Security and Freedom Through Encryption (SAFE) Act

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Security and Freedom Through 
Encryption (SAFE) Act''.

SEC. 2. SALE AND USE OF ENCRYPTION.

    (a) In General.--Part I of title 18, United States Code, is amended 
by inserting after chapter 121 the following new chapter:

        ``CHAPTER 122--ENCRYPTED WIRE AND ELECTRONIC INFORMATION

``2801. Definitions.
``2802. Freedom to use encryption.
``2803. Freedom to sell encryption.
``2804. Prohibition on mandatory key escrow.
``2805. Unlawful use of encryption in furtherance of a criminal act.
``Sec. 2801. Definitions
    ``As used in this chapter--
            ``(1) the terms `person', `State', `wire communication', 
        `electronic communication', `investigative or law enforcement 
        officer', `judge of competent jurisdiction', and `electronic 
        storage' have the meanings given those terms in section 2510 of 
        this title;
            ``(2) the terms `encrypt' and `encryption' refer to the 
        scrambling of wire or electronic information using mathematical 
        formulas or algorithms in order to preserve the 
        confidentiality, integrity, or authenticity of, and prevent 
        unauthorized recipients from accessing or altering, such 
        information;
            ``(3) the term `key' means the variable information used in 
        a mathematical formula, code, or algorithm, or any component 
        thereof, used to decrypt wire or electronic information that 
        has been encrypted; and
            ``(4) the term `United States person' means--
                    ``(A) any United States citizen;
                    ``(B) any other person organized under the laws of 
                any State, the District of Columbia, or any 
                commonwealth, territory, or possession of the United 
                States; and
                    ``(C) any person organized under the laws of any 
                foreign country who is owned or controlled by 
                individuals or persons described in subparagraphs (A) 
                and (B).
``Sec. 2802. Freedom to use encryption
    ``Subject to section 2805, it shall be lawful for any person within 
any State, and for any United States person in a foreign country, to 
use any encryption, regardless of the encryption algorithm selected, 
encryption key length chosen, or implementation technique or medium 
used.
``Sec. 2803. Freedom to sell encryption
    ``Subject to section 2805, it shall be lawful for any person within 
any State to sell in interstate commerce any encryption, regardless of 
the encryption algorithm selected, encryption key length chosen, or 
implementation technique or medium used.
``Sec. 2804. Prohibition on mandatory key escrow
    ``(a) Prohibition.--No person in lawful possession of a key to 
encrypted information may be required by Federal or State law to 
relinquish to another person control of that key.
    ``(b) Exception for Access for Law Enforcement Purposes.--
Subsection (a) shall not affect the authority of any investigative or 
law enforcement officer, acting under any law in effect on the 
effective date of this chapter, to gain access to encrypted 
information.
``Sec. 2805. Unlawful use of encryption in furtherance of a criminal 
              act
    ``Any person who willfully uses encryption in furtherance of the 
commission of a criminal offense for which the person may be prosecuted 
in a court of competent jurisdiction--
            ``(1) in the case of a first offense under this section, 
        shall be imprisoned for not more than 5 years, or fined in the 
        amount set forth in this title, or both; and
            ``(2) in the case of a second or subsequent offense under 
        this section, shall be imprisoned for not more than 10 years, 
        or fined in the amount set forth in this title, or both.''.
    (b) Conforming Amendment.--The table of chapters for part I of 
title 18, United States Code, is amended by inserting after the item 
relating to chapter 33 the following new item:

``122. Encrypted wire and electronic information............    2801''.

SEC. 3. EXPORTS OF ENCRYPTION.

