II

106TH CONGRESS

1ST SESSION S. 798

To promote electronic commerce by encouraging and facilitating the use

of encryption in interstate commerce consistent with the protection of

national security, and for other purposes.

IN THE SENATE OF THE UNITED STATES

APRIL 14, 1999

Mr. MCCAIN (for himself, Mr. BURNS, Mr. WYDEN, Mr. LEAHY, Mr. ABRAHAM, and Mr. KERRY) introduced the following bill; which was read twice

and referred to the Committee on Commerce, Science, and Transportation

A BILL

To promote electronic commerce by encouraging and facilitating the use of encryption in interstate commerce consistent with the protection of national security, and for

other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Promote Reliable On5 Line Transactions to Encourage Commerce and Trade

6 (PROTECT) Act of 1999’’.
2

•S 798 IS

1 SEC. 2. PURPOSES.

2 The purposes of this Act are—

3 (1) to promote electronic growth foster elec4 tronic commerce;

5 (2) create consumer confidence in electronic

6 commerce;

7 (3) meet the needs of businesses and individuals

8 using electronic networks;

9 (4) prevent crime; and

10 (5) improve national security

11 by facilitating the widespread use of encryption and

12 assisting the United States Government in devel13 oping the capability to respond to the challenges

14 posed by new technological developments.

15 SEC. 3. FINDINGS.

16 Congress finds the following:

17 (1) The ability to digitize information makes

18 carrying out tremendous amounts of commerce and

19 personal communication electronically possible.

20 (2) Miniaturization, distributed computing, and

21 reduced transmission costs make communication via

22 electronic networks a reality.

23 (3) The explosive growth in the Internet and

24 other computer networks reflects the potential

25 growth of electronic commerce and personal commu26 nication.
3

•S 798 IS

1 (4) The Internet and the global information in2 frastructure have the potential to revolutionize the

3 way individuals and businesses conduct business.

4 (5) The full potential of the Internet for the

5 conduct of business cannot be realized as long as it

6 is an insecure medium in which confidential business

7 information and sensitive personal information re8 main at risk of unauthorized viewing, alteration, and

9 use.

10 (6) The United States critical infrastructures

11 increasingly rely on vulnerable commercial informa12 tion systems and electronic networks and represent

13 a growing risk to national security and public safety

14 because the security and privacy of those systems

15 and networks is not assured.

16 (7) Encryption of information enables busi17 nesses and individuals to protect themselves, their

18 commercial information and networks, and the

19 United States critical infrastructures against unau20 thorized viewing, alteration, and abuse ensuring the

21 security, confidentiality, authenticity, and integrity

22 of information.

23 (8) American computer software and hardware,

24 communications, and electronics businesses are lead25 ing the world technology revolution, and the Amer-
4

•S 798 IS

1 ican information technology industry is a vital sector

2 of the United States economy. These businesses have

3 developed in the commercial marketplace, and are

4 prepared to offer immediately to computer users

5 worldwide, a variety of communications and com6 puter hardware and software that provide strong, ro7 bust, and easy-to-use encryption.

8 (9) Notwithstanding American preeminence in

9 information technology, many foreign companies cur10 rently manufacture products and services that are

11 comparable in quality and capabilities to United

12 States products and frequently provide stronger

13 encryption. These foreign companies are competing

14 fiercely with United States companies for sales not

15 only of the encryption product or service, but also

16 for the ultimate product that uses the encryption ca17 pability, including applications ranging from online

18 banking to electronic mail to banking.

19 (10) The leading survey of available encryption

20 products reports that, as of December, 1997, there

21 were 656 foreign encryption products (out of 1619

22 encryption products produced worldwide) available

23 from 474 vendors in 29 different foreign countries.

24 (11) To promote economic growth, foster elec25 tronic commerce, meet the needs of businesses and
5

•S 798 IS

1 individuals using electronic networks, prevent crime,

2 and improve national security, Americans should be

3 free to continue using lawfully any encryption prod4 ucts and programs, and American companies should

5 be free to sell, license, or otherwise distribute such

6 encryption products and programs worldwide so long

7 as national security is not put at risk.

8 (12) The United States government should pro9 mote the use of the United States encryption prod10 ucts and expedite its work with the industry to up11 date the United States Data Encryption Standard

12 (DES).

13 (13) NIST has proposed requirements and es14 tablished procedures for adopting a new, stronger,

15 private sector—developed Advanced Encryption

16 Standard (AES).

17 (14) Similar to DES, it is anticipated that AES

18 will become an international encryption standard

19 adopted by individuals and companies worldwide.

