```

[House Hearing, 106 Congress]
[From the U.S. Government Publishing Office]

 
                 ENCRYPTION SECURITY IN A HIGH TECH ERA

=======================================================================

                                HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                INTERNATIONAL ECONOMIC POLICY AND TRADE

                                 OF THE

                              COMMITTEE ON
                        INTERNATIONAL RELATIONS
                        HOUSE OF REPRESENTATIVES

                       ONE HUNDRED SIXTH CONGRESS

                             FIRST SESSION

                               __________

                         TUESDAY, MAY 18, 1999

                               __________

                           Serial No. 106-108

                               __________

    Printed for the use of the Committee on International Relations

 Available via the World Wide Web: http://www.house.gov/international 
                               relations

                                 ______

                    U.S. GOVERNMENT PRINTING OFFICE
64-674 CC                   WASHINGTON : 2000

                  COMMITTEE ON INTERNATIONAL RELATIONS

                 BENJAMIN A. GILMAN, New York, Chairman
WILLIAM F. GOODLING, Pennsylvania    SAM GEJDENSON, Connecticut
JAMES A. LEACH, Iowa                 TOM LANTOS, California
HENRY J. HYDE, Illinois              HOWARD L. BERMAN, California
DOUG BEREUTER, Nebraska              GARY L. ACKERMAN, New York
CHRISTOPHER H. SMITH, New Jersey     ENI F.H. FALEOMAVAEGA, American 
DAN BURTON, Indiana                      Samoa
ELTON GALLEGLY, California           MATTHEW G. MARTINEZ, California
ILEANA ROS-LEHTINEN, Florida         DONALD M. PAYNE, New Jersey
CASS BALLENGER, North Carolina       ROBERT MENENDEZ, New Jersey
DANA ROHRABACHER, California         SHERROD BROWN, Ohio
DONALD A. MANZULLO, Illinois         CYNTHIA A. McKINNEY, Georgia
EDWARD R. ROYCE, California          ALCEE L. HASTINGS, Florida
PETER T. KING, New York              PAT DANNER, Missouri
STEVEN J. CHABOT, Ohio               EARL F. HILLIARD, Alabama
MARSHALL ``MARK'' SANFORD, South     BRAD SHERMAN, California
    Carolina                         ROBERT WEXLER, Florida
MATT SALMON, Arizona                 STEVEN R. ROTHMAN, New Jersey
AMO HOUGHTON, New York               JIM DAVIS, Florida
TOM CAMPBELL, California             EARL POMEROY, North Dakota
JOHN M. McHUGH, New York             WILLIAM D. DELAHUNT, Massachusetts
KEVIN BRADY, Texas                   GREGORY W. MEEKS, New York
RICHARD BURR, North Carolina         BARBARA LEE, California
PAUL E. GILLMOR, Ohio                JOSEPH CROWLEY, New York
GEORGE RADAVANOVICH, Califorina      JOSEPH M. HOEFFEL, Pennsylvania
JOHN COOKSEY, Louisiana
THOMAS G. TANCREDO, Colorado
                    Richard J. Garon, Chief of Staff
          Kathleen Bertelsen Moazed, Democratic Chief of Staff
                                 ------                                

        Subcommittee on International Economic Policy and Trade

                ILEANA ROS-LEHTINEN, Florida, Chairwoman
DONALD A. MANZULLO, Illinois         ROBERT MENENDEZ, New Jersey
STEVEN J. CHABOT, Ohio               PAT DANNER, Missouri
KEVIN BRADY, Texas                   EARL F. HILLIARD, Alabama
GEORGE RADANOVICH, California        BRAD SHERMAN, California
JOHN COOKSEY, Louisiana              STEVEN R. ROTHMAN, New Jersey
DOUG BEREUTER, Nebraska              WILLIAM D. DELAHUNT, Massachusetts
DANA ROHRABACHER, California         JOSEPH CROWLEY, New York
TOM CAMPBELL, California             JOSEPH M. HOEFFEL, Pennsylvania
RICHARD BURR, North Carolina
             Mauricio Tamargo, Subcommittee Staff Director
        Jodi Christiansen, Democratic Professional Staff Member
                Yleem Poblete, Professional Staff Member
                     Camilla Ruiz, Staff Associate

                            C O N T E N T S

                              ----------                              

                               WITNESSES

                                                                   Page

William Reinsch, Under Secretary of Commerce, Bureau of Export 
  Administration.................................................     9
Barbara McNamara, Deputy Director, National Security Agency......    11
Ron Lee, Assistant Attorney General, National Security, 
  Department of Justice..........................................    13
Gene Voegtlin, Esq., Legislative Counsel, International 
  Association of Chiefs of Police................................    15
Ira Rubinstein, Senior Corporate Attorney, Microsoft Corporation.    41
Jeffrey Smith, General Counsel, Americans for Computer Privacy...    43
David Weiss, Vice President of Product Marketing, CITRIX 
  Corporation....................................................    44
Alan Davidson, Staff Counsel, Center for Democracy and Technology    45
Dinah Pokempner, Deputy General Counsel, Human Rights Watch......    47
Ed Black, President and CEO, Computer and Communications Industry 
  Association....................................................    48

                 ENCRYPTION SECURITY IN A HIGH TECH ERA

                              ----------                              

                         Tuesday, May 18, 1999

                  House of Representatives,
             Subcommittee on International Economic
                                          Policy and Trade,
                              Committee on International Relations,
        Washington, D.C.
    The Subcommittee met, pursuant to notice at 2:15 p.m., in 
room 2172, Rayburn House Office Building, Hon. Ileana Ros-
Lehtinen [Chairwoman of the Subcommittee] presiding.
    Ms. Ros-Lehtinen. [presiding] The Subcommittee will come to 
order.
    I apologize for arriving late. I had to give a brief remark 
on a luncheon that Congressman Menendez, Mr. Gilman, and I are 
hosting for Cuban political prisoners tomorrow. So I hope that 
all of you could join us in room 2200 at 1 p.m. So I was 
speaking on the Floor and I was unavoidably delayed. Thank you 
so much for your patience and I apologize especially to my 
Ranking Member.
    Someone once said I used to think that cyberspace was 50 
years away. What I thought was 50 years away was only 10 years 
away. What I thought was 10 years away, it was already here, I 
just wasn't aware of it yet. This applies to the debate today 
on encryption where it seems our policy is trying to play a 
game of catch up with our technological advancements.
    The Internet has rapidly expanded as a form in which to 
conduct business transactions, and millions of messages are 
transferred in a matter of seconds across oceans and 
continents, over barriers of languages and culture. Information 
that used to take hours to transfer can now be sent in a matter 
of seconds. Contracts are completed in minutes. Mergers in what 
seems instantaneously. In an increasingly diverse and 
globalized marketplace, the availability and efficiency of 
electronic businesses is becoming more appealing for companies 
hoping to keep a competitive advantage in international trade, 
maintaining their dominance in or seeking to capture the market 
of brain-power industries.
    As these types of information transfers become more common, 
fear has emerged about their security and about the 
interception of messages and transactions by those who seek to 
steal or sabotage. Technology to prevent these types of 
invasions and violations of personal, corporate, and government 
security by encoding digital information already exists. It is 
what we call encryption. A need for commercial encryption 
rapidly developed with the growth of the global economy and, 
with it, so did concerns over exporting this technology to our 
overseas counterparts. The business community, the 
Administration, and law enforcement entities have been at odds 
as to how to best promote American technological products 
abroad while ensuring that our security, both national and 
economic, are not threatened by the export of American-designed 
encryption products.
    The Administration has stated its concerns about possible 
threats to U.S. national security and to public safety, which 
they feel would arise if criminals and terrorists were to use 
encryption that the U.S. Government could not penetrate. They 
fear that if there were no export controls on encryption and no 
key recovery features on the products we sell in overseas 
markets, it would further complicate and impede law enforcement 
efforts at tracking down terrorists or other criminals who use 
computers in their efforts to promote violent terrorist acts or 
who commit economic sabotage.
    Opponents of the Administration's view argue that export 
controls cannot prevent access to strong non key recovery 
encryption by criminals because it is widely available 
elsewhere, including over the Internet where it can be easily 
downloaded from foreign company sites. They add that the one 
thing these controls are ensuring is U.S. companies losing 
market shares to foreign competitors. Currently, there are no 
statutory restrictions on the domestic use of encryption, but 
the industry argues that restrictive export controls have 
hampered technological development and will continue to thwart 
U.S. efforts until American companies will lose their current 
technological dominance. There is a need for strong encryption 
for domestic use and cross-border communications and 
transactions.
    While the Administration argues that it has continued to 
promote stronger encryption products of greater than 56 bits, 
it has done so under the condition that these be designed with 
key recovery features where a third-party would have access to 
a key to decrypt the information. Further, the Administration's 
decision to liberalize exports for certain industries ignores 
the security needs of other sectors left unprotected by current 
restrictions.
    Privacy advocates contend that the Administration has been 
utilizing the export control process to influence whether 
companies developed key recovery encryption products by 
facilitating the exportation of these products and making it 
more difficult to export unrecoverable encryption products. 
They further state that the national security arguments fail 
any test of logic that strong encryption serves as a deterrent 
to criminal activity by making it difficult for those who 
engage in espionage to penetrate the system.
    Aside from the fact that all parties agree about the 
important role of encryption in electronic commerce, little 
consensus has been reached on the issue of export controls. The 
SAFE Act is one of the several legislative attempts at 
codifying existing domestic use policy and at liberalizing U.S. 
export control regulations to compete successfully in the 
global arena. This will be one of the issues we hope to cover 
today as we attempt to debate the future of encryption and the 
effects of controls on our technological market.
    I would like to recognize our Ranking Member, Mr. Menendez 
of New Jersey for his opening statement. Mr. Menendez.
    Mr. Menendez. Thank you, Madam Chair Lady, and I am happy 
to see that we are having this hearing which I think is an 
incredibly important one the Committee has jurisdiction over, 
and one that I think is going to be a part of making sure, 
along with the Export Administration Act and a few other issues 
that this Committee has jurisdiction in, that continues to fuel 
America's competitiveness in the future. The decisions that we 
make are going to affect American industry and American 
competitiveness in this new millennium.
    Now anyone who has been on the Internet and purchased a 
book from Amazon.com or ordered an airline ticket online is 
familiar with encryption technology. In the information age, 
encryption technology is like a Wells Fargo truck. It keeps 
your information under lock and key and delivers it only to its 
intended end-user. Encryption technology is crucial to the 
development of electronic commerce, which is growing by leaps 
and bounds. According to Under Secretary Reinsch's testimony, 
electronic commerce transactions in 1996 were $12 million, but 
are projected to reach $2.1 billion by the year 2000.
    So I think we need to be clear, from the very outset, that 
the encryption debate is not about who does and who does not 
support our national security interests. None of us who support 
moving encryption technology forward believe that we would do 
anything to risk the national security of the United States. I 
do not care for those who would suggest that, in fact, we do. 
No one is advocating a policy that would intentionally 
compromise U.S. national security or the safety of American 
citizens. The encryption debate is more about whether or not it 
is too late for the U.S. Government and law enforcement to 
control the spread of non key recovery encryption products in 
the U.S. and abroad.
    Clearly, we should consider the value of controlling only 
the strongest encryption technologies. However, the value of 
controlling anything over 56-bit technology when 128-bit 
technology can be downloaded from the Internet, is 
questionable. American industry is rightly concerned about 
losing market shares to foreign competitors who have no 
restrictions on their products. We can be certain that if the 
United States cannot offer non key recovery encryption 
technology overseas, that consumers will buy it from the 
French, Japanese, and Israeli companies who are making similar 
products. Or from American companies who establish companies 
overseas, produce the intellectual property there, and that 
ultimately means job losses here at home as well as revenue 
losses here at home.
    Now the goal of the FBI, NSA, and law enforcement agencies 
is well-founded. The key recovery system would ensure that they 
have access to the requisite data to snag criminals or track 
suspected criminal activities. Yet the proliferation of non key 
recovery technology within the United States and abroad and the 
rapid speed at which this industry is developing leads me to 
believe that the Administration's policy is too little, too 
late.
    I look forward to hearing the testimony of our witnesses, 
in particular, the representatives from the FBI and NSA. I 
would very much like to hear your views on current policy and 
your concerns with the Goodlatte legislation. I will do so with 
an open mind, but I believe we cannot turn back the clock as we 
move forward into a new millennium. Thank you, Madam 
Chairwoman.
    Ms. Ros-Lehtinen. Thank you so much, Mr. Menendez. We are 
thrilled to have the Chairman of our Committee, Congressman Ben 
Gilman of New York, join us. It shows the high level of 
importance that he gives to this issue of encryption. Welcome, 
Mr. Gilman.
    Mr. Gilman. Thank you, Madam chairman. I want to thank you 
for arranging this hearing with these experts who are all 
prepared to testify before us today. You certainly have a good 
cross-section of views assembled. I welcome this opportunity to 
attend this very important hearing on security in the high-tech 
era and on the Security and Freedom through Encryption Act, the 
SAFE Act, H.R. 850, sponsored by the gentleman from Virginia, 
Mr. Goodlatte, and the gentle lady from California, Ms. 
Lofgren.
    I am pleased that the witnesses before us today come from a 
broad cross-section of the law enforcement community, export 
control and intelligence agencies, human rights and privacy 
advocates, and the private sector representatives. I would like 
to compliment you, Madam Chair, for your holding this hearing 
at this time and taking a leading role on this vitally 
important issue.
    I would like to remind my colleagues that on Thursday of 
this week at 9 a.m., the Chairman of the Intelligence 
Committee, Mr. Porter, and I will be co-hosting a members-only 
classified briefing on the implications of decontrolling the 
export of encryption products. I urge our colleagues on this 
Committee to attend if they would like to have a full 
perspective on the national security and intelligence aspects 
of the encryption issue.
    In my view, before we begin the process of making sweeping 
changes in our export control laws, Congress should avail 
itself of all the information we can obtain in all venues 
available to us. With the United States participating in a 
NATO-led military operation against Serbia, we should be doubly 
cautious in this respect because of the possibility of 
terrorist attacks on our interests. I am very concerned that 
the enactment of a SAFE Act would make strong encryption all 
the more available to our adversaries and would undermine 
international efforts to modernize and improve multilateral 
export controls under the Wassenaar arrangement.
    I draw the attention of the Subcommittee Members to the 
recent statement of the International Association of the Chiefs 
of Police. ``Unchecked proliferation of encryption technology 
poses an enormous danger to both law enforcement and to society 
as a whole.'' In a May 12th letter that we received from B'nai 
Brith International, its president Richard Heideman noted 
that--and I quote--``Unlimited proliferation of nonrecoverable 
encryption products may result in their use by terrorist 
groups, by narcotics traffickers, by members of organized 
crime, and other dangerous criminals to the detriment of our 
Nation's national security and public safety.'' Mr. Heideman 
concluded that his organization has strong reservations about 
the Security and Freedom through Encryption Act and urges that 
Congress maintain meaningful export safeguards.
    Unlimited proliferation of this technology only makes the 
street-corner drug dealer further immune from the consequences 
of his and others' actions. The drug trade costs us billions 
each year in crime, in health care costs, lost worker 
productivity, destroyed families, and lost young lives. Let us 
not contribute to that carnage under the guise of greater trade 
and commerce.
    For those who say that this encryption technology is 
already readily available abroad, they often fail to remind you 
that foreign governments, in most cases, have also retained the 
right to access in protection of their national security 
interests. Those governments are not naive, nor should we be. 
While we are still waiting for the final version of the Cox 
report on high-tech exports to China, many of their 
recommendations are already public. Among them are concrete 
suggestions on how to strengthen the successor regime of the 
Cold War COCOM export system. Its modern-day equivalent, the 
so-called Wassenaar arrangement has just agreed to modernize 
our multilateral encryption export control system, yet the 
enactment of the SAFE Act would undercut that arrangement and 
the findings of the Cox report.
    Accordingly, I urge my colleagues not to rush to judgment 
on an issue such as this which directly affects our national 
security and our law enforcement needs. I thank the gentle lady 
for recognizing me.
    Ms. Ros-Lehtinen. Thank you so much, Chairman Gilman. Mr. 
Delahunt.
    Mr. Delahunt. I thank you, Madam. I just would welcome my 
colleague from the Judiciary Committee and acknowledge the 
presence of Mr. Goodlatte, one of the primary sponsors. I want 
to personally welcome him.
    Ms. Ros-Lehtinen. Thank you, Mr. Delahunt. Mr. Bereuter.
    Mr. Bereuter. Madam Chairman, it is an important hearing 
today. I have been following this issue for quite some period 
of time now. I agree with many of the comments made by Chairman 
Gilman. We do need to be concerned about the implications for 
law enforcement and national security and a lot of the best 
information we have in the way of documentation of its 
importance is classified. On the other hand, we need to make 
sure that we do in the way we control things does not have an 
unnecessary anti-competitive factor which is brought to bear. 
So I will say nothing further, but look forward to the 
testimony of two large and important groups of panelists.
    Ms. Ros-Lehtinen. Thank you, Doug. The sponsor of the bill, 
Mr. Goodlatte. We are honored to have you with us today.
    Mr. Goodlatte. Madam Chairman, first let me thank you for 
holding this hearing and for being very gracious in allowing 
me, a non-Member of the Committee, to participate. I would also 
like to thank the Ranking Member, Mr. Menendez, and Chairman 
Gilman for their participation in this and for allowing me to 
participate as well.
    I do have a statement that I would ask to be made a part of 
the record.
    Ms. Ros-Lehtinen. Without objection.
    [The information referred to appears in the appendix.]
    Mr. Goodlatte. I also have an article written by 
Congressman Chris Cox, the Chairman of the Cox Commission, who 
advocates a strong export policy with regard to exporting 
encryption, making it more available, entitled ``China: Export 
of Technology Would be Liberating Force,'' in which he 
advocates the export of strong encryption.
    Madam Chairman, this much-needed bipartisan legislation 
currently has 253 cosponsors, about 110 Democrats, about 140 
Republicans; a majority of the Republican and Democratic 
leadership in the House are cosponsors as are two-thirds of the 
Members of the International Relations Committee and all but 4 
Members of this Subcommittee, and it accomplishes several 
important goals. First and foremost, strong encryption in the 
hands of the good guys, if you will, helps to prevent a number 
of the concerns that have been raised by some of the Members of 
the Committee, which are legitimate concerns by law enforcement 
and national security, but making sure that we have strong 
encryption to protect e-mail, medical records, financial 
transactions, copyrighted material, industrial trade secrets, 
and a whole host of other areas, as well as preventing major 
terrorist and criminal activities such as breaking into the New 
York Stock Exchange or the Chicago Board of Trade or a nuclear 
power plant or the electric power grid of the United States are 
all very positive purposes that are hindered by a policy that 
discourages the use of strong encryption and which is the 
policy that we have today.
    The gentleman from New Jersey mentioned the use of 
encryption by companies like Amazon.com and others who do 
business on the Internet. Amazon.com cannot use the 128-bit 
strong encryption that they use for domestic sales 
internationally, unless they acquire it from a foreign vendor. 
This, to me, seems to be a ludicrous consequence of the policy 
that we currently confront in this country.
    I'll give you another personal experience that I came 
across recently when I led a congressional delegation to Europe 
to deal with electronic commerce issues. In Brussels, in 
meeting with the deputy chief of the U.S. mission there, he 
indicated to me that he has worked with the National Security 
Agency and the FBI and other agencies on a regular basis on 
issues like this. But his own personal experience colored his 
view of the need for significant change in our export control 
laws when he told me that he bought a $2,000 computer system 
which was shipped to him from the United States and he then 
received a phone call from the company that sold it to him 
telling him they could not send him the software because it 
violated American export control laws. So he went down the 
street to a little shop in Brussels and purchased the software 
that he needed there.