    (a) Amendment to Export Administration Act of 1979.--Section 17 of 
the Export Administration Act of 1979 (50 U.S.C. App. 2416) is amended 
by adding at the end thereof the following new subsection:
    ``(g) Computers and Related Equipment.--
            ``(1) General rule.--Subject to paragraphs (2), (3), and 
        (4), the Secretary shall have exclusive authority to control 
        exports of all computer hardware, software, and technology for 
        information security (including encryption), except that which 
        is specifically designed or modified for military use, 
        including command, control, and intelligence applications.
            ``(2) Items not requiring licenses.--No validated license 
        may be required, except pursuant to the Trading With The Enemy 
        Act or the International Emergency Economic Powers Act (but 
        only to the estent that the authority of such Act is not 
        exercised to extend controls imposed under this Act), for the 
        export or reexport of--
                    ``(A) any software, including software with 
                encryption capabilities--
                            ``(i) that is generally available, as is, 
                        and is designed for installation by the 
                        purchaser; or
                            ``(ii) that is in the public domain for 
                        which copyright or other protection is not 
                        available under title 17, United States Code, 
                        or that is available to the public because it 
                        is generally accessible to the interested 
                        public in any form; or
                    ``(B) any computing device solely because it 
                incorporates or employs in any form software (including 
                software with encryption capabilities) exempted from 
                any requirement for a validated license under 
                subparagraph (A).
            ``(3) Software with encryption capabilities.--The Secretary 
        shall authorize the export or reexport of software with 
        encryption capabilities for nonmilitary end-uses in any country 
        to which exports of software of similar capability are 
        permitted for use by financial institutions not controlled in 
        fact by United States persons, unless there is substantial 
        evidence that such software will be--
                    ``(A) diverted to a military end-use or an end-use 
                supporting international terrorism;
                    ``(B) modified for military or terrorist end-use; 
                or
                    ``(C) reexported without any authorization by the 
                United States that may be required under this Act.
            ``(4) Hardware with encryption capabilities.--The Secretary 
        shall authorize the export or reexport of computer hardware 
        with encryption capabilities if the Secretary determines that a 
        product offering comparable security is commercially available 
        outside the United States from a foreign supplier, without 
        effective restrictions.
            ``(5) Definitions.--As used in this subsection--
                    ``(A) the term `encryption' means the scrambling of 
                wire or electronic information using mathematical 
                formulas or algorithms in order to preserve the 
                confidentiality, integrity, or authenticity of, and 
                prevent unauthorized recipients from accessing or 
                altering, such information;
                    ``(B) the term `generally available' means, in the 
                case of software (including software with encryption 
                capabilities), software that is offered for sale, 
                license, or transfer to any person without restriction, 
                whether or not for consideration, including, but not 
                limited to, over-the-counter retail sales, mail order 
                transactions, phone order transactions, electronic 
                distribution, or sale on approval;
                    ``(C) the term `as is' means, in the case of 
                software (including software with encryption 
                capabilities), a software program that is not designed, 
                developed, or tailored by the software publisher for 
                specific purchasers, except that such purchasers may 
                supply certain installation parameters needed by the 
                software program to function properly with the 
                purchaser's system and may customize the software 
                program by choosing among options contained in the 
                software program;
                    ``(D) the term `is designed for installation by the 
                purchaser' means, in the case of software (including 
                software with encryption capabilities) that--
                            ``(i) the software publisher intends for 
                        the purchaser (including any licensee or 
                        transferee), who may not be the actual program 
                        user, to install the software program on a 
                        computing device and has supplied the necessary 
                        instructions to do so, except that the 
                        publisher may also provide telephone help line 
                        services for software installation, electronic 
                        transmission, or basic operations; and
                            ``(ii) the software program is designed for 
                        installation by the purchaser without further 
                        substantial support by the supplier;
                    ``(E) the term `computing device' means a device 
                which incorporates one or more microprocessor-based 
                central processing units that can accept, store, 
                process, or provide output of data; and
                    ``(F) the term `computer hardware', when used in 
                conjunction with information security, includes, but is 
                not limited to, computer systems, equipment, 
                application-specific assemblies, modules, and 
                integrated circuits.''.
    (b) Continuation of Export Administration Act.--For purposes of 
carrying out the amendment made by subsection (a), the Export 
Administration Act of 1979 shall be deemed to be in effect.

Summary: Security and Freedom Through Encryption (SAFE) Act - Amends the Federal criminal code to permit any person within any State, and any US person in a foreign country, to use any encryption regardless of the encryption algorithm selected, encryption key length chosen, or implementation technique or medium used, with an exception for the unlawful use of encryption in furtherance of a criminal act. Allows any person within any State to sell in interstate commerce any encryption. Specifies that no person in lawful possession of a key to encrypted information may be required by Federal or State law to relinquish to another person control of that key, with an exception for access for law enforcement purposes. Sets penalties for the willful use of encryption in furtherance of the commission of a criminal offense. Amends the Export Administration Act of 1979 to grant the Secretary of Commerce exclusive authority to control exports of all hardware, software, and technology for information security , except that which is specifically designed or modified for military use. Prohibits requiring any validated license for the export or reexport of any: (1) software, including software with encryption capabilities that is generally available as is and that is designed for installation by the purchaser, or that is in the public domain for which copyright or other protection is not available or is available to the public because it is generally accessible to the public in any form. Or (2) computing device solely because it incorporates or employs in any form software exempted from any requirement for a validated license under this section. Directs the Secretary to authorize the export or reexport of: (1) software with encryption capabilities for nonmilitary end-uses in any country to which exports of software of similar capability are permitted for use by financial institutions not controlled in fact by US persons, unless there is substantial evidence that such software will be diverted to a military end-use or an end-use supporting international terrorism, modified for military or terrorist end-use, or reexported without any US authorization that may be required under the Act. And (2) computer hardware with encryption capabilities if the Secretary determines that a product offering comparable security is commercially available outside the United States from a foreign supplier without effective restrictions.