20 (15) NIST has requested candidate algorithms,

21 evaluated candidate algorithms, and encouraged

22 public comment at each step of the process. NIST’s

23 open and public process for developing and testing

24 the new AES should be applauded and supported.
6

•S 798 IS

1 (16) Further demonstrating the worldwide

2 availability, use, and sophistication of encryption

3 abroad, only 5 of the 15 AES candidate algorithms

4 submitted to NIST for evaluation that complied with

5 all requirements and procedures for submission were

6 proposed by companies and individuals in the United

7 States. The remaining 10 candidate algorithms were

8 proposed by individuals and companies from 11 dif9 ferent countries (Australia’s LOKI97; Belgium’s

10 RIJNDAEL; Canada’s CAST–256 and DEAL;

11 Costa Rica’s FROG; France’s DFC; Germany’s MA12 GENTA; Japan’s E2; Korea’s CRYPTON; and the

13 United Kingdom, Israel, and Norway’s SERPENT

14 algorithms).

15 (17) NIST’s efforts to create the AES to re16 place DES are important to the development of ade17 quate global information security to a degree that

18 Congress should explicitly authorize and support

19 NIST’s efforts and establish a deadline of January

20 1, 2002, for finalizing the new standard.

21 (18) Once NIST finalizes AES, the Federal

22 Government should permit all United States prod23 ucts meeting the new AES standards or its equiva24 lent to be exported worldwide to ensure global secu25 rity and to permit United States companies to com-
7

•S 798 IS

1 pete effectively with their foreign competitors con2 sistent with the national security requirements of the

3 United States.

4 (19) The United States Government has legiti5 mate law enforcement and national security objec6 tives, which can be met by permitting American

7 companies to compete globally, while at the same

8 time recognizing the challenges to law enforcement

9 and national security posed by quickly advancing

10 technological developments and providing for re11 search, development, and adoption of new technology

12 to respond to these challenges.

13 (20) As part of its efforts to fight crime with

14 technology and ensure the safety of commercial net15 works, the United States Government should estab16 lish a mechanism for facilitating communications

17 with experts in information security industries, in18 cluding cryptographers, engineers, software pub19 lishers, and others involved in the design and devel20 opment of information security products and should

21 ensure that such sums as necessary are appropriated

22 to ensure and enhance national security and law en23 forcement.

24 (21) The United States Government also should

25 expand and expedite its computer security research
8

•S 798 IS

1 activities at NIST and the Federal laboratories,

2 work with industry to recommend priority activities

3 at university research facilities, and fund scholar4 ships in information security.

5 SEC. 4. DEFINITIONS.

6 In this Act:

7 (1) COMPUTER HARDWARE.—The term ‘‘com8 puter hardware’’ includes computer systems, equip9 ment, application-specific assemblies, smart cards,

10 modules, integrated circuits, printed circuit board

11 assemblies, and devices that incorporate 1 or more

12 microprocessor-based central processing units that

13 are capable of accepting, storing, processing, or pro14 viding output of data.

15 (2) ENCRYPT AND ENCRYPTION.—The term

16 ‘‘encrypt’’ and ‘‘encryption’’ means the scrambling

17 (and descrambling) of wire communications, elec18 tronic communications, or electronically stored infor19 mation, using mathematical formulas or algorithms

20 to preserve the confidentiality, integrity, or authen21 ticity of, and prevent unauthorized recipients from

22 accessing or altering, such communications or infor23 mation.

24 (3) ENCRYPTION PRODUCT.—The term

25 ‘‘encryption product’’—
9

•S 798 IS

1 (A) means computer hardware, computer

2 software, or technology with encryption capa3 bilities; and

4 (B) includes any subsequent version of or

5 update to an encryption product, if the

6 encryption capabilities are not changed.

7 (4) EXPORTABLE.—The term ‘‘exportable’’

8 means the ability to transfer, ship, or transmit to

9 foreign users.