    Today there are more than 20 significant strong companies 
in Europe creating encryption software that are major 
competitors to the United States that did not exist just a few 
years ago. What we are confronted with is a circumstance in 
which we are already beginning to see significant erosion in 
the U.S. dominance of the software and hardware computer 
industry because of the fact that most major software and 
hardware today has strong encryption built into it, and if you 
can't export it out of the United States, you are better off 
dealing with a company overseas because if you are, for 
example, a company with branches in London, Paris, Tokyo, New 
York, and San Francisco, you can buy these products 
domestically--there is no limitation on the domestic use of 
strong encryption--and use them in your New York and San 
Francisco offices, but you can't send them to your London, 
Paris, and Tokyo office.
    However, if you buy it from a German company, to use an 
example, there are no import restrictions on strong encryption. 
So you can import the German products, use it at your New York 
and San Francisco offices and also send it to your London, 
Paris, and Tokyo offices. This is the crux of the problem that 
we have in not facing up to the fact that encryption is not 
like other items that are strongly suitable for export 
controls.
    Bombs, jets, mainframe computers are all products that are 
manufactured in a few places, sent to a few places, and the 
export of the products from this country can be a choke hold on 
making sure they don't go to inappropriate places. But 
encryption is not a tangible thing. It is a mathematical 
algorithm. It is little ones and zeros going through fiber-
optic wires and by satellite all over the world. So it is my 
hope that we will be able to move forward with this 
legislation, which will help to create and protect American 
jobs, which will help to fight crime in a whole host of ways, 
and which will protect the privacy of law-abiding American 
citizens and I very much thank you for the opportunity to 
participate today.
    Ms. Ros-Lehtinen. Thank you so much, Bob. Congressman Burr.
    Mr. Burr. Thank you, Madam Chairman. Let me just say that, 
my good friend Mr. Goodlatte, I had hoped that after we 
dispensed with this in Commerce last year that law enforcement 
and the technology businesses would find the agreement that 
could move forward together. Unfortunately, I don't have the 
impression that we are there. That as you talked about the 
inability to export software, I think a year from now, with the 
new chips, we will, in fact, find ourselves not exporting the 
computer. I think we have some bigger problems to deal with.
    I would suggest today to my colleagues that the way to find 
the answer is not to dig our heels in the sand and say we can't 
move from where we are. In fact, the challenge to each of us is 
to find where that balance is, to move there, and not to find 
new ways to drive technology offshore where, for a short-term 
gain, we do significant long-term damage to not only the 
development of business in this country and the creation of 
jobs, but to our national security which is an area that we are 
all sensitive to.
    Technology has few boundaries, as my good friend Mr. 
Goodlatte referred to, and our ability to understand 
technology's flow around the world is, in fact, a significant 
key to our understanding of where we move with legislation. 
Madam chairman, I am only hopeful that all Members will 
encourage not only the business sector, but the law enforcement 
sector to work a little bit harder to try to find a compromise, 
one that facilitates the business needs of the future, the 
development of technology, and also provides some assurances of 
law enforcement's access. Clearly, if technology is that 
advanced in intelligence, I am hopeful that somebody will 
transmit an updated map to our intelligence agencies. Maybe we 
won't have quite the problem that we have had over the past 
week.
    Technology is a tremendous tool. It is a tremendous tool 
for every person in the world. It will become more the tool for 
opening up not only closed markets, but closed societies in the 
future. We have to find a way to make this work, to make it 
work for all who have a concern and to utilize this tool to its 
fullest. I am confident that this hearing and many others that 
we will have this session of Congress will help us to get to 
that legislation. I thank the Chair and I yield back.
    Ms. Ros-Lehtinen. Thank you. Mr. Radanovich.
    Mr. Radanovich. Thank you, Madam Chair, I will be brief. I 
would like to submit a statement for the record.
    Ms. Ros-Lehtinen. Without objection.
    [The information referred to appears in the appendix.]
    Mr. Radanovich. Thank you. But do want to state my wish 
that we get a bill forward sometime this session that would 
open up markets for U.S. business and, at the same time, 
preserve our security. I appreciate the chairwoman for having 
this hearing and hopefully we can move this issue forward and 
get it dealt with. Thank you very much.
    Ms. Ros-Lehtinen. Thank you so much. Mr. Rohrabacher.
    Mr. Rohrabacher. I would just like to say that Mr. 
Goodlatte has put a lot of effort into this and is a very 
patriotic American and where we have had our disagreements in 
the past, I think that he is using good judgment here and I am 
very happy to be a cosponsor of this bill.
    Ms. Ros-Lehtinen. Thank you. Thank you so much for your 
patience, all of you in the audience and our panelists as well. 
We will first hear from Bill Reinsch, who currently serves as 
the under secretary for export Administration in the Department 
of Commerce. As head of this bureau, Mr. Reinsch is charged 
with administering and enforcing the export control policies of 
the U.S. Government. Before joining the Department of Commerce, 
he served on the staffs of several Members of Congress who are 
extensively involved with international trade issues. He has 
testified before this Subcommittee many times and we are glad 
to have you back, Bill. Thank you.
    Next will be Barbara McNamara, who is Deputy Director of 
the National Security Agency. From 1995 to 1997, Ms. McNamara 
served as the Deputy Director of operations, National Security 
Agency of the Central Security Service. Prior to that, she 
served as the NSA representative to the Department of Defense, 
as well as chief of the Office of International Economics and 
Global Issues in the Operations Organization. Ms. McNamara 
began her career in the National Security Agency as a linguist 
and served in a variety of analytical and management positions 
in the Operations Office. Thank you so much for being with us.
    Ronald Lee is the associate deputy attorney general for the 
Department of Justice. He is currently the Acting Director of 
the Executive Office of National Security at the Department. He 
has served as the program manager for the development of the 
Administration's 5-year counter terrorism and technology crime 
plan. In 1994, Mr. Lee was appointed as general counsel of the 
National Security and served as their chief legal officer 
representing the NSA in all legal matters. Welcome, Mr. Lee, to 
our panel.
    We also have a representative from the International 
Association of Chiefs of Police, who is pro-export controls, 
but he does not represent the Administration. Mr. Gene Voegtlin 
is the legislative counsel of the International Association of 
Chiefs of Police. In this position, he is responsible for 
directing the day-to-day implementation of the Association's 
government affairs program. Prior to joining the Association, 
Mr. Voegtlin served as the Director of legislative and 
political affairs for the National Federation of Federal 
Employees. His prior experience also includes serving as a 
legislative representative of the Federal Managers Association 
and the American Chemical Society. We welcome you, Mr. 
Voegtlin, today.
    We will begin with the Honorable Mr. Reinsch. Thank you, 
Bill.

  STATEMENT OF WILLIAM REINSCH, UNDER SECRETARY OF COMMERCE, 
                BUREAU OF EXPORT ADMINISTRATION

    Mr. Reinsch. Thank you very much, Madam chairman. It is a 
pleasure to be here with you again to testify on the direction 
of the Administration's encryption policy. I would appreciate, 
Madam chairman, if you would put my full statement in the 
record.
    Ms. Ros-Lehtinen. Correct. Without objection, we will glad 
to put all of your statements into the record.
    Mr. Reinsch. Thank you. Notwithstanding the comments of 
some of your colleagues, Madam Chairman, I think we have made a 
great deal of progress in this area since the last time I was 
here. But it is still, nevertheless, obvious that encryption 
remains a hotly debated issue.
    The Administration continues to support a balanced approach 
which considers privacy and commerce, as well as protecting 
important law enforcement and national security equities. We 
have been consulting closely with industry and its customers to 
develop policy that provides that balance in a way that also 
reflects the evolving realities of the marketplace. The 
Internet and other digital media are becoming increasingly 
important to the conduct of international business. Mr. 
Menendez used one of my better statistics and so I think I will 
skip over the other ones in my statements and you can read 
them. But I think there is no disagreement over that point, in 
any event.
    Clearly, many service industries, which traditionally 
required face-to-face interaction, such as banks, other 
financial institutions, and retail merchants, are now providing 
cyberservice. Customers can now sit at their home computers and 
access their banking and investment accounts or buy a winter 
jacket with a few strokes of their keyboard. Furthermore, most 
businesses maintain their records and other proprietary 
information electronically. They now conduct many of their day-
to-day communications and business transactions via the 
Internet and e-mail. An inevitable byproduct of this growth of 
electronic commerce is the need for strong encryption to 
provide the necessary secure infrastructure for digital 
communications, transactions, and networks.
    Developing a new policy in this area has been complicated 
because we do not want to hinder encryption's legitimate use, 
particularly for electronic commerce yet, at the same time, we 
want to protect our vital national security foreign policy and 
law enforcement interests. During the past 3 years, we have 
learned that there are many ways to assist in lawful access. 
There is no one-size-fits-all solution. On September 22nd of 
last year, we published a regulation implementing our decision 
to allow the export under a license exception of unlimited 
strength encryption to banks and financial institutions located 
in countries that are Members of the Financial Action Task 
Force or which have effective anti-money laundering laws.
    The further result of our ongoing dialogue with industry 
was an update to our encryption policy which the Vice President 
unveiled last September 16th. The regulations implementing the 
update were published on December 31. This will not end the 
debate over encryption controls, but we believe the regulation 
addresses some private sector concerns by opening large markets 
and further streamlining exports. The update reduced controls 
on exports of 56-bit products and, for certain industry 
sectors, on exports of products of unlimited bit length, 
whether or not they contain recovery features.
    In developing our policy, we identified key sectors that 
can form the basis of a secure infrastructure for communicating 
and storing information: banks, a broad range of financial 
institutions, insurance companies, online merchants, and health 
facilities. Many of the updates permit the export of encryption 
to these end-users under a license exception. The policy also 
allows for exports of 56-bit software and most hardware to any 
end-user under a license exception; exports of strong 
encryption, including technology to U.S. companies and their 
subsidiaries, under a license exception, to protect important 
business proprietary information; and approval under a 
licensing arrangement of recovery-capable or recoverable 
encryption products of any key length to recipients located in 
46 countries. Such products include systems that are managed by 
a network or corporate security administrator.
    In December, through the hard work of Ambassador David 
Aaron, the President's special envoy on encryption, the 
Wassenaar arrangement's members agreed on several changes 
related to encryption controls. Specific changes to 
multilateral encryption controls included removing them on all 
encryption products at or below 56-bits and on certain consumer 
items regardless of key length.
    Most importantly--and I want to take a moment on this, 
Madam chairman--the Wassenaar members agreed to remove 
encryption software from Wassenaar's general software note and 
replace it with a new cryptography note. Drafted in 1991 when 
banks, governments, and militaries were the primary users of 
encryption, the general software note allowed countries to 
permit the export of mass-market encryption software without 
restriction. The GSN was created to release general purpose 
software used on personal computers, but it inadvertently 
encouraged some signatory countries to permit the unrestricted 
export of encryption software. It was essential to modernize 
the general software note and close a loophole that permitted 
the uncontrolled export of encryption with unlimited key 
length.
    Under the new note, mass-market hardware has been added and 
a 64-key length or below has been set as an appropriate 
threshold. This will result in government review of the 
dissemination of mass-market software of up to 64-bits. I want 
to be clear that this does not mean encryption products of more 
than 64-bits cannot be exported. Our own policy permits that as 
does the policy of most other Wassenaar members. It does mean, 
however, that such exports must be reviewed by governments 
consistent with their national export control procedures.
    Finally, Madam chairman, with respect to H.R. 850, the 
Administration opposes this legislation, as we did its 
predecessor in the last Congress. The bill proposes export 
liberalization far beyond what the Administration can entertain 
and which would be contrary to our international export control 
obligations. Despite some cosmetic changes the authors have 
made, the bill in letter and spirit would destroy the balance 
we have worked so hard to achieve and would jeopardize our law 
enforcement and national security interests.
    I want to reiterate that this Administration does not seek 
controls or restraints on domestic manufacture or use of 
encryption. We continue to believe the best way to make 
progress on ways to assist law enforcement is through a 
constructive dialogue. As a result, we see no need for the 
statutory provisions contained in the bill.
    Second, once again, we must take exception to the bill's 
export provisions. In particular, the references to IEEPA, as I 
understand them, might have the effect of precluding controls 
under current circumstances and in any future situation where 
the EAA had expired and the definition of general availability, 
as in the past, would preclude export controls over most 
software. In addition, whether intended or not, we believe the 
bill as drafted could inhibit the development of key recovery, 
even as a viable commercial option for those corporations and 
end-users that want it in order to guarantee access to their 
data. The Administration has repeatedly stated that it does not 
support mandatory key recovery, but we endorse and encourage 
development of voluntary key recovery systems and, based on 
industry input, we see growing demand for them, especially 
corporate key recovery, that we do not want to cutoff.
    The Administration does not seek encryption export control 
legislation nor do we believe such legislation is needed. The 
current regulatory structure provides for balanced oversight of 
export controls and the flexibility needed so that it can 
continue to promote our economic foreign policy and national 
security interests while adjusting to advances in technology. 
We believe this is the best approach to an encryption policy 
that promotes secure electronic commerce, maintains U.S. leads 
in information technology, protects privacy, and protects 
public safety and national security interests.
    Thank you, Madam chairman.
    Ms. Ros-Lehtinen. Thank you so much.
    Ms. McNamara.

   STATEMENT OF BARBARA MCNAMARA, DEPUTY DIRECTOR, NATIONAL 
                        SECURITY AGENCY

    Ms. McNamara. Good afternoon, Madam Chair. Thank you for 
the opportunity to appear today. I would like to begin briefly 
by introducing the National Security Agency and its mission and 
explain why this issue is so important to us.
    NSA secures information systems for the Department of 
Defense and other U.S. Government agencies and provides 
information derived from foreign signals to a variety of users 
in the Federal Government. It is the signal's intelligence role 
that I want to address today. NSA intercepts and analyzes the 
communications signals of foreign adversaries to produce 
critically unique and actionable intelligence reports for our 
national leaders and military commanders. Very often, time is 
of the essence. Intelligence is perishable. It is worthless if 
we cannot get it to the decisionmakers in time to make a 
difference.
    Signals intelligence proved its worth in World War II when 
the United States broke the Japanese naval code and learned of 
their plans to invade Midway Island. This intelligence 
significantly aided the U.S. defeat of the Japanese fleet and 
helped shorten the war. NSA provides the same kind of 
intelligence support today in the former Yugoslavia and other 
locations around the world wherever U.S. military forces are 
deployed.
    NSA signals intelligence efforts also support policymakers 
and law enforcement. Demands on NSA for timely intelligence 
have only grown since the breakup of the Soviet Union and have 
expanded into national security areas of terrorism, weapons 
proliferation, and narcotics trafficking. Today, many of the 
world's communications are still unencrypted. Historically, 
encryption has been used primarily by governments and the 
military. It was employed for confidentiality and hardware-
based systems and was often difficult to use. As encryption 
moves to software-based implementations and the 
infrastructure--and I underline infrastructure--develops to 
provide a host of encryption-related security services, 
encryption will spread and be widely used by other foreign 
adversaries that have traditionally relied upon unencrypted 
communications. As a result, much of the crucial information we 
are able to provide today could quickly become unavailable to 
the decisionmaker.
    As you will hear from my colleague from the Department of 
Justice, it is important to understand that the needs of 
national security and the needs of law enforcement are 
different and must be addressed separately. At NSA, we are 
focused on preserving export controls on encryption to protect 
national security. As you consider the SAFE Act, it is very 
important to understand the significant effect certain 
provisions of this bill will have on national security.
    The SAFE Act would mandate the immediate decontrol of most 
commercial computer software encryption and specified hardware 
encryption exports. This will greatly complicate our 
exploitation of foreign targets and the timely delivery of 
usable intelligence because it will take too long to decrypt a 
message if, indeed, we can decrypt it at all. This bill would 
also deprive us of the opportunity to conduct a meaningful 
review of a proposed encryption export. Historically, this 
review process has provided us with valuable insight into what 
is being exported, to whom, and for what purpose. Without this 
review and the ability to deny an export application if 
necessary, it will be impossible to control exports of 
encryption to countless bad guys.
    The SAFE Act would permit exports of encryption based on 
products comparable to those being exported for foreign 
financial institutions. But using the special treatment 
afforded banks and financial institutions which are well-
regulated and have a good record of providing access to lawful 
requests for information, as the basis for a blanket approval 
of export to all other end-users in a country would eliminate 
important national security end-use considerations. The 
criteria for exporting encryption to these institutions should 
not be the basis for decontrolling other encryption exports.
    The SAFE Act also eliminates control for computer hardware 
with encryption capability if it is found that the product is 
available in the overseas market. The apparent availability of 
a product in a country without regard to its actual performance 
capabilities or without restrictions on end-users or end-uses 
will have the practical effect of forcing the decontrol of such 
exports, a condition that is unacceptable to national security.
    We believe that we need a balanced encryption policy that 
considers the needs of national security and industry. The 
recent U.S. and Wassenaar policy updates are positive moves in 
that direction. You will hear from others that industry is 
prohibited from exporting anything greater than 56 bits. That 
is patently wrong. Last year's update allows vendors to export 
unlimited-strength encryption, even 128 bits, to specified 
market sectors in a set of countries that represents 
approximately 70 percent of the world's economies or did at the 
time and that redresses the issue of Amazon.com that 
Congressman Goodlatte referred to.
    This is an example of the kind of advances possible under 
the current regulatory structure which provides greater 
flexibility than a statutory structure would. Let me make it 
clear. We want U.S. companies to effectively compete in world 
markets. In fact, it is something that we strongly support as 
long as it is done consistent with national security needs.
    In summary, the SAFE Act will harm national security by 
making NSA's job of providing critical actionable intelligence 
to our leaders and military commanders difficult if not 
impossible, thus putting our Nation's security at considerable 
risk. The United States cannot have an effective decisionmaking 
process, or a strong fighting force, or a responsive law 
enforcement community, or a strong counterterrorism capability 
unless the information required to support them is available in 
time to make a difference. The nation needs a balanced 
encryption policy that allows U.S. industry to continue to be 
the world's leader, but that also protects the security of our 
Nation. Thank you, Madam chairman.
    Ms. Ros-Lehtinen. Thank you so much.
    Mr. Lee.

  STATEMENT OF RON LEE, ASSISTANT ATTORNEY GENERAL, NATIONAL 
                SECURITY, DEPARTMENT OF JUSTICE

    Mr. Lee. Madam Chair, I would like to emphasize some of the 
points in my written statement for the Subcommittee in my brief 
remarks this afternoon. I would like to be clear, because the 
views of the Department of Justice on encryption and export 
controls are often caricatured or misrepresented.
    The Department of Justice supports the spread of strong 
recoverable encryption to protect the privacy of American 
citizens and to protect the security of our information 
infrastructure. This is not, after all, a debate about whether 
the U.S. national interest is served by the success of U.S. 
companies abroad. We fully accept and support that premise. We 
are, however, deeply concerned about the threat to public 
safety posed by the widespread distribution and use of 
nonrecoverable encryption. Law enforcement agencies, both in 
the United States and abroad--and we work closely with many law 
enforcement agencies abroad--have already begun to see cases 
where encryption has been used in efforts to conceal criminal 
activity. The number and complexity of these cases will 
certainly increase as encryption proliferates and, I emphasize, 
as encryption increasingly becomes an integral part of mass-
market software items and network-based information services.
    Thus, we cannot just extrapolate from past examples where 
encryption has posed a problem. We must, as a government, in 
partnership with the Congress, take this moment to realize that 
encryption is becoming a part of our commerce and make 
responsible public choices.
    Faced with the use of nonrecoverable encryption, agents 
would not be able to make effective use of search warrants, 
wiretap orders, and other legal processes that have been 
authorized by Congress and ordered by the courts. These tools 
are absolutely essential to effective law enforcement 
investigations today. Without these tools, law enforcement 
would find it increasingly difficult, if not impossible, to 
obtain important evidence of criminal activity and to gather 
and develop and present the evidence needed in criminal 
prosecutions.
    In the face of these challenges, the Department of Justice 
supports the carefully balanced approach to export controls 
that the Administration is actively pursuing. The Chair asked 
about progress in the last year. I would like to report that 
the Attorney General, along with the Director of the Federal 
Bureau of Investigation and other government officials have 
been actively engaging industry leaders in a continuing, 
cooperative, and positive dialogue. This dialogue has continued 
throughout the Department and the FBI at several different 
levels.
