IP: LETTER FROM SENATOR PATRICK LEAHY (D-VT) ON ENCRYPTION

[Dave Farber <farber () central cis upenn edu>]

To: farber () eff org


             Please post where appropriate


        -----BEGIN PGP SIGNED MESSAGE-----


             LETTER FROM SENATOR PATRICK LEAHY (D-VT) ON ENCRYPTION
             
        May 2, 1996


        Dear Friends:


        Today, a bipartisan group of Senators has joined me in supporting
        legislation to encourage the development and use of strong,
        privacy-enhancing technologies for the Internet by rolling back
        the out-dated restrictions on the export of strong cryptography.


        In an effort to demonstrate one of the more practical uses of
        encryption technology (and so that you all know this message
        actually came from me), I have signed this message using a
        digital signature generated by the popular encryption program
        PGP.  I am proud to be the first member of Congress to utilize
        encryption and digital signatures to post a message to the
        Internet.


        As a fellow Internet user, I care deeply about protecting
        individual privacy and encouraging the development of the Net as
        a secure and trusted communications medium.  I do not need to
        tell you that current export restrictions only allow American
        companies to export primarily weak encryption technology.  The
        current strength of encryption the U.S. government will allow out
        of the country is so weak that, according to a January 1996 study
        conducted by world-renowned cryptographers, a pedestrian hacker
        can crack the codes in a matter of hours!  A foreign intelligence
        agency can crack the current 40-bit codes in seconds.


        Perhaps more importantly, the increasing use of the Internet and
        similar interactive communications technologies by Americans to
        obtain critical medical services, to conduct business, to be
        entertained and communicate with their friends, raises special
        concerns about the privacy and confidentiality of those
        communications.  I have long been concerned about these issues,
        and have worked over the past decade to protect privacy and
        security for our wire and electronic communications.  Encryption
        technology provides an effective way to ensure that only the
        people we choose can read our communications.


        I have read horror stories sent to me over the Internet about how
        human rights groups in the Balkans have had their computers
        confiscated during raids by security police seeking to find out
        the identities of people who have complained about abuses. 
        Thanks to PGP, the encrypted files were undecipherable by the
        police and the names of the people who entrusted their lives to
        the human rights groups were safe.


        The new bill, called the "Promotion of Commerce On-Line in the
        Digital Era (PRO-CODE) Act of 1996," would:


             o    bar any government-mandated use of any particular
             encryption system, including key escrow systems and affirm
             the right of American citizens to use whatever form of
             encryption they choose domestically;


             o    loosen export restrictions on encryption products so
             that American companies are able to export any generally
             available or mass market encryption products without
             obtaining government approval; and


             o    limit the authority of the federal government to set
             standards for encryption products used by businesses and
             individuals, particularly standards which result in products
             with limited key lengths and key escrow.


        This is the second encryption bill I have introduced with Senator
        Burns and other congressional colleagues this year. Both bills
        call for an overhaul of this country's export restrictions on
        encryption, and, if enacted, would quickly result in the
        widespread availability of strong, privacy protecting
        technologies. Both bills also prohibit a government-mandated key
        escrow encryption system.  While PRO-CODE would limit the
        authority of the Commerce Department to set encryption standards
        for use by private individuals and businesses, the first bill we
        introduced, called the "Encrypted Communications Privacy Act",
        S.1587, would set up stringent procedures for law enforcement to
        follow to obtain decoding keys or decryption assistance to read
        the plaintext of encrypted communications obtained under court
        order or other lawful process.


        It is clear that the current policy towards encryption exports is
        hopelessly outdated, and fails to account for the real needs of
        individuals and businesses in the global marketplace.  Encryption
        expert Matt Blaze, in a recent letter to me, noted that current
        U.S. regulations governing the use and export of encryption are
        having a "deleterious effect ... on our country's ability to
        develop a reliable and trustworthy information infrastructure." 
        The time is right for Congress to take steps to put our national
        encryption policy on the right course.


        I am looking forward to hearing from you on this important issue.
        Throughout the course of the recent debate on the Communications
        Decency Act, the input from Internet users was very valuable to
        me and some of my Senate colleagues.


        You can find out more about the issue at my World Wide Web home
        page (http://www.leahy.senate.gov/) and at the Encryption Policy
        Resource Page (http://www.crypto.com/). Over the coming months, I
        look forward to the help of the Net community in convincing other
        Members of Congress and the Administration of the need to reform
        our nation's cryptography policy.


        Sincerely,


        Patrick Leahy
        United States Senator






        -----BEGIN PGP SIGNATURE-----
        Version: 2.6.2


        iQCVAwUBMYjdVBM5YGSLu9/1AQGFwwQArk/HYG65cSOr3dsykvkDFonjISjur7xb
        SEMCFLI3E4KSoXSy4+6cNogICGADxDnwI8j/29Gviu+d93eQ2veeNmKP43+r0R+S
        Zcv86b3/pK6btq3QqVN6+x3G8CEA2MnDtuSWbNyANEdValtpOYTCzU2Sm6gNfg9Q
        4QxUZ4R4+Ps=
        =VJ87
        -----END PGP SIGNATURE-----