[Congressional Record: June 17, 1998 (Senate)] ENCRYPTION Mr. LOTT. Mr. President, I rise today out of concern for our nation's computer and electronic industries. As you are well aware, the Administration's [[Page S6438]] export policies prohibit American companies from selling state-of-the- art encryption technology abroad without recovery keys and back door access. Encryption is a series of mathematical formulas that scramble and unscramble data and communications. It is used to thwart computer hackers, industrial and foreign espionage agents, and criminals from gaining access to and reading sensitive personal, business, and military communications. The higher the bit-key length, the more difficult it is for unauthorized persons to break the code. Technically advanced encryption ensures that an individual's medical, financial, business, personal records and electronic-mail cannot be accessed without their consent. The Administration is now promoting the deployment of recovery keys so designated third parties would be able to access and share with law enforcement the computer data and communications of American citizens without their knowledge. Currently, government mandated key escrow is not required and is opposed by the computer industry, privacy advocates, legal scholars, and by many members of Congress. Mr. LEAHY. While current law does not mandate any key recovery, the current Administration, just as past Administrations, uses the export control regime to ``dumb down'' the encryption available for widespread integration into high-tech products intended for both domestic use and for export to foreign customers. Export regulations in place now are being used expressly to coerce the development and use of encryption products capable of giving law enforcement surreptitious access to plaintext by conditioning the export of 56-bit DES encryption on development of key recovery features. These regulations are scheduled to sunset in December 1998, at which time export of even 56-bit strength encryption will no longer be permitted. I understand that the Administration is already undertaking discussions with industry on what will happen upon sunset of these regulations. I have long contended that taking unilateral steps will not resolve this issue, but instead could delay building the consensus we so urgently need. This issue simply cannot by resolved by Executive fiat. Mr. ASHCROFT. Mr. President, I have been involved in the debate regarding encryption technology and privacy for more than three years now. In the course of that time I have not seen any real attempt by the White House to resolve this problem. In fact, over the course of that time the Administration has moved further from negotiation by taking increasingly extreme positions on this critical national issue. Mr. CRAIG. Mr. President, as you have heard, current U.S. policy allows only encryption below the 56-bit key length to be sold abroad. For a long time now, software companies have argued that this level of encryption is so low it provides little security for the information being transmitted over the ``super highway.'' This policy also states that, in the production of encryption stronger than 56-bit, software companies must provide some type of ``backdoor'' access to ensure law enforcement can decode encrypted material. Addressing this from an economic perspective, customers--especially foreign customers--are unwilling to purchase American encryption products with backdoors and third-party access. This is particularly true since they can buy stronger encryption overseas from either foreign-owned companies or American owned companies on foreign soil without these invasive features. Mr. WYDEN. Since coming to the Senate, I have worked side-by-side with Senators Burns, Ashcroft, Leahy and others on the critical issue of encryption. Our common goal has been to craft a policy that puts the United States squarely out front of the crypto-curve, rather than locks us permanently behind it. A one-size-fits-all government policy simply won't work in this digital era. We all recognize and acknowledge the legitimate needs of law enforcement and the national security communities, but tying the hands of America's high technology industry in the process will serve neither those needs, nor the national interest in maintaining our competitive edge in the fiercely competitive global marketplace. It's time to move forward with comprehensive encryption reform legislation. Mr. BURNS. I would like to point out that the government's plan for encryption--whether they call it ``key escrow'' or ``key recovery'' or ``plaintext access''--simply won't work. Eleven of the world's most prominent computer security experts have told us government mandated key recovery won't work because it won't be secure, as explained in a study published this week by the Center for Democracy and Technology. Key escrow also won't work because it will cost billions, as revealed in a recent study published by the Business Software Alliance. We have also been told that the kind of system the Administration wants is not technically feasible. Additionally, constitutional scholars testified that government mandated key escrow, third party recovery probably violates the Bill of Rights. Mr. LOTT. Even though a national recovery system would be technically unfeasible, costly, and violates an individual's privacy rights, the Administration continues to require key escrow as a precondition for relaxing America's encryption policy. Again, Mr. President, I would point out that state-of-the-art encryption is available in the international marketplace without key recovery and without backdoor access. This backdoor door requirement is simply backward thinking policy. It does not make sense to hold the computer industry hostage to force the creation of such an unworkable system. Mr. BURNS. The Majority Leader is absolutely right. We do not need experts to tell us key recovery will not work. All that is needed is a little common sense to understand that no one will buy systems with backdoor access. Criminals will not escrow their keys and terrorists will find keyless systems from America's foreign competitors. There is nothing we can do to stop undesirables from using strong, unescrowed encryption. Mr. LOTT. Even though advanced encryption products are widely available across the globe, the White House continues to stall Congressional and industry attempts to reach a sensible market oriented