report on H.R. 695, July
25, 1997; House Report 105-108, Part 3, Committee on National
Security Report on H.R. 65, September 12, 1997; House Report
105-108, Part 4, Permanent Select Committee on Intelligence
Report on H.R. 695, September 16, 1997; House Report 105-108,
Part 5, Committee on Commerce Report on H.R. 695, September 29,
1997; Hiding Crimes in Cyberspace, Dorothy E. Denning and
William E. Baugh, Jr., to appear in Information, Communication
and Society, vol. 2, no. 3 (Autumn 1999) and in Cybercrime,
B.D. Loader and D. Thomas (eds.) Routledge, 1999; Growing
Development of Foreign Encryption Products in the Face of U.S.
Export Regulations, Lance J. Hoffman, et al, Cyberspace Policy
Institute, School of Engineering and Applied Science, George
Washington University, Washington, D.C., June 1999;
Cryptography & Liberty 1999: An International Survey of
Encryption Policy, Electronic Privacy Information Center,
Washington, DC, June 1999; Congressional Research Service Issue
Brief Encryption Technology: Congressional Issues, produced by
Mr. Richard M.Nunno, February 25, 1999; Terrorism in the Next
Millennium: Enter the Cyberterrorist, by George R. Barth, National
Counterintelligence Center; Access With Trust, Federal Public Key
Infrastructure Steering Committee, Government Information Technology
Services Board, Office of Management and Budget, Washington, DC,
September 1998; Cryptography Policy: the Guidelines and the Issues,
Organization for Economic Cooperation and Development, Washington, DC,
March 1998; Deciphering the Cryptography Debate, by Kenneth Flamm, The
Brookings Institution; The Risks of Key Recovery, Key Escrow, & Trusted
Third Party Encryption: A Report by an Ad Hoc Group of Cryptographers
and Computer Scientists, produced by Center for Democracy and
Technology, June 1998; ``Opening the Lines for Criminal Conversation,''
Robert D. Novak, Washington Post, June 28, 1999; and ``Wiretap
Technology. Updating an effective tool,'' by the Honorable Henry J.
Hyde, Washington Times, October 1996.
Testimony before the United States House of Representative
Judiciary Subcommittee on Courts and Intellectual Property,
March 4, 1999: The Honorable William A. Reinsch, Under
Secretary for Export Administration, Department of Commerce;
Mr. Dave McCurdy, President, Electronic Industries Alliance;
the Honorable Ron Lee, Associate Deputy Attorney General,
Department of Justice; Mr. Craig McLaughlin, Chief Technology
Officer, Privada, Inc.; Mr. Edward Gillespie, Executive
Director, Americans for Computer Privacy; Mr. Thomas Parenty,
Director, Data and Communications Security Sybase, Inc. on
behalf of Business Software Alliance; Ms. Dorothy E. Denning,
Computer Science Department, Georgetown University; and
Statement of the Honorable Howard Coble, United States
Representative, 6th District of North Carolina.
Testimony before the United States House of Representatives
Commerce Subcommittee on Telecommunications Trade and Consumer
Protection, May 25, 1999: The Honorable Ronald D. Lee,
Associate Deputy Attorney General, Department of Justice; the
Honorable Barbara A. McNamara, Deputy Director, National
Security Agency; the Honorable William A. Reinsch,
Undersecretary Bureau of Export Administration, Department of
Commerce, Executive Director, Americans for Computer Privacy;
Mr. Richard Hornstein, General Counsel, Network Associates; Mr.
Tom Arnold, Vice President and Chief Technology Officer,
CyberSource Corporation; Dr. Gene Schultz, Trusted Security
Advisor, Global Integrity Corporation; Mr. Paddy Holohan,
Executive Vice President, Marketing, Baltimore Technologies
International Finance Services Centre; and Mr. David Dawson,
Chairman and CEO, V-One Corporation.
Testimony before the United States House of Representatives
Armed Services Committee, July 13, 1999: the Honorable Janet
Reno, Attorney General; the Honorable William A. Reinsch,
Undersecretary for Export Administration, Department of
Commerce; the Honorable Louis J. Freeh, Director, Federal
Bureau of Investigation; Ms. Elizabeth Kaufman, Senior Director
and General Manager for Security, Cisco Systems, Inc; and Mr.
Matthew Bowcock, Executive Vice President of Cooperate
Development, Baltimore Technologies.
