- cypherpunks-legacy - lists.cpunks.org

text of info file on Cantwell bill
by ssteele＠eff.org 08 Feb '94

08 Feb '94

Following are Representative Maria Cantwell's remarks to the House of Representatives when she introduced H.R. 3627, Legislation to Amend the Export Administration Act of 1979. Her synopsis of the bill appears at the end. These remarks appeared in the Congressional Record on November 24, 1993, at Volume 139, Page 3110. Please write to Rep. Cantwell today at cantwell(a)eff.org letting her know you support her bill. In the Subject header of your message, type "I support HR 3627." In the body of your message, express your reasons for supporting the bill. EFF will deliver printouts of all letters to Rep. Cantwell. With a strong showing of support from the Net community, Rep. Cantwell can tell her colleagues on Capitol Hill that encryption is not only an industry concern, but also a grassroots issue. *Again: remember to put "I support HR 3627" in your Subject header.* The text of the Cantwell bill can be found with the any of the following URLs (Universal Resource Locaters): ftp://ftp.eff.org/pub/Policy/Legislation/cantwell.bill http://www.eff.org/ftp/EFF/Policy/Legislation/cantwell.bill gopher://gopher.eff.org/00/EFF/legislation/cantwell.bill ********************************************************************** Mr. Speaker, I am today introducing legislation to amend the Export Administration Act of 1979 to liberalize export controls on software with encryption capabilities. A vital American industry is directly threatened by unilateral U.S. Government export controls which prevent our companies from meeting worldwide user demand for software that includes encryption capabilities to protect computer data against unauthorized disclosure, theft, or alteration. The legislation I am introducing today is needed to ensure that American companies do not lose critical international markets to foreign competitors that operate without significant export restrictions. Without this legislation, American software companies, some of America's star economic performers, have estimated they stand to lose between $6 and $9 billion in revenue each year. American hardware companies are already losing hundreds of millions of dollars in lost computer system sales because increasingly sales are dependent on the ability of a U.S. firm to offer encryption as a feature of an integrated customer solution involving hardware, software, and services. The United States' export control system is broken. It was designed as a tool of the cold-war, to help fight against enemies that no longer exist. The myriad of Federal agencies responsible for controlling the flow of exports from our country must have a new charter, recognizing today's realities. Next year, the House Foreign Affairs Subcommittee of Economic Policy, Trade and the Environment, of which I am a member, will be marking up legislation to overhaul the Export Administration Act. It is my hope that the legislation I introduce today will be included in the final Export Administration Act rewrite. This legislation takes some important steps to resolve a serious problem facing some of our most dynamic industries. It would give the Secretary of Commerce exclusive authority over dual use information security programs and products, eliminates the requirement for export licenses for generally available software with encryption capabilities, and requires the Secretary to grant such validated licenses for exports of other software with encryption capabilities to any country to which we already approve exports for foreign financial institutions. The importance of this legislation cannot be overstated. America's computer software and hardware companies, including such well-known companies as Apple, DEC, Hewlett-Packard, IBM, Lotus, Microsoft, Novell, and WordPerfect, have been among the country's most internationally competitive firms earning more than one-half of their revenues from exports. The success of American software and hardware companies overseas is particularly dramatic and the importance of foreign markets is growing. Currently, American software companies hold a 75 percent worldwide market share and many derive over 50 percent of their revenues from foreign sales. American computer hardware manufacturers earn more than 60 percent of their revenues from exports. As my colleagues are well-aware, we are participants in a new information age that is quickly transforming local and national marketplaces and creating new international marketplaces where none previously existed. President Clinton and Vice President Gore have both spent considerable time explaining their vision of the National Information Infrastructure that is essential to our continued economic growth. Part of that infrastructure is already in place. International business transactions that just a few years ago took days or weeks or months to complete can now be accomplished in minutes. Driving this marketplace transformation is the personal computer. And, at the heart of every personal computer is computer software. Even the most computer illiterate of us recognize that during the past decade, computer prices have dropped dramatically while computer capabilities have increased exponentially. That combination has made it possible to exchange information and conduct business at a scale that was considered science fiction only a few years ago. Indeed, we all now rely on computer networks to conduct business and exchange information. Whether it be the electronic mail or "e-mail" system that we all now use in our congressional offices or the automated teller system relied on to conduct our personal financial affairs, we rely on computer networks of information. In the future, individuals will use information technologies to conduct virtually any of the routine transactions that they do today in person, over the telephone, and through paper files. From personal computers at home, in schools, and in public libraries, they will access books, magazine articles, videos, and multimedia resources on any topic they want. People will use computer networks to locate and access information about virtually any subject imaginable, such as background on the candidates in local political races, information on job opportunities in distant cities, the weather in the city or country they will be visiting on their vacation, and the highlights of specific sports events. Consumers will use their computers and smart televisions to shop and pay for everything from clothing and household goods to airline tickets, insurance, and all types of on-line services. Electronic records of the items they purchase and their credit histories will be easy to compile and maintain. Individuals will access home health programs from their personal computers for instant advice on medical questions, including mental health problems, information about the symptoms of AIDS, and a variety of personal concerns that they would not want other family members, or their neighbors and employers to know about. They will renew their prescriptions and obtain copies of their lab results electronically. The U.S. economy is becoming increasingly reliant on this information network. While we may not often think about these networks, they now affect every facet of our professional, business, and personal lives. They are present when we make an airline reservation; when we use a credit card to make a purchase; or when we visit a doctor who relies on a computer network to store our medical information or to assist in making a diagnosis. These networks contain information concerning every facet of our lives. For businesses, the reliance on information security is even greater. While businesses rely on the same commercial use networks that individual consumers use, in addition, businesses are now transmitting information across national and international borders with the same ease that the information was once transmitted between floors of the same office building. While all of this information exchange brings with it increased efficiencies and lower operating costs, it has also brought with it the need to protect the information from improper use and tampering. Information security is quickly becoming a top priority for businesses that rely on computer networks to conduct business. According to a recent survey of Fortune 500 companies conducted for the Business Software Alliance, 90 percent of the participants said that information security was important to their operations. Indeed, almost half of the Fortune 500 companies surveyed recently stated that data encryption was important to protect their information. One third of those companies said they look for encryption capabilities when buying software. The challenge for information security can be met by America's computer companies. American companies are deeply involved in efforts to ensure that the information