    We have gained a lot from the dialogue. We have both 
explained the public safety concerns that we have from the 
spread of nonrecoverable encryption and we have learned about 
innovative solutions that industry has presented. It was in 
part this collaboration and dialogue that led us to be able to 
participate in the active report in the export control updates 
announced by the Administration last September. We thank the 
Members of Congress who have helped to facilitate this dialogue 
and we will work hard to make sure that these discussions 
continue. We believe that the current balanced approach is the 
most conducive approach to continuing this open dialogue with 
industry.
    In this connection, the rapid elimination of export 
controls, as proposed in H.R. 850, the Security And Freedom 
through Encryption Act, would upset this balance dramatically. 
We believe that passage of the SAFE Act would cause the further 
spread of unbreakable encryption products that will be used by 
terrorist organizations and others for criminal purposes.
    Of course, we recognize that law enforcement is already 
coming across nonrecoverable encryption by criminals. We are 
not standing still. In order to protect public safety, we are 
continuing to develop our own technical expertise. The 
Department of Justice has begun initiatives such as the funding 
of a centralized technical resource within the FBI which will 
support Federal, State, and local law enforcement personnel in 
developing a broad range of expertise, technologies, and tools 
to respond directly to the threat posed by unbreakable 
encryption when used by criminals.
    We look forward to working with Congress to develop this 
resource. However, I must emphasize that no technology, no set 
of technologies, no tool box offers a silver bullet. The 
widespread use of nonrecoverable encryption by criminals would 
quickly overwhelm whatever technical response and capabilities 
we could develop. In summary, we believe that the 
Administration's approach balances the need for secure private 
communications and electronic commerce with the equally 
important need to protect the safety of the public against 
threats from terrorists and criminals. We look forward to 
working with you on this important issue. Thank you.
    Ms. Ros-Lehtinen. Thank you so much.
    Mr. Voegtlin.

    STATEMENT OF GENE VOEGTLIN, ESQ., LEGISLATIVE COUNSEL, 
         INTERNATIONAL ASSOCIATION OF CHIEFS OF POLICE

    Mr. Voegtlin. Thank you. Good afternoon, Madam Chair, 
Chairman Gilman, and Members of the Subcommittee. I am pleased 
to be here today on behalf of the International Association of 
Chiefs of Police. Our president, Ronald Neubauer, had hoped to 
be here today, but, unfortunately, he is out of the country and 
therefore cannot attend.
    I would like to briefly tell you about the IACP and then 
summarize our statement. Founded in 1893, the IACP, with 17,000 
members in 112 countries, is the world's oldest and largest 
association of law enforcement executives. Our mission 
throughout the history of the association has been to identify, 
address, and work to provide solutions to urgent law 
enforcement issues. As I appear before you today, it is clear 
that robust, nonrecoverable encryption technology and the 
threat it poses to the ability of law enforcement agencies to 
perform their mission looms as one of the most urgent and 
important issues facing our members in the communities they 
serve.
    The IACP's position on the encryption issue is clear. We 
strongly believe that the unchecked proliferation of robust 
nonrecoverable encryption technology poses an enormous danger 
to effective law enforcement, public safety, and to society as 
a whole. Therefore, the IACP believes that any encryption 
legislation that is enacted must protect the ability of law 
enforcement agencies to perform court-authorized electronic 
surveillance and the search and seizure of criminally related 
information stored in computers.
    In addition, the IACP believes that it is of vital 
importance to maintain the stringent export controls on robust 
nonrecoverable encryption products. The relaxation of export 
controls would likely result in the widespread proliferation of 
unbreakable encryption products which would severely limit if 
not completely destroy the ability of law enforcement agencies 
to effectively investigate and apprehend international 
terrorists and criminals. This is why the IACP was pleased last 
December when 33 nations signed on to the Wassenaar export 
control agreement to impose or expand existing controls on 
encryption and other data scrambling technologies.
    I would like to note, however, that the IACP's position on 
the need for law enforcement access does not mean that we 
oppose all uses of encryption technology. The IACP certainly 
recognizes that there is a legitimate need to use encryption 
products as a tool to protect electronic commerce and 
individual privacy. Indeed, law enforcement agencies themselves 
have a need for secure communications and information storage. 
Nevertheless, we must balance these legitimate concerns with 
the threat we face by providing criminals, drug lords, and 
terrorists with an impenetrable means of communicating to their 
criminal associates.
    In addition, the IACP is aware of the economic issues 
involved in the manufacture and sale of encryption technology 
and products. However, we believe that we must consider the 
enormous economic damage that is being done to the United 
States economy as a result of crime and related consequences. 
For example, experts have estimated that the economic loss to 
the United States as a result of drug-related crime, accidents, 
medical care, and the loss of productivity reaches upward to 
$50 billion a year.
    Finally, I would like to stress that providing law 
enforcement with a means to access the plain text of encrypted 
information would not represent an expansion of the police 
power to conduct searches or infringement on the Fourth 
Amendment protections against unreasonable searches. Law 
enforcement agencies would still be required to follow the 
current procedures that are necessary to gain access to other 
information that is used in the commission of crime. Providing 
for law enforcement access is entirely consistent with the 
constitutional safeguards of the Fourth Amendment.
    What we would be doing by ensuring that law enforcement can 
access the plain text of encrypted criminal information is 
simply modernizing our current search warrant laws to keep pace 
with advances in computer technology. It is imperative that 
Congress take immediate steps to protect the capabilities of 
law enforcement. Electronic surveillance and wiretaps are two 
of the most effective tools in law enforcement's arsenal. Over 
the years, numerous arrests, prosecutions, and convictions have 
been secured against criminals because of court-authorized 
surveillance and wiretaps operations.
    It is our belief that if Congress allows a robust 
encryption technology to be sold without providing for a means 
of law enforcement plain text access, it would effectively be 
stripping law enforcement agencies of their ability to 
successfully perform electronic surveillance, wiretaps, and the 
search and seizure of criminal information stored in computers. 
Therefore, before any legislation is enacted, the IACP urges 
Congress to ensure that it contain provisions that would 
provide law enforcement with immediate and complete plain text 
access to information encrypted in the furtherance of criminal 
activity. The inclusion of such provisions are absolutely vital 
if we are to preserve the investigative capabilities of our 
Nation's law enforcement agencies.
    If Congress fails to provide law enforcement with this 
necessary access, law enforcement agencies will be further 
behind the technology curve. Terrorists, drug lords, and other 
criminal elements will have the upper hand over law enforcement 
and, as a result, the personal safety and security of all 
Americans and their property will be endangered. Thank you.
    Ms. Ros-Lehtinen. Thank you so much to all of our panelists 
and we are proud to begin our series of questions by our 
Chairman of the International Relations Committee, Mr. Gilman.
    Mr. Gilman. Mr. Lee, how many major organized crimes cases 
have made without court-authorized wiretap evidence? Can you 
give us a rough estimate?
    Mr. Lee. Chairman Gilman, each major organized crime case, 
like any other investigation of a major crime, is done with a 
combination of law enforcement investigative tools. Law 
enforcement brings to bear the entire set of tools to 
investigate, apprehend, and prosecute these criminals. In each 
of these investigations, court-authorized wiretap operations 
and the evidence derived from them are absolutely essential to 
the success of the enterprise. By that I would mean both the 
successful investigation of the organized crime matter and also 
the successful prosecution and marshalling of evidence against 
the defendants.
    Mr. Gilman. Thank you. Mr. Voegtlin, do you agree with that 
assessment?
    Mr. Voegtlin. Yes, absolutely.
    Mr. Gilman. How often in cases such as kidnappings and 
planned terrorist bombs has the court-authorized wiretap 
prevented the loss of life? Mr. Lee.
    Mr. Lee. Mr. Chairman, there have been numerous cases where 
court-authorized wiretaps have been used by law enforcement 
officials to prevent and solve--to prevent loss of life and to 
solve the cases. I would add to that list not just terrorism 
and kidnapping, but also cases such as child pornography and 
other exploitation of children. It is an absolutely essential 
tool.
    Mr. Gilman. What about the timing of information that you 
receive from wiretaps, too? Is that critical to the cases 
involved?
    Mr. Lee. Mr. Chairman, the timing, the ability to quickly 
derive the plain text, the meaning from the wiretaps on a real-
time instantaneous basis is absolutely critical, both to saving 
lives and also to apprehending criminals and furthering the 
investigation.
    Mr. Gilman. Thank you. Mr. Reinsch, what effect would the 
implementation of the SAFE Act have on the Wassenaar 
arrangement?
    Mr. Reinsch. Mr. Gilman, first it would put us in violation 
of it. It is inconsistent with it and, second, I believe it 
would undercut our efforts to obtain stronger multilateral 
controls. It would probably result in our allies abandoning 
their efforts to control these products.
    Mr. Gilman. Could you tell us, Mr. Reinsch, do the 
provisions in the SAFE Act relating to terrorist countries 
provide effective control for the Administration to stop the 
export of encrypted products to those countries?
    Mr. Reinsch. That is a more complicated question than the 
Wassenaar question, Mr. Gilman. We believe generally no, but it 
is a more--that they do not help us provide effective control, 
but it is a more complicated legal analysis. The bill contains 
two provisions that contradict each other. One which addresses 
this question specifically and one which generally removes 
licensing authority for what we believe would be most mass-
market products. Even if we were to try to reconcile those 
conflicting provisions by construing the stricter one as 
ruling, we have some concerns about the way that it is drafted. 
It imposes, not with respect to countries, but with respect to 
individuals--individual terrorists or individual terrorist 
organizations--a substantial evidence test which is quite a 
high test, an unusual one for the kind of system that would 
make it much more difficult for us to identify and list, 
meeting the standards of the Act, terrorist organizations and 
proscribe exports to them.
    Mr. Gilman. Just one last question: Mr. Voegtlin, what 
would encryption without access do to local law enforcement's 
ability to fight the drug war?
    Mr. Voegtlin. Basically, we are concerned that it would all 
but eliminate our ability to fight the drug war. Currently--and 
it is becoming on an ever-increasing basis--State police 
directors and local law enforcement agents are coming across 
encryption in an ever-increasing fashion. Right now what we are 
looking at are situations where you have drugs being imported 
into this country and the command and control is taking place 
overseas and they are using encrypted communications to talk to 
the subordinates in this country, to talk about distribution 
and other coordination efforts. Without being able to access 
this information through wiretaps, the ability for State and 
local law enforcement agencies to work in cooperation with the 
Federal agencies on the drug issue will be severely limited if 
not completely destroyed.
    Mr. Gilman. Thank you and thank you, Madam chairman.
    Ms. Ros-Lehtinen. Thank you so much, Mr. Gilman, for being 
with us. Mr. Menendez.
    Mr. Menendez. I thank you, Madam Chairlady, I appreciate 
this panel's testimony. Before I ask my questions, I want to 
ask Mr. Lee, is your division of the Justice Department 
National Security? Is that my understanding?
    Mr. Lee. Sir, I am a Senior Member of the Deputy Attorney 
General's Office. One component of the Deputy Attorney 
General's Office is called the Executive Office of National 
Security. I am the acting head of that component, but I also 
have other responsibilities in the Office of the Deputy 
Attorney General.
    Mr. Menendez. That is not the same division of the Justice 
Department that declared the air space over Camden Yards to 
banners talking about freedom and democracy our national 
security risk, is it?
    Mr. Lee. I am not familiar with that matter.
    Mr. Menendez. Because that really colored my perception of 
what national security is. Let me ask the panel the following. 
My friend and colleague from New Jersey, a new Member of 
Congress, Rush Holt, is a rocket scientist. His constituents 
have a bumper sticker in his district that says, ``My 
Congressman is a rocket scientist.'' Now, I am not a rocket 
scientist. I am just a poor old country lawyer. What I don't 
have an understanding about----
    I am not a professor either of the law. But what I really 
have a problem listening to the testimony here about is one 
basic set of circumstances which seems to be glossed over and 
maybe all of you can help.
    No. 1 is, there is no domestic control of encryption. Is 
that a correct statement?
    Mr. Reinsch. That is correct.
    Mr. Menendez. So I, as an American, or for that fact, 
someone from abroad who is visiting here could buy this 
domestically. I guess taking it back home might be a violation 
of the law. Is that the case?
    Mr. Reinsch. Yes, in general. There would be a personal use 
issue, but if you were taking it back to give to somebody else 
or to sell that would----
    Mr. Menendez. If I wanted to buy and use it and take it 
back. But I don't even have to do that, as I understand it. 
This technology exists by a variety of countries--the Japanese, 
the Israelis, French, others--who have all of this capacity at 
its highest levels, as I said in my opening statement, in the 
Internet, you can download 128 bits. Now I heard Ms. McNamara 
say that we don't control, we, in fact, permit under the new 
regulations over 56 bits. But that's if you have, in fact, a 
key recovery system. If you have a non key recovery system, you 
can't do that, can you?
    Mr. Reinsch. No. Maybe I can clarify that part. I would 
like to have Ms. McNamara talk a little bit about the 
availability issue if we have time for that. The policy permits 
the export in a variety of circumstances that my statement went 
over fairly quickly of more than 56-bit encryption. In fact, 
encryption without bit length limit and without key recovery 
features can be exported to U.S. subsidiaries, for example, to 
health care organizations, to banks, to financial institutions, 
and so on.
    Mr. Menendez. Yes. Outside of that specific category--and I 
have a chart here: the banks, financial, health insurance, 
health care----
    Mr. Reinsch. Right.
    Mr. Menendez. Outside of that category.
    Mr. Reinsch. No.
    Mr. Menendez. If you want to, you could not.
    Mr. Reinsch. Except via--there is a whole list in that 
category, more than the ones I mentioned, but outside of what I 
assume is on your chart, the only way high-level encryption, 
128-bit or whatever, could be exported would be pursuant to an 
individual license that we would issue. An exporter can apply 
for anything they want and we will consider any application 
they submit, but it would take an individual license outside of 
those categories.
    Mr. Menendez. My point, Mr. Secretary--and for members of 
the panel, maybe you can help me here, elucidate to me--the 
point is whether you buy it here or domestically and you have 
this capacity and you illegally--because we are talking about 
illicit activities that we are concerned about and national 
securities and espionage and all of that--bottom line is 
whether you buy it domestically or whether you buy it abroad 
and use it for an illicit purpose here in the United States, 
what is it that we accomplish in terms of controlling the 
technology that is readily available and that can be used by 
anyone who seeks to do so illicitly for espionage or terrorism, 
for anything. I listened to the line of questioning of our 
distinguished Chairman and, all of those things can be 
accomplished by someone who wants to break the law and use and 
seek the technology abroad. Tell me what it is that--how do we 
circumvent all of that?
    Ms. McNamara. Let me try and answer that question and then 
any of my colleagues can chime in behind, sir. Let me first 
address the issue that you raised about nations overseas. As 
you heard Mr. Reinsch say and I said as well, in December of 
last year, 33 nations signed up to the Wassenaar agreement. 
What that does is permits those 33 nations to have an umbrella 
arrangement or agreement which allows them then to invoke 
export controls in their own individual countries. They are 
doing that and they are abiding by it.
    Some of those nations without Wassenaar had their own 
export control regime and they are abiding by that. The 33 
nations that signed up to the Wassenaar agreement are the 33 
nations which are today the world's predominant producers of 
encryption, save one or two, and even those, although not 
members of Wassenaar, do have their own export control 
regulatory regime which they invoke for the export of 
encryption from their own national producers.
    The export of, or the individuals who, as you point out, 
illegally use or apply for the use of encryption, on an 
individual basis, we are never going to stop all of that. What 
we are attempting to talk about here is the actual broad use of 
encryption or the incentive for the broad export of encryption 
from this country.
    Encryption today is not being used broadly. Encryption 
today is, for the most part, being used by individuals for 
applications that are approved under our export control regime 
for business, for banking, for online commerce. All of that 
export, without requiring key recovery features, I might add, 
is available under today's export control regime from this 
country as of last September. That was reinforced and 
reendorsed by the Wassenaar agreements.
    When we look at the international use of encryption, I will 
tell you that we expect to see the broad use of encryption 
internationally when three conditions are met. Those three 
conditions are it becomes inexpensive--and I will grant you, it 
is becoming inexpensive--it becomes easy to use--and, in some 
cases, it is in fact easy to use. In other cases it is not--and 
what will be required for the broad international use of 
encryption is a security management infrastructure which will 
allow the registering of keys, the authentication of users, and 
the free and open exchange of encryption across international 
boundaries. Those international security management 
infrastructures do not exist today, globally. So we are not 
seeing the broad use of encryption.
    Mr. Menendez. I appreciate your answer. My concern, 
however, remains, I think, unanswered. That is, maybe you 
cannot answer it. Not that you don't want to answer it. Maybe 
it cannot be answered. That is this, that, listening to your 
answer, Wassenaar, as I understand it, is ultimately not 
binding, but even to the extent that, while it is predominate 
of the countries, it is not exclusive. To the extent that you 
have access in those countries, domestically, as we would have 
access here domestically; and to the extent that you have 
acknowledged that it is becoming more and more inexpensive and 
easier to use, ultimately it just seems to me that those--
forgetting about the broad base appeal that we seek to divert 
for the time being--ultimately, those who want to use such 
encryption opportunities to do something illicitly, to do 
something in terms of how this panel has described their 
concerns about it, ultimately have the wherewithal to do it 
now. So I don't know exactly what we stop here except American 
companies from being competitive in the world because those who 
want to do it will do it.
    Last, even to those that you have given presumptions of 
approval to, to American subsidiaries abroad that have foreign 
nationals working for them. It does not give me a sense of 
rhyme or reason. I get the sense that, we want to try to stop 
what we cannot stop and we are just hoping to buy time here at 
the end of the day. I may be wrong in that perception, but that 
is certainly the perception I have.
    Mr. Lee. Mr. Menendez, if I may address that briefly from 
the law enforcement perspective, our position is not that the 
policy is a failure if there is one single illicit or bad 
person using encryption. We fully understand that people are 
going to go to great lengths to use encryption that we probably 
will never be able to read. The issue for us is that we are 
starting to get into a world where everyone will be using 
encryption and the policy issue, both for the world of exports 
and for the United States, is what will that world look like? 
Will it be a world where there is some possibility that the 
wiretaps that Mr. Voegtlin and I have spoken about will have 
some value, some meaning to protect public safety? Or will it 
be a world where those wiretaps are completely useless? That is 
the overarching policy issue, not whether a criminal or a 
terrorist could--indeed they can and they do. We are seeing 
that increasingly--not whether they can, in an isolated case, 
find encryption that frustrates us. The question is, as 
encryption becomes much more pervasive so that people don't 
have to go to any effort whatsoever to use it, what kind of a 
world will we live in?
    Mr. Menendez. My concern, Mr. Lee, is that what you are 
concerned about already is becoming a reality, notwithstanding 
anything that we are doing right now. I thank the Chair Lady.
    Ms. Ros-Lehtinen. Thank you so much, Mr. Menendez. Mr. 
Bereuter.
    Mr. Bereuter. Thank you, Madam chairman. Thank you for your 
testimony. Mr. Reinsch, the reference has been made to the 
dialogue the Administration had been engaging in with the 
industry. I believe it may have first been started or at least 
noticeably progressing when it was initiated by John Deutsch, 
the Director of the Central Intelligence Agency. It seems to me 
that he maintained a successful back channel communication with 
the group of top industrial CEO's. They were moving ahead in 
what appeared to be very useful negotiations to strike a useful 
balance. When Deutsch left, Deputy Attorney General Jamie 
Gorelick continued that process and she has been now for well 
over a year.
    It seems to me, looking at it from the outside, that the 
discussions have withered away and do not appear to have the 
attention or the focus of the necessary officials in the 
Administration. In its place appears to be unilateral 
declarations. The Administration, through a new policy unveiled 
by Vice President Gore, implemented new regulations. Industry, 
not satisfied with this action, is lobbying for enactment of 
the SAFE legislation. I was always interested in the past to 
see representatives, actual employees of the software 
companies, coming up here, and lobbyists paid by them to 
represent those software companies on this issue oftentimes 
unaware of what had happened with negotiations with the top-
level CEO's in their own companies.