In addition, the Committee staff was briefed on the subject
of encryption from representatives of Cisco Systems, Inc.; IBM;
Nortel; 3Com; Center for Technology and Democracy; Netscape;
Motorola; the Alliance for Network Security; the Business
Software Alliance; and Americans for Computer Privacy.
Committee Consideration
The Committee met on July 15, 1999, to mark up H.R. 850. In
closed session, the Committee approved by unanimous voice vote
the amendment in the nature of a substitute to H.R. 850 as
amended and reported by the Committee on the Judiciary (House
Report No. 106-117, Part 1, (April 27, 1999)), which was
offered by Chairman Goss and Mr. Dixon and further amended by
Ms. Pelosi. Upon adoption of the Goss and Dixon amendment as
amended, the Committee, in open session, by unanimous voice
vote, ordered H.R. 850, the ``Encryption for the National
Interest Act,'' as amended by the Committee, reported favorably
to the House, a quorum being present.
Vote of the Committee
During its consideration of H.R. 850, the Committee took no
roll call votes.
Findings and Recommendations of the Committee on Government Reform and
Oversight
With respect to clause 3(c)(4) of rule XIII of the Rules of
the House of Representatives, the Committee has not received a
report from the Committee on Government Reform pertaining to
the subject of the bill.
Oversight Findings
In compliance with clause 3(c)(1) of rule XIII of the Rules
of the House of Representatives, the bill as reported by the
Committee reflects the conclusions, findings, and
recommendations of the Committee in light of its oversight
activity.
Congressional Budget Office Estimates
In compliance with clause 3(c)(2) and (3) of rule XIII of
the Rules of the House of Representatives, and pursuant to
sections 308 and 402 of the Congressional Budget Act of 1974,
the Committee submits the following estimate prepared by the
Congressional Budget Office:
U.S. Congress,
Congressional Budget Office,
Washington, DC, July 23, 1999.
Hon. Porter J. Goss,
Chairman, Committee on Intelligence, House of Representatives,
Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for H.R. 850, the
Encryption for the National Interest Act.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contacts are Mark Hadley
and Mark Grabowicz.
Sincerely,
Barry B. Anderson
(For Dan L. Crippen, Director).
Enclosure.
H.R. 850--Encryption for the National Interest Act
Summary: H.R. 850 would clarify the President's authority
to control the export of encryption products. The effectiveness
or strength of contemporary encryption products is measured by
the number of bits that make up the key for the encryption
algorithm. (The term ``key'' refers to the mathematical code
used to translate encrypted information back into its original,
unencrypted format.) Under current policy, domestic producers
may export encryption products with key lengths of up to 56
bits and stronger products for specified industries.
H.R. 850 would generally allow domestic producers to export
encryption products with key lengths of up to 64 bits. The
President would determine the maximum strength of encryption
products that may be exported (with a review and potential
update of that maximum every 180 days). The bill would
establish a board to advise the President on the export of
encryption products. H.R. 850 also would establish two federal
crimes relating to the improper use of encryption technology
and would require the Attorney General to issue numerous
reports and maintain data on the instances in which encryption
impedes or obstructs the ability of the Department of Justice
(DOJ) to enforce the criminal laws. Finally, the bill would
authorize appropriations of $75 million over the 2000-2003
period to establish a technical support center within the
Federal Bureau of Investigation (FBI).
Assuming the appropriation of the necessary amounts, CBO
estimates that enacting this bill would result in additional
discretionary spending by DOJ of about $80 million over the
2000-2004 period. Enacting H.R. 850 also would affect direct
spending and receipts. Therefore, pay-as-you-go procedures
would apply. CBO estimates, however, that the amounts of
additional direct spending and receipts would not be
significant.
CBO is uncertain whether H.R. 850 contains
intergovernmental mandates as defined in the Unfunded Mandates
Reform Act (UMRA), but we estimate that any costs to state,
local, or tribal governments would not be significant and would
not meet the threshold established by that act ($50 million in
1996, adjusted annually for inflation).
This bill would impose no new private-sector mandates as
defined in UMRA.
Estimated cost to the Federal Government: The estimated
budgetary impact of H.R. 850 is shown in the following table.
For purpose of this estimate, CBO assumes H.R. 850 will be
enacted by the beginning of fiscal year 2000 and that the
authorized amounts will be provided for each year. The costs of
this legislation fall within budget function 750
(administration of justice).