solution to the nation's outdated encryption export regime. This stonewalling tactic will only cede even more of our nation's technology market to foreign competitors and America will lose forever its ability to sell encryption technology at home and abroad. It is time to change America's export policy before it is too late. If the Administration will not do what is right, reform its export regime, then Congress must enact encryption reform during this session. Mr. LEAHY. The Majority Leader is correct that reform of our encryption policy is needed. The Attorney General came to the Hill in March and asked for a legislative moratorium on encryption matters. This request was made because the Administration wanted to talk with the information technology industry about developing means for law enforcement to gain surreptitious access to plaintext scrambled by strong encryption. According to eleven of the world's leading cryptographers in a report reissued on June 8, the technical risks and costs of such backdoors ``will exacerbate, not alleviate, the potential for crime and information terrorism'' for America's computer users and our critical infrastructures. In the Senate we have a name for debate that delays action on legislative matters. We call it a filibuster. On encryption policy, the Administration has been willing to talk, but not to forge a real solution. That amounts to a filibuster. The longer we go without a sensible policy, the more jobs will be lost, the more we risk eroding our privacy rights on the Internet, and the more we leave our critical infrastructures vulnerable. Mr. BURNS. We can readily see that the current U.S. policy on encryption jeopardizes the privacy of individuals, the security of the Internet, and the competitiveness of U.S. industry. We have been debating this issue since the Administration's introduction of the ill- fated Clipper chip proposal over five years ago. Yet no substantial change in Administration policy has taken place. It is time for us to take action. I first introduced comprehensive encryption reform legislation in the [[Page S6439]] form of the Pro-CODE bill over two years ago, then reintroduced it in this Congress with the cosponsorship of the Majority Leader, Senators Ashcroft, Leahy, Wyden, and others. Along with Senators Ashcroft, Leahy, and others, I am also an original cosponsor of the E-PRIVACY bill, which would foster the use of strong encryption and global competitiveness. We have held numerous hearings on the issue. Yet despite the increasingly desperate drumbeat of criticism from industry, individuals, and privacy groups, from across the political spectrum, the Administration's policy has remained fundamentally unchanged. Mr. LEAHY. Since the hearing I chaired in May 1994 on the Administration's ``Clipper Chip'' proposal, the Administration has taken some steps in the right direction. Clipper Chip is now dead, and the Administration has transferred authority over the export of encryption products from the State Department to the Commerce Department, as called for in legislation I introduced in the last Congress with Senators Burns, Wyden and others. Furthermore, the Administration has permitted the export of up to 56-bit DES encryption, at least until the end of this year. But these actions are simply not enough for our high-tech industries to maintain their leading edge in the global marketplace. Mr. ASHCROFT. Our technology companies need to be able to compete effectively. Without reasonable export laws our technology sector will be seriously harmed. More encryption companies will leave the country so they are free to sell their products around the globe as well as within the United States. Make no mistake, the market will not be denied. Today, robust encryption products from Canada, Japan, Germany and elsewhere are being sold on the world market. You have heard of the companies that are manufacturing and selling encryption. They are Nortel, Nippon and Seimens. These are not upstart companies. They are substantial players on the international scene, and they offer encryption products that are technically and financially competitive with those produced in the U.S. Mr. LOTT. That's right. In fact, a recent survey conducted by Trusted Information Systems found that hundreds of foreign companies sell over 600 encryption products from 29 countries. It is even possible to download some of the strongest technology available, 128-bit key length encryption, off of the Internet. Clearly, America's policy of restricting the sale of American encryption software and hardware has not impacted the availability and use of this technology throughout the globe. No one disputes the fact that the development and use of robust encryption worldwide will continue with or without U.S. business participation. What is particularly disturbing to me is that export controls, instead of achieving their intended purpose, have only served to deny America's premier computer industry the opportunity to compete on a level playing field with foreign competitors. Costing our economy and our nation billions of dollars and the loss of countless American jobs in the process. Given the wide availability of encryption technology, continuing to restrict U.S. access to foreign markets makes no sense. Mr. ASHCROFT. That is absolutely correct. The Administration's encryption policy is, in effect, a tax on American consumers. We owe it to these customers and the innovators in the software industry to reform this encryption policy now. From the birth of the United States, this country has been a world leader in innovation, creativity, entrepreneurship, vision and opportunity. Today all of these American attributes are on display in our technology sector. Whether in telecommunications, or computer hardware or software, the United States has maintained a leadership position because of the opportunities afforded to people with the vision, determination and responsibility to reach for their highest and best. We must work diligently to ensure that ample opportunities are maintained in this country for our technology sector to continue to thrive and innovate. If companies are stifled and cannot compete, then the people, the ideas, the jobs, and the economic growth will simply go elsewhere. Mr. BURNS. In the computer business these days, they talk about ``Internet time.'' In the Internet industry, where product life cycles can be as low as 6 months, the world changes rapidly. Yet we