Following are Representative Maria Cantwell's remarks to the House of Representatives when she introduced H.R. 3627, Legislation to Amend the Export Administration Act of 1979. Her synopsis of the bill appears at the end. These remarks appeared in the Congressional Record on November 24, 1993, at Volume 139, Page 3110. Please write to Rep. Cantwell today at cantwell@eff.org letting her know you support her bill. In the Subject header of your message, type "I support HR 3627." In the body of your message, express your reasons for supporting the bill. EFF will deliver printouts of all letters to Rep. Cantwell. With a strong showing of support from the Net community, Rep. Cantwell can tell her colleagues on Capitol Hill that encryption is not only an industry concern, but also a grassroots issue. *Again: remember to put "I support HR 3627" in your Subject header.* The text of the Cantwell bill can be found with the any of the following URLs (Universal Resource Locaters): ftp://ftp.eff.org/pub/Policy/Legislation/cantwell.bill http://www.eff.org/ftp/EFF/Policy/Legislation/cantwell.bill gopher://gopher.eff.org/00/EFF/legislation/cantwell.bill ********************************************************************** Mr. Speaker, I am today introducing legislation to amend the Export Administration Act of 1979 to liberalize export controls on software with encryption capabilities. A vital American industry is directly threatened by unilateral U.S. Government export controls which prevent our companies from meeting worldwide user demand for software that includes encryption capabilities to protect computer data against unauthorized disclosure, theft, or alteration. The legislation I am introducing today is needed to ensure that American companies do not lose critical international markets to foreign competitors that operate without significant export restrictions. Without this legislation, American software companies, some of America's star economic performers, have estimated they stand to lose between $6 and $9 billion in revenue each year. American hardware companies are already losing hundreds of millions of dollars in lost computer system sales because increasingly sales are dependent on the ability of a U.S. firm to offer encryption as a feature of an integrated customer solution involving hardware, software, and services. The United States' export control system is broken. It was designed as a tool of the cold-war, to help fight against enemies that no longer exist. The myriad of Federal agencies responsible for controlling the flow of exports from our country must have a new charter, recognizing today's realities. Next year, the House Foreign Affairs Subcommittee of Economic Policy, Trade and the Environment, of which I am a member, will be marking up legislation to overhaul the Export Administration Act. It is my hope that the legislation I introduce today will be included in the final Export Administration Act rewrite. This legislation takes some important steps to resolve a serious problem facing some of our most dynamic industries. It would give the Secretary of Commerce exclusive authority over dual use information security programs and products, eliminates the requirement for export licenses for generally available software with encryption capabilities, and requires the Secretary to grant such validated licenses for exports of other software with encryption capabilities to any country to which we already approve exports for foreign financial institutions. The importance of this legislation cannot be overstated. America's computer software and hardware companies, including such well-known companies as Apple, DEC, Hewlett-Packard, IBM, Lotus, Microsoft, Novell, and WordPerfect, have been among the country's most internationally competitive firms earning more than one-half of their revenues from exports. The success of American software and hardware companies overseas is particularly dramatic and the importance of foreign markets is growing. Currently, American software companies hold a 75 percent worldwide market share and many derive over 50 percent of their revenues from foreign sales. American computer hardware manufacturers earn more than 60 percent of their revenues from exports. As my colleagues are well-aware, we are participants in a new information age that is quickly transforming local and national marketplaces and creating new international marketplaces where none previously existed. President Clinton and Vice President Gore have both spent considerable time explaining their vision of the National Information Infrastructure that is essential to our continued economic growth. Part of that infrastructure is already in place. International business transactions that just a few years ago took days or weeks or months to complete can now be accomplished in minutes. Driving this marketplace transformation is the personal computer. And, at the heart of every personal computer is computer software. Even the most computer illiterate of us recognize that during the past decade, computer prices have dropped dramatically while computer capabilities have increased exponentially. That combination has made it possible to exchange information and conduct business at a scale that was considered science fiction only a few years ago. Indeed, we all now rely on computer networks to conduct business and exchange information. Whether it be the electronic mail or "e-mail" system that we all now use in our congressional offices or the automated teller system relied on to conduct our personal financial affairs, we rely on computer networks of information. In the future, individuals will use information technologies to conduct virtually any of the routine transactions that they do today in person, over the telephone, and through paper files. From personal computers at home, in schools, and in public libraries, they will access books, magazine