[Largely bureaucratic, but there may be some interesting nuggets. This is an advisory group to watch over exports in general, with a subcommittee that is chartered to watch over encryption issues. --gnu] EXECUTIVE SUMMARY PRESIDENT'S EXPORT COUNCIL SUBCOMMITTEE ON ENCRYPTION APRIL 23, 1998 SUMMARY OF OPEN SESSION The open session of the President's Export Council Subcommittee on Encryption (PECSENC) was called to order at 8:30 a.m. Mr. Adorjan noted the Committee's mandate and described the framework and agenda of the meeting. He then described the proposed focus of the Subcommittee working groups on U.S. regulation and legislation, international, and technology. He emphasized that the objective would be for each working group to address the many subjects related to encryption export policy from the perspective of the primary topic. He noted that as the working groups made progress on issues, they would bring recommendations for decision to the entire Subcommittee. He added that each working group would issue individual reports or recommendations rather than waiting for an integrated report of all three working groups. He again noted his hope that the work of the three groups be integrated further on in the process. He commented that there had been discussion of a fourth group focused on law enforcement, but concluded that it would be more valuable to integrate law enforcement issues into the work of the three groups because of its impact on these areas. He then described the proposed list of working group participants and possible chairs, noting that his goal was to get a balanced representation of members within each group. He said that during the afternoon breakout sessions, he would like each working group to reach a set of decisions on the scope and approach of its work plan, and the timetable for completion. Mr. Adorjan then discussed how the PECSENC, as a Subcommittee of the President's Export Council, would communicate any formal activity to the Administration, noting that the process used by the PEC Subcommittee on Export Administration (PECSEA) worked well. He described this process, and explained that any proposals to send reports or letters to the Administration were submitted by the Subcommittee Chair to the PEC Chair for distribution to Committee members, with the PEC staff coordinating this effort. Mr. Adorjan then commented on Mr. Stewart Baker's e-mail recommendation to submit a letter urging the Administration to move forward on the financial institutions regulation which had been pending. He agreed with Mr. Baker's assessment that the Subcommittee should focus not only on long-term issues, but also intervene in short-term issues. Mr. Adorjan added that issuing a letter to the Administration with support of PEC and Subcommittee members was an effective means of bringing a topic to the forefront. He then suggested that the working groups address such time sensitive issues, as appropriate, and formulate recommendations for circulation throughout the entire Subcommittee. Mr. Adorjan then asked for any comments with regard to the working group activities. As there were none, he turned to the issue of membership, noting that the PECSENC had 23 members with approximately 30 total members planned. He added that at the previous meeting, members had discussed the importance of having a cryptographer and insurance industry representative as members. He assured members that the department was pursuing these recommendations. At the request of Subcommittee members, Under Secretary Reinsch discussed Secretary Daley's recent remarks to a group of information technology associations regarding the release of the Commerce Department report titled "The Emerging Digital Economy." Mr. Reinsch noted that while the report focused on electronic commerce, the Secretary also took the opportunity to comment on the encryption debate. He emphasized that the Secretary supported the President's policy to balance national security, privacy, and commercial interests, but believed that implementation of the policy had not been as successful as it should be. He added that if it could not be implemented successfully, the victims would be the law enforcement community and U.S. business, as foreign products would become more dominant. With respect to the ability of the United States to impact the activities of foreign countries on encryption, Mr. Reinsch noted that each country that confronted the issue had to work out the debate in its own way. Responding to Mr. Lynn McNulty's request for views on the Economic Strategy Institute's report entitled "Finding the Key, Reconciling National and Economic Security Interests in Cryptography Policy", Mr. Reinsch noted that while the report did not offer alternatives, it demonstrated that balancing the competing interests in the debate was difficult. Mr. Adorjan then introduced the first presenter in the Justice Department's threat assessment briefing, Mr. Charles Barry Smith, Supervisory Special Agent, Office of Public and Congressional Affairs at the Federal Bureau of Investigation. Agent Smith began by stating that law enforcement was supportive of strong encryption to protect privacy, but that it would be adversely impacted by commercially available non-recovery encryption products. He discussed the legal issues related to wiretapping, describing it as a technique of last resort done under strict judicial procedures. He then described the adverse impact of non-recovery encryption on law enforcement's ability to perform search and seizure of criminally related electronically stored data. He provided case examples where electronic surveillance had been used successfully and described high-profile cases where encryption played a role. In