**************************************
The Institute of Electrical and Electronics Engineers-
United States Activities
1828 L Street, NW, Suite 1202
Washington, DC 20036
T: (202) 785-0017; F: (202) 785-0835
The Association for Computing
U.S. Public Policy Office
666 Pennsylvania Ave., SE
Suite 302 B
Washington, DC 20003
T: (202) 544-4859
F: (202) 547-5482
July 3, 1997
The Honorable John McCain
Chairman
Senate Commerce, Science & Transportation Committee
241 Russell Senate Office Bldg.
Washington, DC 20510
Dear Mr. Chairman:
The U.S. Public Policy Office for the Association for Computing (USACM) and
The Institute of Electrical and Electronics Engineers-United States
Activities (IEEE-USA) note with considerable dismay the Senate Commerce,
Science and Transportation Committee's recent approval of S. 909, the
"Secure Public Networks Act."
We share many of the concerns of the Committee members regarding problems
of national security and law enforcement. However, we believe that the
"Secure Public Networks Act," as approved by the Committee, leads U.S.
encryption policy in the wrong direction. The proposed bill stands in
opposition to the scientific and professional opinions of many experts who
believe that national security and public safety will be weakened by the
mandated introduction of constrained or recoverable-key encryption. We
also believe that such action will hinder U.S. competitiveness in
international markets, establish a dangerous precedent for the future, and
endanger cherished civil liberties in the U.S. and elsewhere in the world.
Since no hearings were held on the bill, the Committee may not have had
full information on its implications.
We believe the bill will have a serious, negative and long-term impact on
society in general and on our organizations and their members. We are
keenly interested in supporting significant consideration of the important
issues involved, and we would very much like to provide technical and
scientific input on this issue. Many of our members are
internationally-recognized experts in the area of information security and
encryption, and several have significant experience with law enforcement
and national security issues. We would be happy to put you in contact with
some of these experts should you desire more information on the points we
outline in this letter.
In what follows, we briefly outline some of the reasons why so many
experts believe such a bill is harmful if it became law.
- 2 -
First, the bill is economically harmful. Voting to restrict strong
cryptography would damage America's dominance in information technologies.
Secure software and hardware is available overseas. Mathematical acumen
exists around the world; the U.S. can neither control nor contain it.
Software companies will continue to be forced to seek talent elsewhere.
The widely-used, strong cryptographic algorithm IDEA, for example, was
developed in Europe. U.S. software and hardware suppliers can incorporate
IDEA into their products, but only if those products are confined to use in
the U.S. Export controls have obviously not hindered the worldwide spread
of encryption products based on IDEA and produced outside the U.S. These
controls have merely prevented U.S. providers from participating in that
global market. Customers throughout the world have the sophistication to
understand the need for strong cryptographic products and they will
continue to seek to buy them wherever they are sold. The result will be an
increasing loss of jobs and revenues in an area where the U.S. once held
the dominant position. It is conceivable that our own industry and
civilian sector might eventually become dependent on foreign cryptography
products should U.S. firms continue to be prohibited from open competition
in this arena.
Second, this bill threatens cherished civil freedoms. Information
technologies make data surveillance possible and increasingly affordable.
The best technical protections available to the individual depend upon
cryptography. There is also an unfortunate history of a few law
enforcement agents and government officials using their positions and
access to violate the law and the rights of citizens. Strong encryption is
the only practical means available to law-abiding citizens to defend
themselves against these infrequent, but all-too-real abuses.
The wording in the proposed bill for organizations with Federal funding to
rely on a mandated form of encryption will be burdensome and may lead to
severe invasions of privacy. For instance, if a library or university were
forced to implement such encryption, how could the organization ensure that
its users were actually employing the system? The only sure method would
be to "snoop" on the messages to see if they were breakable under the
mandated scheme. Otherwise, users would be able to substitute their own
encryption instead of, or in addition to, the mandated form, thus rendering
this bill meaningless but still costly to implement. This raises serious
questions about privacy -- and more importantly -- First Amendment
considerations.