----------------------------------------------------------------------------------------------------------------
By fiscal years, in millions of dollars--
--------------------------------------------
2000 2001 2002 2003 2004
----------------------------------------------------------------------------------------------------------------
SPENDING SUBJECT TO APPROPRIATION
Estimated Authorization Level...................................... 26 21 16 16 1
Estimated Outlays.................................................. 19 25 16 16 4
----------------------------------------------------------------------------------------------------------------
Basis of Estimate
Spending subject to appropriation
H.R. 850 would establish a technical support center within
the FBI and authorize appropriations of $75 million over the
2000-2003 period. Based on the historical spending patterns of
FBI funds, CBO estimates that implementing this provision would
result in outlays of $74 million over the 2000-2004 period.
In addition, CBO estimates that complying with the bill's
data collection and reporting requirements would cost DOJ about
$1 million a year, assuming appropriation of the necessary
amounts. The expense of compiling and maintaining data on the
instances in which encryption impedes or obstructs the ability
of the department to enforce the criminal laws is difficult to
ascertain because the number of such instances is unknown--but
DOJ believes that if H.R. 850 were enacted they would be
numerous.
Under current policy, the Department of Commerce's (DOC's)
Bureau of Export Administration (BXA) would likely spend about
$500,000 a year reviewing exports of encryption products. If
H.R. 850 were enacted, BXA would still be required to review
requests to export encryption products. Thus, CBO estimates
that implementing H.R. 850 would not significantly change the
costs to control exports of nonmilitary encryption products.
H.R. 850 would establish a new federal crime for using
encryption technologies to conceal incriminating information
relating to a felony from law enforcement officials and for
illegally decrypting private information. The bill would also
create a new federal crime for violating privacy by decrypting
someone's private information. Because H.R. 850 would establish
new federal crimes, CBO anticipates that the U.S. government
would be able to pursue cases that it otherwise would be unable
to prosecute. Based on information from DOJ, however, we do not
expect the government to pursue many additional cases. Thus,
CBO estimates that implementing these provisions would not have
a significant impact on the cost of federal law enforcement
activity.
Direct spending and revenues
Enacting H.R. 850 would affect direct spending and receipts
by imposing criminal fines. Collections of such fines are
recorded in the budget as governmental receipts (i.e.,
revenues), which are deposited in the Crime Victims Fund and
spent in subsequent years. Any additional collections as a
result of this bill are likely to be negligible, however,
because the federal government would probably not pursue many
cases under the bill. Because any increase in direct spending
would equal the fines collected (with a lag of one year or
more), the additional direct spending would be negligible.
Direct spending also could result from the provision that
would allow the government to be sued for decrypting private
information without a court order. CBO expects that this
provision is not likely to result in any significant spending.
Pay-as-you-go considerations: The Balanced Budget and
Emergency Control Act sets up pay-as-you-go procedures for
legislation affecting direct spending or receipts. H.R. 850
would affect direct spending and receipts by imposing criminal
fines and by allowing civil actions against the United States
government. CBO estimates that the amount of additional direct
spending and receipts would not be significant.
Estimated impact on State, local, and tribal governments:
H.R. 850 would require state and local law enforcement agencies
to follow specified procedures in order to obtain access to the
decryption keys of suspected criminals and would require state
courts to undertake additional administrative duties in
processing such requests. In addition, the bill would limit the
liability of anyone who provides access to a decryption key to
law enforcement officials who follow the procedures prescribed
by the bill. We cannot determine if the requirements of H.R.
850 would constitute new intergovernmental mandates because it
is unclear how these requirements would interact with the
current wiretap, search, and seizure laws. CBO estimates that
the costs of those requirements would be small because they are
similar to current laws and procedures and because the burden
of the bill's requirements would fall predominantly on federal
entities. We therefore estimate that the bill would not impose
significant costs on state, local, or tribal governments and
that such costs would not exceed the threshold established by
UMRA ($50 million in 1996), adjusted annually for inflation.)
Estimated impact on the private sector: This bill would
impose no new private-sector mandates as defined in UMRA.
