I
103D CONGRESS
2D SESSION
H. R. 5199
To amend the National Institute of Standards and Technology Act to provide
for the establishment and management of voluntary encryption standards
to protect the privacy and security of electronic information, and for
other purposes.
IN THE HOUSE OF REPRESENTATIVES
OCTOBER 6, 1994
Mr. BROWN of California introduced the following bill; which was referred to
the Committee on Science, Space, and Technology
A BILL
To amend the National Institute of Standards and Tech-
nology Act to provide for the establishment and manage-
ment of voluntary encryption standards to protect the
privacy and security of electronic information, and for
other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Encryption Standards
and Procedures Act of 1994’’.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds the following:
(1) Advancements in communications and infor-
mation technology and the widespread use of that
technology have enhanced the volume and value of
domestic and international communication of elec-
tronic information as well as the ability to preserve
the confidentiality, protect the privacy, and authen-
ticate the origin, of that information.
(2) The proliferation of communications and in-
formation technology has made it increasingly dif-
ficult for the government to obtain and decipher, in
a timely manner and as provided by law, electronic
information that is necessary to provide for public
safety and national security.
(3) The development of the Nation’s informa-
tion infrastructure and the realization of the full
benefits of that infrastructure require that electronic
information resident in, or communicated over, that
infrastructure is secure, confidential, and authentic.
(4) Security, privacy, and authentication of
electronic information resident in, or communicated
over, the Nation’s information infrastructure are en-
hanced with the use of encryption technology.
(5) The rights of individuals and other persons
to security, privacy, and protection in their commu-
nications and in the dissemination and receipt of
electronic information should be preserved and pro-
tected.
(6) The authority and ability of the government
to obtain and decipher, in a timely manner and as
provided by law, electronic information necessary to
provide for public safety and national security
should also be preserved.
(7) There is a national need to develop, adopt,
and use encryption methods and procedures that ad-
vance the development of the Nation’s information
infrastructure and that preserve the personal rights
referred to in paragraph (5) and the governmental
authority and ability referred to in paragraph (6), as
provided by law.
(b) PURPOSES.—It is the purpose of this Act—
(1) to promote the development of the Nation’s
information infrastructure consistent with public
welfare and safety, national security, and the privacy
and protection of personal property;
(2) to encourage and facilitate the development,
adoption, and use of encryption standards and pro-
cedures that provide sufficient privacy, protection,
and authentication of electronic information and
that reasonably satisfy the needs of government to
provide for public safety and national security; and
(3) to establish Federal policy governing the de-
velopment, adoption, and use of encryption stand-
ards and procedures and a Federal program to carry
out that policy.
SEC. 3. ENCRYPTION STANDARDS AND PROCEDURES.
(a) COMPUTER SYSTEM SECURITY AND PRIVACY AD-
VISORY BOARD.—
(1) REQUIREMENT OF PRIVACY EXPERTISE.—
Section 21(a)(2) of the National Institute of Stand-
ards and Technology Act (15 U.S.C. 278g–4(a)(2))
is amended by inserting ‘‘(including computer sys-
tems privacy)’’ after ‘‘related disciplines’’.
(2) EXPANDED FUNCTIONS.—Section 21(b) of
such Act (15 U.S.C. 278g–4(b)) is amended—
(A) by striking ‘‘and’’ at the end of para-
graph (2);
(B) by striking the period at the end of
paragraph (3) and inserting ‘‘; and’’; and
(C) by adding after paragraph (3) the fol-
lowing new paragraph:
‘‘(4) to advise the Institute and the Congress
on privacy issues pertaining to electronic information
and on encryption standards developed under section
31(b).’’.
‘‘(3) 
CONSULTATION.—Standards 
developed
under paragraph (1) shall be developed in consulta-
tion with the heads of other appropriate Federal
agencies.
‘‘(c) PERMITTED USE OF STANDARDS.—The Federal
Government shall make available for public use any stand-
ard established under subsection (b), except that nothing
in this Act may be construed to require such use by any
individual or other person.
‘‘(d) ESCROW AGENTS.—
‘‘(1) DESIGNATION.—If a key escrow encryption
standard is established under subsection (b), the
President shall designate at least 2 Federal agencies
that satisfy the qualifications referred to in para-
graph (2) to act as key escrow agents for that stand-
ard.
‘‘(2) QUALIFICATIONS.—A key escrow agent
designated under paragraph (1) shall be a Federal
agency that—
‘‘(A) possesses the capability, competency,
and resources to administer the key escrow
encryption standard, to safeguard sensitive in-
formation related to it, and to carry out the re-
sponsibilities set forth in paragraph (3) in a
timely manner; and
‘‘(B) is not a Federal agency that is au-
thorized by law to conduct electronic surveil-
lance.
‘‘(3) RESPONSIBILITIES.—A key escrow agent
designated under paragraph (1) shall, by regulation
and in consultation with the Secretary and any other
key escrow agent designated under such paragraph,
establish procedures and take other appropriate
steps—
‘‘(A) to safeguard the confidentiality, in-
tegrity, and availability of keys or components
thereof held by the agent pursuant to this sub-
section;
‘‘(B) to preserve the integrity of any key
escrow encryption standard established under
subsection (b) for which the agent holds the
keys or components thereof;
‘‘(C) to hold and manage the keys or com-
ponents thereof consistent with the require-
ments of this section and the encryption stand-
ard established under subsection (b); and
‘‘(D) to carry out the responsibilities set
forth in this paragraph in the most effective
and efficient manner practicable.