    I think this matter of encryption control is a very serious 
matter, yet it appears the issue has been left to drift off the 
legislative cliff. We need, I think, to find a balance, an 
option that works in the real world. That would entail intense, 
very high-level negotiations and compromise, it seems to me, 
much like the negotiations were leading to, I thought, that 
Deutsch was leading.
    So my questions, to begin with, are what steps are being 
taken to reengage at the highest level industrial CEO's to find 
a realistic, workable balance, or is something going on that 
you can't talk about here or that you can talk about here? Who 
is the Administration's point person in this dialogue? When was 
the last dialogue meeting with top leadership of the software 
companies? When is the next meeting? Is anything like this 
happening?
    Mr. Reinsch. I can make some comments, Mr. Bereuter, 
without going into all the details of 2 of 3 years of history 
on this which I see in some respects similar to your points and 
in some respects, I think, different than the points you have 
made. I don't think we have become unengaged, if you will.
    I think after Mr. Deutsch's departure from the government, 
the dialogue has ensued really on two levels. There was a 
direct dialogue with law enforcement and with the Justice 
Department and the FBI, which I think Mr. Lee could comment on 
separately, which was designed to put those two groups in 
direct contact for discussions, in many respects, at a 
technical level of how they could help each other and how they 
could try to advance the ball from that point of view.
    Mr. Bereuter. With the industry? A dialogue with the 
industry?
    Mr. Reinsch. That is correct. I am sorry. Yes, with the 
industry.
    In addition, we have continued the dialogue at senior 
levels, both with individual executives and also with several 
large groups, both hardware and software, that have become the 
representatives, if you will, of that point of view. Throughout 
this dialogue, whether before or after Mr. Deutsch's departure 
from the government, at no time has the industry abandoned or 
dropped its goal of passing Mr. Goodlatte's bill and we don't 
assume that there is anything that we can do that will cause 
them to change their mind. When Mr. Goodlatte is offering them 
the whole pie, I wouldn't expect them to deny the opportunity.
    At the same time, I think that what we have done with them 
has been very successful in addressing a lot of the problems 
they have identified, and I think if you go back and look at 
their reaction, you can ask the following panel. Ask Mr. Smith, 
who will be on after me and some others about their reaction 
after the Vice President's announcement in September. I think 
you will find that it was quite a positive reaction and a 
welcoming reaction as a product of some constructive dialogue 
we had at that time. Their final sentence was, this is great, 
we want more. We respect that. But I think it has been a 
successful relationship. It goes on.
    I think the next encounter is likely to be the 10th of June 
when we have a group of CSPP CEO's coming to town on several 
subjects. Computers is probably at the top of their agenda, but 
I am sure encryption will not be far behind and I am sure they 
will be meeting with representatives of the Administration. I 
understand they will be up here as well. I think that will be a 
chance to renew the dialogue collectively, but there are 
frequent opportunities for one-on-one or smaller group 
discussions. My secretary, Mr. Daley, has been to California 
several times in the last 3 or 4 months, as have I. We have 
these discussions every time we go.
    Mr. Bereuter. Secretary Reinsch, I would expect that 
seeking the whole pie, Mr. Goodlatte's legislation, would be a 
good negotiating tactic. I wouldn't deem it impossible to find 
something that is balanced despite their almost unanimous 
support for it.
    Director McNamara, my understanding is that the Wassenaar 
agreement still allows the export to countries that set 
different standards. I can't understand really, in that 
situation, how you are able to achieve your purposes in 
protecting the national security or how law enforcement is able 
to pursue at the local, national, or State level their 
objectives when you have got this differential under Wassenaar. 
What am I missing here? Is that a problem or am I wrong about 
the impact of Wassenaar on the exports to the various 
countries?
    Ms. McNamara. The existence of Wassenaar allows countries 
to actually have something to connect an export control regime 
to in those countries that didn't have a regulatory 
underpinning in their countries. It is all up to national 
discretion, as it is in our----
    Mr. Bereuter. It is differential in its application, isn't 
it, Director McNamara?
    Ms. McNamara. I am sorry, sir?
    Mr. Bereuter. It is differential in its application, 
country-to-country?
    Ms. McNamara. Yes. Country-to-country, as it is here. But 
it is fundamentally based on end-use and end-user and there are 
agreements that are in common, like preventing the export of 
encryption to terrorists and we can do, actually, a comparison 
for you, sir, if that would be helpful.
    Mr. Bereuter. It does seem to me that the end-user approach 
is unenforceable in reality. Secretary Reinsch, one final 
question. You mentioned in your written testimony at least that 
you believe the Goodlatte bill, as drafted, could inhibit the 
development of key recovery even as a viable commercial option 
for those corporation end-users that want it in order to 
guarantee access to their data. Could you elaborate on that?
    Mr. Reinsch. Yes, Mr. Bereuter, if I can find the 
provision. I think if you look at--I wouldn't say, by the way, 
that--I tried to phrase that statement in my testimony 
carefully because I wouldn't say that the problem is as big in 
this bill as it is in some other ones that have been 
introduced, but I think if you look at, in general, the 
provisions on page--in my draft, which I think is the one with 
all the cosponsors on the front, the provisions on page five 
and page six of the bill. We would interpret them as 
significantly discouraging the use of key recovery. I would not 
go so far as to say the bill prohibits that, but we think it 
has an inhibiting effect.
    Mr. Bereuter. You did say inhibit and that is the word I 
tried to use in your quote. I will look at those. Thank you 
very much. Thank you, Madam chairman.
    Ms. Ros-Lehtinen. Thank you. Mr. Goodlatte, we are going to 
recognize you in a moment even though you are not a Member of 
our Committee. Mr. Delahunt.
    Mr. Delahunt. Yes, thank you, Madam chairwoman. I have had 
the benefit of this testimony in my capacity on the Judiciary 
Committee and I have had an opportunity to engage in some 
dialogue. I would just make some observations. I think that 
both Mr. Bereuter and Mr. Menendez have articulated some of the 
concerns I know that you have heard from me in terms of those 
who are sophisticated and have an intent to indulge in illicit 
activity, you simply can't deter them, given the realities of 
foreign availability. I think this is the problem that we are 
wrestling with. I think, if I am correct, Director McNamara, I 
think you just acknowledged that earlier in your testimony? I 
don't want to put words in your mouth, but that was the 
conclusion that I draw.
    Ms. McNamara. We are never going to stop everyone from 
breaking the law. That is true, sir. But coming down in the 
car, I happened to be thinking that just because somebody 
speeds through a school zone doesn't necessarily mean we raise 
the speed limit in the school zone.
    Mr. Delahunt. Right.
    Ms. McNamara. There are some products available overseas. I 
would appreciate it if you accept Mr. Gilman's earlier offer 
when he announced the classified session on Thursday and I 
would be happy to talk about this in more detail at that 
session.
    Mr. Delahunt. I hope to accept that invitation, but I am 
just saying for those who are unable to go to that particular 
briefing. I think that the concern that I have from a national 
security perspective, if the development of encryption 
technology in this country is impeded--put aside for a moment 
the adverse impact in terms of our balance, in terms of our 
economy--what we are going to have is these cutting-edge 
encryption technologies far surpassing what we have available 
to us. If the marketplace is really driving this issue. I think 
I understand where you are heading. I think, particularly, I am 
addressing this to Ms. McNamara, not just because you are a 
former resident of Massachusetts, because I know you have 
strong feelings about this particular issue.
    Ms. McNamara. About Massachusetts, sir.
    Mr. Delahunt. About Massachusetts, obviously. Don't worry, 
they won't tear down Fenway Park. I can assure you that.
    But my point is, particularly from a national security 
perspective, we are dealing with a level, I presume, of 
sophistication in terms of potential adversaries where they 
will take advantage of cutting-edge technologies that are 
available in the marketplace. This is the bottom line in terms 
of the concerns that I have and, at the same time, 
disadvantaging our, commercial interests as far as competing in 
the global economy.
    Ms. McNamara. As Mr. Reinsch said, if I may, as Mr. Reinsch 
said and I said in my testimony, we do not want to impede the 
creativity of U.S. industry. That is not our goal. We want to 
see U.S. industry succeed and we want to see them succeed 
overseas. What this bill does, though, is eliminate all control 
mechanisms on exports.
    Now when we say that, what we want to see is a regulatory 
process where, outside of those sectors who have broad relief 
and therefore have--they can sell their products anywhere in 
certain sectors and for electronic commerce for certain 
purposes, we want to see a review process and we want to see 
who the end-user and the end-use is going to be so we can 
understand the product.
    Mr. Delahunt. I don't disagree with what you are saying in 
the stated goal. But, at the same time, I think what we have to 
remember--you refer to Wassenaar and it is discretionary and I 
don't think we ever level off that playing field until we have 
an enforceable multilateral export control regime. I just don't 
see--that all nations will respect and that do not disadvantage 
commercial interests and we are not going to do this with an 
agreement, that is related to the Wassenaar compact.
    Mr. Reinsch. I think--if I could comment, Mr. Delahunt--
what intrigues me about this line of argument--and it was 
similar to the one that Mr. Menendez was putting forward--is 
the interesting question is what do we do in the interim before 
we reach that point. We may never reach that point, but let us 
assume that we are striving for an effective multilateral 
arrangement, which would deal with this.
    Mr. Delahunt. Right.
    Mr. Reinsch. I think that is a fair statement. What do we 
do between now and then? It seems to me that the suggestion you 
are making is almost that because we cannot succeed completely, 
we should give up. I think we are not prepared to give up 
simply because we are not going to be perfect.
    Mr. Delahunt. Again, I think you have got to deal with the 
realities on the ground. Mr. Lee and Chief, you say there are 
incidents that have occurred in terms of encryption. Can you 
quantify them? Give us some hard data in terms of--Chief.
    Mr. Voegtlin. Actually, like, Mr. Menendez, I am not a 
rocket scientist nor am I police chief. I just represent the 
police chiefs. As a matter of fact, in preparing for this 
testimony today, I was on the phone with State police directors 
in some of the largest States in the country asking them to 
quantify the number of incidents. It kind of goes to the point 
that you are making. What they told me is that right now, since 
this is in a growing area, most of the evidence that they could 
give me is anecdotal, but I think it speaks to the larger issue 
of what you are talking about, that it is already out, that the 
cow has left the barn or the horse has left the barn on this 
issue.
    But--and this is going back to me not being a rocket 
scientist--from what we understand here, there are questions 
about reliability, as Chairman Gilman mentioned, with foreign-
made products, that there is not a whole lot of robust 
nonrecoverable encryption out there right now that is being 
used.
    Mr. Delahunt. Let me just regain my time and I know my time 
is expiring and I just would ask for a minute's worth of 
followup here. The reality is, I compared it during the hearing 
in the Judiciary Committee to an imaginary line. You simply buy 
it here. You don't even have to get on the plane and go across, 
the ocean. Just download it and it is available instantaneously 
all over the world. The criminal element that most chiefs of 
police deal with on a regular basis--I served in the law 
enforcement community for 21 years and when they start using 
encryption, that comes as a surprise to me.
    Mr. Voegtlin. That is----
    Mr. Delahunt. These violent criminals--and I think that is 
the concern that most Americans have in terms of traditional 
street crimes which local chiefs of police and State police and 
local prosecutors deal with--God forbid they start using 
encryption because we are in real trouble.
    Mr. Voegtlin. Congressman, and if I can----
    Mr. Delahunt. I am talking about the, you know----
    Mr. Voegtlin. I know who you----
    Mr. Delahunt. Most of us aren't rocket scientists.
    Mr. Voegtlin. Right.
    Mr. Delahunt. Most of us have difficulty logging on.
    Mr. Voegtlin. That is exactly the point that we are trying 
to make in that when encryption, highly robust encryption, 
becomes widespread, when the United States--which is a market 
leader in this area and would be with this legislation--takes 
the lead in the manufacture and distribution of this robust, 
unbreakable encryption, it will become easier for those street-
level thugs to use encryption. The problem will become more 
widespread and----
    Mr. Delahunt. With all due----
    Mr. Voegtlin [continuing]. Let me just finish.
    Mr. Delahunt. OK.
    Mr. Voegtlin. In the opinion of the International 
Association of Chiefs of Police, what you are facing is a 
choice: whether or not you want to take this kind of software, 
make it available widespread to increase its use, to allow 
people on a low-level of crime--I know we are always going to 
be dealing with folks who are drug lords who have unlimited 
resources--but when you start putting it on the street level, 
it becomes more widespread and that is our concern.
    Mr. Delahunt. With all due respect to your position, I 
wasn't a chief-of-police, I was a chief prosecutor in a major 
jurisdiction. I daresay, that, availability to the street-level 
criminal simply is an argument that is disingenuous, with all 
due respect. I can't accept that argument. I know better. I 
know better. I yield back and thank the Chair.
    Ms. Ros-Lehtinen. Thank you so much, Mr. Delahunt. Mr. 
Goodlatte, if we could recognize Mr. Gilman for one question 
before we turn to Mr. Goodlatte.
    Mr. Gilman. Just one question in response to what the 
testimony has been. The gentleman made the point that there are 
always people willing to do illicit acts and use means to 
conceal them, but is that a reason to throw in the towel and 
see encryption devices on every street corner in the hands of 
every petty drug dealer? Isn't the issue here proliferation of 
unaccessible encryption?
    Mr. Voegtlin. Absolutely. That is exactly what we are 
talking about--is when this becomes proliferated. When this is 
widespread, the problems will multiply and State and local law 
enforcement, which is only dealing with it on an anecdotal 
level at the moment, will deal with it over and over again. The 
resources of the State and local law enforcement agencies are 
obviously less than the Federal Government. If they are already 
dealing with it, imagine what it will be in 10 years when even 
local dealers dealing with distribution networks on the street 
level are able to communicate in absolute security that law 
enforcement has no idea what they are talking about.
    Mr. Gilman. Mr. Lee, would you care to comment on that 
issue?
    Mr. Lee. I would only add, Mr. Chairman, that I think you 
have really pinpointed the issue and the public policy dilemma 
for all of us. One of the things that I mentioned in my opening 
statement is that we have been having very productive 
discussions at a number of levels with law enforcement, arising 
from the CEO interaction and, in large part, it is to look at 
where industry sees the marketplace going and how we can better 
understand their needs, how they can better understand public 
safety needs, and what the possibilities are for a convergence 
of those interests. That has been a very productive dialogue 
and I think it is one way that we are, with industry, 
addressing the question: How are we going to shape the way the 
market looks? How are we going to stand up together and make 
sure that all of the interests that Mr. Reinsch has mentioned 
here as having to be balanced, make sure they are all balanced? 
That is the challenge for all of us.
    Mr. Gilman. Thank you.
    Ms. Ros-Lehtinen. Thank you, Mr. Gilman. Mr. Goodlatte.
    Mr. Goodlatte. Thank you, Madam chairman. First, I would 
like to note that, as someone who was born and grew up in the 
Commonwealth of Massachusetts, I am glad to find that I have 
something in common with Ms. McNamara. I am sorry we don't 
agree on this legislation, but we do agree on something that 
Congressman Menendez said earlier, and I think it is absolutely 
correct--and that is we are all concerned about national 
security and law enforcement issues.
    The issue here is not whether or even when strong 
encryption is going to be available. It is available now and it 
is going to be widespread very soon. The issue is how we are 
going to deal with it and whether we are, as a nation, going to 
cede this market to dozens of foreign countries and literally 
hundreds of foreign companies who are already starting up and 
producing this product. There are 650 strong encryption 
products available in the United States from foreign sources 
that could not be exported if a U.S. company made the same 
product and attempted to sell it overseas. That is a serious 
problem and one that our competitors overseas are well-aware 
of.
    The problem with the Wassenaar agreement is that it is 
Swiss cheese. It is something that is loaded with loopholes. 
The gentleman from Nebraska is exactly right. It can be applied 
differentially in different countries. It is being done. The 
aspect of this related to recoverable encryption is one that is 
being rejected. Madam chairman, if I may, I would make a part 
of the record an article from the National Journal of 
Technology Daily pointing out that the French who were 
previously cited in previous hearings as one of our strongest 
allies in this effort to control encryption have abandoned key 
recovery.
    Ms. Ros-Lehtinen. Without objection.
    Mr. Goodlatte. Then the following day an article, also in 
Tech Daily, pointing out that the British government has 
abandoned key escrow or key recovery, leaving us with a 
situation where, as more and more countries do this--and I 
don't know of any that has attempted to implement a key 
recovery scheme--we are going to be put in a position where we 
are holding back the ability to make strong encryption 
available to people who want to use it, except if they want to 
download it from the Internet, buy it from foreign sources and 
the only folks who are going to be impacted negatively by this 
are the U.S. companies who aren't going to break the law. They 
are not going to violate our export control laws, but dozens of 
great companies from IBM to Microsoft to Sun Microsystems to 
the list goes on and on and on, they are going to be competing 
with one hand tied behind their back. So the effect is going to 
be they either send the business offshore or they cede this 
business to foreign competition.
    Now, with regard to recoverable encryption, the gentleman 
from the Commerce Department has indicated that you are not 
calling for a key recovery system, but the gentleman from the 
Justice Department keeps referring to recoverable encryption. 
During the hearing in the Judiciary Committee, I asked him what 
he meant by recoverable encryption if it wasn't key recovery 
and he said that there are many technologies that aren't 
strictly speaking key recovery that do promote the interests of 
law enforcement as well as other government interests.
    If you are not referring to key recovery, Mr. Lee, what are 
you referring to? You have still, in spite of having agreed to 
respond to that, not responded to that in any substantive way 
to give us other ideas of what you mean, if it is not key 
recovery. It might be the Clipper Chip, which is a notorious 
proposal of the Justice Department of a few years back where 
the chip was embedded into the computer itself and was 
thoroughly rejected by everybody involved in the process. But 
what are you referring to?
    Mr. Lee. It is not the Clipper Chip. I was referring to a 
variety of technologies which are going to depend on the 
application, on the market sector, on the end-user, on the 
business need. What each of those technologies have in common 
is that they provide some capability to provide plain text upon 
presentation of a lawfully authorized court warrant.
    Some of the examples that we have given--I obviously don't 
want to get into proprietary information or favoring particular 
companies, but--for example, the consortium of private doorbell 
companies that came to us and proposed a method, which 
Secretary Reinsch can elaborate on, which would allow the 
export of strong encryption while also meeting law enforcement 
needs. There are many others. They are detailed on various web 
sites. I don't have an exhaustive catalog of them here, Mr. 
Goodlatte, but there are a variety of different products.
    Again, no one of them is--there is no such thing as a key 
recovery system. That is a term that we were using to refer, 
perhaps unartfully, to the concept that a product which is 
designed and marketed to meet a business need also supports the 
needs of law enforcement. That is all we are after. We are not 
wedded to any particular technology or product or application.
    Mr. Goodlatte. But you would mandate that every company 
that wants to manufacture and export a product in the United 
States for sale overseas have that type of device attached to 
it in spite of the fact that we are confronted with a flood of 
foreign competition that would not have that mandated to it 
and, in fact, would be advertising that they have a product 
that is secure that U.S. companies cannot offer. In fact they 
are advertising that fact right now.
    Mr. Lee. Sir, we would not mandate that. As Secretary 
Reinsch and the other panel members have testified, in pursuant 
to the encryption export updates last September, there were a 
number of encryption products for a number of very important 
sectors, very significant parts of the world economy where 
encryption does not have to provide those kinds of 
capabilities. Also----
    Mr. Goodlatte. So you would not object to the provisions in 
this bill which prohibits the government from mandating key 
recovery or key escrow?
    Mr. Lee. That wasn't my testimony, sir.
    Mr. Goodlatte. Please clarify then.
    Mr. Lee. We have testified, both in our written statements 
and in our verbal testimony, that we are concerned that 
provisions in H.R. 850 would inhibit the government from 
encouraging the use of key recovery, key escrow, other types of 
plain text availability systems, both for its internal use and 
for people seeking to do business with the government. You also 
have Secretary Reinsch's testimony on that point.
    Mr. Goodlatte. What do you mean by the word ``encourage?''