have been debating this issue for over five years now, while America's sensitive communications go unsecured, our critical information infrastructures go unprotected, and our electronic commerce jobs get shipped overseas. It is time for the Congress to act. Mr. ASHCROFT. If this issue is not resolved, and resolved soon, we will lose this industry, we will lose our leadership position in technology, and our national security will suffer. We have a choice to make as policy makers--do we allow our companies to compete internationally or do we force them, by our antiquated and ill- conceived government policy, to move overseas. We cannot simply ignore the reality that robust encryption exists in the international marketplace now. Instead, we must allow our companies to compete, and do so now. We cannot allow extraneous issues to stand in the way of remedying the deficiencies with our current approach to encryption. We must recognize that keeping the encryption industry on American shores is the best way to ensure national security. We would not think of allowing all our defense industries to move abroad. By the same token, we should not force the encryption industry abroad through outdated policies. Simply put, strong encryption means a strong economy and a strong country. This concern is just one of the many reasons we need to pass effective encryption legislation this year and just one of the reasons that Senator Leahy and I recently drafted the E-PRIVACY bill, S. 2067. Mr. LEAHY. I join with my colleagues from both sides of the aisle in calling for passage of good encryption legislation that promotes computer privacy, fosters the global competitiveness of our high-tech industries, and encourages the widespread use of strong encryption as an online crime prevention and anti-terrorism tool. The E-PRIVACY bill that I have sponsored with Senator Ashcroft, Senator Burns and others, satisfies these goals. Prompt Senate consideration of encryption legislation is sorely needed to protect America's economy and security. Mr. CRAIG. Mr. President, the E-PRIVACY bill seeks to protect individual privacy, while at the same time addressing national security and law enforcement interests. It would also modernize export controls on commercial encryption products. The E-Privacy Act specifically addresses the concerns of law enforcement. First and foremost, it makes it a crime to intentionally use encryption to conceal incriminating communications or information. It also provides that with an official subpoena, existing wiretap authority can be used to obtain communications decryption keys/ assistance from third parties. Mrs. MURRAY. Mr. President, I want to thank Senator Leahy, Senator Burns and Senator Ashcroft as well as Senator Lott and Senator Daschle for their work and leadership on the issue of encryption. I am proud to be an original cosponsor of S. 2067, the E-PRIVACY Act. This is my sixth year as a member of the Senate and the sixth year I have advocated for reasonable legislation on encryption. Sadly, the Administration has not been a constructive player in this debate. It is time for the United States to acknowledge that we no longer exclusively control the pace of technology. Purchasers around the world can download software off of the Internet from any country by simply accessing a website. Foreign purchasers have turned to Russian, German, Swiss and other foreign vendors for their encryption needs. Washington state and American companies deserve the opportunity to compete free from unreasonable government restrictions. Their role in the international marketplace should be determined by their ingenuity and creativity rather than an outdated, ineffectual system of export controls. The time to act is now. I urge the Senate to consider the E- PRIVACY Act at the earliest opportunity. Mr. BURNS. The basic facts remain the same. People need strong, unescrowed encryption to protect themselves online in the information [[Page S6440]] age. Law enforcement has legitimate concerns about the spread of this technology, and we must work to provide them the tools and expertise they need to keep up with advances in encryption technology. We cannot stop time, however. The genie is out of the bottle. As Bill Gates, the CEO of Microsoft, recently said, ``Encryption technology is widely available outside the United States and inside the United States, and that's just a fact of life.'' Mr. CRAIG. With the rapid expansion of the ``super highway'' and Internet commerce it is crucial we bring encryption legislation to the forefront. A secure, private and trusted national and global information infrastructure is essential to promote citizens' privacy and economic growth. Mr. BURNS. As my colleagues recognize, technically advanced and unobtrusive encryption is fundamental to ensuring the kind of privacy Americans will need and desire in the years to come. Congress must choose a future where individuals and companies will have the tools they need to protect their privacy, not a future where people fear the use electronic commerce because they have no security. I commend the Majority Leader, Senators Ashcroft, Leahy, Craig, Wyden, and Murray for their vision and bipartisan leadership on this issue. I hope that Congress will be able to move forward with real encryption reform legislation that protects the privacy and security of Americans in the Information Age, before it is too late. Mr. LOTT. I think it is worth repeating to my colleagues that the Administration's approach to encryption makes no sense. It is not good policy. Continuing to restrict the foreign sale of American encryption technology that is already available abroad, or will soon be available, is anti-business, anti-consumer, anti-jobs, and anti-innovation. The time for a change in America's export regime is long overdue. Unfortunately, the Administration continues to support its outmoded and competition-adverse encryption control policy. That is why this Congress needs to find a legislative solution to this issue. If America's export controls are not relaxed now, then Congress places in peril our entire technology industry. Not just those companies that create and market encryption products and services, but virtually every company involved in the development and sale of computer hardware and software. Congress cannot and will not put America's entire technological base at risk for an ineffective and outmoded export policy on encryption. ____________________