transmitted on computer networks is secure. Numerous companies have developed and are developing software products with encryption capabilities that can ensure that transmitted information is received only by the intended user and that it is received in an unaltered form. Those encryption capabilities are based on mathematical formulas or logarithms of such a size that makes it almost impossible to corrupt data sources or intercept information being transmitted. I wish I could stand here today and tell my colleagues that U.S. export control laws were working and encryption technology was only available to American software companies. However, this is not the case. Sophisticated encryption technology has been available as a published public standard for over a decade and many private sources, both domestic and foreign, have developed encryption technology that they are marketing to customers today. It is an industry where commercial competition is fierce and success will go to the swift. Software is being developed and manufactured with encryption capabilities for the simple reason that software customers are demanding it. Computer users recognize the vulnerability of our information systems to corruption and improper use and are insisting on protection. That protection will be purchased or obtained from American companies or from foreign software companies. The choice is not whether the protection will be obtained, but from which company. Incredible as it may seem to most of my colleagues, the Executive Branch has seen fit to regulate exports of American computer software with encryption capabilities -- that is, the same software that is available across the counter at your local Egghead or Computerland software store -- munitions and thereby substantially prohibit its export to foreign customers. This policy, which has all the practical effect of shutting the barn door after the horses have left in preventing access to software with encryption capabilities, does have the actual detrimental effect of seriously endangering sales of both generally available American software and American computer systems. This is because increasingly sales are dependent on the ability of a U.S. firm to offer encryption as a feature of an integrated customer solution involving hardware, software and services. Indeed, software can be exported abroad by the simplest measures and our intelligence gathering agencies have no hope of ever preventing it. Unlike most munitions that are on the prohibited export list, generally available software with encryption capabilities can be purchased without any record by anyone from thousands of commercial retail outlets, or ordered from hundreds of commercial mail order houses, or obtained for free from computer bulletin boards or networks. Once obtained, it can be exported on a single indistinguishable floppy disk in the coat pocket of any traveler or in any business envelope mailed abroad. Moreover, both generally available and customized software can be exported without anyone ever actually leaving the United States. All that is necessary are two computers with modems, one located in the United States and one located abroad. A simple international phone call and a few minutes is all that it takes to export any software program. Once a software program with encryption capabilities is in a foreign country, any computer can act as a duplicating machine, producing as many perfect copies of the software as needed. The end result is that the software is widely available to foreign users. All this was demonstrated at a hearing held on October 12 by Chairman Gejdenson's Economic Policy Trade and Environment Subcommittee of the Foreign Affairs Committee. Furthermore, while current Executive Branch policy regulates the export of American manufactured software with encryption capabilities, it is obviously powerless to prevent the development and manufacture of such software by foreign competitors. Not surprisingly, that is exactly what is happening. We heard testimony at the subcommittee's hearing that over 200 foreign hardware, software and combination products for text, file, and data encryption are available from 20 foreign countries. As a result, foreign customers, that have, in the past, spent their software dollars on American-made software, are now being forced, by American policy, to buy foreign software -- and in some cases, entire foreign computer systems. The real impact of these policies is that customers and revenue are being lost with little hope of regaining them, once lost. All precipitated by a well-intentioned, but completely misguided and inappropriate policy. There were efforts, in the last Congress to correct this policy. In response, the Bush Administration did, in fact, marginally improve its export licensing process with regard to mass market software with limited encryption capabilities. However, those changes are simply insufficient to eliminate the damage being done to American software companies. My legislation is strongly supported by the Business Software Alliance. The Business Software Alliance represents the leading American software businesses, including Aldus, Apple Computer, Autodesk, Borland International, Computer Associates, GO Corp., Lotus Development, Microsoft, Novell, and WordPerfect. In addition, Adobe Systems, Central Point, Santa Cruz Operation, and Symantec are members of BSA's European operation. Together, BSA members represent 70 percent of PC software sales. The legislation is also supported by the Industry Coalition on Technology Transfer, an umbrella group representing 10 industry groups including the Aerospace Industries Association, American Electronic Association, Electronics Industry Association, and Computer and Business Equipment Manufacturing Association. All these companies are at the forefront of the software revolution. Their software, developed for commercial markets, is available throughout the world and is at the core of the information revolution. They represent the finest of America's future in the international marketplace, and the industry has repeatedly been recognized as crucial to America's technological leadership in the 21st century. My legislation is straightforward. It would allow American companies to sell the commercial software they develop in the United States to their overseas customers including our European allies -- something that is very difficult if not impossible under present policies. I urge my colleagues to support this legislation and ask unanimous consent that the text of the bill and a section-by-section explanation be printed at this point. ************************************************************************ Section-By-Section Analysis of Report Control Liberalization for Information Security Programs and Products Section 1 Section 1 amends the Export Administration Act by adding a new subsection that specifically addresses exports of computer hardware, software and technology for information security including encryption. The new subsection has three basic provisions. First, it gives the Secretary of Commerce exclusive authority over the export of such programs and products except those which are specifically designed for military use, including command, control and intelligence applications or for deciphering encrypted information. Second, the government is generally prohibited from requiring a validated export license for the export of generally available software (e.g., mass market commercial or public domain software) or computer hardware simply because it incorporates such software. Importantly, however, the Secretary will be able to continue controls on countries of terrorists concern (like Libya, Syria, and Iran) or other embargoed countries (like Cuba and North Korea) pursuant to the Trading With The Enemy Act or the International Emergency Economic Powers Act (except for instances where IEEPA is employed to extend EAA-based controls when the EAA is not in force). Third, the Secretary is required to grant validated licenses for exports of software to commercial users in any country to which exports of such software has been approved for use by foreign financial institutions. Importantly, the Secretary is not required to grant such export approvals if there is substantial evidence that the software will be diverted or modified for military or terrorists' end-use or re-exported without requisite U.S. authorization. Section 2 Section 2 provides definitions necessary for the proper implementation of the substantive provisions. For example, generally available software is offered for sale or licensed to the public without restriction and available through standard commercial channels of distribution, is sold as is without further customization, and is designed so as to be installed by the purchaser without additional assistance from the publisher. Computer hardware and computing devices are also defined.