response to Raymond Humphrey's question as to whether or not criminals would use key recovery products, Agent Smith said that past experience showed that criminals tended to use what was generally available, citing the use of cellular phones as an example. Ambassador Katz raised the issue of whether it was too late to reverse the impact of the general availability of non-key recovery encryption. Agent Smith responded that at this point encryption was just an added feature, but would soon become integrated into products and user-friendly, resulting in increased use. In response to Ms. Simons' question of the issue of domestic controls, Agent Smith noted that law enforcement was in fact concerned about the proliferation of non-recovery products within the United States, as well as the impact of imports of such products. Agent Smith emphasized that law enforcement did not advocate that the government be the holder of the information or key, but that it have access to information pursuant to lawful authority without having to go to the individual who may be engaged in the illegal activity. Adorjan then introduced the second Justice Department speaker, Mr. Scott Charney, Chief of the Computer Crime and Intellectual Property Section in the Criminal Division of the Justice Department. Mr. Charney began by commenting that his office was a large proponent of using cryptography to protect systems for both authentication and privacy and commerce purposes based on its experience with hacker cases. He noted that if information was encrypted, it was not as much of a concern if hackers gained access to it. He said that the question to ask was whether the public wanted the kind of infrastructure that helped criminals protect themselves because products were unbreakable and law enforcement had no access to data, or the kind of infrastructure where the public got the benefits of robust cryptography but where it did more to preserve public safety. Mr. Douglas McGowan asked about the method of controlling keys for individual users of key recovery encryption outside of the corporate environment. Mr. Charney responded that there were many ingenious ways to implement the technology which allow people to retain control to information and keys while providing for government access with the necessary authority. He added that there were ways to implement key recovery that offered benefits for the consumer and public safety, and used the example of "self-wrapping" encryption. Mr. Donald Goldstein noted that there was evidence that the public was relatively trusting and accepting of key management and recovery techniques, citing the example of ATM card usage. He cautioned that the network might become unreliable if a vulnerability was introduced which could result in the public not trusting the system anymore. Mr. Chaney responded that this vulnerability was far less than what existed in today's plaintext world and that an expectation of zero risk on networks was not realistic. He added that there needed to be a balance of benefits and risks and that it was difficult to quantify risks to privacy versus public safety. There was also a general discussion with Messrs. Smith and Charney on related issues, including the concept of a "Net Center", the policies of other countries, imports of non-recovery encryption, the difficulty in designing different products in different markets, the possibility of a single law enforcement standard, economic intelligence and espionage, including losses to the economy if robust encryption was not available, the need for real time access to encrypted communications, and the ability of law enforcement to solve crimes in the future if constrained by non key-recovery encryption products. Mr. Anthony Pentino of the National Security Agency suggested that law enforcement might find a better way to communicate its position beyond the congressional level to the general public at large to counter what appeared to be an exaggeration of privacy concerns fostered by its detractors. Ms. Simons then asked that in the future, the Subcommittee members have the opportunity to submit questions to speakers. Mr Adorjan suggested that these questions be conveyed through the working groups. Mr. Linton Wells from the Department of Defense commented that Deputy Secretary of Defense John Hamre recently spoke to NATO allies in Brussels regarding the importance of each country developing national solutions on encryption. He noted that Hamre's point was that encryption needed to be regarded not just from commerce and law enforcement standpoint, but as a national security issue as well. As NATO moved from military dedicated command and control to public networks, strong identification, authentication, and interoperability were crucial. He also noted that with respect to the Defense Department engaging in electronic commerce, key recovery encryption would be necessary from an internal control standpoint. Mr. Adorjan agreed that this issue was not unique to the Defense Department, but corporations as well. Turning to the briefing foreign activities, Mr. Adorjan introduced Ms. Michelle O'Neill, Executive Director to Ambassador Aaron and Mr. James Lewis, Director of the Office of Strategic Trade and Foreign Policy Controls. Ms. O'Neill began by explaining that Ambassador Aaron, who was unable to attend the meeting, had been appointed as Special Envoy for Cryptography in November 1996. The goal of his discussions with other countries was international consensus on the development of key management and key recovery architectures that would foster robust, dependable security for global information infrastructure while protecting public safety and national security. She said that two key issues were the