There are three points that I would like to make. First, the sad state of security of our country's information infrastructures will not be solved by this bill. This is because the security problems are not the result of using exportable encryption, but rather of not using any encryption at all and of not employing other essential safeguards. Sensitive data, including passwords, is routinely transmitted and stored in the clear. Of the thousands of incidents reported to the Computer Emergency Response Center, I am not aware of any that can be attributed to faulty encryption caused by export controls.
Security also requires much more than encryption.
Encryption will not stop insiders from compromising proprietary information, siphoning money from bank accounts, and planting destructive time bombs. It will not stop hackers from exploiting security holes in order to penetrate systems, deface Web pages, and disrupt service. It will not prevent Trojan horses, disguised as appealing software programs, from entering users' computers and stealing passwords and other secrets while they are being typed. In short, encryption is not a silver bullet. It must be augmented with other security measures, both technical and procedural.