10 (5) GENERALLY AVAILABLE OR GENERAL

11 AVAILABILITY.—The terms ‘‘generally available’’ or

12 ‘‘general availability’’ mean—

13 (A) in the case of computer hardware or

14 computer software (including encryption prod15 ucts), computer hardware, or computer software

16 that is—

17 (i) distributed via the Internet;

18 (ii) widely offered for sale, license, or

19 transfer (without regard to whether it is

20 offered for consideration), including over21 the-counter retail sales, mail order trans22 actions, telephone order transactions, elec23 tronic distribution, or sale on approval;

24 (iii) preloaded on computer hardware

25 that is widely available; or
10

•S 798 IS

1 (iv) assembled from computer hard2 ware or computer software components

3 that are generally available;

4 (B) not designed, developed, or tailored by

5 the manufacturer for specific purchasers, except

6 that the purchaser or user may—

7 (i) supply certain installation param8 eters needed by the computer hardware or

9 computer software to function properly

10 with the computer system of the user or

11 purchaser; or

12 (ii) select from among options con13 tained in the computer hardware or com14 puter software; and

15 (C) are available in more than 1 country

16 through a means described in subparagraph

17 (A).

18 (6) KEY.—The term ‘‘key’’ means the variable

19 information used in a mathematical formula, code,

20 or algorithm, or any component thereof, used to

21 decrypt wire communications, electronic communica22 tions, or electronically stored information, that has

23 been encrypted.

24 (7) LICENSE EXCEPTION.—The term ‘‘license

25 exception’’ means an authorization by the Bureau of
11

•S 798 IS

1 Export Administration of the Department of Com2 merce that allows the export or re-export, under

3 stated conditions, of items subject to the Export Ad4 ministration Regulations that otherwise would re5 quire a license.

6 (8) NIST.—The term ‘‘NIST’’ means the Na7 tional Institute of Standards and Technology in the

8 Department of Commerce.

9 (9) ON-LINE MERCHANT.—The term ‘‘on-line

10 merchant’’ means either a person or a company or

11 other entity engaged in commerce that, as part of its

12 business, uses electronic means to conduct commer13 cial transactions in goods (including, but not limited

14 to, software and all other forms of digital content)

15 or services, whether delivered in tangible or elec16 tronic form.

17 (10) PERSON.—The term ‘‘person’’ has the

18 meaning given the term in section 2510(1) of title

19 1, United States Code.

20 (11) PUBLICLY AVAILABLE OR PUBLIC AVAIL21 ABILITY.—The terms ‘‘publicly available’’ or ‘‘public

22 availability’’ mean—

23 (A) information that is generally accessible

24 to the interested public in any form; or
12

•S 798 IS

1 (B) technology and software that are al2 ready published or will be published, arise dur3 ing, or result from fundamental research, are

4 educational, or are included in certain patent

5 applications.

6 (12) RECOVERABLE PRODUCT.—The term ‘‘re7 coverable product’’ means an encryption product

8 that—

9 (A) incorporates an operator-controlled

10 management interface enabling real-time access

11 to specified network traffic prior to encryption,

12 or after decryption, at a designated access point

13 under the control of the network owner or oper14 ator (utilizing a protocol such as IPSec);

15 (B) permits access to data prior to

16 encryption, or after decryption, at a server

17 under the control of a network owner or oper18 ator (utilizing a protocol such as SSL, TLS, or

19 Kerberos);

20 (C) includes a key or data recovery system

21 which, when activated, enables a system admin22 istrator or user to recover plaintext or keys to

23 decrypt data transmitted or stored in encrypted

24 form; or
13

•S 798 IS

1 (D) offers the system administrator or

2 end-user the capability to create a duplicate key

3 (or keys) for archival and other purposes.

4 (13) SECRETARY.—The term ‘‘Secretary’’

5 means the Secretary of Commerce.

6 (14) STATE.—The term ‘‘State’’ means any

7 State of the United States and includes the District

8 of Columbia and any commonwealth, territory, or

9 possessions of the United States.

10 (15) STRATEGIC PARTNERS.—The term ‘‘stra11 tegic partners’’ means 2 or more entities that—

12 (A) have a business need to share the pro13 prietary information of 1 or more United States

14 companies; and

15 (B) are contractually bound to one an16 other; or

17 (C) have an established pattern on con18 tinuing or recurring contractual relations.

19 (16) TECHNICAL ASSISTANCE.—The term

20 ‘‘technical assistance’’ includes assistance such as in21 structions, skills training, working knowledge, and

22 consulting services, and may involve transfer of tech23 nical data.

24 (17) TECHNICAL DATA.—The term ‘‘technical

25 data’’ may include data such as blueprints, plans,
14

•S 798 IS

1 diagrams, models, formulae, tables, engineering de2 signs and specifications, manuals, and instructions

3 written or recorded on other media or devices such

4 as disk, tape, or read-only memories.