1 0

EFF Wants You (to add your voice to the crypto fight)
by Mike Godwin 07 Feb '94

07 Feb '94

* DISTRIBUTE WIDELY * Monday, February 7th, 1994 From: Jerry Berman, Executive Director of EFF jberman(a)eff.org Dear Friends on the Electronic Frontier, I'm writing a personal letter to you because the time has now come for action. On Friday, February 4, 1994, the Administration announced that it plans to proceed on every front to make the Clipper Chip encryption scheme a national standard, and to discourage the development and sale of alternative powerful encryption technologies. If the government succeeds in this effort, the resulting blow to individual freedom and privacy could be immeasurable. As you know, over the last three years, we at EFF have worked to ensure freedom and privacy on the Net. Now I'm writing to let you know about something *you* can do to support freedom and privacy. *Please take a moment to send e-mail to U.S. Rep. Maria Cantwell (cantwell(a)eff.org) to show your support of H.R. 3627, her bill to liberalize export controls on encryption software.* I believe this bill is critical to empowering ordinary citizens to use strong encryption, as well as to ensuring that the U.S. software industry remains competitive in world markets. Here are some facts about the bill: Rep. Cantwell introduced H.R. 3627 in the House of Representatives on November 22, 1993. H.R. 3627 would amend the Export Control Act to move authority over the export of nonmilitary software with encryption capabilities from the Secretary of State (where the intelligence community traditionally has stalled such exports) to the Secretary of Commerce. The bill would also invalidate the current license requirements for nonmilitary software containing encryption capablities, unless there is substantial evidence that the software will be diverted, modified or re-exported to a military or terroristic end-use. If this bill is passed, it will greatly increase the availability of secure software for ordinary citizens. Currently, software developers do not include strong encryption capabilities in their products, because the State Department refuses to license for export any encryption technology that the NSA can't decipher. Developing two products, one with less secure exportable encryption, would lead to costly duplication of effort, so even software developed for sale in this country doesn't offer maximum security. There is also a legitimate concern that software companies will simply set up branches outside of this country to avoid the export restrictions, costing American jobs. The lack of widespread commercial encryption products means that it will be very easy for the federal government to set its own standard--the Clipper Chip standard. As you may know, the government's Clipper Chip initiative is designed to set an encryption standard where the government holds the keys to our private conversations. Together with the Digital Telephony bill, which is aimed at making our telephone and computer networks "wiretap-friendly," the Clipper Chip marks a dramatic new effort on the part of the government to prevent us from being able to engage in truly private conversations. We've been fighting Clipper Chip and Digital Telephony in the policy arena and will continue to do so. But there's another way to fight those initiatives, and that's to make sure that powerful alternative encryption technologies are in the hands of any citizen who wants to use them. The government hopes that, by pushing the Clipper Chip in every way short of explicitly banning alternative technologies, it can limit your choices for secure communications. Here's what you can do: I urge you to write to Rep. Cantwell today at cantwell(a)eff.org. In the Subject header of your message, type "I support HR 3627." In the body of your message, express your reasons for supporting the bill. EFF will deliver printouts of all letters to Rep. Cantwell. With a strong showing of support from the Net community, Rep. Cantwell can tell her colleagues on Capitol Hill that encryption is not only an industry concern, but also a grassroots issue. *Again: remember to put "I support HR 3627" in your Subject header.* This is the first step in a larger campaign to counter the efforts of those who would restrict our ability to speak freely and with privacy. Please stay tuned--we'll continue to inform you of things you can do to promote the removal of restrictions on encryption. In the meantime, you can make your voice heard--it's as easy as e-mail. Write to cantwell(a)eff.org today. Sincerely, Jerry Berman Executive Director, EFF jberman(a)eff.org P.S. If you want additional information about the Cantwell bill, send e-mail to cantwell-info(a)eff.org. To join EFF, write membership(a)eff.org. The text of the Cantwell bill can be found with the any of the following URLs (Universal Resource Locaters): ftp://ftp.eff.org/pub/Policy/Legislation/cantwell.bill http://www.eff.org/ftp/EFF/Policy/Legislation/cantwell.bill gopher://gopher.eff.org/00/EFF/legislation/cantwell.bill