Previous CBO estimates: CBO has completed numerous other
estimates of bills affecting the export of encryption products,
including three versions of H.R. 850. Differences between this
estimate and our previous estimates reflect differences between
the bills. On April 21, 1999, CBO transmitted a cost estimate
for H.R. 850 as ordered reported by the House Committee on the
Judiciary on March 24, 1999. On July 1, 1999, CBO transmitted
an estimate for H.R. 850 as ordered reported by the House
Committee on Commerce on June 23, 1999. On July 16, 1999, CBO
transmitted an estimate of H.R. 850 as ordered reported by the
House Committee on International Relations on July 13, 1999. On
July 9, 1999, CBO transmitted an estimate for S. 798, the
Promote Online Transactions to Encourage Commerce and Trade
(PROTECT) Act of 1999, as ordered reported by the Senate
Committee on Commerce, Science, and Transportation on June 23,
1999. And on July 22, 1999, CBO transmitted an estimate for
H.R. 850 as ordered reported by the House Committee on Armed
Services on July 21, 1999.
CBO estimated that the versions of H.R. 850 reported by the
Judiciary Committee and the International Relations Committee
would each cost between $3 million and $5 million over the
2000-2004 period, that the version reported by the Armed
Services Committee would cost $5 million over the 2000-2004
period, and that the House Commerce Committee's version of H.R.
850 and the Senate bill (S. 798) would each increase costs by
at least $25 million over the same period. None of those
previously estimated bills contain authorizations for a new
technical support center within the FBI.
Estimate prepared by: Federal costs: Mark Hadley and Mark
Grabowicz. Impact on State, local, and tribal governments:
Shelley Finlayson.
Estimate approved by: Robert A. Sunshine, Deputy Assistant
Director for Budget Analysis.
Committee Cost Estimates
The Committee agrees with the estimate of the Congressional
Budget Office.
Specific Constitutional Authority for Congressional Enactment of this
Legislation
The intelligence and intelligence-related activities of the
United States government are carried out to support the
national security interests of the United States, to support
and assist the armed forces of the United States, and to
support the President in the execution of the foreign policy of
the United States. Article 1, section 8, of the Constitution of
the United States provides, in pertinent part, that ``Congress
shall have power * * * to pay the debts and provide for the
common defense and general welfare of the United States; * * *
''; ``to raise and support Armies, * * * ''; ``to provide and
maintain a Navy; * * * '' and ``to make all laws which shall be
necessary and proper for the carrying into execution . . . all
other powers vested by this Constitution in the Government of
the United States, or in any Department or Officer thereof.''
Therefore, pursuant to such authority, Congress is empowered to
enact this legislation.
Changes in Existing Law Made by the Bill, as Reported
In compliance with clause 3(e) of rule XIII of the Rules of
the House of Representatives, changes in existing law made by
the bill, as reported, are shown as follows (existing law
proposed to be omitted is enclosed in black brackets, new
matter is printed in italic, existing law in which no change is
proposed is shown in roman):
TITLE 18, UNITED STATES CODE
* * * * * * *
Chap. Sec.
1. General provisions......................................... 1
* * * * * * *
2801 Encrypted data, including communications..................
* * * * * * *
CHAPTER 125--ENCRYPTED DATA, INCLUDING COMMUNICATIONS
Sec.
2801. Unlawful use of encryption in furtherance of a criminal act.
2802. Privacy protection.
2803. Court order access to plaintext or decryption information.
2804. Notification procedures.
2805. Lawful use of plaintext or decryption information.
2806. Identification of decryption information.
2807. Definitions.
Sec. 2801. Unlawful use of encryption in furtherance of a criminal act
(a) Prohibited Acts.--Whoever knowingly uses encryption in
furtherance of the commission of a criminal offense for which
the person may be prosecuted in a district court of the United
States shall--
(1) in the case of a first offense under this
section, be imprisoned for not more than 5 years, or
fined under this title, or both; and
(2) in the case of a second or subsequent offense
under this section, be imprisoned for not more than 10
years, or fined under this title, or both.
(b) Consecutive Sentence.--Notwithstanding any other
provision of law, the court shall not place on probation any
person convicted of a violation of this section, nor shall the
term of imprisonment imposed under this section run
concurrently with any other term of imprisonment imposed for
the underlying criminal offense.
(c) Probable Cause Not Constituted by Use of Encryption.--The
use of encryption by itself shall not establish probable cause
to believe that a crime is being or has been committed.
