Clinton Administration Talks Encryption

(September 17, 1999) With the House of Representatives close to a vote on the Security and Freedom through Encryption (SAFE) Act, the Clinton administration announced a new set of encryption policy proposals, including liberalization of export restraints.

The Clinton administration announced on Thursday, September 16, that "Any encryption commodity or software of any key length can now be exported under a license exception (i.e., without a license) after a technical review, to commercial firms and other nongovernment end users in any country except for the seven state supporters of terrorism." However, regulations implementing this proposal will not be released for months.

The Administration will also submit a bill, titled the "Cyberspace Electronic Security Act of 1999". According to a "fact sheet" released by the White House press office, the bill "would protect the growing use of encryption for the legitimate protection of privacy and confidentiality by businesses and individuals, while helping law enforcement obtain evidence to investigate and prosecute criminals despite their use of encryption to hide criminal activity."

President Clinton wrote in a letter to Congress that "A sound and effective public policy must support the development and use of encryption for legitimate purposes but allow access to plaintext by law enforcement when encryption is utilized by criminals."

Secretary of Commerce William Daley outlined the encryption export components of the administration's new proposal in a statement delivered on September 16. "First, the new regulations will permit any encryption product or software with a key length over 64 bits to be exported under a license exception to commercial firms and other nongovernment end users in any country except for the seven state supporters of terrorism. This means that exporters will be able to ship freely once Commerce has reviewed their products and classified them."

	Wm. Daley

"Second, retail products with key lengths over 64 bits -- those that do not require substantial support, are sold in tangible form or have been specifically designed for individual consumer use -- may be exported under a license exception to all end users, including governments, except in the seven state supporters of terrorism."

"Third, the new regulations will also implement our international commitments for encryption controls. Last year, the Wassenaar Arrangement -- thirty three countries which have common controls on exports, including encryption -- made a number of changes to modernize multilateral encryption controls. Among these changes, the U.S. will decontrol exports of 56 bits DES and equivalent products, including toolkits and chips, to all users and destinations except the seven state supporters of terrorism after a technical review. In addition, exports with key lengths of 64 bits or less, including chips, that fall under the Wassenaar Arrangement's definition of mass market will also be decontrolled."

Daley said that "We hope to have the implementing regulations published in the Federal Register before December 15."

The White House Press Office also released a statement of the Press Secretary. It stated that "The strategy announced today continues to maintain the balance among privacy, commercial interests, public safety and national security. This approach is comprised of three elements -- information security and privacy, a new framework for export controls, and updated tools for law enforcement."

"With respect to encryption export controls, the strategy announced today rests on three principles: a one-time technical review of encryption products in advance of sale, a streamlined post-export reporting system, and a process that permits the government to review the exports of strong encryption to foreign government and military organizations and to nations of concern. Consistent with these principles, the government will significantly update and simplify export controls on encryption."

The statement also elaborated that the Cyberspace Electronic Security Act of 1999 would:

"Ensure that law enforcement maintains its ability to access decryption information stored with third parties, while protecting such information from inappropriate release.

Authorize $80 million over four years for the FBI's Technical Support Center, which will serve as a centralized technical resource for Federal, State, and local law enforcement in responding to the increasing use of encryption by criminals.

Protect sensitive investigative techniques and industry trade secrets from unnecessary disclosure in litigation or criminal trials involving encryption, consistent with fully protecting defendants' rights to a fair trial."