    Mr. Lee. The government has a number of statutory 
obligations to make information available to its citizens: 
document retention programs, government public-right-to-know 
information, all the information that the government has is 
held in trust. If that information is encrypted, we have a 
responsibility, which is set out in statute, to make sure that, 
at the appropriate time, that information will be made 
available to the public. So that is the kind of obligation 
where some kind of plain text recovery system is going to be 
necessary to meet that obligation. Again, contractors, others 
who are collecting information for that purpose would----
    Mr. Goodlatte. There is nothing in the legislation which 
prohibits the government from having its own key recovery 
system for its own record keeping purposes. But we do prohibit 
the government from mandating that anybody who does business 
with the government, which is virtually every business and 
every citizen in the United States, from using a system that 
requires a key recovery system to be attached to it. If they 
prefer for their own security and their own privacy to not have 
a key recovery system, as many people do, we do not allow the 
government to mandate that. But we do not prohibit the 
government from having its own key recovery system for its own 
purposes. Nor do we prohibit any private business from doing 
that for those who choose to do it. It is not the business of 
the government to mandate to people whether they should have 
key recovery or not have key recovery.
    The problem with it is if you mandate it and other creators 
of products in other countries do not. They have a tremendous 
market dominating advantage in selling a whole array of 
hardware and software products that are going to be using 
strong encryption when they can say that they can guarantee you 
that no one, the U.S. Government or anyone else has a key to 
that system.
    Mr. Lee. The government does a number of its business 
through contractors and one of the concerns we have is that 
this would prevent the government from doing its business in 
the way that the government deemed most appropriate when the 
contract is----
    Mr. Goodlatte. So you would insidiously put key recovery 
into the entire country by saying that if you want to do 
business with the U.S. Government, you have got to have key 
recovery. That is what you mean by encourage. When you say you 
really don't want to mandate key recovery, but you want to 
encourage it by saying if you want to do business with the 
government online--which everybody will be doing in the near 
future--you are going to require that they have a system that, 
if they do business with the government, has a key recovery 
feature. Is that what you are saying?
    Mr. Lee. I guess, a couple of points in response, if I may. 
It wasn't my testimony that the government is going to be 
seeking to do those things. I have testified what the 
government's position is, as have the other panelists. The 
government's policy, the Administration's policy, is that there 
are not restrictions on the use of encryption. What I did 
testify, Mr. Goodlatte, was that, to fulfill its statutory 
obligations in the way that it deems best, the government may 
decide, if it is necessary, to have some form of key recovery.
    Mr. Goodlatte. Require contractors doing business with the 
government to use key recovery as well?
    Mr. Lee. In order to fulfill statutory obligations such as 
record keeping, that may be a possibility. I wouldn't----
    Mr. Goodlatte. When you say contractors, would that be 
other people doing business with the government like taxpayers 
filing tax returns?
    Mr. Lee. I was dealing with the situation of contractors. 
Again----
    Mr. Goodlatte. Where would you draw the line? I just want 
to make it clear why this bill draws the line at saying we are 
not going to be mandate because of the fact that this is an 
all-encompassing thing. Once you start down that road of 
saying, if you want to do business with the government, you 
have got to use key recovery, you can, very shortly, require 
that virtually every system of communications that we have in 
the country have key recovery, not by mandating it, but by, to 
use your phrase, encouraging it because if you want to 
communicate with the government in this fashion, you have got 
to do that.
    Mr. Lee. I think with the possible exception of Washington, 
D.C., we may have a difference of opinion of the impact of the 
U.S. Government on the overall economy.
    Mr. Goodlatte. I don't know many law-abiding citizens who 
don't file tax returns or don't have to communicate with the 
government on a whole host of other issues that are vitally 
important to them from social security and Medicare to census 
taking to--the list goes on and on and on.
    Mr. Lee. I also respectfully disagree that the government 
is trying to do something insidious here. What we are trying to 
do is to make sure that we fulfill our statutory obligations.
    Mr. Goodlatte. I don't--certainly there is no statutory 
obligation to impose key recovery because, at this point in 
time--and I hope forever in the future--we do not have any kind 
of domestic limitations on the use of strong encryption or the 
requirement that you use a key recovery system to protect your 
privacy, to protect your property, which is what strong 
encryption is designed to do. Thank you, Madam chairman.
    Ms. Ros-Lehtinen. Thank you so much. Mr. Sherman.
    Mr. Gilman. Madam chairman, before I go----
    Ms. Ros-Lehtinen. Yes, Mr. Gilman.
    Mr. Gilman. Can I just make a unanimous consent----
    Ms. Ros-Lehtinen. Absolutely.
    Mr. Gilman [continuing]. The May 11th letter from the 
president of B'nai Brith, Richard Heideman, on encryption 
issues be made part of the record.
    Ms. Ros-Lehtinen. Without objection.
    Mr. Gilman. Thank you, Madam.
    Ms. Ros-Lehtinen. Thank you.
    Mr. Sherman. Madam chairman, I would like to pick up on the 
questions being asked by the honorable gentleman from Virginia. 
Mr. Lee, maybe you could just put our minds to rest. Will this 
Administration ever say that, in order for a bank to have any 
deposits of the U.S. Government, that it must divulge the key 
recovery information as a condition for having U.S. Government 
deposits? Are you keeping open that hammer that you would use 
to deprive Americans of their privacy?
    Mr. Lee. I have testified, as have my fellow panelists, 
that it is the Administration's policy not to seek mandatory 
regulation of key recovery.
    Mr. Sherman. I am not talking mandatory. I am saying, as 
you may know, the U.S. Government sends out an awful lot of 
social security checks. Those are being sent out by wire to 
banks across this country. Will the Administration ever tell 
banks that they must divulge the key information in order to be 
eligible to receive such wired social security deposits?
    Mr. Lee. I think the wise thing for me to do would be to 
defer that question to Secretary Reinsch.
    Mr. Sherman. You've shown tremendous wisdom.
    Ms. Ros-Lehtinen. He's a country lawyer.
    Mr. Sherman. Now let us see whether the Secretary will show 
wisdom. Can you put our minds to rest or are you going to----
    Mr. Reinsch. All I can say, Mr. Sherman, is that I have 
been involved in, as far as I know, most of the discussions 
that have gone on this issue for the last 3 years and nobody 
has even thought about that. Nobody has even----
    Mr. Sherman. Nobody has thought of it. Can you tell us 
how----
    Mr. Reinsch. Nobody has thought of that. Nobody has 
suggested it.
    Mr. Sherman [continuing]. That gentleman from Virginia has 
thought of it. Can you put our minds to rest or could we face 
that mechanism of trying to force the divulging of key----
    Mr. Reinsch. I can only tell you what I have said because I 
am not in the bank regulatory business. If you want to know 
what is contemplated with respect to bank regulation, you will 
have to have ask the bank regulators. I haven't talked to them 
about this. As far as I know it has never occurred to them and 
it is not on their agenda, but I certainly wouldn't presume to 
speak for them.
    Mr. Sherman. But you are representing the Administration 
here in terms of a desire to have access to a key that would 
allow you to decode encrypted information. In that capacity, 
will you be pressing to use all of the levers of the 
Administration to try to compel domestic organizations doing 
domestic business with American citizens, will you try to 
penalize them or take away their right to do business with, for 
example, social security recipients because they do not divulge 
the key?
    Mr. Reinsch. As far as I know, we have no intention of 
doing that. But let me stress, at the same time, what Mr. Lee 
said. The issue here isn't keys, from a law enforcement point 
of view, the issue here is data and access to data. Key 
recovery and the existence of the key is one means of achieving 
the objective. The Department of Justice and other law 
enforcement entities have, as far as I know--and have said this 
many times and I think Mr. Lee said it today--have no interest 
in trying to expand their capacity to obtain private 
information beyond what existing laws and existing courts 
permit them to do.
    What we are trying to deal with here is simply a means of 
how do you apply existing court rulings and legislation with 
respect to law enforcement access to private information to a 
new technology? We are not trying to expand the right of 
access. I think the best way to look at this debate is to focus 
on the information and----
    Mr. Sherman. Excuse me, I have a limited amount of time. 
You have gone well beyond the question I asked.
    There is, I think, no prospect of getting Congress to give 
the Administration or any Administration domestically what you 
are seeking internationally. Do you disagree or will you be 
proposing legislation that would prevent someone from buying 
encryption, strong encryption, at their local software store?
    Mr. Reinsch. We have testified to that many times and it is 
in my statement. We have no intention of doing that.
    Mr. Sherman. So what we have is a situation where you can't 
go after what you would like domestically, so you want to 
punish the U.S. software industry by putting it at a 
disadvantage vis-a-vis its foreign competitors. Not 
surprisingly, our foreign competitors and their governments 
have welcomed this effort and have engaged in a little dance at 
Wassenaar where they pretend to be interested in preventing 
their companies from marketing strong encryption worldwide and 
we fall for it and are now in a process of giving away what may 
be the world's most important industry to our foreign 
competitors. Then you come to us and you show us how beautiful 
our economic competitors' dance at Wassenaar and give us that 
as a reason why we should bludgeon our own industry and make it 
more difficult for them to compete worldwide.
    I know there is a question in there somewhere.
    Mr. Reinsch. Was there a question in there, Mr. Sherman?
    Mr. Sherman. There will be a question, I assure you, Mr. 
Secretary.
    Mr. Reinsch. All right.
    Mr. Sherman. That question is: For Mr. Voegtlin--Gene, I am 
mispronouncing your name.
    Mr. Voegtlin. Voegtlin.
    Mr. Sherman. Voegtlin. That is: You talk about how you 
don't want street thugs communicating with each other, using 
encryption you cannot decode. Is there any prospect of 
preventing that when, in fact, your colleagues here 
representing the Administration won't even propose legislation 
that would prevent any American, criminal or otherwise, from 
getting all kinds of encryption from their local software 
store?
    Mr. Voegtlin. As you say, they represent the 
Administration. I do not.
    Mr. Sherman. Will you be proposing the legislation that 
they are unwilling to propose?
    Mr. Voegtlin. If I could, I don't know if we would. But I 
will say this and I would like to get this as clear as I can. 
The folks that I represent view this as an issue of great 
importance and, to them, a simple choice. You have a choice--
they understand the need for encryption. They agree that it has 
legitimate uses. But they are more concerned about trying to--
and trying to do their jobs and how encryption prevents them 
from doing it.
    If they had the answer to this issue, I wouldn't be up 
here. Actually, I would be a very rich man. I am not, so they 
don't. But what I think you are all confronting here is a basic 
choice. You need to find some kind of balance between strong 
recoverable encryption that can fulfill the vast majority of 
legitimate uses and strong unbreakable encryption that could be 
put to insidious, dangerous, frightening uses.
    I know that is an answer that doesn't answer. But, again, I 
don't have the answer for you. All I can try to tell you is 
that we are facing----
    Mr. Sherman. I agree with you completely. I agree with you 
completely. I don't have the answer. You don't have the answer. 
There are elements of the Administration so angry that there 
isn't an answer that they would just like to bludgeon the hell 
out of the U.S. software industry. They are, of course, 
encouraged by our foreign competitors. But it is certainly not 
an answer to say that we are going to allow something to be 
purchased at every software store in America, but we are going 
to prevent legitimate people from exporting that same software.
    Because I will ask you, speaking on behalf of the police 
chiefs, do you know of any mechanism that the police chiefs can 
use to prevent anything that is purchasable at every software 
store in America from being exported, either physically or over 
the line to criminal figures in other countries? Do you have 
any prospect at all of preventing that?
    Mr. Voegtlin. I have no information myself. I would be glad 
to check with our Committees that deal with terrorism, 
international crime, and organized crime and see if any of 
those experts have an answer.
    Mr. Reinsch. Actually, Mr. Sherman, if I could comment. 
That is my job. The other half of what BXA does is enforce the 
Export Administration Act and that is what we try to do. The 
answer to your question is, in the circumstances you have 
described, it is extraordinarily difficult. There is no 
question about that.
    Mr. Sherman. Is extraordinarily difficult, is that 
Washington talk for completely impossible?
    Mr. Reinsch. It is not.
    I try to avoid Washington talk.
    Mr. Sherman. Again, if I were to walk into Egghead, buy 
something, and send it over the Internet to somebody in Canada, 
wouldn't you think that would be like completely impossible for 
you to stop me?
    Mr. Reinsch. What we have said about this many times and 
what Ms. McNamara said earlier is, if somebody wants to defeat 
the system, they can do that. There is no question about that. 
We have never denied that. I would not go so far as to say it 
is clearly impossible. We have a number of investigations going 
on. We do catch people. Never underestimate the stupidity of 
some of the people we have to deal with.
    I didn't say that.
    Mr. Sherman. It is a shame that you do have to deal with 
Congress.
    Again, I think that you are----
    Ms. Ros-Lehtinen. He is not going to name names.
    Mr. Sherman. I think my time has expired.
    Ms. Ros-Lehtinen. Thank you, Mr. Sherman.
    Mr. Burr. Let us move on.
    Mr. Burr. Mr. Secretary, your comments are shared.
    Mr. Reinsch. We may be talking about different people, 
though, Mr. Burr.
    Mr. Burr. I feel confident we are. Mr. Secretary, I would 
like to read some statements to you and ask you some questions 
relevant to those statements. The first is, and I quote, ``As 
the line between military and civilian technology becomes 
increasingly blurred, what remains clear is that a second-class 
commercial satellite industry means a second-class military 
satellite industry as well. The same companies make both 
products and they depend on export for their health and for the 
revenues that allow them to develop the next generation of 
products.'' If we replaced the word satellite with the word 
encryption, do you think that statement would still stand?
    Mr. Reinsch. First of all, Mr. Burr, I am delighted to see 
that Members of Congress are reading my speeches. It warms my 
heart. I encourage you share that with some of your colleagues. 
I would love to have them look at it.
    I think, as a general statement, yes. I think that 
statement would stand. I think there are a lot of similarities. 
I was thinking when you made your opening comments, which I 
felt were quite thoughtful on this subject, that it would be 
appropriate to apply the comments you made to some other 
situations as well. That does not mean, however, in either of 
those cases, this one or the other one, that the answer is no 
controls. I think it means that the answer is balance and a 
realistic view about what is controllable and what is not and 
what the national security implications of both are.
    Mr. Burr. I hope, from my opening statement and from my 
line of questions, you will understand that I think the 
difficulty that we have or the disconnect with all of our 
witnesses and many of the Members here and I think what we 
struggle to understand is we see this reality of the access 
that the domestic market has today, our inability to limit in 
any way encryption products, yet some belief on the part of the 
Administration and others that there is a way to do it. If 
there is, then share that with us. If there isn't, then, as Mr. 
Sherman said, let us find the best balance to allow our United 
States companies to compete in this global marketplace.
    Let me go on one more statement. ``Some of these satellites 
bring telephone, television, and Internet services to the 
Chinese people. I believe such services are an integral part of 
any effort to bring democracy and freedom to China.'' Could the 
same be said of strong encryption products, which might provide 
those movements for democracy in China to stay behind the 
prying eyes of the Chinese government?
    Mr. Reinsch. Mr. Burr, that is--I would say two things 
about that. I think that is certainly true. I think, at the 
same time, some of your colleagues, particularly those on the 
Armed Services Committee, would make exactly the other point 
here and that is do we want to sell strong encryption to the 
People's Liberation Army so it could be further used to protect 
their own communications from our intelligence and to further 
oppress the Chinese people?
    Mr. Burr. Do we currently allow encryption products to be 
placed on the satellites that we export?
    Mr. Reinsch. The satellites that are launched have 
encryption which might best be described as--and it is an 
outdated encryption--it is encryption that allows us to encrypt 
the signals that control the movement of the satellite.
    Mr. Burr. Does it limit one's access to the information off 
of the satellite?
    Mr. Reinsch. I will defer to our satellite export.
    Mr. Burr. It is not a proprietary question.
    Ms. McNamara. The encryption that has been used on U.S. 
satellites that have been sold overseas, when there is 
encryption used, it is, as Secretary Reinsch describes, for 
telemetering the satellite itself and, for the most part, in 
fact, I believe in all cases with regard to China, always 
remain in the hands of U.S. persons. It does not have anything 
to do with the actual transmission of information over that 
satellite. It is for the control purposes of the satellite and 
when the U.S. persons were there at launch, the U.S. encryption 
that was used was, in fact, retained in the hands of the U.S. 
parties on the ground.
    Mr. Burr. But there is no encryption product in the 
satellite which protects the security of the data that is 
transmitted from the satellite?
    Ms. McNamara. In fact, these are dumb satellites. It is 
what--it is the medium over which people communicate. If the 
communications or the originator of the communications uses 
encryption, then the information being passed over that 
satellite is encrypted. But it is encrypted from the ground, 
not because it transmits over the satellite.
    Mr. Reinsch. If I could comment, Mr. Burr, though, Mr. 
Goodlatte's bill, You have touched on a very central dilemma. 
Mr. Goodlatte's bill would, in effect, permit the sale of 
strong encryption both to Chinese individuals who want to 
encrypt their communications in order to, do things that their 
government would probably rather have them not do and it would 
also permit the sale of that same encryption to other forces in 
the Chinese government who don't want that to happen.
    Mr. Burr. I think the part that possibly Mr. Goodlatte is 
frustrated over is the willingness for the Administration to 
understand the frustration that currently exists when that 
product is available here in this country, can be transmitted 
sold, carried out of the country to be used by people that we 
restrict U.S. companies from marketing like product to. I 
think, to some degree, we are like the ostrich with the common 
practice of the head in the hole. When we have our head in that 
hole, we believe nothing goes on while we are there. The fact 
is, in reality it is, isn't it?
    Mr. Reinsch. If it will make Mr. Goodlatte feel any 
better--and I think he knows this--I am at least as frustrated 
as he is, perhaps for different reasons. But we are working 
very hard to try to prevent the situation that you have 
described from occurring. I have testified in other 
circumstances, I think, in the past before this Committee, that 
I, for one, would say if we were to reach the point at which 
you, in terms of commercial consequences, that you are 
anticipating, I would hope that the Administration would be 
wise enough to see that and adjust its policy.
    I think the disagreement we might have is whether or not 
that point has arrived now and, if not, how quickly it will 
arrive. I think what Ms. McNamara suggested is that, for a 
number of reasons, we find that point somewhat more distant 
than the Members of this Committee probably do.
    Mr. Burr. I hope you understand that my questions are more 
broad than specifically to the encryption issue. If my 
understanding is correct, this time next year, with the Merced 
chip in computers, the off-the-shelf leader model with exceed 
the M-top standards that we currently have requiring export 
licenses. Is that accurate?
    Mr. Reinsch. Oh, no question. In fact, I can tell you, I 
think my latest sound bite on that is if we don't change what 
we are doing by the end of the year, we are going to be 
controlling Sony Play Stations. It is moving that fast. This is 
also something the Administration is working quite hard on and 
we expect to be able to consult with you all and share 
something with you shortly. But I think it is going to come as 
no surprise to you that there will be a substantial number of 
Members in your body who will oppose any changes, 
notwithstanding the point that you have made.
    Mr. Burr. I would agree with your statement that there will 
be quite a few people who oppose it.
    Mr. Reinsch. I am delighted to hear the consistency of your 
point of view. Not all of your colleagues are consistent on 
these two sectors.
    Mr. Burr. My hope is that that consistency is something 
that becomes contagious with the Administration.
    Mr. Reinsch. We strive for it every day.
    Mr. Burr [continuing]. As it relates to the need for these 
technology companies to, one, compete; two, compete on a level 
playing field for the effort to grow to the next generation. 
With that, I will yield back.
    Ms. Ros-Lehtinen. Thank you. Mr. Rohrabacher.
    Mr. Rohrabacher. Yes. Speaking of consistency--and I will 
just put it right out front--I find it a bit appalling that 
representatives of this Administration would be here so 
adamantly arguing for something they claim to be, based in 
national security, like this encryption debate, while, at the 
same time, labeling Communist China, which is, at the very 
least, a potential hostile power--if most of us believe that it 
is a hostile power--by continuing to insist that we call 
Communist China a strategic partner of the United States. So I 
don't want to hear much about consistency in this debate on the 
national security concerns of our country because the overall 
policy toward China is doing far more damage to our national 
security than any of this type of regulation that we are 
talking about today. In fact, if there isn't a change in the 
basic, fundamental approach to China, all of your talk about 
national security is irrelevant.