articles, videos, and multimedia resources on any topic they want. People will use computer networks to locate and access information about virtually any subject imaginable, such as background on the candidates in local political races, information on job opportunities in distant cities, the weather in the city or country they will be visiting on their vacation, and the highlights of specific sports events. Consumers will use their computers and smart televisions to shop and pay for everything from clothing and household goods to airline tickets, insurance, and all types of on-line services. Electronic records of the items they purchase and their credit histories will be easy to compile and maintain. Individuals will access home health programs from their personal computers for instant advice on medical questions, including mental health problems, information about the symptoms of AIDS, and a variety of personal concerns that they would not want other family members, or their neighbors and employers to know about. They will renew their prescriptions and obtain copies of their lab results electronically. The U.S. economy is becoming increasingly reliant on this information network. While we may not often think about these networks, they now affect every facet of our professional, business, and personal lives. They are present when we make an airline reservation; when we use a credit card to make a purchase; or when we visit a doctor who relies on a computer network to store our medical information or to assist in making a diagnosis. These networks contain information concerning every facet of our lives. For businesses, the reliance on information security is even greater. While businesses rely on the same commercial use networks that individual consumers use, in addition, businesses are now transmitting information across national and international borders with the same ease that the information was once transmitted between floors of the same office building. While all of this information exchange brings with it increased efficiencies and lower operating costs, it has also brought with it the need to protect the information from improper use and tampering. Information security is quickly becoming a top priority for businesses that rely on computer networks to conduct business. According to a recent survey of Fortune 500 companies conducted for the Business Software Alliance, 90 percent of the participants said that information security was important to their operations. Indeed, almost half of the Fortune 500 companies surveyed recently stated that data encryption was important to protect their information. One third of those companies said they look for encryption capabilities when buying software. The challenge for information security can be met by America's computer companies. American companies are deeply involved in efforts to ensure that the information transmitted on computer networks is secure. Numerous companies have developed and are developing software products with encryption capabilities that can ensure that transmitted information is received only by the intended user and that it is received in an unaltered form. Those encryption capabilities are based on mathematical formulas or logarithms of such a size that makes it almost impossible to corrupt data sources or intercept information being transmitted. I wish I could stand here today and tell my colleagues that U.S. export control laws were working and encryption technology was only available to American software companies. However, this is not the case. Sophisticated encryption technology has been available as a published public standard for over a decade and many private sources, both domestic and foreign, have developed encryption technology that they are marketing to customers today. It is an industry where commercial competition is fierce and success will go to the swift. Software is being developed and manufactured with encryption capabilities for the simple reason that software customers are demanding it. Computer users recognize the vulnerability of our information systems to corruption and improper use and are insisting on protection. That protection will be purchased or obtained from American companies or from foreign software companies. The choice is not whether the protection will be obtained, but from which company. Incredible as it may seem to most of my colleagues, the Executive Branch has seen fit to regulate exports of American computer software with encryption capabilities -- that is, the same software that is available across the counter at your local Egghead or Computerland software store -- munitions and thereby substantially prohibit its export to foreign customers. This policy, which has all the practical effect of shutting the barn door after the horses have left in preventing access to software with encryption capabilities, does have the actual detrimental effect of seriously endangering sales of both generally available American software and American computer systems. This is because increasingly sales are dependent on the ability of a U.S. firm to offer encryption as a feature of an integrated customer solution involving hardware, software and services. Indeed, software can be exported abroad by the simplest measures and our intelligence gathering agencies have no hope of ever preventing it. Unlike most munitions that are on the prohibited export list, generally available software with encryption capabilities can be purchased without any record by anyone from thousands of commercial retail outlets, or ordered from hundreds of commercial mail order houses, or obtained for free from computer bulletin boards or networks. Once obtained, it can be exported on a single indistinguishable floppy disk in the coat pocket of any traveler or in any business envelope mailed abroad. Moreover, both generally available and customized software can be exported