1 0

Newspaper coverage of Administration encryption announcements
by Mike Godwin 07 Feb '94

07 Feb '94

The Washington Post, the New York Times, and the Wall Street Journal have all published stories over the last three days concerning the Administration's announcement on Friday, Feb. 5, 1994, that it will continue to deploy the controversial "Clipper Chip" encryption technology and will not significantly change its export controls. >From the Post on Saturday: "That means the administration will continue long-standing restrictions on exports of powerful encryption devices that the NSA cannot crack, and continue to encourage use of NSA-developed encryption gear, called the "Clipper chip," by all U.S. firms. The Clipper Chip makes it relatively easy for the government to eavesdrop on encrypted communications.... "Further, government officials said, the administration is expected in a few weeks to endorse an FBI proposal that U.S. telecommunications firms be required to guarantee law enforcement agencies' ability to tape phone and computer lines regardless of where the technology goes. "At the core of these high-tech disputes lies a fundamental conflict between Americans' cherished privacy rights and the government's investigative needs." >From the Times on Saturday: "But the Administration's action immediately drew a chorus of criticism from both business and privacy-rights groups. Computer and software companies, including Apple Computer, I.B.M. and Microsoft, have adamantly opposed the Clipper Chip because they believe customers will not trust an encryption program that was built by the government and whose inner workings remain a secret. "Perhaps more importantly, they fear that it will harm their ability to export products; they predict that foreign customers will resist buying computers and telecommunications equipment built with decoding technology devised by the National Security Agency. "Privacy-rights groups argue that the technology could lead to unauthorized eavesdropping, because the keys for unscrambling the code will remain in official hands. "'This is bad for privacy, bad for security and bad for exports,' said Jerry Berman, executive director of the Electronic Frontier Foundation, a Washington nonprofit group that lobbies on privacy issues related to electronic networks. 'The Administration is preparing to implement systems that the public will not trust, that foreign countries will not buy, and that terrorists will overcome.'" >From the Wall Street Journal on Monday: "The issue has become a controversial one between law enforcement officials and the computer industry and civil libertarians. In unfolding details of the administration's decision, Mike Nelson, an official at the Office of Science and Technology Policy, said the issue was so difficult it represented 'the Bosnia of telecommunications policy.' "Jerry Berman, executive director of the Electronic Frontier Foundation, a Washington-based computer users' civil-rights group, said the administration's handling of the Clipper Chip policy could make it 'as successful' as the Bosnia policy, which has come under widespread criticism." William Safire has also written about this in today's NYTimes. >From owner-cypherpunks Mon Feb 7 15:40:40 1994

1 0

[whitfield.diffie@Eng.Sun.COM: Preliminary remarks]
by gnu 07 Feb '94

07 Feb '94

------- Forwarded Message To: gnu(a)toad.com From: whitfield.diffie(a)Eng.Sun.COM

