IP: from EPIC Alert 3.05

[Dave Farber <farber () central cis upenn edu>]

=======================================================================
[2] Draft Crypto Bill Circulating
=======================================================================


Senator Patrick Leahy (D-VT) is expected to introduce the Encrypted
Communications Privacy Act of 1996 within the next week.  The bill
attempts to answer a number of unresolved issues concerning the use of
encryption technology.  Among the key features, the bill:


- Creates a legal framework for key escrow agents including the 
obligations to disclose keys and assist law enforcement, and sets 
penalties for improper disclosure;


- Criminalizes the use of encryption which may have the effect of 
obstructing a felony investigation;


- Affirms the freedom to use encryption; and


- Relaxes export controls by transferring authority for export 
decisions to the Secretary of Commerce.


The bill reflects a number of the recommendations made by EPIC, EFF,
the USACM and various industry and trade groups to relax export control
law and affirm the freedom to use all forms of encryption. However, the
bill does little to roll back the deployment of Clipper-inspired
encryption in the federal government or remove the classification
restrictions on encryption policy that currently block public scrutiny
of government policy.


The bill also brings into sharp focus the problems with key escrow
encryption.  The bill makes clear that escrow agents could face
staggering liability -- criminal prosecution if they fail to comply
with what are currently ill-defined obligations to assist law
enforcement and civil liability if keys are improperly disclosed or
trade secrets improperly released.  There is also no indication that
Congress has yet considered the risks to network vulnerability or
record integrity if key escrow is widely deployed.


EPIC will provide a copy of the bill online as soon as it is formally
introduced.  Check the EPIC crypto page for this and other developments
relating to encryption policy:


   http://www.epic.org/crypto/