OPENING STATEMENT KENNETH DAM Max Pam Professor of American and Foreign Law University of Chicago Law School and Chair, Committee to Study National Cryptography Policy News Conference on Cryptography's Role in Securing the Information Society National Press Club Washington, D.C. May 30, 1996 *** Good morning. In this age of telecommunications and lightning-speed advances in computing, keeping private information private gets tougher all the time. Without proper safeguards, personal financial transactions, medical records, corporate secrets such as bidding information and proprietary research reports may be compromised by criminals and corporate spies. Without proper safeguards, crucial information systems such as those of the banking system and the public switched telecommunications network may be vulnerable to intrusion by terrorists, curious computer hackers, and unfriendly foreign governments. One of the best ways to protect electronic information is through encryption, which is the use of mathematical formulas to scramble information into digital codes. Once of concern only to spies and the military, cryptography has now become a vital tool for protecting the legitimate interests of the nation's businesses and the privacy of its citizens. This change has created a dilemma for the U.S. government because encryption also can be used in a wide range of illegitimate activities. Drug dealers, terrorists, and other criminals can use cryptography to thwart even legally authorized search and surveillance by law enforcement officials; foreign governments can encrypt information that the U.S. needs to protect its national security. Now the federal government -- which in the past has sought to restrict the spread of encryption -- must weigh the pros and cons of promoting broader use of cryptography. The National Research Council was asked by Congress to provide policy makers with guidance in making this assessment. Our study committee was made up of individuals with expertise in many relevant fields: technical expertise in computers, communications, and cryptography; policy experience in law enforcement, intelligence, civil liberties, national security, diplomacy, and international trade; business experience in telecommunications and computer hardware and software, as well as in protecting information in the for-profit and not-for-profit sectors. It was formed to examine the appropriate balance among various national security, law enforcement, business, and privacy interests. Our committee's broad conclusion is that the advantages of cryptography in safeguarding information outweigh the possible disadvantages of making apprehension and prosecution of criminals more difficult. Thus, we believe that federal policies should promote rather than discourage the use of encryption. For example, current export controls impede the use of strong encryption by U.S. firms with foreign customers and suppliers as well as reducing the availability of strong encryption domestically. The government needs to make it easier for U.S. companies operating internationally to use strong encryption, and for U.S. technology vendors to develop and sell cryptography products both in this country and abroad. Indeed, maintaining world leadership for U.S. information technology vendors is an important contribution to national security, as well as being important to the economy. Furthermore, the development of products with encryption should be driven largely by market forces rather than by government-imposed requirements or standards. There are no legal limits on the kinds of encryption that presently can be sold in the United States and we strongly endorse the idea that no law should bar the manufacture, sale, or use of any form of encryption within the United States. We do not believe that by adopting such a course the government would necessarily be choosing the interests of business and individuals over those of national security and law enforcement. We say this for two reasons. First, availability of encryption technologies will benefit law enforcement and national security. Here's how: by making economic espionage more difficult, cryptography supports law enforcement. By protecting elements of the civilian infrastructure such as banking, telecommunications, and air traffic control networks, cryptography safeguards national security. The second reason is that current national policy -- which discourages the use of cryptography despite its many valuable applications -- can at most delay encryption's spread. Already, the use of such technologies is growing, and in the long run, we believe widespread non-governmental use of cryptography in the United States and abroad is inevitable. The government should recognize this changing reality and help law enforcement and national security authorities develop the new technical capabilities they will need to conduct investigations and surveillance in a world in which information will be more protected and even unencrypted communications will be harder to read. Our report also urges that the government should explore escrowed encryption rather than the aggressive promotion that is the case today. Encrypted information is unintelligible to anyone lacking the keys to unlock the digital code. In escrowed encryption, the decoding key would be held by a trusted third-party organization or institution. This is attractive to law enforcement agencies because with a court order, they could obtain the key and unlock even the most unbreakable code. However, escrowed encryption is relatively untried and many unresolved issues remain, ranging from the liability of these third parties to the magnitude of the risk incurred by companies trusting these third parties with the keys to their sensitive business plans and trade secrets. Rather than aggressively promoting escrowed encryption, our committee believes that the government should explore escrowed encryption for its own purposes as a way of gaining operational experience with this technology and making it more useful to the commercial sector. Even when that occurs, we say that adoption of escrowed encryption or of any other specific technology or standard by the commercial sector should be voluntary and based on business needs, not government pressure. To make it easier for U.S. companies with foreign customers and suppliers to protect their information with the best encryption technologies, the committee believes that export controls should be progressively relaxed, though not eliminated. Right now federal law makes it hard to export strong encryption technology. This helps protect the government's ability to gather foreign intelligence. However, it also makes it more difficult for U.S. technology vendors to produce and sell cryptography products both here and overseas, and it limits what's available here because software companies are reluctant to develop different products for U.S. and foreign markets. And we call on the executive and legislative branches to develop national cryptography policy on the basis of open public discussion. In the past, government officials have treated many aspects of cryptography policy as "top secret," to be discussed only behind closed doors. This has led to considerable public distrust and resistance, which makes it impossible to achieve consensus. In our report we point to a number of specific areas such as telecommunications and banking where the government should actively promote the adoption of encryption. For example, the privacy of the cellular phone and the security of the nation's telecommunications networks should be enhanced through the use of cryptography. In the case of the cellular phone many people have at home, the digital signals sent between the cell phone and the cell's ground station could be encrypted. This would prevent eavesdroppers from listening in on conversations. Overall, we believe that adoption of our recommendations would lead to enhanced protection and privacy for individuals and businesses in a many areas, while also bolstering the international competitiveness of U.S. companies. My colleagues and I will now entertain questions from the media. Before asking a question, please step to an aisle microphone and state your name and affiliation. ----------------------------------------------------------------------------