1 0

wh_press_secy.statement
by Dan Brown 04 Feb '94

04 Feb '94

THE WHITE HOUSE CONTACT: 202 156-7035 OFFlCE OF THE PRESS SECRETARY EMBARGOED UNTIL 3 PM (EST) FRIDAY, February 4, 1994 STATEMENT OF THE PRESS SECRETARY Last April, the Administration announced a comprehensive interagency review of encryption technology, to be overseen by the National Security Council. Today, the Administration is taking a number of steps to implement the recommendations resulting from that review. Advanced encryption technology offers individuals and businesses an inexpensive and easy way to encode data and telephone conversations. Unfortunately, the same encryption technology that can help Americans protect business secrets and personal privacy can also be used by terrorists, drug dealers, and other criminals. In the past, Federal policies on encryption have reflected primarily the needs of law enforcement and national security. The Clinton Administration has sought to balance these needs with the needs of businesses and individuals for security and privacy. That is why, today the National Institute of Standards ant Technology (NIST) is committing to ensure a royalty-free, public-domain Digital Signature Standard. Over many years, NIST has been developing digital signature technology that would provide a way to verify the author and sender of an electronic message. Such technology will be critical for a wide range of business applications for the National Information Infrastructure. A digital signature standard will enable individuals to transact business electronically rather than having to exchange signed paper contracts. The Administration has determined that such technology should not be subject to private royalty payments, and it will be taking steps to ensure that royalties are not required for use of a digital signature. Had digital signatures been in widespread use, the recent security problems with the Intemet would have been avoided. Last April, the Administration released the Key Escrow chip (also known as the "Clipper Chip") that would provide Americans with secure telecommunications without compromising the ability of law enforcement agencies to carry out legally authorized wiretaps. Today, the Department of Commerce and the Department of Justice are taking steps to enable the use of such technology both in the U.S. and overseas. At the same time, the Administration is announcing its intent to work with industry to develop other key escrow products that might better meet the needs of individuals and industry, particularly the American computer and telecommunications industry. Specific steps being announced today include: - Approval by the Commerce Secretary of the Escrowed Encryption Standard (EES) as a voluntary Federal Informahon Processing Standard, which will enable govemment gencies to purchase the Key Escrow chip for use with telephones nd modems. The department's National Institute of Standards and Technology (NIST) will publish the standard. - Publication by the Department of Justice of procedurs for the release of escrowed keys and the announcement of NIST and the Automated Services Division of the Treasury Department as the escrow agents that will store the keys needed for decryption of communications using the Key Escrow chip. Nothing in these procedures will diminish tne existing legal and procedural requirements that protect Americans from unauthorized wiretaps. - New procedures to allow export of products containing the Key Escrow chip to most countries. In addition, the Department of State will streamline export licensing procedures for encryption products that can be exported under current export regulations in order to help American companies sell their products overseas. In the past, it could take weeks for a company to obtain an export license for encryption products, and each shipment might require a separate license. The new procedures announced today will substantially reduce administrative delays and paperwork for encryption exports. To implement the Administration's encryption policy, an interagency Working Group on Encryption and Telecommunications has been established. It will be chaired by the White House Office of Science and Technology Policy and the National Security Council and will include representatives of the Departments of Commerce, Justice, State, and Treasury as well as the FBI, the National Security Agency, the Office of Management and Budget, and the National Economic Council. This group will work with industry and public-interest groups to develop new encryption technologies and to review and refine Administration policies regarding encryption, as needed. The Administration is expanding its efforts to work with industry to improve on the Key Escrow chip, to develop key-escrow software, and to examine alternatives to the Key Escrow chip. NIST will lead these efforts and will request additional staff and resources for this purpose. We understand that many in industry would like to see all encryption products exportable. However, if encryption technology is made freely available worldwide, it would no doubt be usod extensively by terrorists, drug dealers, and other criminals to harm Americans both in the U.S. and abroad. For this reason, the Administration will continue to restrict export of the most sophisticated encryption devices, both to preserve our own foreign intelligence gathering capability and because of the concerns of our allies who fear that strong encryption technology would inhibit their law enforcement capabilities. At the same time, the Administration understands the benefits that encryption and related technologies can provide to users of computers and telecommunications networks. Indeed, many of the applications of the evolving National Information Infrastructure will require some form of encryption. That is why the Administration plans to work more closely with the private sector to develop new forms of encryption that can protect privacy and corporate secrets without undermining the ability of law-enforcement agencies to conduct legally authorized wiretaps. That is also why the Administration is committed to make available free of charge a Digital Signature Standard. The Administration believes that the steps being announced today will help provide Americans with the telecommunications security they need without compromising the capability of law enforcement agencies and national intelligence agencies. Today, any American can purchase and use any type of encryption product. The Administration does not intend to change that policy. Nor do we have any intention of restrictiog domestic encryption or mandating the use of a particular technology.

1 0

reno_key_escrow.statement
by Dan Brown 04 Feb '94

04 Feb '94

Department of Justice EMBARGOED FOR 3 P.M. RELEASE AG FRIDAY, FEBRUARY 4, 1994 (202) 616-2771 ATTORNEY GENERAL MAKES KEY ESCROW ENCRYPTION ANNOUNCEMENTS Attorney General Janet Reno today announced selection of the two U.S. Government entities that will hold the escrowed key components for encryption using the key escrow encryption method. At the same time, the Attorney General made public procedures under which encryption key components will be released to government agencies for decrypting communications subject to lawful wiretaps. Key Escrow Encryption (formerly referred to as Clipper Chip ) strikes an excellent balance between protection of communications privacy and protection of society. It permits the use in commercial telecommunications products of chips that provide extremely strong encryption, but can be decrypted, when necessary, by government agencies conducting legally authorized wiretaps. Decryption is accomplished by use of keys--80-bit binary numbers-- that are unique to each individual encryption chip. Each unique key is in turn split into two components, which must be recombined in order to decrypt communications. Knowing one component does not make decryption any more feasible than not knowing either one. The two escrow agents are the National Institute of Standards and Technology (NIST), a part of the Department of Commerce, and the Automated Systems Division of the Department of the Treasury. The two escrow agents were chosen because of their abilities to safeguard sensitive information, while at the same time being able to respond in a timely fashion when wiretaps encounter encrypted communications. In addition, NIST is responsible for establishing standards for protection of sensitive, unclassified information in Federal computer systems. The escrow agents will act under strict procedures, which are being made public today, that will ensure the security of the key components and govern their release for use in conjunction with lawful wiretaps. They will be responsible for holding the key components: for each chip, one agent will hold one of the key components, and the second agent will hold the other. Neither will release a key component, except to a government agency with a requirement to obtain it in connection with a lawfully authorized wiretap. The system does not change the rules under which government agencies are authorized to conduct wiretaps. When an authorized government agency encounters suspected key- escrow encryption, a written request will have to be submitted to the two escrow agents. The request will, among other things, have to identify the responsible agency and the individuals involved; certify that the agency is involved in a lawfully authorized wiretap; specify the wiretap's source of authorization and its duration; and specify the serial number of the key-escrow encryption chip being used. In every case, an attorney involved in the investigation will have to provide the escrow agents assurance that a validly authorized wiretap is being conducted. Upon receipt of a proper request, the escrow agents will transmit their respective key components to the appropriate agency. The components will be combined within a decrypt device, which only then will be able to decrypt communications protected by key- escrow encryption. When the wiretap authorization ends, the device s ability to decrypt communications using that particular chip will also be ended. The Department of Justice will, at the various stages of the process, take steps to monitor compliance with the procedures.