5 (18) TECHNICAL REVIEW.—The term ‘‘tech6 nical review’’ means a review by the Secretary of an

7 encryption product, based on information about a

8 product’s encryption capabilities supplied by the

9 manufacturer, that an encryption product works as

10 represented.

11 (19) UNITED STATES PERSON.—The term

12 ‘‘United States person’’ means any—

13 (A) United States citizen; or

14 (B) legal entity that—

15 (i) is organized under the laws of the

16 United States, or any States, the District

17 of Columbia, or any commonwealth, terri18 tory, or possession of the United States;

19 and

20 (ii) has its principal place of business

21 in the United States.

22 (20) UNITED STATES SUBSIDIARY.—The term

23 ‘‘United States subsidiary’’ means—

24 (A) a foreign branch of a United States

25 company; or
15

•S 798 IS

1 (B) a foreign subsidiary or entity of a

2 United States entity in which—

3 (i) a United States company or entity

4 beneficially owns or controls (whether di5 rectly or indirectly) 25 percent or more of

6 the voting securities of the foreign sub7 sidiary or entity, if no other person owns

8 or controls (whether directly or indirectly)

9 an equal or larger percentage;

10 (ii) the foreign subsidiary or entity is

11 operated by a United States company or

12 entity pursuant to the provisions of an ex13 clusive management contract;

14 (iii) the majority of the members of

15 the Board of Directors of the foreign sub16 sidiary or entity also are members of the

17 comparable governing body of the United

18 States company or entity;

19 (iv) a United States company or enti20 ty has the authority to appoint the major21 ity of the members of the Board of Direc22 tors of the foreign subsidiary; or

23 (v) a United States company or entity

24 has the authority to appoint the Chief Op-
16

•S 798 IS

1 erating officer of the foreign subsidiary or

2 entity.

3 TITLE I—DOMESTIC

4 ENCRYPTION PROVISIONS

5 SEC. 101. DEVELOPMENT AND DEPLOYMENT OF

6 ENCRYPTION A VOLUNTARY PRIVATE SEC7 TOR ACTIVITY.

8 (a) STATEMENT OF POLICY.—The use, development,

9 manufacture, sale, distribution, and importation of

10 encryption products, standards, and services for purposes

11 of assuring the confidentiality, authenticity, or integrity

12 of electronic information shall be voluntary and market

13 driven.

14 (b) LIMITATION ON REGULATION.—Neither the Fed15 eral Government nor a State may establish any conditions,

16 ties, or links between encryption products, standards, and

17 services used for confidentiality, and those used for au18 thenticity or integrity purposes.

19 SEC. 102. SALE AND USE OF ENCRYPTION LAWFUL.

20 Except as otherwise provided by this Act, it is lawful

21 for any person within any State, and for any United

22 States person in a foreign country, to develop, manufac23 ture, sell, distribute, import, or use any encryption prod24 uct, regardless of the encryption algorithm selected,

25 encryption length chosen, existence of key recovery, or
17

•S 798 IS

1 other plaintext access capability, or implementation or me2 dium used.

3 SEC. 103. MANDATORY GOVERNMENT ACCESS TO

4 PLAINTEXT PROHIBITED.

5 (a) IN GENERAL.—No department, agency, or instru6 mentality of the United States or of any State may—

7 (1) require that;

8 (2) set standards for;

9 (3) condition any approval on;

10 (4) create incentives for; or

11 (5) tie any benefit to,

12 a requirement that, a decryption key, access to a

13 key, key recovery information, or any other plaintext

14 access capability be—

15 (A) required to be built into computers

16 hardware or software for any purpose;

17 (B) given to any other person (including a

18 department, agency, or instrumentality of the

19 United States or an entity in the private sector

20 that may be certified or approved by the United

21 States or a State); or

22 (C) retained by the owner or user of an

23 encryption key or any other person, other than

24 for encryption products for the use of the
18

•S 798 IS

1 United States Government or a State govern2 ment.

3 (b) EXISTING ACCESS PROTECTED.—Subsection (a)

4 does not affect the authority of any investigative or law

5 enforcement officer, or any member of the intelligence

6 community (as defined in section 3 of the National Secu7 rity Act of 1947 (50 U.S.C. 401a)), acting under any law

8 in effect on the date of enactment of this Act, to gain

9 access to encrypted communications or information.