‘‘(4) AUTHORITY.—A key escrow agent des-
ignated under paragraph (1) may enter into con-
tracts, cooperative agreements, and joint ventures
and take other appropriate steps to carry out its re-
sponsibilities.
‘‘(e) LIMITATIONS ON ACCESS AND USE.—
‘‘(1) RELEASE
OF
KEY
TO
CERTAIN
AGEN-
CIES.—A key escrow agent designated under sub-
section (d) may release a key or component thereof
held by the agent pursuant to that subsection only
to a Federal agency that is authorized by law to con-
duct electronic surveillance and that is authorized to
obtain and use the key or component by court order
or other provision of law. An entity to whom a key
or component thereof has been released under this
paragraph may use the key or component thereof
only in the manner and for the purpose and dura-
tion that is expressly provided for in the court order
or other provision of law authorizing such release
and use.
‘‘(2) LIMITATION ON USE BY PRIVATE PERSONS
AND FOREIGN CITIZENS.—
‘‘(A) IN GENERAL.—Except as provided in
subparagraph (B), a person (including a person
not a citizen or permanent resident of the
United States) that is not an agency of the
Federal Government or a State or local govern-
ment shall not have access to or use keys asso-
ciated with an encryption standard established
under subsection (b).
‘‘(B) EXCEPTION.—A representative of a
foreign government may have access to and use
a key associated with an encryption standard
established under subsection (b) only if the
President determines that such access and use
is in the national security and foreign policy in-
terests of the United States. The President
shall prescribe the manner and conditions of
any such access and use.
‘‘(3) LIMIT ON USE BY GOVERNMENT AGEN-
CIES.—A government agency, instrumentality, or po-
litical subdivision thereof shall not have access to or
use a key or component thereof associated with an
encryption standard established under subsection (b)
that is held by a key escrow agent under subsection
(d) unless such access or use is authorized by this
section, by court order, or by other law.
‘‘(f) REVIEW AND REPORT.—
‘‘(1) IN GENERAL.—Within 2 years after the
date of the enactment of this Act and at least once
every 2 years thereafter, the Secretary shall conduct
a hearing on the record in which all interested par-
ties shall have an opportunity to comment on the ex-
tent to which encryption standards, procedures, and
requirements established under this section have
succeeded in fulfilling the purposes of this section
and the manner and extent to which such standards,
procedures, and requirements can be improved.
‘‘(2) REPORT.—Upon completion of a hearing
conducted under paragraph (1), the Secretary shall
submit to the Congress a report containing a state-
ment of the Secretary’s findings pursuant to the
hearing along with recommendations and a plan for
correcting any deficiencies or abuses in achieving the
purposes of this section that are identified as a re-
sult of the hearing.
‘‘(g) REGULATIONS.—Within one year after the date
of the enactment of this Act, the Secretary and each key
escrow agent designated by the President under subsection
(d) shall, after notice to the public and opportunity for
comment, issue any regulations necessary to carry out this
section.
‘‘(h) LIABILITY.—The United States shall not be lia-
ble for any loss incurred by any individual or other person
resulting from any compromise or security breach of any
encryption standard established under subsection (b) or
any violation of this section or any regulation or procedure
established by or under this section by—
‘‘(1) any person who is not an official or em-
ployee of the United States; or
‘‘(2) any person who is an official or employee
of the United States, unless such compromise,
breach, or violation is willful.
‘‘(i) SEVERABILITY.—If any provision of this section,
or the application thereof, to any person or circumstance,
is held invalid, the remainder of this section, and the ap-
plication thereof, to other persons or circumstances shall
not be affected thereby.
‘‘(j) DEFINITIONS.—For purposes of this section:
‘‘(1) The term ‘content’, when used with respect
to electronic information, includes the substance,
purport, or meaning of that information.
‘‘(2) The term ‘electronic communications sys-
tem’ has the meaning given such term in section
2510(14) of title 18, United States Code.
‘‘(3) The term ‘encryption’ means a method—
‘‘(A) to encipher and decipher the content
of electronic information to protect the privacy
and security of such information; or
‘‘(B) to verify the integrity, or authenticate
the origin, of electronic information.
‘‘(4) The term ‘encryption standard’ means a
technical, management, physical, or administrative
standard or associated guideline or procedure for
conducting 
encryption, 
including 
key 
escrow
encryption, to ensure or verify the integrity, authen-
ticity, or confidentiality of electronic information
that, regardless of application or purpose, is stored,
processed, transmitted, or otherwise communicated
domestically or internationally in any public or pri-
vate electronic communications system.
‘‘(5) The term ‘key escrow encryption’ means
an encryption method that allows the government,
pursuant to court order or other provision of law, to
decipher electronic information that has been
encrypted with that method by using a unique secret
code or key that is, in whole or in part, held by and
obtained from a key escrow agent.
‘‘(6) The term ‘key escrow agent’ means an en-
tity designated by the President under subsection
(d) to hold and manage keys associated with an
encryption standard established under subsection
(b).