1 0

harris.statement
by Dan Brown 04 Feb '94

04 Feb '94

United States Department of State Washington, D.C. 20520 EMBARGOED FOR RELEASE, 3:00 PM EST, FEB. 4, 1994 Statement of Dr. Martha Harris Deputy Assistant Secretary of State for Political-Military Affairs February 4, 1994 Encryption -- Export Control Reform The Secretary of State is announcing today measures arising from the Administration's decision to reform export control procedures applicable to products incorporating encryption technology. These reforms are part of the Administration's effort to eliminate unnecessary controls and ensure efficient implementation. The reforms will simplify encryption product export licensing and speed the review of encryption product exports, thus helping U.S. manufacturers to compete more effectively in the global market. While there will be no changes in the types of equipment controlled by the Munitions List, we are announcing measures to expedite licensing. Last year the President announced an initiative to encourage U.S. manufacturers and users of encryption to take advantage of a government technology (the key-escrow chip) that provides excellent security while ensuring that the Government has a means to decode the encryption when lawfully authorized, such as when executing a court-authorized warrant in connection with a criminal investigation. At the time he announced this initiative, the President directed a comprehensive review of U.S. policy regarding domestic use and export of encryption technology. The reforms we are announcing today result from that review. The President has determined that vital U.S. national security and law enforcement interests compel maintaining appropriate control of encryption. Still, there is much that can be done to reform existing controls to ensure that they are efficiently implemented and to maintain U.S. leadership in the world market for encryption technology. Accordingly, the President has asked the Secretary of State to take immediate action to implement a number of procedural reforms. The reforms are: * License Reform: Under new licensing arrangements, encryption manufacturers will be able to ship their products from the United States directly to customers within approved regions without obtaining individual licenses for each end user. This will improve the ability of our manufacturers to provide expedited delivery of products, and to reduce shipping and tracking costs. It should also reduce the number of individual license requests, especially for small businesses that cannot afford international distributors. * Rapid review of export license applications: A significant number of encryption export license applications can be reviewed more quickly. For such exports, we have set a license turnaround goal of two working days. * Personal use exemption: We will no longer require that U.S. citizens obtain an export license prior to taking encryption products out of the U.S. temporarily for their own personal use. In the past, this requirement caused delays and inconvenience for business travellers. * Allow exports of key-escrow encryption: After initial review, key-escrow encryption products may now be exported to most end users. Additionally, key-escrow products will qualify for special licensing arrangements. These reforms should have the effect of minimizing the impact of export controls on U.S. industry. The Department of State will take all appropriate actions to ensure that these reforms are implemented as quickly as possible. The Secretary of State asks that encryption product manufacturers evaluate the impact of these reforms over the next year and provide feedback both on how the reforms have worked out and on recommendations for additional procedural reforms. The contact point for further information on these reforms is Rose Biancaniello, Office of Defense Trade Controls, Bureau of Political-Military Affairs, Department of State, (703) 875-6644.

1 0

interagency_workgroup.notice
by Dan Brown 04 Feb '94

04 Feb '94

>From the White House Feb. 4, 1994 ****************************************************************** WORKING GROUP ON DATA SECURITY The Administration has created a new interagency working on data security to deal with issues like encryption and digital telephony. This group will be chaired by the White House Office of Science and Technology Policy and the National Security Council and will include representatives of the agencies that have participated in Presidential Review Directive 27, which called for a comprehensive review of the impact of encryption technology and advanced digital telecomrnunications systems. Agencies participating in the new working group include the Office of Management and Budget, FBI, Department of Justice, Department of Comrnerce, National Security Agency, the Department of Treasury, and the Department of State. The group will work closely with the Inforrnation Comrnittee of the Information Infrastructure Task Force, which is responsible for coordinating Administration telecommunications and inforrnation policy. It will seek input from the private sector both informally and through groups like the National Security Telecommunications Advisory Committee and the U.S. Advisory Committee on the National Information Infrastructure. The working group will develop and irnplement Administration policies on encryption. Advanced encryption technology can provide better privacy protection for individuals, but can also thwart efforts by law enforcement agencies to use wiretaps to catch and prosecute criminals. The working group will attempt to reconcile the need of privacy and the needs of law enforcement. Last April, the Administration announced development of the Clipper chip, a new computer chip designed to provide better telecomrnunications security without compromising the ability of law enforcement to do wiretaps. The working group will work with industry to develop and apply technologies like the Clipper Chip, to evaluate possible alternatives to the Clipper Chip, and to review and refine Administration policies regarding encryption as developments warrant. In addition, the working group will coordinate Administration policies regarding digital telephony. As more and more telephone companies install high-speed, digital communications links, it becomes more and more difficult for law enforcement agencies to conduct wiretaps. The working group will work with industry to ensure that new digital telecommunications systems are designed in a way that ensures that do not prevent courtauthorized wiretaps. For more information on the interagency working group, contact Matt Heymann at NIST Public Affairs (301/975-2758), Mike Nelson at OSTP (202/395-6175), or Ray Mislock at NSC (202/395-4614).

