excerpt from William P. Crowell

[John W. Noerenberg]

Excerpt from prepared testimony of William P. Crowell deputy director,
National Security Agency before the House National Security Committee
Wednesday, July 29, 1997:

[Intro elided]

Goodlatte Bill and  National Security

Before I go into the details of what the nation needs in a balanced
encryption policy - a policy that gets strong encryption to be used widely
while at the same time protects the nation's public safety and national
security - it is important to understand that the Goodlatte bill would
directly threaten national security.

First, the Goodlatte bill would impact our foreign intelligence mission.
The analysis of foreign communications has, literally, helped shorten
global wars and averted regional ones. The export control process is very
important since it gives us valuable insights into what is being exported,
to whom, and for what purpose.

Second, the Goodlatte bill would undermine international efforts to catch
terrorists, spies, and drug traffickers. Quite simply, such efforts save
American lives and protect our free society. Secretary of Defense Cohen and
Attorney General Reno sent letters to you last week that very clearly state
their support for encryption policies that account for these national
security and public safety interests. Not only would the Goodlatte bill
jeopardize national security, it would do very little to achieve the goal
of getting strong encryption used widely. For these reasons, it is
important to understand some of the technical aspects of encryption so we
can develop balanced policy solutions that are technically sound.

[crypto 101 elided]

 The Administration's Approach To Encryption Policy

  Reform Is Very Different From Earlier Key Escrow Initiatives

Some have argued that the Administration's recent policy initiative is the
same as previous key escrow initiatives. Their argument is disingenuous and
incorrect. The KMI initiative is about creating an environment in which
commercial encryption can flourish. Just as significant, the
Administration's proposal differs significantly from previous key escrow
initiatives because:

  -- It eliminates the  focus on bit lengths;
  -- The government doesn't hold the keys;
  -- A separate key escrow infrastructure is not required;
  -- Keys can be held overseas;
  -- It doesn't prescribe algorithms or limit them to hardware; and,
  -- Users' data recovery needs can be met.

With these impediments addressed, industry and government can work to
develop encryption products that will win acceptance in foreign markets and
establish infrastructure services to support those products. Several major
companies recognize these profound changes and have formed business
ventures to thrive within the new climate. In October 1996 IBM formed the
Key Recovery Alliance and that alliance has already grown to over 50
domestic and international companies. Alliance members include Apple,
Mitsubishi, Boeing, DEC, Hewlett Packard, Motorola, Novell, SUN, America
Online, Unisys, and RSA.

Despite Being Available, Encryption is Not Being Widely Used

Most measurements of encryption are inadequate (incomplete or inconclusive)
since they do not show how many people are using encryption. Encryption can
be measured in a number of ways. Depending on how it is measured, one could
misconstrue the data to conclude that "the encryption genie is out of the
bottle" or that the bottle is tightly plugged.

The fact of the matter is that encryption is widely available (e.g.,
embedded in tens of millions of commercial software products) but, based on
our impressions from market surveys, etc., is not widely used. Those who
argue that government encryption policies are outdated because "the
encryption genie is out of the bottle" (i.e., there are many products
advertised to contain encryption and some of them are available from the
Internet) must consider two important perspectives.

First, encryption is not now being, and will not be, used to its fullest
potential (with confidence by 100s of millions of people) until there is an
infrastructure in place to support it. Encryption is not a genie that will
magically solve the security problem. Nor is the Administration trying to
'keep the plug in the bottle'. The Administration wants to help promote a
full range of trusted security services providing privacy, authentication,
and data integrity while simultaneously fulfilling public safety and
national security responsibilities for our government, and governments
worldwide.

Second, serious users of security products don't use free security products
from the Internet. The president of a prominent Internet security
corporation was recently asked in a magazine article on this issue: "Since
encryption technology is available as freeware off the Internet, why would
anyone pay a company for it?" He responded by saying: "Freeware is worth
exactly what you pay for it. I'd rather not implement security systems
using software for which the source code is available to any 12- yearold
who thinks being a hacker is fun." In other words, when determining what
encryption you use to protect valuable business secrets, you should
consider who you're getting it from, how it got to you, and whether you'll
receive support when you need it.

U.S.  Encryption Policies Are Addressing Concerns That The Rest
Of The World Is Also Facing

The U.S. is not the only nation which has concerns that encryption use by
criminals can threaten public safety. All countries that are major
producers of cryptography control its export. Some of those countries have
voiced their displeasure with the U.S. decision to export 56-bit
encryption. Though the U.S. does not have domestic restrictions, some
countries do through import controls of encryption and its domestic use.
Recently, France, Israel, and Russia imposed import and domestic use
restrictions, and severe Asian, South American, and African countries have
informally done so for many years.

At this point, it would be over-generalizing to say that the world has
agreed to an approach on key recovery, but it is accurate to say that all
governments want authorized access to encrypted information. The U.S. is
not the only nation that recognizes the dual-edged nature of the encryption
tool.

Wrap Up

The Administration is basing its policies on the foundation that the need
for robust commercial encryption will grow and it has proposed policy
reforms to ensure that American companies and the public, can flourish in
the future encryption market. The Administration 's approach is not past
its time, it is just in time. The fundamental issue in play is how industry
will build key management infrastructures to support mass market products
with encryption. If infrastructures are built that support key recovery,
then the export control debate can be concluded. Otherwise, governments
worldwide are likely to resist the use of those products because of public
safety concerns. Though the Administration's proposed policies will have a
significant impact on NSA, I believe they are a reasonable response to a
complex, interdependent set of issues. I hope that the Administration can
continue to work with Congress and industry to reach a resolution of these
issues. Thank you for the opportunity to address this important matter.

####


john noerenberg
jwn2 at qualcomm.com
pager: jwn2 at pager.qualcomm.com
  --------------------------------------------------------------------
   "We need not to be left alone.  We need to be really
    bothered once in a while."
  -- Ray Bradbury, Farhenheit 451, 1953
  --------------------------------------------------------------------