    What I see here is a lot of activity and a lot of effort 
being put into this effort to--let us, I will just put it right 
out--you are trying to strengthen government's control, not of 
other people who are hostile to the United States, but trying 
to strengthen government's control of ordinary Americans and 
American enterprise. I don't want to--you hear this all of the 
drug dealers are going to do this and the bad guys are going to 
do this, but what do we end up with? Those guys are going to 
end up with encryption anyway. This is the message I am hearing 
all around me is these guys are going to end up--and I realize 
that this is taking to it to absurdism, you might say, but the 
fact is that when encryption is outlawed, only outlaws will 
have encryption. Sorry to put it that way, but after listening 
to the arguments today, I have just come to the conclusion that 
the only impact you are going to have is on honest people and 
on enterprisers and not on people who are hostile to the United 
States.
    You are going to have the doctors in this country. You will 
have their electronic files open and available. You are going 
to have the lawyers, the bankers. I am a former journalist--
trying to tell me that you are going to say you are not making 
it mandatory, but you are going to say it is going to be 
conditional, these restrictions are going to be conditional on 
whether or not people are dealing with the government? 
Journalists have to get up on their computer and dial in to get 
their automatic press releases now. The press releases aren't 
handed out on paper. They come over the electronic processes. 
So in order to get those, the journalists, in order to get 
information from the government, they have got to say that they 
understand that their computers are going to be open to 
government snooping? All in the name of getting the bad guys?
    Let me just note: The government for the last 20 years has 
had all of this control and the ability to go in and snoop as 
you wanted to snoop and the drug war is a joke. You go down 
into any city in the United States of America and any kid can 
get drugs. This is telling us that we have got to open up the 
possibility in the years ahead in the new millennium to have 
this type of power in the hands of the government in order to 
fight the drug war? It is a joke. You have been unsuccessful 
with all that power already. Again, the only people you are 
really going to affect are honest citizens like the doctors and 
the lawyers, the journalists and the rest.
    Let me just note this. In the years ahead, the computer 
systems that we have are going to serve as the basis of 
American prosperity. Like it or not, that is the world that we 
are heading into. The Internet system will be used for 
enterprise and purchases that are the foundation--look at our 
stock market today. Where is the growth? Where is the faith in 
the investors? It is in these Internet stocks. What you are 
talking about is a threat to that foundation in order to make 
sure the government has the power to snoop. Yes, we need 
certain powers in the hands of the government to tackle the bad 
guys. But, as I say, I don't see this as any type of threat to 
the bad guys because the bad guys will be the ones to get it 
and the good guys will be the ones who follow the law.
    Here is my question. That is my statement. Here is my 
question? I want to ask Mr. Lee this. Now your title, Mr. Lee, 
is what?
    Mr. Lee. I am an associate deputy attorney general at the 
Department of Justice.
    Mr. Rohrabacher. For?
    Mr. Lee. The titles don't actually say for X or Y, but I 
work in part on national security and international matters.
    Mr. Rohrabacher. Was it you or your office that denied the 
effort to get a wiretap on the suspect in the Los Alamos theft?
    Mr. Lee. As other officials of the Department of Justice 
have testified, there is a process set up where the counsel for 
the Office of Intelligence, Policy, and Review reviews requests 
from the FBI for that kind of search warrant.
    Mr. Rohrabacher. Yes. So was it you or your office that 
denied that request for a search warrant for a wiretap? I 
understand that Mr. Lee who was the suspect in the case was the 
only wiretap that was denied. Is that from your office?
    Mr. Lee. Again--sir, I was not involved in that decision.
    Mr. Rohrabacher. Was that your office?
    Mr. Lee. There has been public testimony which, again, I 
don't have the transcript in front of me, so I want to be 
careful not to be inaccurate in any respect, but there has been 
public testimony that the Attorney General asked a member of 
the deputy attorney general's office to review that matter. 
That was not me. I don't have any further firsthand 
information.
    Mr. Rohrabacher. That wasn't my question. Was it your 
office? You are the head of an office. Was it your office that 
denied that request?
    Mr. Lee. Again, the public testimony is that the prior 
incumbent of my office had a role in evaluating that request. I 
do not have firsthand information and so I don't think it would 
be appropriate for me to try to characterize it any further.
    Mr. Rohrabacher. I will take that as a yes. Let me suggest, 
as I did in my opening statement, when you have a wrong headed 
Administration that has wrong headed policies toward people who 
are hostile to the United States of America, no matter what we 
do on this encryption, no matter what powers that we grant to 
the government, we are not going to be safe. I feel, in fact, 
very hesitant to grant the type of enormous powers, as we come 
into this new age of electronics and computers, to grant this 
enormous power to the Federal Government, especially one that 
is represented by an Administration that is totally going the 
wrong way on national security issues.
    With that, I yield back my time.
    Ms. Ros-Lehtinen. Thank you. Mr. Cooksey.
    Mr. Cooksey. Thank you, Madam chairman. Earlier today, I 
believe there was a question about the effect of H.R. 850 on 
local law enforcement. It was mentioned that there was concern 
about this effect.
    I have a letter here from the Louisiana Sheriffs' 
Association specifically endorsing H.R. 850 and rejecting the 
escrowing of the encryption keys. I will ask this question of 
any one of you that is willing to answer it. Can anyone explain 
to me why the sheriffs in my area are not concerned about the 
effect of this bill? I will take a response from any one of you 
or all of you.
    Mr. Voegtlin. I can't speak to the rationale of the 
Louisiana Sheriffs' Association. Perhaps if you talk to folks 
at the National Sheriffs' Association, they would be able to 
fill you in. I can't speak to their concerns. I know, on behalf 
of my membership, the 17,000 members that make up the IACP, 
that they have expressed, both through numerous Committee 
hearings and numerous membership resolutions that have been 
passed, that they are very concerned about this issue and its 
impact on their ability to perform at the State and local 
level. I can't answer for the sheriffs.
    Mr. Cooksey. Would anyone else like to try? In their 
resolution--and I will read a couple of them--they said the 
legislation proposed by the FBI would require all users of an 
encryption to deposit a key with a key escrow agent that would 
be available to FBI access. The FBI access would create and 
maintain a dangerous and unnecessary vulnerability to 
Louisiana's information computer infrastructure while failing 
to offer any increased level of protection these systems 
require. While the FBI's efforts toward recovering information 
about criminal cases through high security encryption are well-
intentioned, the key escrow plan poses too many severe threats 
to public safety, confidentiality, and legitimate computer 
users that far outweigh the isolated benefits it may provide.
    There is another resolution. Does anyone want to answer it 
now?
    Mr. Lee. Sir, it is hard to answer without having read the 
letter which I have not had the benefit of doing. Again, the 
Administration is not proposing some massive central data base 
where everyone's keys would be kept. We have been quite clear 
and consistent that, really, a variety of private agents who 
would be serving people's whole range of security services for 
business needs is what is envisioned and that is what we want 
to work with industry on developing. One of the needs that we 
think this set of services will have to address is the needs 
that businesses have for the recovery of their information and 
plain text.
    Mr. Cooksey. Do you think each one of those could be 
subject to hackers, to being broken into? Is that possible?
    Mr. Lee. It is certainly possible.
    Mr. Cooksey. Is it probable? I see someone out in the 
audience shaking their head yes.
    Mr. Lee. I don't have the information to answer that, sir.
    Mr. Cooksey. Let me just state that I feel very strongly on 
law enforcement. I have a very close working relationship with 
law enforcement people in our area. We have some real 
professionals, particularly some people from the Department of 
Justice, the FBI. We have got some top people. But I quite 
frankly don't feel that you see the same level of loyalty to 
the principles of law enforcement in some of the political 
appointees in your Department and it is really a disappointment 
to me.
    I am not a career politician. I am a physician. I don't 
want to be a career politician and I quite frankly hold a lot 
of the politicians in real contempt because of the 
inconsistencies I see. Here I see the potential for some more 
inconsistencies, but, that said, thank you, Madam chairman.
    Ms. Ros-Lehtinen. Thank you so much. Mr. Campbell.
    Mr. Campbell. Madam chair, out of courtesy to the next 
panel and the fact that I haven't heard all of the testimony, I 
will yield and thank you and thank the panel.
    Ms. Ros-Lehtinen. Thank you so much. I will also furnish my 
questions in writing in courtesy of the second set of 
panelists. But we thank you very much for your patience and we 
appreciate you being with us today and we will look forward to 
continuing this dialogue as this bill goes through the process. 
Thank you so much to all of you.
    I would like to introduce the second set of panelists. We 
will start with Ira Rubinstein, who is senior corporate 
attorney for Microsoft Corporation. Prior to joining Microsoft, 
Mr. Rubinstein was an associate with different law firms and is 
currently a Member of the President's Export Council 
Subcommittee on Encryption and serves on the Steering Committee 
for Americans for Computer Privacy. Mr. Rubinstein is the 
author of numerous publications addressing export controls and 
encryption software.
    Mr. Jeffrey Smith is a partner at the firm of Arnold and 
Porter in the firm's Legislative and Government Contracts 
Practices Division and serves as general counsel for Americans 
for Computer Privacy. From 1995 to 1996, he served as general 
counsel of the Central Intelligence Agency. Prior to that, he 
was appointed by then-Secretary of Defense William Perry to the 
Commission to Review the Roles and Missions of the Armed 
Services. Mr. Smith has also served in various capacities 
within Congress, including general counsel of the Senate Armed 
Services Committee.
    David Weiss is Vice President of product marketing at 
CITRIX Systems. In this capacity, he is responsible for mapping 
the company's long-term product strategy and direction. He was 
instrumental in the release of the industry's first Windows 
application and launching Internet technology and, prior to 
joining the firm, he was a founding Member and Director in 
marketing for Business Matters, Inc., a financial modeling 
software company. This corporation, CITRIX, I am proud to say 
is located in my hometown of South Florida and we are happy to 
have David with us today. Thank you.
    Mr. Alan Davidson is the Staff Counsel for the Center for 
Democracy and Technology, a nonprofit, Washington-based 
organization that works to promote civil liberties on the 
Internet. Mr. Davidson is currently leading the efforts to 
promote encryption policies that protect privacy and, prior to 
joining the legal profession, Mr. Davidson was a computer 
scientist. He worked as a senior consultant and designed the 
information systems for NASA's space station freedom projects. 
He also worked on technology and policy issues at the U.S. 
Congress Office of Technology Assessment.
    Ms. Dinah PoKempner is the Deputy General Counsel of Human 
Rights Watch, one of the largest human rights monitoring 
organizations in the world. Ms. PoKempner has performed field 
research in Cambodia, Vietnam, Hong Kong, Bosnia, and Croatia 
for the organization and currently directs institutional policy 
in various areas, including electronics, communications, and 
international law.
    Mr. Edward Black is the President and CEO of the Computer 
and Communications Industry Association, an international trade 
association comprised of leading computer, communications, and 
networking equipment manufacturers, software providers, 
telecommunications, and online service providers. Prior to 
being named president in earlier 1995, he served as vice 
president and general counsel for CCIA since the mid-1980's. He 
currently serves as the Chair of the State Department's 
Advisory Committee on International Communications and 
Information Policy.
    We thank all of you for being here today. We will be glad 
to put all of your statements in the record and we ask you to 
please be as brief as possible.
    Mr. Rubinstein.

    STATEMENT OF IRA RUBINSTEIN, SENIOR CORPORATE ATTORNEY, 
                     MICROSOFT CORPORATION

    Mr. Rubinstein. Good afternoon, Madam chairman. I greatly 
appreciate the opportunity to appear today before the Committee 
on behalf of Microsoft and the business software lines of BSA. 
I especially wanted to thank you, Madam chairman, for your 
support of the SAFE Act in this and prior Congresses. I also 
want to thank the other Committee Members who cosponsored the 
bill this year.
    American software and hardware companies have succeeded 
because we have responded to the needs of computer users 
worldwide. One of the most important features users are 
demanding is the ability to protect their electronic 
information and communications securely. American companies 
have innovative products that can meet this demand and compete 
internationally, but there is one thing in our way: the 
continued application of over broad and restrictive U.S. export 
controls.
    BSA strongly supports the SAFE Act because it modernizes 
and liberalizes U.S. export controls. We urge the Committee to 
report the SAFE Act without amendment and we look forward to 
its passage in the House this year.
    I want to emphasize three points today. First, any effort 
to control mass-market products based on key lengths is doomed 
to failure. Eight years ago in a 1991 study, the National 
Academy of Science discussed the nature of mass-market software 
and the futility of trying to control it. The NAS concluded, 
``The widespread availability of such software, coupled with 
its difficulty of detection and ease of reproduction makes any 
attempts at controls impossible,''.
    These observations and conclusions were true in 1991 and 
remain true today. If anything, they are even more true, given 
the rise of the Internet and the other means for electronically 
distributing software to mass-market customers on a worldwide 
basis. The addition of encryption functionality to mass-market 
products does not somehow alter these characteristics. Products 
that are not controllable at 56-bit key length do not become 
controllable at longer key lengths.
    My second point is that export controls create competitive 
advantages that foreign firms have been very successful in 
exploiting. Their entry point is U.S. export controls. Because 
U.S. firms are unable to satisfy customer demand for 128-bit 
encryption, non-U.S. firms create and freely distribute so-
called step-up software whose sole purpose is to increase the 
key lengths of U.S. products from 40 bits or 56 bits to 128 
bits. At the same time, these foreign firms develop powerful 
service software and related applications for Internet banking, 
e-commerce, and secure messaging. They also develop consulting 
expertise to service key customers such as banks, ISP's, telcos 
and online merchants. These are all the pieces needed to offer 
a complete package of 128-bit encryption to foreign customers 
and U.S. firms can't compete with this.
    This approach has spawned several of the fastest growing 
and most successful non-U.S. software firms focusing on the 
Internet market. In the interests of time, I will just 
highlight one of them, a firm called Baltimore Technologies, 
which is an Irish company which recently merged with Zergo, a 
U.K. company, and now offers a complete line of e-commerce and 
enterprise security products. At this point, I would like to 
show you exactly how Baltimore markets its products over the 
Internet.
    [Slide.]
    These slides, these are slides of what you would see if you 
visited their web site. It is not a live connection, in the 
interests of making it go quickly. The first page is their 
homepage. You see in the upper lefthand corner that it is the 
Zergo homepage and it lists products and services and other 
information that you can find there.
    [Slide.]
    The next page includes in its marketing materials the very 
statement of the problem that we are here today to discuss. I 
will read it quickly. ``U.S. export restrictions dictate that 
most web service and browsers cannot perform 128-bit encryption 
for security. Instead, export versions of browsers, like 
Internet Explorer and Netscape Navigator and export versions of 
web servers like Netscape Enterprise Server and Microsoft 
Internet Information Server, are limited to 40 bits of 
encryption, which is not secure enough for most applications.'' 
So here is the marketing material of a very successful foreign 
firm citing U.S. export controls.
    The success of these foreign companies threatens the growth 
of U.S. software firms and their contribution to the U.S. 
economy. It also threatens American technological leadership, 
the loss or diminution of which directly threatens U.S. 
national security and law enforcement objectives as well.
    Let me conclude with a final point and that is that the 
SAFE Act strikes the right policy balance by promoting the use 
of encryption for several purposes: to prevent crime by 
protecting sensitive communications data; to promote national 
security by protecting the nation's critical infrastructure; to 
protect e-commerce; and to protect individual privacy. Thank 
you, Madam chairwoman.
    Ms. Ros-Lehtinen. Thank you so much for your testimony. Mr. 
Smith.

  STATEMENT OF JEFFREY SMITH, GENERAL COUNSEL, AMERICANS FOR 
                        COMPUTER PRIVACY

    Mr. Jeffrey Smith. Thank you, Madam chair, and Members of 
the Subcommittee for the opportunity to testify on H.R. 850, 
the SAFE Act, sponsored by Representatives Goodlatte and 
Lofgren and cosponsored by a bipartisan group of over 250 House 
Members. I serve as counsel to the Americans for Computer 
Privacy, a coalition of 3,500 individuals, 40 trade 
associations, and over 100 companies representing a wide range 
of companies. We support policies that allow strong encryption 
and we specifically endorse the enactment of the SAFE Act and 
we respectfully urge the Subcommittee to report it without 
amendments for full Committee consideration.
    As Vice President Gore said in September 1998 when he 
announced the current Administration policy, developing a 
national encryption policy is one of the most difficult issues 
facing the country. It requires balancing many competing 
objectives, all of which are of great importance to the nation. 
Strong encryption is essential to protecting our Nation's 
infrastructure, ensuring the privacy of electronic 
communications, protecting our national security interests, 
safeguarding the public, and maintaining U.S. leadership in the 
development of information technology.
    The challenge is how to do that. The question this 
Subcommittee must address is what is the best policy to achieve 
these objectives? It is the firm view of ACP and its Members 
that, given the breathtaking pace at which information 
technology, including cryptography, is developing around the 
globe, the only way to achieve these goals, in the long run, is 
to adopt policies that will assure American industry continues 
to lead the world in information technology.
    It is often said that the first responsibility of 
government is national defense and it seems to us that the 
President, Congress, and industry collectively have a 
responsibility to ensure that in the future our law enforcement 
and intelligence agencies have the ability to continue to 
protect this nation as they do today. Indeed, they will 
probably need additional resources and technical help to meet 
the challenges of the next century. But those challenges are 
far greater if they are forced to face a world in which the 
majority of communications pass-over systems that are foreign-
designed, foreign-built, foreign-installed, and incorporate 
foreign encryption. We are concerned that the current policy of 
this government risks just such an outcome.
    We have worked hard over the last couple of years with the 
Administration to help fashion its new policy and we are 
grateful for the new policy, but we think further steps are 
needed and we urge the enactment of the SAFE Act. With that, I 
will yield the rest of my time, Madam chairman.
    Ms. Ros-Lehtinen. Thank you so much. We appreciate it, Mr. 
Smith.
    Mr. Weiss.

STATEMENT OF DAVID WEISS, VICE PRESIDENT OF PRODUCT MARKETING, 
                       CITRIX CORPORATION

    Mr. Weiss. Thank you. I will try to be as brief. Good 
afternoon, Madam chairwoman, and greetings from the Sunshine 
State, and Members of the Subcommittee, thank you for the 
opportunity to speak with you this afternoon regarding this 
important topic. My name is David Weiss. I am the Vice 
President of product marketing for CITRIX.
    Ms. Ros-Lehtinen. Now, because you are a constituent, take 
all the time you like.
    Mr. Weiss. Thank you very much. I am pleased to be 
testifying this afternoon on behalf of the Software Information 
Industry Association, SIIA, the result of a merger between the 
Software Publishers' Association and the Information Industry 
Association. SIIA represents 1,400 member companies engaged in 
every aspect of electronic commerce and has long supported 
efforts to liberalize encryption export controls and H.R. 850, 
the SAFE Act.
    CITRIX is the worldwide leader in server-based computing. 
Our products enable individuals to access applications which 
are running on their corporate networks while traveling at home 
or from anywhere in the world. Since 1989, we have worked hard 
to ensure that we provide cost-effective products to allow 
businesses to deliver access to their mission-critical 
applications to their employees and partners reliably and 
efficiently. Our products allow companies and organizations to 
share their corporate network resources with all of their 
employees, regardless of their physical location.
    In today's fast-paced economy, companies must be able to 
communicate and share information with their employees 
securely. Companies like mine have worked hard to develop 
technology and products that meet these critical needs, 
providing both individuals and businesses with the tools they 
need to remain competitive. Encryption has become a requirement 
for the technologies we developed. Without these capabilities, 
we cannot assure customers that our products incorporate 
reliable security to protect their corporate communications and 
proprietary information. Encryption helps individuals and 
businesses meet the challenges that we face in the online 
environment, while assuring that we are able to take advantage 
of its key benefits.