Sec. 2802. Privacy protection
(a) In General.--It shall be unlawful for any person to
intentionally--
(1) obtain or use decryption information without
lawful authority for the purpose of decrypting data,
including communications;
(2) exceed lawful authority in decrypting data,
including communications;
(3) break the encryption code of another person
without lawful authority for the purpose of violating
the privacy or security of that person or depriving
that person of any property rights;
(4) impersonate another person for the purpose of
obtaining decryption information of that person without
lawful authority;
(5) facilitate or assist in the encryption of data,
including communications, knowing that such data,
including communications, are to be used in furtherance
of a crime; or
(6) disclose decryption information in violation of a
provision of this chapter.
(b) Criminal Penalty.--Whoever violates this section shall
be imprisoned for not more than 10 years, or fined under this
title, or both.
Sec. 2803. Court order access to plaintext or decryption information
(a) Court Order.--(1) A court of competent jurisdiction shall
issue an order, ex parte, granting an investigative or law
enforcement officer timely access to the plaintext of encrypted
data, including communications, or requiring any person in
possession of decryption information to provide such
information to a duly authorized investigative or law
enforcement officer--
(A) upon the application by an attorney for the
Government that--
(i) is made under oath or affirmation by the
attorney for the Government; and
(ii) provides a factual basis establishing
the relevance that the plaintext or decryption
information being sought has to a law
enforcement, foreign counterintelligence, or
international terrorism investigation then
being conducted pursuant to lawful authorities;
and
(B) if the court finds, in writing, that the
plaintext or decryption information being sought is
relevant to an ongoing lawful law enforcement, foreign
counterintelligence, or international terrorism
investigation and the investigative or law enforcement
officer is entitled to such plaintext or decryption
information.
(2) The order issued by the court under this section shall be
placed under seal, except that a copy may be made available to
the investigative or law enforcement officer authorized to
obtain access to the plaintext of the encrypted information, or
authorized to obtain the decryption information sought in the
application. Such order shall, subject to the notification
procedures set forth in section 2804, also be made available to
the person responsible for providing the plaintext or the
decryption information, pursuant to such order, to the
investigative or law enforcement officer.
(3) Disclosure of an application made, or order issued, under
this section, is not authorized, except as may otherwise be
specifically permitted by this section or another order of the
court.
(b) Record of Access Required.--(1) There shall be created an
electronic record, or similar type record, of each instance in
which an investigative or law enforcement officer, pursuant to
an order under this section, gains access to the plaintext of
otherwise encrypted information, or is provided decryption
information, without the knowledge or consent of the owner of
the data, including communications, who is the user of the
encryption product involved.
(2) The court issuing the order under this section may
require that the electronic or similar type of record described
in paragraph (1) is maintained in a place and a manner that is
not within the custody or control of an investigative or law
enforcement officer gaining the access or provided the
decryption information. The record shall be tendered to the
court, upon notice from the court.
(3) The court receiving such electronic or similar type of
record described in paragraph (1) shall make the original and a
certified copy of the record available to the attorney for the
Government making application under this section, and to the
attorney for, or directly to, the owner of the data, including
communications, who is the user of the encryption product,
pursuant to the notification procedures set forth in section
2804.
(c) Authority To Intercept Communications Not Increased.--
Nothing in this chapter shall be construed to enlarge or modify
the circumstances or procedures under which a Government entity
is entitled to intercept or obtain oral, wire, or electronic
communications or information.
(d) Construction.--This chapter shall be strictly construed
to apply only to a Government entity's ability to decrypt data,
including communications, for which it has previously obtained
lawful authority to intercept or obtain pursuant to other
lawful authorities, which without an order issued under this
section would otherwise remain encrypted.
Sec. 2804. Notification procedures
(a) In General.--Within a reasonable time, but not later
than 90 days after the filing of an application for an order
under section 2803 which is granted, the court shall cause to
be served, on the persons named in the order or the
application, and such other parties whose decryption
information or whose plaintext has been provided to an
investigative or law enforcement officer pursuant to this
chapter, as the court may determine is in the interest of
justice, an inventory which shall include notice of--
(1) the fact of the entry of the order or the
application;
(2) the date of the entry of the application and
issuance of the order; and
(3) the fact that the person's decryption information
or plaintext data, including communications, has been
provided or accessed by an investigative or law
enforcement officer.
The court, upon the filing of a motion, may make available to
that person or that person's counsel, for inspection, such
portions of the plaintext, applications, and orders as the
court determines to be in the interest of justice.