1 0

gore_crypto.statement
by Dan Brown 04 Feb '94

04 Feb '94

THE WHITE HOUSE OFFICE OF THE VICE PRESIDENT EMBARGOED UNTIL, 3: 00 PM EST CONTACT: 202/456-7035 February 4, 1994 STATEMENT OF THE VICE PRESIDENT Today's announcements on encryption represent important steps in the implementation of the Administration's policy on this critical issue. Our policy is designed to provide better encryption to individuals and businesses while ensuring that the needs of law enforcement and national security are met. Encryption is a law and order issue since it can be used by criminals to thwart wiretaps and avoid detection and prosecution. It also has huge strategic value. Encryption technology and cryptoanalysis turned the tide in the Pacific and elsewhere during World War II. [end of statement]

1 0

doj_escrow_intercept.procedures
by Dan Brown 04 Feb '94

04 Feb '94

U.S. Department of Justice Washington, D.C. 20530 February 4, 1994 AUTHORIZATION PROCEDURES FOR RELEASE OF ENCRYPTION KEY COMPONENTS IN CONJUNCTION WITH INTERCEPTS PURSUANT TO TITLE III The following are the procedures for the release of escrowed key components in conjunction with lawfully authorized interception of communications encrypted with a key-escrow encryption method. These procedures cover all electronic surveillance conducted pursuant to Title III of the Omnibus crime Control and Safe Streets Act of 1968, as amended (Title III), Title 18, United States Code, Section 2510 et seq. 1) In each case there shall be a legal authorization for the interception of wire and/or electronic communications. 2) All electronic surveillance court orders under Title III shall contain provisions authorizing after-the-fact minimization, pursuant to 18 U.S.C. 2518(5), permitting the interception and retention of coded communications, including encrypted communications. 3) In the event that federal law enforcement agents discover during the course of any lawfully authorized interception that communications encrypted with a key escrow encryption method are being utilized, they may obtain a certification from the investigative agency conducting the investigation, or the Attorney General of the United States or designee thereof. Such certification shall (a) identify the law enforcement agency or other authority conducting the interception and the person providing the certification; (b) certify that necessary legal authorization has been obtained to conduct electronic surveillance regarding these communications; (c) specify the termination date of the period for which interception has been authorized; (d) identify by docket number or other suitable method of specification the source of the authorization; (e) certify that communications covered by that authorization are being encrypted with a key-escrow encryption method; (f) specify the identifier (ID) number of the key escrow encryption chip providing such encryption; and (g) specify the serial (ID) number of the key-escrow decryption device that will be used by the law enforcement agency or other authority for decryption of the intercepted communications. 4) The agency conducting the interception shall submit this certification to each of the designated key component escrow agents. If the certification has been provided by an investigative agency, as soon thereafter as practicable, an attorney associated with the United States Attorney's Office supervising the investigation shall provide each of the key component escrow agents with written confirmation of the certification. 5) Upon receiving the certification from the requesting investigative agency, each key component escrow agent shall release the necessary key component to the requesting agency. The key components shall be provided in a manner that assures they cannot be used other than in conjunction with the lawfully authorized electronic surveillance for which they were requested. 6) Each of the key component escrow agents shall retain a copy of the certification of the requesting agency, as well as the subsequent confirmation of the United States Attorney's Office. In addition, the requesting agency shall retain a copy of the certification and provide copies to the following for retention in accordance with normal record keeping requirements: (a) the United States Attorney's Office supervising the investigation, and (b) the Department of Justice, Office of Enforcement Operations. 7) Upon, or prior to, completion of the electronic surveillance phase of the investigation, the ability of the requesting agency to decrypt intercepted communications shall terminate, and the requesting agency may not retain the key components. 8) The Department of Justice shall, in each such case, (a) ascertain the existence of authorizations for electronic surveillance in cases for which escrowed key components have been released; (b) ascertain that key components for a particular key escrow encryption chip are being used only by an investigative agency authorized to conduct electronic surveillance of communications encrypted with that chip; and (c) ascertain that, no later than the completion of the electronic surveillance phase of the investigation, the ability of the requesting agency to decrypt intercepted communications is terminated. 9) In reporting to the Administrative Office of the United States Courts pursuant to 18 U.S.C. Section 2519(2), the Assistant Attorney General for the Criminal Division shall, with respect to any order for authorized electronic surveillance for which escrowed encryption components were released and used for decryption, specifically note that fact. These procedures do not create, and are not intended to create, any substantive rights for individuals intercepted through electronic surveillance, and noncompliance with these procedures shall not provide the basis for any motion to suppress or other objection to the introduction of electronic surveillance evidence lawfully acquired. ************************************************************* U.S. Department of Justice Washington, D.C. 20530 February 4, 1994 AUTHORIZATION PROCEDURES FOR RELEASE OF ENCRYPTION KEY COMPONENTS IN CONJUNCTION WITH INTERCEPTS PURSUANT TO STATE STATUTES Key component escrow agents may only release escrowed key components to law enforcement or prosecutorial authorities for use in conjunction with lawfully authorized interception of communications encrypted with a key-escrow encryption method. These procedures apply to the release of key components to State and local law enforcement or prosecutorial authorities for use in conjunction with interceptions conducted pursuant to relevant State statutes authorizing electronic surveillance, and Title III of the Omnibus crime Control and Safe Streets Act of 1968, as amended, Title 18, United States Code, Section 2510 et seq. 1) The state or local law enforcement or prosecutorial authority must be conducting an interception of wire and/or electronic communications pursuant to lawful authorization. 2) Requests for release of escrowed key components must be submitted to the key component escrow agents by the principal prosecuting attorney of the State, or of a political subdivision thereof, responsible for the lawfully authorized electronic surveillance. 