need for harmonized export control policies and the development compatible infrastructures, as it was clear that no widely used encryption system or any successful national policy would be possible without international cooperation. She also noted that while governments must provide appropriate policy framework, the task of building this infrastructure would lie with the private sector. She said that through Ambassador Aaron's discussions, they had learned that while most governments were behind the United States in development of encryption policies, each shared the same concerns as the United States in trying to strike the right balance. Mr. Lewis' discussion focused on multilateral controls on encryption exports. He began by noting that a number of countries controlled the export of encryption, but that the task was to modernize encryption export controls to reflect today's environment and agree to the implementation of common policies. He added that most governments had common concerns about role of encryption in society. He noted that the U.S. objectives with respect to encryption policy were law enforcement access, use of recoverable encryption, and promotion of electronic commerce. He then explained the history and structure of Wassenaar Arrangement and outlined the issues that the forum was considering with respect to encryption, including moving to a positive control list, consideration of the treatment of commercial encryption products given widespread commercial use, treatment of software and intangible technology (phone conversations, faxes, Internet transmissions), decontrol levels, and transparency in reporting. He said that the United States had raised encryption as an issue for discussion at the last Wassenaar Arrangement plenary in December 1997 and asked countries to adopt similar policies as the United States. He indicated that given the scope of the issues under consideration, he was not sure that resolution would happen anytime soon. He added that Ambassador Aaron's group was finding that other countries were moving slowly in the U.S. direction and had more sympathy for the U.S. position than it would appear. There was a general discussion of the issue of mass market encryption software, the treatment of intangible technology and the need to develop a common approach on encryption. Following the lunch break and the meeting of the non-public working group sessions, Chairman Adorjan reconvened the Subcommittee at 3:00 p.m. He asked each group to give a report on its discussions and began with Mr. Gant Redmon and the working group on technology. Mr. Redmon began by noting that the issue of interoperability was a key part of the group's discussion and said that building key recovery was not an impossible project (with respect to stored data). He said that from a technological standpoint, interoperability could cause a great deal of difficulty in terms of those products that have key recovery and those that do not. He also noted the strong domestic impact of export issues and other pressures to create encryption products a certain way. With respect to mass market software, he said that the working group generally agreed that 56 bit encryption products were the de facto standard. Mr. Adorjan then turned to Ambassador Katz for a briefing on the international working group discussion. Katz noted that the first task they agreed to focus on was developing an understanding of the state of current encryption policies, including foreign availability and policies of other governments. He said that the working group would seek briefings from government and the private sector and perhaps survey suppliers and users. He indicated that the group had identified another issue: whether export control policy is the most effective instrument to meet broader objectives of law enforcement, national security, and privacy. He finished by noting that the working group planned on completing its information gathering prior to the September meeting and would then work on policy recommendations. Mr. Adorjan then turned to the Regulatory and Legislative working group. Mr. Richard Barth began by noting that the working group had considered the letter drafted by Mr. Baker and supported it with minor edits. He added that they felt that the issue of raising the decontrol level to 56 bit encryption products could be included as a second point. He then noted that the group had agreed on a set of operating principles for themselves and perhaps for the use of the entire Subcommittee. These included the objective of balancing the interests of law enforcement, privacy and national, seeking this balance via market driven forces and, where necessary, taking a legislative approach. He concluded with a request for a panel briefing on the legislative environment and a briefing on the export control requirements on encryption. Adorjan agreed that briefings on three issues would be useful, specifically briefings on the status of legislative issues, export policies and administration, and international threat briefing by the National Security Agency. With respect to these briefings, he would ask the presenters to provide topical outlines in advance of the briefings. Mr. Adorjan said he looked forward to the working groups developing a defined scope of work by the next meeting, and suggested that they interact by e-mail. He added that the working groups did not need to get consensus, but that the long term objective was to formulate a set of recommendations. Finally, he noted that he and Under Secretary Reinsch would invite Secretary Daley to participate at the June 22 meeting. Mr. Adorjan asked if there were other issues to be discussed. As there were none, he adjourned the session at 3:35 p.m.