(b) Postponement of Inventory for Good Cause.--(1) On an ex
parte showing of good cause by an attorney for the Government
to a court of competent jurisdiction, the serving of the
inventory required by subsection (a) may be postponed for an
additional 30 days after the granting of an order pursuant to
the ex parte motion.
(2) No more than 3 ex parte motions pursuant to paragraph (1)
are authorized.
(c) Admission Into Evidence.--The content of any encrypted
information that has been obtained pursuant to this chapter or
evidence derived therefrom shall not be received in evidence or
otherwise disclosed in any trial, hearing, or other proceeding
in a Federal or State court, other than the court organized
pursuant to the Foreign Intelligence Surveillance Act of 1978,
unless each party, not less than 10 days before the trial,
hearing, or proceeding, has been furnished with a copy of the
order, and accompanying application, under which the decryption
or access to plaintext was authorized or approved. This 10-day
period may be waived by the court if the court finds that it
was not possible to furnish the party with the information
described in the preceding sentence within 10 days before the
trial, hearing, or proceeding and that the party will not be
prejudiced by the delay in receiving such information.
(d) Construction.--The provisions of this chapter shall be
construed consistent with--
(1) the Classified Information Procedures Act (18
U.S.C. App.); and
(2) the Foreign Intelligence Surveillance Act of 1978
(50 U.S.C. 1801 et seq.).
(e) Contempt.--Any violation of the provisions of this
section may be punished by the court as a contempt thereof.
(f) Motion To Suppress.--Any aggrieved person in any trial,
hearing, or proceeding in or before any court, department,
officer, agency, regulatory body, or other authority of the
United States or a State, other than the court organized
pursuant to the Foreign Intelligence Surveillance Act of 1978,
may move to suppress the contents of any decrypted data,
including communications, obtained pursuant to this chapter, or
evidence derived therefrom, on the grounds that--
(1) the plaintext was decrypted or accessed in
violation of this chapter;
(2) the order of authorization or approval under
which it was decrypted or accessed is insufficient on
its face; or
(3) the decryption was not made in conformity with
the order of authorization or approval.
Such motion shall be made before the trial, hearing, or
proceeding unless there was no opportunity to make such motion,
or the person was not aware of the grounds of the motion. If
the motion is granted, the plaintext of the decrypted data,
including communications, or evidence derived therefrom, shall
be treated as having been obtained in violation of this
chapter. The court, upon the filing of such motion by the
aggrieved person, may make available to the aggrieved person or
that person's counsel for inspection such portions of the
decrypted plaintext, or evidence derived therefrom, as the
court determines to be in the interests of justice.
(g) Appeal by United States.--In addition to any other right
to appeal, the United States shall have the right to appeal
from an order granting a motion to suppress made under
subsection (f), or the denial of an application for an order
under section 2803, if the attorney for the Government
certifies to the court or other official granting such motion
or denying such application that the appeal is not taken for
purposes of delay. Such appeal shall be taken within 30 days
after the date the order was entered on the docket and shall be
diligently prosecuted.
(h) Civil Action for Violation.--Except as otherwise provided
in this chapter, any person described in subsection (i) may, in
a civil action, recover from the United States Government the
actual damages suffered by the person as a result of a
violation described in that subsection, reasonable attorney's
fees, and other litigation costs reasonably incurred in
prosecuting such claim.
(i) Covered Persons.--Subsection (h) applies to any person
whose decryption information--
(1) is knowingly obtained without lawful authority by
an investigative or law enforcement officer;
(2) is obtained by an investigative or law
enforcement officer with lawful authority and is
knowingly used or disclosed by such officer unlawfully;
or
(3) is obtained by an investigative or law
enforcement officer with lawful authority and whose
decryption information is unlawfully used to disclose
the plaintext of the data, including communications.
(j) Limitation.--A civil action under subsection (h) shall be
commenced not later than 2 years after the date on which the
unlawful action took place, or 2 years after the date on which
the claimant first discovers the violation, whichever is later.
(k) Exclusive Remedies.--The remedies and sanctions described
in this chapter with respect to the decryption of data,
including communications, are the only judicial remedies and
sanctions for violations of this chapter involving such
decryptions, other than violations based on the deprivation of
any rights, privileges, or immunities secured by the
Constitution.