10 TITLE II—GOVERNMENT

11 PROCUREMENT

12 SEC. 201. POLICY.

13 It is the policy of the United States—

14 (1) to permit the public to interact with govern15 ment through commercial networks and infrastruc16 ture; and

17 (2) to protect the privacy and security of any

18 electronic communication from, or stored informa19 tion obtained from, the public.

20 SEC. 202. FEDERAL PURCHASES OF ENCRYPTION PROD21 UCTS.

22 (a) IN GENERAL.—Any department, agency, or in23 strumentality of the United States may purchase

24 encryption products for use by officers and employees of
19

•S 798 IS

1 the United States to the extent and in the manner author2 ized by law.

3 (b) INTEROPERABILITY REQUIRED.—No department,

4 agency, or instrumentality of the United States, nor any

5 department, agency, or political subdivision of a State,

6 may purchase an encryption product for its use unless the

7 product will interoperate with other commercially-available

8 encryption products, including products without a

9 decryption key, access to a key, key recovery information,

10 or any other plaintext access capability.

11 (c) CITIZENS NOT REQUIRED TO PURCHASE SPECI12 FIED PRODUCT.—No department, agency, or instrumen13 tality of the United States, nor any department, agency,

14 or political subdivision of a State, may require any person

15 in the private sector to use any particular encryption prod16 uct or methodology, including products with a decryption

17 key, access to a key, key recovery information, or any

18 other plaintext access capability, to communicate with, or

19 transact business with, the government.
20

•S 798 IS

1 TITLE III—ADVANCED

2 ENCRYPTION STANDARD

3 SEC. 301. DEADLINE FOR FINAL SELECTION OF ALGO4 RITHM OR ALGORITHMS BY NIST.

5 (a) AES PROCESS.—The NIST shall continue and

6 complete the AES process initiated on January 2, 1997,

7 including—

8 (1) establishing performance requirements,

9 (2) setting procedures for submitting, testing,

10 evaluating, and judging proposals; and

11 (3) finally selecting one or more new private

12 sector-developed encryption algorithms.

13 (b) DEADLINE.—Notwithstanding subsection (a),

14 NIST shall make a final selection of one or more new pri15 vate sector-developed encryption algorithms by January 1,

16 2002.

17 SEC. 302. COMMERCE DEPARTMENT ENCRYPTION STAND18 ARDS AND EXPORTS AUTHORITY RE19 STRICTED.

20 (a) REGULATORY AUTHORITY.—Except as otherwise

21 provided in this Act, the Secretary of Commerce may not

22 promulgate or enforce any regulation, adopt any standard,

23 or carry out any policy that establishes an encryption

24 standard for use by businesses or other entities other than
21

•S 798 IS

1 for computer systems operated by a department, agency,

2 or other entity of the United States government.

3 (b) EXPORT AUTHORITY.—Except as otherwise pro4 vided in this Act, the Secretary of Commerce may not pro5 mulgate or enforce any regulation, adopt any standard,

6 or carry out any policy relating to encryption that has the

7 effect of imposing government-designed encryption stand8 ards on the private sector by restricting the export of

9 encryption products.

10 TITLE IV—IMPROVEMENT OF

11 GOVERNMENTAL TECHNO12 LOGICAL CAPABILITY

13 SEC. 401. INFORMATION TECHNOLOGY LABORATORY.

14 Section 20(b) of the National Institute oF Standards

15 and Technology Act (15 U.S.C. 278g–3(b)) is amended—

16 (1) by striking ‘‘and’’ at the end of paragraph

17 (4);

18 (2) by striking ‘‘policy.’’ in paragraph (5) and

19 inserting ‘‘policy;’’; and

20 (3) by adding at the end thereof the following:

21 ‘‘(6) to obtain information regarding the most

22 current information security hardware, software,

23 telecommunications, and other electronic capabilities;
22

•S 798 IS

1 ‘‘(7) to research and develop new and emerging

2 techniques and technologies to facilitate lawful ac3 cess to communications and electronic information;

4 ‘‘(8) to research and develop methods to detect

5 and prevent unwanted intrusions into commercial

6 computer networks, particularly those interconnected

7 with computer systems of the United States govern8 ment;

9 ‘‘(9) to provide assistance in responding to in10 formation security threats and vulnerabilities at the

11 request of other departments, agencies, and instru12 mentalities of the United States and State govern13 ments; and

14 ‘‘(10) to facilitate the development and adop15 tion of the best information security practices by de16 partments, agencies, and instrumentalities of the