    CITRIX products enable communications and information 
sharing, usually within a company and generally involving vital 
applications. For most of our customers, the ability to 
communicate privately with business colleagues is critical. 
Many use CITRIX products to share sensitive information and 
require our products to protect that data from misappropriation 
by unauthorized parties or misuse by otherwise authorized but 
negligent or malicious parties.
    Encryption is the only practical means by which parties to 
an online communication can trust that each is who he claims to 
be and that the information is only available to its intended 
recipients. It is the only practical way to guarantee that the 
communication between those parties remains protected. Such 
capabilities are critical for both businesses and individuals 
seeking to take advantage to use the Internet. Without robust 
tools, no one can be assured that their online activities 
remain private and that their online transactions are 
trustworthy.
    Companies are rapidly developing innovative technologies 
and applications for use on public networks and users are just 
rapidly integrating these capabilities into their everyday 
lives. To ensure that this market continues to grow, consumer 
concerns like security, authentication, and privacy must be 
addressed. Without encryption, we simply can't do it. We must 
be able to use and widely deploy encryption if we are to help 
users protect against the inherent vulnerabilities of public 
networks. In order for our customers to be able to communicate 
securely, our products offer a variety of encryption 
technologies, some of which cannot be exported under the 
current regulations.
    The impact on our company and all of U.S. industry is 
significant. Companies are forced to choose between 
incorporating encryption into their products to meet the 
consumers' requirements or creating multiple product lines. If 
the company does not incorporate the strong security features 
that so many businesses demand, their products will fail in the 
marketplace. If the manufacturer does choose to incorporate 
strong encryption, it forgoes the lucrative foreign marketplace 
and many companies, especially many young Internet startup 
firms that are shaping the electronic commerce marketplace 
cannot afford to create multiple product lines.
    Given the time constraints, I just want to say that on 
behalf of CITRIX and the SIIA, we strongly endorse H.R. 850 and 
I will yield the rest of my time.
    Ms. Ros-Lehtinen. Thank you so much, David. To the panelist 
and our Congressional Members and our visitors, I have asked 
that Congressman Campbell be kind enough to Chair the remainder 
of the hearing. I have to go to the Floor and await my turn to 
speak on the Central America aid package so I have read your 
testimony and I look forward to sending you some questions in 
writing. Thank you so much. Thank you, Tom.
    Mr. Campbell. [presiding] Mr. Davidson.
    Mr. Davidson.

STATEMENT OF ALAN DAVIDSON, STAFF COUNSEL, CENTER FOR DEMOCRACY 
                         AND TECHNOLOGY

    Mr. Davidson. Thank you. Good afternoon and I would like to 
thank you for this opportunity to testify in front of the 
Subcommittee on behalf of the Center for Democracy and 
Technology. CDT has supported the SAFE Act since it was first 
introduced in the 104th Congress. While we are pleased to be 
here testifying once again in front of this Subcommittee, it is 
unfortunate that we are here making many of the same arguments 
that we were making 2 years ago. I would like to take the 
chance to thank the Chair and Mr. Goodlatte and the other 
sponsors of the SAFE Act and supporters of the SAFE Act for 
their continued support for privacy online.
    I would like to make, briefly, three quick points today. 
The first is that the current U.S. policy harms personal 
privacy, that U.S. policy is failing in the international 
marketplace and that it is time to move on because a new, more 
comprehensive encryption relief package like SAFE offers is 
ultimately going to be better for public safety and individual 
privacy.
    CDT is here today because current U.S. policy does violence 
to our constitutional liberties here in the United States and 
to individual privacy around the world. We live in an era of 
eroding personal privacy where more and more of our personal 
data is available in electronic form and particularly on the 
Internet. Encryption is the essential tool to protecting the 
security of our data in this open, decentralized, global 
network. The U.S. export controls keep people from getting the 
encryption they need and protecting their privacy online. Most 
directly, export controls limit the availability of good, U.S. 
encryption products around the world, particularly in the mass-
market products that most individuals use.
    Export controls also affect the security of people in the 
United States when they communicate abroad with people who 
don't have access to those strong products. Finally, encryption 
products affect the security of the infrastructure by dumbing 
down our security infrastructure and keeping us from making 
encryption something that is easily available to people around 
the world, including in the United States. In summary, 
encryption leaves us in the worst of both worlds. Sophisticated 
criminals, terrorists, rogue governments have access to it, but 
law-abiding individuals do not have security and privacy 
protected by the tools that they need.
    The second point I wanted to make was that U.S. encryption 
policy is failing in the international arena. We were told 2 
years ago that the world was on the verge of adopting key 
recovery and export controls. In fact, the marketplace has 
failed to embrace key recovery. The world community has failed 
to embrace export controls and key recovery as well. In fact, 
as we have heard in testimony, many countries, including 
countries like Ireland, Canada, and Finland, are moving in the 
opposite direction. Even some of the staunchest U.S. allies, 
the U.K. and France, have failed to completely embrace U.S. 
encryption policy.
    U.S. encryption policy is failing in the courts. Just 
earlier this month, the Ninth Circuit Court of Appeals found 
that export controls on encryption source code were 
unconstitutional violations of the First Amendment. The court 
ruled that these were prior restraints on free expression that 
rest boundless discretion in government officials. I think that 
the court recognized something that the Administration hasn't, 
that you can't stop the spread of ideas at the border and that 
especially you can't do it without doing violence to our First 
Amendment.
    I think it is time for our U.S. encryption policy to move 
on. We are setting the ground rules today for how much privacy 
people will have as they move their lives online. On balance, 
we believe that strong encryption both serves individual 
privacy and protects public safety and that kind of change is 
not going to happen without your help. While we remain 
concerned about certain criminal provisions in the SAFE Act, we 
believe that, on the balance, the bill is a dramatic step 
forward for individual privacy and public safety and I would 
encourage you all to support its rapid passage without any 
weakening amendments.
    Mr. Campbell. Thank you, Mr. Davidson.
    Ms. PoKempner.

  STATEMENT OF DINAH POKEMPNER, DEPUTY GENERAL COUNSEL, HUMAN 
                          RIGHTS WATCH

    Ms. PoKempner. Thank you. I appreciate very much the 
opportunity to come before this Committee. I am Dinah 
PoKempner, deputy general counsel of Human Rights Watch, one of 
the largest human rights research and reporting organizations 
in the world. We have used encryption for many years and I am 
going to present two examples from my testimony. There has been 
a great deal of discussion at this hearing about, on the one 
hand, the economic interest inherent in encryption and, on the 
other hand, law enforcement and national security.
    I am going to tell you a little bit about human rights 
applications of encryption and, in particular, dwell on two 
examples. Now the Internet revolution changed human rights 
advocacy dramatically. We can now report on things in real-
time. We can reach massive audiences very inexpensively and 
really mobilize popular opinion and action as never before. But 
we have a problem. Electronic communications are inherently 
insecure and this can have deadly consequences for human rights 
activists. Every year, human rights activists are attacked, 
jailed, disappeared, and killed. We document this in our world 
report. In 1998, we counted 10 such killings before the report 
went to press.
    So, for this reason, our researchers routinely use 
encryption when they are in dangerous places like Bosnia, 
China, Lebanon, Rwanda, Kashmir, Hong Kong, and Belgrade. I am 
going to give you a couple of examples. We have had a 
researcher who was arrested last year in the Kinshasa airport 
and detained for 24 hours while guards threatened to beat him. 
Fortunately, all of his research was encrypted. By the way, he 
was on a human rights investigation mission for which he had 
obtained a visa. It was perfectly transparent and obvious what 
he was doing. Yet, the government arrested him to get his 
information. Fortunately, because he felt secure his 
information was safe, he was able to delay until his release 
could be secured.
    We have a situation where the lack of security produced 
absolutely devastating consequences. For example, last year in 
April, a Member of the United Nations Secretary General's 
investigation team who went to gather evidence of massacres of 
Rwandan refugees in the eastern part of what was then former 
Zaire was arrested when he returned to Kinshasa. The Congolese 
authorities meticulously copied his research notes, as well as 
maps and reports that had been given him by local human rights 
activists. This information set off a man hunt for all of this 
official's informants. Many of these human rights activists had 
to go underground to emerge later as refugees and one, Gallican 
Ntirivamunda, has disappeared and is presumed dead.
    In contrast, our researcher, who had gone the year before, 
took pains to every night burn his notes after he had typed 
them into his lap top, encrypted them, and transmitted them. 
So, as this example might give you an idea, global access to 
strong encryption is vital, not just access for United States 
residents and citizens.
    I am going to give you one more example that will point out 
some of the problems that export controls can bring up and that 
is what is going on in Kosovo. It is very difficult. The strong 
encryption is available right now, but it is really difficult 
to master it, download it, familiarize yourself, and exchange 
keys when you are in the middle of a war. That is what is going 
on right now in Kosovo. People who want to report abuses can't 
communicate securely. The Serbian government is believed to 
have sophisticated Russian technology that enables them to 
crack code.
    So privacy advocates teamed up with a private company 
called the Anonymizer to create a gateway that allows people 
living in former Yugoslavia to access the Anonymizer and, 
through the Anonymizer, have confidential and encrypted 
communications. But there is a problem which one of the other 
panelists alluded to. If you have a browser that is export 
strength, this is not secure. Your communications can be 
intercepted. So you have to still do yet another step of going 
to another site, downloading yet more software to upgrade your 
browser. It still doesn't solve the problem of secure 
communications in the most difficult circumstances, in crisis 
situations.
    This is what I wanted to point out is that export controls, 
among other things, inhibit the development of products that 
would be most useful to human rights activists. That is, mass-
market strong encryption that is ubiquitous, that is built-in, 
that is easy-to-use, that you don't have to be a computer 
expert or adept to use. I am certainly not one and most human 
rights activists aren't adept either.
    I am going to end that with the thought that when we talk 
about the kinds of policies the United States is going to 
adopt, it is going to be looked at as a global leader. It is 
going to be looked at as a model. Will we adopt policies that 
will allow our government to continue to protest abuses of 
human rights advocates and suppression of human rights abuses? 
Are we going to hold encryption hostage to the fear of 
sophisticated terrorists and criminals who are going to use it 
no matter what the legality is and then deprive law-abiding 
citizens and human rights activists of its benefits.
    I will just finish by saying that what I would like you to 
keep in mind is that what is at stake is more than just our 
market share, more than abstract principles of privacy and free 
expression against, say, the tangible reality of terrorism. 
There are actual lives of human rights advocates at stake and 
that is what I would like you to keep in mind.
    Mr. Campbell. Thank you very much. I only regret that the 
Administration spokespersons are not here to listen to you as 
you listened to them.
    Mr. Black.

    STATEMENT OF ED BLACK, PRESIDENT AND CEO, COMPUTER AND 
              COMMUNICATIONS INDUSTRY ASSOCIATION

    Mr. Black. Thank you for the opportunity to testify before 
you today and I apologize for my not-yet-disappeared 
laryngitis. Encryption is a subject of vital importance to the 
members of the Computer and Communications Industry Association 
and to all of our industry. I have to take a quick aside and 
say as a citizen, however, I think Dinah's comments are just so 
right-on and that is a key part of this that we should never 
focus on. We will focus on the business aspects, but it is hard 
not to think of the importance to freedom and democracy of real 
meaningful encryption available to people around the world.
    Like the current key recovery requirements, the 
Administration's original Clipper Chip proposal would have 
mandated that all encryption products contain a back door for 
law enforcement and national security agencies to give them 
access to the plain text of any communication or computer file 
upon request. Not surprisingly, CCIA members continue to oppose 
the Administration's policy, as do most of the high-tech 
industry, most of the broader business community, and privacy 
groups. The Administration supporters on the Hill, we think, 
are also few and dwindling in number.
    Because of CCIA's members support for the SAFE bill, which 
we think is an excellent bill which we congratulate Mr. 
Goodlatte and Congresswoman Lofgren on, we believe that it is 
possible that--we will use the word ``proliferation''--
proliferation of encryption is going to happen, is important to 
happen. We think the use of strong encryption around the world 
is essential to reaching the full potential of electronic 
communications and commerce. We all recognize that the 
relaxation of encryption export restrictions is of critical 
importance if we are to fully realize the information age we 
have just entered.
    I want to address quickly the Administration's contention 
that it does not control or seek to control domestic use or 
sale of encryption. The National Security Agency has testified 
on numerous occasions that the full implementation of the 
Administration's key recovery plan would have no impact on 
their ability to carry out their national security mission. The 
only logical inference is that the key recovery export policy 
is designed to benefit domestic law enforcement agencies while 
avoiding the political and constitutional pitfalls of direct 
domestic restrictions.
    Another fallacy of the government's policy is that the 
United States has some monopoly on the science of cryptography 
or the production of encryption tools. This is hard to justify 
in light of the government's own efforts to replace the current 
DES encryption standard with a new advanced encryption 
standard, AES. Of the 15 logarithms submitted in the NIST 
competition, 10 were from organizations outside of the United 
States, including countries such as Australia, Belgium, Canada, 
Costa Rica, England, France, Germany, Israel, Japan, and South 
Korea. At least half of the five finalists are likely to be 
foreign competitors and it is very possible that the next U.S. 
Government standard for encryption will be designed outside of 
our borders.
    To further illustrate the international nature of this 
industry and the futility of our export controls, let me give 
you an example of how the Administration policy has affected 
just one of our member companies. Integrity Solutions is one of 
the world's leading vendors of secured application 
technologies. They are based in San Jose, California. Because 
of our export laws, nearly all of their recent growth in 
staffing and development has been in overseas locations in 
Sweden and the United Kingdom. This was not by design. They 
originally only intended to be based in the U.S. and Sweden, 
but it was a response to the continued restriction of U.S. 
exports on encryption.
    Later this month, it will announced that Integrity, its 
partnership with Major Systems Integrators, will be awarded a 
contract for all certificate authentication technology for the 
Special Administrative Region of Hong Kong. They expect that 
this contract will reap millions of dollars in annual revenues 
and eventually expand to include other Asian nations. 
Unfortunately, none of the revenue will come to the United 
States and none of the jobs that this contract will create will 
go to Americans. Because of our export laws, all of these 
products and services will be shipped out of the United Kingdom 
division. Had the contract not gone to Integrity, it would have 
gone to an Irish company, which would have been the alternative 
winner of the contract.
    My question is: How does our current policy support 
important U.S. interests? We are driving American companies and 
jobs overseas and driving their customers to foreign 
competitors without any significant impact on our national 
security or law enforcement capability. It is just nonsense.
    I wish that I could say that if we experienced further 
relaxations in export controls or even enacted The SAFE bill, 
we would somehow regain these lost jobs and revenue; however, 
Integrity has already established a critical mass of overseas 
presence. They are beyond the point of no return. They will 
continue to derive a majority of the revenue and experience 
nearly all of their growth in foreign countries regardless of 
what we do to our laws. I can only hope that we take quick 
action to prevent this scenario from becoming even more common 
and repeated over and over again until we reach the point where 
a huge portion of this industry has migrated overseas. 
Chairman, Members of the Committee, thank you again for the 
opportunity to testify today.
    Mr. Campbell. Thank you, Mr. Black. The first questioner 
will be Mr. Goodlatte.
    Mr. Goodlatte. I thank you, Mr. Chairman, and I would like 
to echo your observation that it would have been very helpful 
if the Administration's witnesses had been here to hear this 
excellent testimony and, not only that, but the members of the 
media. I think that the intensity of the debate has gone out of 
the hearing because I think we are in great agreement with what 
you have to say.
    I would like to ask you about some of the points that were 
made by the Administration witnesses. First, they made the 
statement that this legislation would not be in compliance with 
the Wassenaar agreement. I would note that the Wassenaar 
agreement has never been ratified by the U.S. Senate. It is 
purely a voluntary effort of the Administration only, but it 
seems to me that the way it is drafted the legislation, which 
provides for an application of export controls in real national 
security instances, does comply. I would ask first, perhaps, 
Mr. Rubinstein if he would comment on the impact of this 
legislation on the Wassenaar agreement.
    Mr. Rubinstein. I think the earlier testimony was that it 
violated Wassenaar by not having adequate review provisions and 
I think that is an incorrect reading of the SAFE Act. There is 
a provision in all of the key export control sections allowing 
for technical review of products prior to export and I think 
that is the key requirement. If there is any difference, 
really, between the SAFE Act and the positions that have 
already been taken by some of the foreign countries that are 
signatories of the Wassenaar arrangement, it is that the SAFE 
Act requires review, but then, otherwise, does not restrict 
export.
    What other countries have done in technical compliance with 
the Wassenaar is to simply impose a licensing requirement, but 
that licensing requirement is one that says strong encryption 
may be exported under general license. So that is, I think, a 
very limited form of compliance and hardly achieves the results 
that were trumpeted when this announcement was first made, 
namely that it levels the playing field. All it really does is 
allow these other countries who already have strong encryption 
vendors in their jurisdictions to comply in appearance by 
saying there is a general license requirement, but then the 
companies are able to export the same products they did prior 
to that arrangement.
    Mr. Goodlatte. Anyone else? Mr. Black?
    Mr. Black. I will pass. I will take some other questions, 
but, for the moment----
    Mr. Goodlatte. Anyone else care to comment on that? If not, 
let me go on to the next--Mr. Davidson.
    Mr. Davidson. Just to say that I think our reading is very 
much the same that it certainly seems that SAFE, on its face, 
does not necessarily come into conflict with Wassenaar, both in 
letter and in spirit. That I think that it was particularly 
interesting to me that Ms. McNamara was careful to say that 
Wassanaar merely permits nations to adopt export controls. It 
does not necessarily require them to adopt export controls and 
are reading is that SAFE does not violate either the letter or 
the spirit of Wassenaar.
    Mr. Black. Maybe if I could take my turn and just respond. 
We have a long experience in the Association of export controls 
and everything from computers to telecom. We have a lot of 
experience with what national discretion means. What we think 
the adoption of your legislation here would in fact put us in 
the position that for decades every other country was in, which 
we would have a standard which might be a little saner and less 
restrictive than other countries. We think it would be very 
consistent with certainly what is the spirit of Wassenaar as it 
will be interpreted by most other countries, which is they are 
going to go off and sell whatever they want without any 
restrictions. So certainly the spirit, we think, would be 
complied with.
    Mr. Goodlatte. Thank you. The Administration's witnesses 
seemed to be divided into two camps: Law enforcement folks 
concerned about recoverable encryption--and I think we have 
pretty well addressed that. The questions asked of that panel. 
Why that will not work. Although we failed to mention the 
enormous cost of it. The cumbersome, perhaps even unworkable 
nature of having a system where billions of keys are stored by 
somebody under some very costly and bureaucratic system.
    But the other issue wasn't touched on as much. That is that 
the National Security folks seemed to be concerned about the 
immediate decontrol--the words used by Barbara McNamara--and I 
think the effort on their part seems to be to delay the 
implementation of strong encryption, and I wonder if you might 
comment on the effect of such a delay. Mr. Smith.
    Mr. Jeffrey Smith. I will take that one if I may. It is our 
sense that NSA is aware that sooner, perhaps rather than later, 
they will face a world of ubiquitous encryption perhaps 
produced outside the United States. I cannot speak for them, 
but my guess is that they recognize that and are hoping that 
delay will somehow permit the market to develop in such a way 
that it permits them to continue to do what they do.
    Our concern is that, as I said in my statement, the current 
policy is driving us much more rapidly toward a world where 
there is, in fact, ubiquitous encryption, but it is not ours. I 
think the consequence of that for the nation, for everything 
that we are trying to achieve, is quite substantial and is why 
the SAFE Act is, in our view, such an important vehicle.
    Mr. Goodlatte. Thank you, Mr. Chairman.
    Mr. Campbell. Thank you, Mr. Goodlatte. The Ranking Member 
of the Committee, the gentleman from New Jersey.
    Mr. Menendez. Thank you, Mr. Chairman. I want to thank the 
panel. I had to step out for a few minutes, but maybe you can 
help me. I was glancing through some of your written testimony 
of that which I may have missed. Is it fair to say that the 
synthesis of your respective testimonies is that, in fact, what 
I was asking the previous panel in terms of what can you really 
control here at the end of day, that the consensus is, I think 
Mr. Smith has just said, that this is available. It is 
available outside. It is available domestically. It is 
available abroad. Ultimately, all those who wish to have access 
for the purposes of doing that which the previous panel is 
concerned about presently have that access right now. Is that a 
fair statement?