(l) Technical Assistance by Providers.--A provider of
encryption technology or network service that has received an
order issued by a court pursuant to this chapter shall provide
to the investigative or law enforcement officer concerned such
technical assistance as is necessary to execute the order. Such
provider may, however, move the court to modify or quash the
order on the ground that its assistance with respect to the
decryption or access to plaintext cannot be performed in fact,
or in a timely or reasonable fashion. The court, upon notice to
the Government, shall decide such motion expeditiously.
(m) Reports to Congress.--In May of each year, the Attorney
General, or an Assistant Attorney General specifically
designated by the Attorney General, shall report in writing to
Congress on the number of applications made and orders entered
authorizing Federal, State, and local law enforcement access to
decryption information for the purposes of reading the
plaintext of otherwise encrypted data, including
communications, pursuant to this chapter. Such reports shall be
submitted to the Committees on the Judiciary of theHouse of
Representatives and of the Senate, and to the Permanent Select
Committee on Intelligence for the House of Representatives and the
Select Committee on Intelligence for the Senate.
Sec. 2805. Lawful use of plaintext or decryption information
(a) Authorized Use of Decryption Information.--
(1) Criminal investigations.--An investigative or law
enforcement officer to whom plaintext or decryption
information is provided may only use such plaintext or
decryption information for the purposes of conducting a
lawful criminal investigation, foreign
counterintelligence, or international terrorism
investigation, and for the purposes of preparing for
and prosecuting any criminal violation of law.
(2) Civil redress.--Any plaintext or decryption
information provided under this chapter to an
investigative or law enforcement officer may not be
disclosed, except by court order, to any other person
for use in a civil proceeding that is unrelated to a
criminal investigation and prosecution for which the
plaintext or decryption information is authorized under
paragraph (1). Such order shall only issue upon a
showing by the party seeking disclosure that there is
no alternative means of obtaining the plaintext, or
decryption information, being sought and the court also
finds that the interests of justice would not be served
by nondisclosure.
(b) Limitation.--An investigative or law enforcement officer
may not use decryption information obtained under this chapter
to determine the plaintext of any data, including
communications, unless it has obtained lawful authority to
obtain such data, including communications, under other lawful
authorities.
(c) Return of Decryption Information.--An attorney for the
Government shall, upon the issuance of an order of a court of
competent jurisdiction--
(1)(A) return any decryption information to the
person responsible for providing it to an investigative
or law enforcement officer pursuant to this chapter; or
(B) destroy such decryption information, if the court
finds that the interests of justice or public safety
require that such decryption information should not be
returned to the provider; and
(2) within 10 days after execution of the court's
order to return or destroy the decryption information--
(A) certify to the court that the decryption
information has either been returned or
destroyed consistent with the court's order;
and
(B) if applicable, notify the provider of the
decryption information of the destruction of
such information.
(d) Other Disclosure of Decryption Information.--Except as
otherwise provided in section 2803, decryption information or
the plaintext of otherwise encrypted data, including
communications, shall not be disclosed by any person unless the
disclosure is--
(1) to the person encrypting the data, including
communications, or an authorized agent thereof;
(2) with the consent of the person encrypting the
data, including pursuant to a contract entered into
with the person;
(3) pursuant to a court order upon a showing of
compelling need for the information that cannot be
accommodated by any other means if--
(A) the person who supplied the information
is given reasonable notice, by the person
seeking the disclosure, of the court proceeding
relevant to the issuance of the court order;
and
(B) the person who supplied the information
is afforded the opportunity to appear in the
court proceeding and contest the claim of the
person seeking the disclosure;
(4) pursuant to a determination by a court of
competent jurisdiction that another person is lawfully
entitled to hold such decryption information, including
determinations arising from legal proceedings
associated with the incapacity, death, or dissolution
of any person; or
(5) otherwise permitted by law.
Sec. 2806. Identification of decryption information
(a) Identification.--To avoid inadvertent disclosure of
decryption information, any person who provides decryption
information to an investigative or law enforcement officer
pursuant to this chapter shall specifically identify that part
of the material that discloses decryption information as such.
(b) Responsibility of Investigative or Law Enforcement
Officer.--The investigative or law enforcement officer
receiving any decryption information under this chapter shall
maintain such information in a facility and in a method so as
to reasonably assure that inadvertent disclosure does not
occur.
Sec. 2807. Definitions
The definitions set forth in section 101 of the Encryption
for the National Interest Act shall apply to this chapter.
* * * * * * *