17 United States, the States, and the private sector.’’.

18 SEC. 402. ADVISORY BOARD ON COMPUTER SYSTEM SECU19 RITY AND PRIVACY.

20 Section 21(b) of the National Institute of Standards

21 and Technology Act (15 U.S.C. 278g–4(b)) is amended—

22 (1) by redesignating paragraphs (2) and (3) as

23 paragraphs (4) and (5), respectively; and

24 (2) by inserting after paragraph (1) the fol25 lowing:
23

•S 798 IS

1 ‘‘(2) to provide a forum for communication and

2 coordination between industry and the Federal Gov3 ernment regarding information security issues;

4 ‘‘(3) to foster the aggregation and dissemina5 tion of general, nonproprietary, and non-confidential

6 developments in important information security tech7 nologies, including encryption, by regularly reporting

8 that information to appropriate Federal agencies to

9 keep law enforcement and national security agencies

10 abreast of emerging technologies so they are able ef11 fectively to meet their responsibilities;’’.

12 SEC. 403. AUTHORIZATION OF APPROPRIATIONS.

13 There are authorized to be appropriated to such de14 partments and agencies as may be appropriate such sums

15 as may be necessary to ensure that United States law en16 forcement agencies and agencies responsible for national

17 security are able to complete any missions or goals author18 ized in law regardless of technological advancements in

19 encryption and digital technology.

20 TITLE V—EXPORT OF

21 ENCRYPTION PRODUCTS.

22 SEC. 501. COMMERCIAL ENCRYPTION PRODUCTS.

23 (a) IN GENERAL.—This title applies to all encryption

24 products, without regard to the encryption algorithm se25 lected, encryption key chosen, exclusion of plaintext access
24

•S 798 IS

1 capability, or implementation or medium used, except

2 those encryption products specifically designed or modified

3 for military use (including command, control, and intel4 ligence applications).

5 (b) AUTHORITY OF SECRETARY OF COMMERCE.—

6 Subject to the other provisions of this title, and notwith7 standing any other provision of law, the Secretary of Com8 merce has exclusive authority to control the exportation

9 of encryption products described in subsection (a). In exer10 cising that authority, the Secretary shall consult with the

11 Secretary of State and the Secretary of Defense.

12 SEC. 502. PRESIDENTIAL AUTHORITY.

13 (a) TERRORIST AND EMBARGO CONTROLS.—Nothing

14 in this Act limits the authority of the President under—

15 (1) the Trading with the Enemy Act (50 U.S.C.

16 App. 1 et seq.); or

17 (2) the International Emergency Economic

18 Powers Act (50 U.S.C. 1701 et seq.), but only to the

19 extent that the authority of that Act is not exercised

20 to extend controls imposed under the Export Admin21 istration Act of 1979 (50 U.S.C. 2401 et seq.)—

22 (A) to prohibit the export of encryption

23 products to any country, corporation, or other

24 entity that has been determined to—
25

•S 798 IS

1 (i) provide support for acts of ter2 rorism; or

3 (ii) pose an immediate threat to na4 tional security; or

5 (B) to impose an embargo on exports to,

6 or imports from, a specific country, corporation,

7 or entity.

8 (b) SPECIAL DENIALS FOR SPECIFIC REASONS.—

9 The Secretary of Commerce shall prohibit the exportation

10 of particular encryption products to an individual or orga11 nization in a foreign country identified by the Secretary

12 if the Secretary determines that there is substantial evi13 dence that the encryption products may be used or modi14 fied for military or terrorist use, including acts against

15 the national security of, public safety of, or the integrity

16 of the transportation, communications, or other essential

17 systems of interstate commerce in, the United States.

18 (c) OTHER EXPORT CONTROLS.—An encryption

19 product is subject to any export control imposed on that

20 product for any reason other than the existence of

21 encryption capability. Nothing in this title alters the Sec22 retary of Commerce’s ability to control exports of products

23 for reasons other than encryption.
26

•S 798 IS

1 SEC. 503. EXPORTATION OF ENCRYPTION PRODUCTS WITH

2 NOT MORE THAN 64-BIT KEY LENGTH.

3 An encryption product that utilizes a key length or

4 64 bits or less, may be exported without an export license

5 or an export license exception, and without any other re6 striction (other than a restriction imposed under this

7 title).