without anyone ever actually leaving the United States. All that is necessary are two computers with modems, one located in the United States and one located abroad. A simple international phone call and a few minutes is all that it takes to export any software program. Once a software program with encryption capabilities is in a foreign country, any computer can act as a duplicating machine, producing as many perfect copies of the software as needed. The end result is that the software is widely available to foreign users. All this was demonstrated at a hearing held on October 12 by Chairman Gejdenson's Economic Policy Trade and Environment Subcommittee of the Foreign Affairs Committee. Furthermore, while current Executive Branch policy regulates the export of American manufactured software with encryption capabilities, it is obviously powerless to prevent the development and manufacture of such software by foreign competitors. Not surprisingly, that is exactly what is happening. We heard testimony at the subcommittee's hearing that over 200 foreign hardware, software and combination products for text, file, and data encryption are available from 20 foreign countries. As a result, foreign customers, that have, in the past, spent their software dollars on American-made software, are now being forced, by American policy, to buy foreign software -- and in some cases, entire foreign computer systems. The real impact of these policies is that customers and revenue are being lost with little hope of regaining them, once lost. All precipitated by a well-intentioned, but completely misguided and inappropriate policy. There were efforts, in the last Congress to correct this policy. In response, the Bush Administration did, in fact, marginally improve its export licensing process with regard to mass market software with limited encryption capabilities. However, those changes are simply insufficient to eliminate the damage being done to American software companies. My legislation is strongly supported by the Business Software Alliance. The Business Software Alliance represents the leading American software businesses, including Aldus, Apple Computer, Autodesk, Borland International, Computer Associates, GO Corp., Lotus Development, Microsoft, Novell, and WordPerfect. In addition, Adobe Systems, Central Point, Santa Cruz Operation, and Symantec are members of BSA's European operation. Together, BSA members represent 70 percent of PC software sales. The legislation is also supported by the Industry Coalition on Technology Transfer, an umbrella group representing 10 industry groups including the Aerospace Industries Association, American Electronic Association, Electronics Industry Association, and Computer and Business Equipment Manufacturing Association. All these companies are at the forefront of the software revolution. Their software, developed for commercial markets, is available throughout the world and is at the core of the information revolution. They represent the finest of America's future in the international marketplace, and the industry has repeatedly been recognized as crucial to America's technological leadership in the 21st century. My legislation is straightforward. It would allow American companies to sell the commercial software they develop in the United States to their overseas customers including our European allies -- something that is very difficult if not impossible under present policies. I urge my colleagues to support this legislation and ask unanimous consent that the text of the bill and a section-by-section explanation be printed at this point. ************************************************************************ Section-By-Section Analysis of Report Control Liberalization for Information Security Programs and Products Section 1 Section 1 amends the Export Administration Act by adding a new subsection that specifically addresses exports of computer hardware, software and technology for information security including encryption. The new subsection has three basic provisions. First, it gives the Secretary of Commerce exclusive authority over the export of such programs and products except those which are specifically designed for military use, including command, control and intelligence applications or for deciphering encrypted information. Second, the government is generally prohibited from requiring a validated export license for the export of generally available software (e.g., mass market commercial or public domain software) or computer hardware simply because it incorporates such software. Importantly, however, the Secretary will be able to continue controls on countries of terrorists concern (like Libya, Syria, and Iran) or other embargoed countries (like Cuba and North Korea) pursuant to the Trading With The Enemy Act or the International Emergency Economic Powers Act (except for instances where IEEPA is employed to extend EAA-based controls when the EAA is not in force). Third, the Secretary is required to grant validated licenses for exports of software to commercial users in any country to which exports of such software has been approved for use by foreign financial institutions. Importantly, the Secretary is not required to grant such export approvals if there is substantial evidence that the software will be diverted or modified for military or terrorists' end-use or re-exported without requisite U.S. authorization. Section 2 Section 2 provides definitions necessary for the proper implementation of the substantive provisions. For example, generally available software is offered for sale or licensed to the public without restriction and available through standard commercial channels of distribution, is sold as is without further customization, and is designed so as to be installed by the purchaser without additional assistance from the publisher. Computer hardware and computing devices are also defined.