1997 Congressional Hearings
Intelligence and Security

Mr. Chairman, much has happened since encryption was debated during the 104th Congress. The President has decided on an encryption policy, and we are well on our way to implementing it. It balances all of the competing interests in this issue: privacy, electronic commerce, law enforcement, and national security.

Making strong commercial encryption widely available is in the best interest of the United States. Indeed, it is inevitable, as powerful computers and advanced telecommunications rapidly lead tothe creation of broad electronic networks which will form the basis for communication and commerce in the future. The ability to encrypt electronic messages and data will be essential for electronic commerce and for the full development of information technology. Businesses andindividuals need encrypted products to protect sensitive commercial information and to preserve privacy, and their demand for those products will further facilitate the spread of encryption.

This trend is also economically desirable. Protecting the confidentiality of business information will reduce losses from industrial espionage. Perhaps more important, we are the world's leadingproducer of information technology with almost half the world's producers and roughly half their revenues coming from exports. And we want to keep it that way.

To retain this leading position and the jobs it produces, we must ensure our producers' continued ability to capture foreign market share. Our companies must be able to meet the growing demand for products with strong encryption. If they do not, foreign firms will step in to fill thevoid. The United States cannot allow its encryption policy to become a point of vulnerability for this vital industrial sector. We must shape our export control policies to allow American companies to take advantage of their strengths in information technology in their pursuit ofglobal markets.

But the increased use of encryption carries with it serious risks for law enforcement and our national security. Any policy on encryption must address these risks as well if it is to be in the national interest. Our policy provides that balance, and does it in close consultation with theprivate sector and by working with the market, not against it.

The Administration's Policy

The President's policy of balance is based on trying to promote key recovery in the marketplace. By "key recovery" I refer to a range of technologies, some in existence, some under development, some still being conceived, designed to permit the plaintext recovery of encrypted data orcommunications. There has been a tendency in this debate to construe this term and others as narrowly focussed on a single technology, and I want to make clear that is not our intent. We expect the market to make those judgments. In order to facilitate the development and dissemination of these products, we have taken the following steps:

• On December 30, 1996, we published new regulations that transferred the licensing of commercial encryption products from the Department of State's Munitions List to the Department of Commerce's Dual-Use list. This change of jurisdiction emphasized theAdministration's decision that strong encryption is not something to be used primarily by governments or military forces, but will become an accepted part of normal commercial activity.

• The new regulations set forth several procedures which support the development of a key management infrastructure. The most important of these is the creation of a license exemption which would allow recoverable encryption products of any strength and key length to be exportedfreely after a single review by Commerce, Justice and the Department of Defense.

• We have also expanded the definition of products eligible for this key recovery license exemption to include not only "key escrow" systems, which use a trusted third party, but also other systems which allow for recovery of the keys or plaintext. This means that we have gonebeyond a simple prescription for key escrow and trusted third parties as the solution to all encryption needs.

• The new regulations also allow for self-escrow and escrowing of keys overseas in certain circumstances, which will make key recovery products more attractive in export markets. Since the establishment of a key management infrastructure may take some time, the regulations makeexplicit that we will consider requests for self escrow and escrowing overseas even before there are government agreements on access or an established network of recovery agents in place.

• To encourage the movement toward the development of these recoverable encryption products, we have also created a special, two year liberalization period during which companies may export 56 bit DES or equivalent products, provided they submit plans and show that they areworking to develop the key management infrastructure envisioned by the Administration. This temporary relief will help provide an incentive and a transition period for manufacturers to move to Key Management Infrastructure.

• To help create standards which will guide the Federal Government in its own key management efforts, the National Institute of Standards and Technology has formed an industry advisory committee to develop requirements and standards for key recovery. We have invitedrepresentatives of foreign governments to attend meetings of this advisory committee, which has met twice, to help ensure coordination and compatibility on a multilateral basis.

• In addition, we have continued discussions with our major trading partners on a common approach to encryption policy. To head this effort, the President appointed David Aaron, our Ambassador to the Organization for Economic Cooperation and Development as his Special Envoy on Encryption.

• We also asked for public comments on this new regulation. We received 43. They are posted on BXA's web site for all to review. A few are critical, but many are very helpful. Perhaps a better gauge of industry response has been the flow of applications since the change in policy. In the first two months we have received close to 400 license applications for exports valued at almost $500 million. Twelve companies have submitted commitment plans which lay out how they will build and market key recovery products, and we know that others are preparing them. These twelve companies include some of the largest software and hardware manufacturers in the country. We have approved six of these plans, and we expect to approve more very shortly.