8 SEC. 504. EXPORTABILITY OF CERTAIN ENCRYPTION PROD9 UCTS UNDER A LICENSE EXCEPTION.

10 (a) LICENSE EXCEPTIONS.—Except as otherwise

11 provided under this title, the export or re-export of the

12 following products shall be exportable under license excep13 tion:

14 (1) Recoverable products.

15 (2) Encryption products to legitimate and re16 sponsible entities or organizations and their strategic

17 partners, including—

18 (A) firms whose shares are publicly traded

19 in global markets;

20 (B) firms subject to a governmental regu21 latory scheme;

22 (C) United States subsidiaries or affiliates

23 of United States corporations;

24 (D) firms or organizations that are re25 quired by law to maintain plaintext records of

26 communications or otherwise maintain such
27

•S 798 IS

1 records as part of their normal business prac2 tice;

3 (E) firms or organizations that are audited

4 annually under widely accepted accounting prin5 ciples;

6 (F) strategic partners of United States

7 companies; and

8 (G) on-line merchants who use encryption

9 products to support electronic commerce, in10 cluding protecting commercial transactions as

11 well as non-public information exchange nec12 essary to support such transactions.

13 (3) Encryption products sold or licensed to for14 eign governments that are members of the North At15 lantic Treaty Organization, Organization for Eco16 nomic Cooperation and Development, and Associa17 tion of Southeast Asian Nations.

18 (4) Any computer hardware or computer soft19 ware that does not itself provide encryption capabili20 ties, but that incorporates or employs in any form

21 interface mechanisms for interaction with other com22 puter hardware and computer software, including

23 encryption products.

24 (5) Any technical assistance or technical data

25 associated with the installation and maintenance of
28

•S 798 IS

1 encryption products, or products incorporating, ena2 bling, or employing encryption products, if such

3 products are exportable under this title.

4 (b) LICENSE EXCEPTION PROCESSING PERIOD IN5 CLUDING ONE-TIME TECHNICAL REVIEW.—Encryption

6 products and related computer services shall be made eligi7 ble for a license exception after a one-time technical re8 view. Exporters’ requests for license exceptions, including

9 the one-time technical review, must be processed within

10 15 working days from receipt of a request. If the exporter

11 is not contacted within this 15-day processing period, the

12 exporter’s request for a license exception will be deemed

13 granted, and the exporter may export the encryption prod14 ucts or related computer services under the license excep15 tion.

16 SEC. 505. EXPORTABILITY OF ENCRYPTION PRODUCTS EM17 PLOYING A KEY LENGTH GREATER THAN 64-

18 BITS.

19 (a) EXPORT RELIEF FOR ENCRYPTION PRODUCTS.—

20 Encryption products, or products that incorporate or em21 ploy in any form, implementation, or medium an

22 encryption product, are exportable under a license excep23 tion if—
29

•S 798 IS

1 (1) the Secretary determines that the product

2 or service is exportable under the Export Adminis3 tration Act of 1979 (50 U.S.C. 2401 et seq.); or

4 (2) the Encryption Export Advisory Board de5 scribed in subsection (b) determines, and the Sec6 retary agrees, that the product or service is—

7 (A) generally available;

8 (B) publicly available; or

9 (C) an encryption product utilizing the

10 same or greater key length or otherwise pro11 viding comparable security is, or will be within

12 the next 12 months generally or widely avail13 able outside the United States from a foreign

14 supplier.

15 (b) BOARD DETERMINATION OF EXPORTABILITY.—

16 (1) ENCRYPTION EXPORT ADVISORY BOARD.—

17 There is hereby established an Encryption Export

18 Advisory Board comprised of—

19 (A) a Chairman, who shall be the Under

20 Secretary of Commerce for Export Administra21 tion;

22 (B) 7 individuals appointed by the Presi23 dent, as follows—

24 (i) 1 representative from the National

25 Security Agency;
30

•S 798 IS

1 (ii) 1 representative from the Central

2 Intelligence Agency;

3 (iii) 1 representative from the Office

4 of the President; and

5 (iv) 4 representatives from the private

6 sector who have expertise in the develop7 ment, operation, or marketing of informa8 tion technology products; and

9 (C) 4 representatives from the private sec10 tor who have expertise in the development, op11 eration, or marketing of information technology

12 products appointed by the Congress, as

13 follows—

14 (i) 1 representative appointed by the

15 Majority Leader of the Senate;

16 (ii) 1 representative appointed by the

17 Minority Leader of the Senate;

18 (iii) 1 representative appointed by the

19 Speaker of the House of Representatives;

20 and

21 (iv) 1 representative appointed by the

22 Minority Leader of the House of Rep23 resentatives.

24 (2) PURPOSE.—The Board shall evaluate and

25 make recommendations by majority vote within 30
31

•S 798 IS

1 days with respect to general availability, public avail2 ability, or foreign availability whenever an applica3 tion for a license exception based on general avail4 ability, public availability, or foreign availability has

5 been submitted to the Secretary.