3) The principal prosecuting attorney of such State or political subdivision of such State shall submit with the request for escrowed key components a certification that shall (a) identify the law enforcement agency or other authority conducting the interception and the prosecuting attorney responsible therefor; (b) certify that necessary legal authorization for interception has been obtained to conduct electronic surveillance regarding these communications; (c) specify the termination date of the period for which interception has been authorize; (d) identify by docket number or other suitable method of specification the source of the authorization; (e) certify that communications covered by that authorization are being encrypted with a key-escrow encryption method; (f) specify the identifier (ID) number of the key escrow chip providing such encryption; and (g) specify the serial (ID) number of the key-escrow decryption device that will be used by the law enforcement agency or other authority for decryption of the intercepted communications. 4) Such certification must be submitted by the principal prosecuting attorney of that State or political subdivision to each of the designated key component escrow agents. 5) Upon receiving the certification from the principal prosecuting attorney of the State or political subdivision, each key component escrow agent shall release the necessary key component to the intercepting State or local law enforcement agency or other authority. The key components shall be provided in a manner that assures they cannot be used other than in conjunction with the lawfully authorized electronic surveillance for which they were requested. 6) Each of the key component escrow agents shall retain a copy of the certification of the principal prosecuting attorney of the State or political subdivision. In addition, such prosecuting attorney shall provide a copy of the certification to the Department of Justice, for retention in accordance with normal record keeping requirements. 7) Upon, or prior to, completion of the electronic surveillance phase of the investigation, the ability of the intercepting law enforcement agency or other authority to decrypt intercepted communications shall terminate, and the intercepting law enforcement agency or other authority may not retain the key components. 8) The Department of Justice may, in each such case, make inquiry to (a) ascertain the existence of authorizations for electronic surveillance in cases for which escrowed key components have been released; (b) ascertain that key components for a particular key escrow encryption chip are being used only by an investigative agency authorized to conduct electronic surveillance of communications encrypted with that chip; and (c) ascertain that, no later than the completion of the electronic surveillance phase of the investigation, the ability of the requesting agency to decrypt intercepted communications is terminated. 9) In reporting to the Administrative Office of the United States Courts pursuant to 18 U.S.C. Section 2519(2), the principal prosecuting attorney of a State or of a political subdivision of a State may, with respect to any order for authorized electronic surveillance for which escrowed encryption components were released and used for decryption, desire to note that fact. These procedures do not create, and are not intended to create, any substantive rights for individuals intercepted through electronic surveillance, and noncompliance with these procedures shall not provide the basis for any motion to suppress or other objection to the introduction of electronic surveillance evidence lawfully acquired. ************************************************************* U.S. Department of Justice Washington D.C. 20530 February 4, 1994 AUTHORIZATION PROCEDURES FOR RELEASE OF ENCRYPTION KEY COMPONENTS IN CONJUNCTION WITH INTERCEPTS PURSUANT TO FISA The following are the procedures for the release of escrowed key components in conjunction with lawfully authorized interception of communications encrypted with a key-escrow encryption method. These procedures cover all electronic surveillance conducted pursuant to the Foreign Intelligence Surveillance Act (FISA), Pub. L. 95-511, which appears at Title 50, U.S. Code, Section 1801 et seq. 1 ) In each case there shall be a legal authorization for the interception of wire and/or electronic communications. 2) In the event that federal authorities discover during the course of any lawfully authorized interception that communications encrypted with a key-escrow encryption method are being utilized, they may obtain a certification from an agency authorized to participate in the conduct of the interception, or from the Attorney General of the United States or designee thereof. Such certification shall (a) identify the agency participating in the conduct of the interception and the person providing the certification; to conduct electronic surveillance regarding these communications; (c) specify the termination date of the period for which interception has been authorized; (d) identify by docket number or other suitable method of specification the source of the authorization; (e) certify that communications covered by that authorization are being encrypted with a key-escrow encryption method; (f) specify the identifier (ID) number of the key escrow encryption chip providing such encryption; and (g) specify the serial (ID) number of the key-escrow decryption device that will be used by the agency participating in the conduct of the interception for decryption of the intercepted communications. 4) This certification shall be submitted to each of the designated key component escrow agents. If the certification has been provided by an agency authorized to participate in the conduct of the interception, a copy shall be provided to the Department of Justice, Office of Intelligence Policy and Review. As soon as possible, an attorney associated with that office shall provide each of the key component escrow agents with written confirmation of the certification. 5) Upon receiving the certification, each key component escrow agent shall release the necessary key component to the agency participating in the conduct of the interception. The key components shall be provided in a manner that assures they cannot be used other than in conjunction with the lawfully authorized electronic surveillance for which they were requested. 6) Each of the key component escrow agents shall retain a copy of the certification, as well as the subsequent written confirmation of the Department of Justice, Office of Intelligence Policy and Review. 7) Upon, or prior to, completion of the electronic surveillance phase of the investigation, the ability of the agency participating in the conduct of the interception to decrypt intercepted communications shall terminate, and such agency may not retain the key components. 8) The Department of Justice shall, in each such case, (a) ascertain the existence of authorizations for electronic surveillance in cases for which escrowed key components have been released; (b) ascertain that key components for a particular key escrow encryption chip are being used only by an agency authorized to participate in the conduct of the interception of communications encrypted with that chip; and (c) ascertain that, no later than the completion of the electronic surveillance phase of the investigation, the ability of the agency participating in the conduct of the interception to decrypt intercepted communications is terminated. 9) Reports to the House Permanent Select Committee on Intelligence and the Senate Select Committee on Intelligence, pursuant to Section 108 of FISA, shall, with respect to any order for authorized electronic surveillance for which escrowed encryption components were released and used for decryption, specifically note that fact. These procedures do not create, and are not intended to create, any substantive rights for individuals intercepted through electronic surveillance, and noncompliance with these procedures shall not provide the basis for any motion to suppress or other objection to the introduction of electronic surveillance evidence lawfully acquired.

1 0