Third, the criminal element will not be hindered by any legislation similar
to the one proposed. The referenced bill provides no provisions that would
actually deter criminals from employing strong encryption obtained from
other sources. Drug cartels, terrorists, pornographers and others who
might use encryption in criminal enterprises are already violating laws
with penalties much more severe than any that might be imposed for using
unauthorized encryption technologies. Meanwhile, law-abiding citizens
would be forced to rely on technologies that might not protect their
private information against "crackers" and potential blackmailers. As in
the physical world, the best public safety results from crime prevented
through good practices, rather than crimes solved. Without strong
cryptography Americans cannot lock their electronic doors, but must instead
remain vulnerable. Thus, constraining cryptography might help law
enforcement solve a small number of crimes, but it will do nothing to
prevent opportunities for even more crimes, thereby reducing overall public
safety.
Fourth, constraints on strong cryptography will jeopardize national
security. Requiring or encouraging weakened technology leaves the United
States vulnerable to information warfare from other nation-states,
techno-anarchists and terrorists, and from organized criminal elements. It
is vital that telephone systems, medical health care systems, utility
systems, and other control mechanisms affecting every sector of the economy
be made more secure and not restrained from using improved security. Our
national security depends on the reliability of our
- 3 -
national infrastructures and critical systems, particularly those based on
computer and communications technology. To legislate the use of untested
mechanisms that present weakened protection, or that have a single point of
failure and attack, will unnecessarily endanger those critical institutions
and the people who depend on them. Those same forces arrayed against our
national interests will be freely able to obtain stronger cryptography
technology from the many other countries that do not place restrictions on
its development and sale.
Fifth, information technologies change quickly. We don't want to require
enabling legislation whenever advances in technology increase the
vulnerability of current key lengths. The recent cracking of 56-bit DES in
the RSA challenge shows that distributed computing power is now available
to break this key length, thus identifying a need for larger keys. A
breakthrough in mathematics, such as increasing the speed of factoring
numbers, would require a prompt response, such as increasing key lengths or
changing algorithms. The proposed legislation would severely discourage
such changes. Additionally, by preventing the initial acquisition of
strong encryption technology, the need for near-term upgrades to defeat
improved cracking techniques is almost assured, as are the extra financial
burdens.
As a last point, consider the implicit message sent by passage of this act
or any like it. The U.S. has long been a vocal proponent of freedom of
speech and other civil rights for citizens around the world. Why should
any other nation's leaders heed further such rhetoric if the U.S. adopts
the proposed bill? If some foreign nation with a history of oppression
were to pass the same legislation so as to eavesdrop on their citizens'
communications for purposes of identifying human rights activities, we
would register strong disapproval. With passage of legislation such as the
"Secure Public Networks Act" the U.S. loses the moral high ground in any
future such scenario.
In summary, our professional position is that passage of the "Secure
Public Networks Act" or similar legislation is ill-advised; we urge you to
defeat this bill. Instead, we encourage passage of legislation such as
Senator Conrad Burns' Pro-CODE bill, or Representative Bob Goodlatte's SAFE
bill as a better, more effective aid to national security, law enforcement
and civil rights.
IEEE is the world's largest technical professional association with 320,000
members worldwide. IEEE-USA promotes the career and technology policy
interests of the more than 220,000 electrical, electronics and computer
engineers who are U.S. members of the Institute. The Association for
Computing (ACM) is an international non-profit educational and scientific
society with 76,000 members worldwide, 60,000 of whom reside in the U.S.
USACM strives to promote dialog on technology policy issues among U.S.
policy makers, the general public, and the technology community.
If you need additional information, please contact Deborah Rudolph in the
IEEE-USA Washington office at (202) 785-0017 or Lauren Gelman in the USACM
Public Policy office at (202) 544-4859 or (202) 298-0842.
Sincerely,
Barbara Simons, Ph.D. Paul J. Kostek
Chair, U.S. Public Policy Vice Chair
Committee of ACM United States Activities Board