6 (3) MEETINGS.—The Board shall meet at the

7 call of the Under Secretary upon a request for a de8 termination, but at least every 30 days if a request

9 is pending. The Federal Advisory Committee Act (5

10 U.S.C. App.) does not apply to the Board or to

11 meetings held by the Board under this subsection.

12 (4) ACTION BY THE SECRETARY.—The Board

13 shall make recommendations to the Secretary. The

14 Secretary shall specifically approve or disapprove of

15 each finding of availability within 30 days of receiv16 ing the recommendation and shall notify the Board

17 and publish the finding in the Federal Register. The

18 Secretary shall explain in detail the reasons for any

19 disapproval, including why and how continued con20 trols will be effective in achieving their purpose and

21 the amount of lost sales and loss in market share of

22 United States encryption products.

23 (5) JUDICIAL REVIEW.—Notwithstanding any

24 other provision of law, a decision by the Secretary

25 disapproving of a Board finding of availability shall
32

•S 798 IS

1 be subject to judicial review under the Administra2 tive Procedure Act (5 U.S.C. 551 et seq.).

3 (6) PRESIDENTIAL OVERRIDE.—The Board

4 shall report to the President within 30 days after

5 each meeting. The President may override any

6 Board determination of exportability and control the

7 export and re-export of specified encryption products

8 to specific countries or individuals if he determines

9 that such exports or re-exports would harm United

10 States national security, including United States ca11 pabilities in fighting drug trafficking, terrorism, or

12 espionage. If the President overrides a Board deter13 mination of exportability and decides to control the

14 export or re-export of any encryption product, the

15 President must inform the Board and Congress and

16 detail the reasons for such controls within 30 days

17 of the determination. The action of the president

18 under this paragraph is not subject to judicial re19 view.

20 (c) RELY ON DETERMINATION OF BOARD.—The

21 manufacturer or exporter of an encryption product or a

22 product incorporating or employing an encryption product

23 may rely upon the Board’s determination that the product

24 is generally available or publicly available or if a com25 parable foreign encryption product is available, and shall
33

•S 798 IS

1 not be held liable or responsible or subject to sanctions

2 for any export of such products under the license excep3 tion.

4 (d) LICENSE EXCEPTION PROCESSING PERIOD IN5 CLUDING ONE-TIME TECHNICAL REVIEW.—Encryption

6 products and related computer services shall be made eligi7 ble for a license exception after a one-time technical re8 view. Exporters’ requests for license exceptions, including

9 the one-time technical review, must be processed within

10 15 working days from receipt of a request. If the exporter

11 is not contacted within this 15-day processing period, the

12 exporter’s request for a license exception will be deemed

13 granted, and the exporter may export the encryption prod14 ucts or related computer services under the license excep15 tion.

16 (e) GRANDFATHERING OF PRIOR DETERMINA17 TIONS.—Any determination by the Secretary prior to en18 actment of this Act that an encryption product with great19 er than a 64-bit key length, or product incorporating or

20 employing such an encryption product, and related serv21 ices, is eligible for export and re-export either without a

22 license or under a license, a license exception, or an

23 encryption licensing arrangement will remain in effect

24 after passage of this Act.
34

•S 798 IS

1 SEC. 506. EXPORTABILITY OF ENCRYPTION PRODUCTS EM2 PLOYING AES OR ITS EQUIVALENT.

3 Upon adoption of the AES, but not later than Janu4 ary 1, 2002, the Secretary may no longer impose United

5 States encryption export controls on encryption products

6 if the encryption algorithm and key length employed were

7 incorporated in the AES, or have an equivalent strength,

8 and such product shall be exportable without the need for

9 an export license or license exception, and without restric10 tions other than those permitted under this Act.

11 SEC. 507. ELIMINATION OF REPORTING REQUIREMENTS.

12 The Secretary may not impose any reporting require13 ments on any encryption product not subject to United

14 States export controls or exported under a license excep15 tion.

Æ