    Mr. Black. Yes.
    Mr. Jeffrey Smith. Yes.
    Mr. Weiss. Yes.
    Mr. Davidson. Yes.
    Mr. Rubinstein. Absolutely.
    Mr. Menendez. Second, could you--any of you who choose to 
do so--quantify the potential loss this year if we do not move 
in a manner that would, for example, on Mr. Goodlatte's 
legislation, the regime that would be established there, if we 
don't move in that direction, what are the potential losses to 
American companies? Do you have any sense of quantifying that?
    Mr. Weiss. I can take a very small attempt, looking 
internally at my own company. We are a relatively small 
software company at $250 million. While encryption has not been 
a significant issue in the first 7 years of our existence, over 
the past 3 it has been and I would quantify our loss last year 
due to our inability to either develop or supply strong 
encryption technology to our customers, multinational customers 
or customers outside the United States, as approximately 10 
percent of our revenue. I expect that to grow as a percentage 
substantially as we begin to build the infrastructure 
surrounding the digital age of which my company hopes to 
participate. So that number will only increase as a percent and 
really put a cap on the markets that we can play in.
    Mr. Menendez. Is there any other industry sense of----
    Mr. Rubinstein. It is hard for me to quantify, but I would 
make two observations. One is that a pronounced trend in the 
last few years is the use of PC's for ever more complex and 
demanding computer applications so PC's networked together have 
begun to replace minicomputers and mainframe computers and 
really run the infrastructure of many large organizations and I 
think that has made encryption and security a much more 
important aspect of software sales even for mass-market vendors 
like Microsoft and other members of the BSA.
    Mr. Menendez. Let me ask another question. This is 
hypothetical, but I would like to get a sense of what the 
industry might say. If we were to, the U.S. Government, were to 
fund the appropriate United States agency to work with the 
private sector to do decryption technology, what would the 
industry's response to that be?
    Mr. Jeffrey Smith. If I might address that. Industry has 
acknowledged that the law enforcement and National Security 
Agencies face a real challenge in the future and recognize that 
they may not have the technological skills possessed by 
industry. So as the Administration panel said and as we have 
said in several of our statements, industry is working with 
government to help them reach that understanding. I can't 
comment for how industry would react to a specific proposal to 
provide specific funding to that, but there are some 
suggestions like that, including one from Senator Bob Kerry in 
the Senate that I, as a personal matter, find intriguing. But 
whether industry as a whole would be prepared to support that, 
I certainly can't speculate.
    Mr. Black. If I could, I think we would all like to think 
that there would be a solution like that. In all honesty, I 
think the reality that it is sand going through the fingers and 
I don't think you pick it back up again with open hands. The 
idea of brute force, attack, is there. It is possible at the 
edges, but most of the folks we talk to it really is probably 
not a viable result. Key recovery is not--we have all looked 
for years for some magic bullet that goes down the middle and 
takes care of everybody's concern. We just don't find it.
    Mr. Davidson. I would just like to echo and say that I 
think, first of all, most people in the technical community 
don't think that brute force attacks are going to work at these 
high-strength encryption products. I wanted to address a 
comment that was made by the Justice Department representative 
earlier about the fact that they were still searching for new--
that we are not talking about key recovery anymore. That it is 
really about new kinds of access technologies and I would just 
like to say that, we have been playing the name game on this 
from key escrow to commercial key escrow to key recovery and 
now it is plain text access.
    All of those systems have the same problem which is that 
the same system that allows surreptitious access by government 
also creates a huge vulnerability that allows surreptitious 
access by the people that you are trying to protect yourself 
from by encrypting to begin with. There are a series of real 
security and economic concerns that have been raised about the 
viability of these systems that have gone--are being completely 
unaddressed.
    There is a report that we submitted to the Committee--and 
hopefully you folks have seen this--on the risks of key 
recovery. I would encourage people who are concerned about the 
national security and law enforcement aspects of all of this to 
ask particularly in those classified briefings, perhaps, ask to 
have the questions raised in this report answered because I 
think the problem has been that they can't be answered and that 
we don't have a viable system that provides access and protects 
security and that is why these systems haven't caught on.
    Mr. Menendez. I thank you all for your patience and your--
yes.
    Mr. Rubinstein. If I could add just one point there, there 
was some discussion in the earlier panel of whether the 
dialogue between industry and law enforcement had withered away 
over the last year and I would agree with Mr. Reinsch that it 
has not and, in fact, there has been some very productive 
dialogue going on and going on, quietly, but taking place. At 
the heart of that dialogue, I think, is the recognition by law 
enforcement that there is no magic bullet.
    The precondition for a constructive dialogue is the 
recognition that there is no single solution that industry can 
offer but, instead, what is most important is that law 
enforcement devote more resources to learning about the new 
technology to understanding how it is used and, of course, in 
order to effectively use that, that technology has to be 
developed and produced in the United States.
    Mr. Menendez. Thank you for your testimony. Thank you, Mr. 
Chairman.
    Mr. Campbell. Thank you, Mr. Menendez. It is my turn. I 
have three specific questions and they are first directed to 
Mr. Rubinstein. This example you gave us of Zergo.
    Mr. Rubinstein. Yes.
    Mr. Campbell. Did they cooperate with Microsoft or with 
Netscape in developing their solution?
    Mr. Rubinstein. No. Let me also apologize. When I was 
showing those slides, I failed to show the last slide which was 
the download page and which listed a number of tool kits and 
add-on products that were available from Zergo. In no case did 
Microsoft supply technical assistance nor was it even asked to 
do so because--if I can try to explain this simply as 
possible--if you have a browser that is signing onto a web 
server, what you do is you insert two pieces of software 
between that communication so that the browser talks to this 
first piece, the first piece to a second piece, and then the 
second piece to the existing server. It is those two 
intermediate pieces that secure the communications at 128 bits. 
It just takes that flow and inserts this new connection and it 
decrypts it again.
    Mr. Campbell. I follow.
    Mr. Rubinstein. So there is no need for U.S. cooperation to 
accomplish that.
    Mr. Campbell. Although, at some point, the company, Zergo, 
must have access to Microsoft's code in order to--they just 
have to decompile what Microsoft is using in that first of the 
four steps in order to make a good interface, I assume.
    Mr. Rubinstein. Right, although one of the very significant 
changes in this whole debate that has occurred results from the 
fact that Internet products are built according to 
international standards so, regardless of the specific company 
implementation, as long as those standards are met, the 
standards are readily available. Even reference code is 
available on a worldwide basis.
    Mr. Campbell. Thanks. Let me ask a hypothetical question 
then of any of the panel, but particularly of the attorneys. 
Would it be a violation of the Export Control Act in this 
situation for Netscape or Microsoft to have assisted Zergo in 
that it--you see my question. I am not sure of the answer. You 
tell me you didn't. That is fine. I am pleased.
    Mr. Rubinstein. The answer would be yes. There is a 
specific provision that deals with providing technical 
assistance to a foreign person in the manufacture of 
encryption----
    Mr. Campbell. Thanks for answering. It was the answer I was 
afraid I might get. A question to Mr. Black and Mr. Smith. This 
is a technological question of which I am ignorant. Does the 
ability to deencrypt develop as the ability to encrypt or are 
they different disciplines?
    Mr. Black. They are really the same coin. The skills are, 
there are differences but it really is the ability to do one is 
the same set of skills and you will find the same people able 
to do the other.
    Mr. Campbell. Would you agree, Mr. Smith?
    Mr. Jeffrey Smith. Yes.
    Mr. Campbell. I hit a wall in mathematics at differential 
equations. They didn't make any intuitive sense to me. That is 
when I stopped. I have a sense there is a point of complexity 
at which encryption can become like those differential 
equations so that when it goes to a certain level, the ability 
to deencrypt is just lost. Am I wrong or does deencryption 
actually follow right along with the ability to encrypt so that 
if we go to longer and longer bit length, we will have industry 
capable of eventually breaking that?
    Mr. Black. In the real world, we have seen the development 
of technology that is more and more powerful and, whatever NSA 
says, I think many of us think they have a lot more capability 
than is there. But it still lags behind and lags behind 
substantially and I think we are--most of us think we are at 
point where, for all practical purposes, the ability to use 
brute force deencryption is just not going to be available in 
the future.
    Mr. Davidson. If you will forgive the mathematical 
terminology, the difficulty in decrypting increases 
exponentially with the increase of the bit length. So, for 
example, the difference between a 56-bit key and a 64-bit key, 
it is only 8 bits longer. But it is 256 times more difficult to 
decrypt in terms of the time it takes to do a brute force 
attack. So when you move to something like 128-bit keys, which 
are widely available outside of the United States, you reach a 
point where people start to measure the amount of time it would 
take to decrypt this using, technology that we----
    Mr. Campbell. Thanks.
    Mr. Black. We have a number which is 256, the number of 
possibilities at that level equal the number of particles in 
the universe.
    Mr. Campbell. Subatomic? And 256 is 2 to the 8th power? Is 
that where that came from? I was wondering----
    Mr. Davidson. 256-bit length. I think you are talking about 
keys that are 256-bits long.
    Mr. Campbell. Let me just understand the algorithm. So if 
you increase bit length by X bits, what is the effect on the--
--
    Mr. Davidson. Two to the X. So, for example, each bit 
doubles the amount of times.
    Mr. Campbell. That is what I thought. Two to the eighth. 
That is what I was asking. 256 is 2 to the 8th. You are 
measuring that in terms of time difficulty of deencryption.
    Mr. Davidson. Right. The number of steps; the number of 
things you have to check.
    Mr. Campbell. The number of steps.
    Mr. Davidson. It is really like doing a combination lock 
and trying all of the combinations.
    Mr. Campbell. OK.
    Mr. Black. There is always a chance you will stumble on it 
right at the beginning, but you have to assume you don't.
    Mr. Campbell. Thanks. My last question is to Ms. PoKempner. 
Understand, I am entirely on your side of this. Nevertheless, 
it seems to me the logic of your position would oppose a 
universally accepted agreement, a Wassenaar that really worked, 
whereas every other member of the panel might be able to live 
with that because it would not put an American firm at a 
competitive disadvantage, the burden of your testimony is the 
value of encryption so strong that no government can break into 
it. Am I reading you correctly?
    Ms. PoKempner. I am reluctant to sound like an absolutist 
because I do believe that there are genuine national security 
and law enforcement issues here, but the problem is that 
virtually unbreakable encryption exists. We use it. We use 128-
bit encryption. For practical purposes, no one is going to 
break that very fast. So we live in a universe where that is 
already out there and my concern is that U.S. attempts to 
either influence the Wassanaar arrangement countries policies 
or its own domestic export controls ultimately have the effect 
of taking strong encryption out of the hands of the law-abiding 
people like ourselves who need to use it but don't have any 
deterrent effect on all of the bad guys that are constantly 
paraded before us as the reason for these controls.
    It is a difficult equation. I think that there is a balance 
and a difficult judgment call that has to be made at the point 
where encryption becomes ubiquitous, which I do believe is an 
inevitability. It is just a question of whether the U.S. is 
going to be part of that.
    At that point, obviously, computer-challenged people like 
myself can use it easily and so can the stupid criminals that 
were referred to earlier. So everyone can use it. Then you have 
a question of, in terms of deterring street crime versus 
protecting human rights activists, people who want to 
communicate from totally repressive situations. People who want 
to, preserve their privacy, their medical records, their 
commerce, then you have a very complicated balancing task.
    But I think that is really where the level of debate should 
be. We are not talking about international terrorists versus, 
all the other interests because the international terrorists 
already have access. Believe me, if my colleagues can use it, 
the international terrorists are much more capable.
    Mr. Campbell. I would like you to come back in another 
occasion and tell us what you and Human Rights Watch found in 
the Democratic Republic of Congo. I'm going to be polite to my 
colleague and yield to him in just 1 second. Though if you 
would be--and indulge me, Brad, I didn't speak before and I 
just wanted to kind of put on record my own thought. I will 
take about 30 seconds.
    It would amaze me if the founders who wrote the Fourth 
Amendment were presented with Congress passing a law compelling 
Americans to make their communication more easily intercepted 
by the government. Would it not? That is, it seems to me, what 
we are asking. As to those who say national security and crime, 
I would say--and this is my one polemic, forgive me. Then I 
yield to my friend. My one polemic for today--I can give you 
safe streets, just get rid of that pesky Fifth Amendment and I 
will beat some confessions out of people and I will give you a 
safe a major city in America, every major city safe from street 
crime. But get rid of this warrant requirement because it is 
too tedious; probable cause is a heck of thing----
    So it isn't that we who believe in freedom ignore the other 
side. We believe that our country made that compromise 200-plus 
years ago. I yield to my colleague from California.
    Mr. Sherman. Mr. Chairman, thank you. Thanks especially for 
your technical questions. Like you, I hit a wall in 
mathematics. In my case, I hit it at long division.
    It seems like we are confronted with three levels of 
criminals. There are the street criminals who aren't going to 
use lap tops, let alone encryption. There are the semi-
sophisticated criminals who pretty much transact domestic 
crime--and I would like anybody on the panel to correct me if I 
am wrong--these folks can get all the encryption they want at 
the local software store today and, if they can't, it is just 
because you folks haven't made it yet and you will and you 
don't need to change the law to put really great encryption in 
every Egghead store in America. I see a lot of heads nodding. 
Then you get up to the international criminals who you would 
think would be sophisticated enough to send the encryption that 
they need over the line, buy it from a foreign source.
    I am at a loss to try to figure out who we are trying to 
protect ourselves from. Now, as I understand it, if they get a 
warrant, they can look at your bank records and if you sent a 
message to your bank by encryption, the bank knows how to 
unencrypt it. I see some heads nodding. So this whole--the 
Administration effort is, I think, as the Chairman pointed out, 
an effort to make sure that when we send messages to each other 
we do it in a form that is most easily wiretappable and then 
understandable. Which is--now one could imagine that that would 
be argument. That we would really say we want everything that 
goes over the wire to be interceptable and decipherable. But 
that is not what we are doing. We are saying, well you can 
encrypt, you just can't do it internationally.
    Which seems to--and I will go back to what I said before 
because I thought it needed a little explanation when I thought 
that the Administration was just trying to punish the software 
industry, but it seems like they are just angry that domestic 
messages will be encrypted in ways that they cannot decipher 
and the only handle they have under our legal system is to try 
to punish that industry or throw a temper tantrum by saying, we 
have got this law where we won't let you export it. I don't 
think there is a question in there anywhere.
    Yes, my more senior colleague from California illustrated 
and explained to me just earlier today how I should deal with 
this and that is, I say, don't you agree?
    Mr. Black. Your questioning actually earlier was, I thought 
very much on point where you were trying to get some people in 
the Administration to acknowledge that the concept of mandatory 
and voluntary that there is something in between which is 
called coercion, extortion, and that is really what we see 
going on. They are using the export control rules to try to 
force, coerce people into adopting practices because they don't 
want to say domestically that some people in the Administration 
really want to have the controls. It is really disingenuous, in 
our view, for them to be saying that this kind of heavy 
leverage, put a gun to your head, let us make a deal is not 
really pushing and forcing and mandating it. It is not any 
semblance of voluntary.
    Mr. Sherman. Let me sneak in one more question here and 
then this is really the question: What would it take for a 
foreign company to produce encryption that works well with 
Microsoft and other U.S.-created products and to sell that 
encryption product around the world? Is there any prohibition 
on us importing encryption? Everybody's saying no. I do that so 
the record will actually reflect your head shakes. Mr. 
Davidson, you were about to say something?
    Mr. Davidson. I was going to agree with your earlier 
comment and say I think you are right and your second question 
gets to that also, which is that really what this is about 
seems to be an attempt to slow-down the spread of encryption. 
That is the best that we hope for in this policy and, to some 
extent, it has worked so far. I think what you are hearing from 
us is that now the costs of that policy far outweigh any 
incremental benefits of continuing it, that the costs not only 
to business, but to privacy interests of individuals, to the 
human rights workers around the world and others, you know are 
too high for continuing to pursue this.
    But I will say one other thing which is that I think we 
remain concerned domestically about the ultimate goals of the 
Administration in this area and what I mean by that is that it 
was only 1\1/2\ years ago that the Administration was 
testifying on Capitol Hill and the FBI director was testifying 
that he would like domestic controls on encryption, mandatory, 
key recoverable, and the House Intelligence Committee, in fact, 
passed a version of the SAFE Act that would have imposed that.
    Although it is somewhat reassuring, I guess, to hear the 
Administration officials say that is not current policy, we 
don't feel that this is far off the table. That remains our 
concern and I think the interchange between Chairman Gilman and 
the Justice Department witnesses was about domestic criminals 
using encryption and the only way that they are ever going to 
stop that is by some kind of domestic control. I think that is 
what we remain very fearful of.
    Mr. Sherman. I would like to comment that domestic control 
at least has the advantage of being a logical action--I think 
inconsistent with the Fourth Amendment--but a logical action 
where you are actually achieving a law enforcement purpose 
other than punishing an industry for coming up with technology. 
I yield back.
    Mr. Campbell. I thank the gentleman. We are at the end of 
our hearing, but I would like to offer each of the panelists 1 
minute, if each wishes, to add anything that he or she did not 
have the opportunity to add heretofore. Is there anyone who 
wishes to avail himself or herself of this opportunity? Mr. 
Rubinstein.
    Mr. Rubinstein. Yes. I would like to add one point which is 
that I think the hope of the Administration policy was that key 
escrow or some form of it would become so ubiquitous that 
everybody would use it and only the very small substratum of 
very sophisticated criminals would escape from that and, as the 
Administration readily admits, they can never really do 
anything about that.
    But as the market has rejected that type of key escrow for 
reasons that Congressman Goodlatte alluded to earlier--its 
cost, its complexity, its vulnerability--as the market has 
rejected that and as the Administration has begun to soften its 
message on key recovery and say we are not insisting on any one 
technology; there are many different approaches; et cetera, the 
very logic of their position begins to erode because if there 
are no mandatory controls and if nonrecovery encryption is 
available overseas, then it is no longer apparent what the 
ongoing controls would achieve.
    Mr. Campbell. Read you loud and clear. Anyone else wish to 
speak? Mr. Davidson.
    Mr. Davidson. First of all I would like to say to the 
Chair, I think that the Chair is right about the Bill of Rights 
and the Fourth Amendment as it applies to this area. You are 
very much on point. While we will see and are hopeful about how 
it moves in the courts, I think that that should inform 
Congresses decisions in terms of thinking about encryption. I 
would also commend this Bernstein decision to you from the 
Ninth Circuit. It is quite interesting. The last thing I would 
just say very briefly is I am noticing that Mr. Goodlatte's 
attendance here at the bitter end of this hearing, and his 
commitment to this issue for the last several years and I would 
like to thank him for that because this has been very important 
for individual privacy.
    Mr. Campbell. Appropriate and so noted. Mr. Smith.
    Mr. Jeffrey Smith. One more minute to go back to a point 
Mr. Bereuter made about the conversations between industry and 
the Administration, initially done by John Deutsch when he was 
the Director of Central Intelligence. That dialogue has 
continued. I think my colleague Mr. Rubinstein made the point 
but I think it is important for this Committee to understand 
that there is a continuing dialogue, but it is a very difficult 
one to maintain because one is reluctant to discuss it too much 
in these public sessions. So I think it is something to be 
explored offline.
    Second, to urge this Committee to take the long-run view of 
this policy. Our concern is that the Administration's policy is 
a short-term policy and our strong view is that both the law 
enforcement and national security interests need to be seen by 
Congress in the long-run and that only the kind of solution 
that is proposed by this bill, in our judgment, strikes the 
balance, gives the government what it needs, gives industry and 
citizens what they need.
    Mr. Campbell. Thank you. With that, the meeting of the 
Subcommittee on International Economic Policy and Trade stands 
adjourned.
    [Whereupon, at 5:35, the Subcommittee was adjourned.]

```