SEC. 102. LAWFUL USE OF ENCRYPTION.
Except as otherwise provided by this Act or
otherwise provided by law, it shall be lawful
for any person within any State and for any
United States person to use any encryption
product, regardless of encryption algorithm
selected, encryption bit length chosen, or im-
plementation technique or medium used.
SEC. 103. UNLAWFUL USE OF ENCRYPTION.
(a) IN GENERAL.—Part I of title 18, United
States Code, is amended by inserting after
chapter 123 the following new chapter:
‘‘CHAPTER 125—ENCRYPTED DATA,
INCLUDING COMMUNICATIONS
‘‘Sec.
‘‘2801. Unlawful use of encryption in furtherance of a criminal
act.
‘‘2802. Privacy protection.
‘‘2803. Court order access to plaintext or decryption informa-
tion.
‘‘2804. Notification procedures.
‘‘2805. Lawful use of plaintext or decryption information.
‘‘2806. Identification of decryption information.
‘‘2807. Definitions.
‘‘§ 2801. Unlawful use of encryption in furtherance of
a criminal act
‘‘(a) PROHIBITED
ACTS.—Whoever know-
ingly uses encryption in furtherance of the
commission of a criminal offense for which the
person may be prosecuted in a district court of
the United States shall—
‘‘(1) in the case of a first offense under
this section, be imprisoned for not more
than 5 years, or fined under this title, or
both; and
‘‘(2) in the case of a second or subse-
quent offense under this section, be im-
prisoned for not more than 10 years, or
fined under this title, or both.
‘‘(b) 
CONSECUTIVE
SENTENCE.—Notwith-
standing any other provision of law, the court
shall not place on probation any person con-
victed of a violation of this section, nor shall
the term of imprisonment imposed under this
section run concurrently with any other term
of imprisonment imposed for the underlying
criminal offense.
‘‘(c) PROBABLE CAUSE NOT CONSTITUTED BY
USE OF ENCRYPTION.—The use of encryption by
itself shall not establish probable cause to be-
lieve that a crime is being or has been com-
mitted.
‘‘§ 2802. Privacy protection
‘‘(a) IN GENERAL.—It shall be unlawful for
any person to intentionally—
‘‘(1) obtain or use decryption informa-
tion without lawful authority for the pur-
pose of decrypting data, including com-
munications;
‘‘(2) 
exceed 
lawful 
authority 
in
decrypting data, including communica-
tions;
‘‘(3) break the encryption code of an-
other person without lawful authority for
the purpose of violating the privacy or se-
curity of that person or depriving that
person of any property rights;
‘‘(4) impersonate another person for
the purpose of obtaining decryption infor-
mation of that person without lawful au-
thority;
‘‘(5) 
facilitate 
or 
assist 
in 
the
encryption of data, including communica-
tions, knowing that such data, including
communications, are to be used in fur-
therance of a crime; or
‘‘(6) disclose decryption information
in violation of a provision of this chapter.
‘‘(b) CRIMINAL PENALTY.—Whoever violates
this section shall be imprisoned for not more
than 10 years, or fined under this title, or both.
‘‘§ 2803. Court order access to plaintext or decryption
information
‘‘(a) COURT ORDER.—(1) A court of com-
petent jurisdiction shall issue an order, ex
parte, granting an investigative or law en-
forcement officer timely access to the plaintext
of encrypted data, including communications,
or requiring any person in possession of
decryption information to provide such infor-
mation to a duly authorized investigative or
law enforcement officer—
‘‘(A) upon the application by an attor-
ney for the Government that—
‘‘(i) is made under oath or affir-
mation by the attorney for the Govern-
ment; and
‘‘(ii) provides a factual basis es-
tablishing 
the 
relevance 
that 
the
plaintext or decryption information
being sought has to a law enforce-
ment, foreign counterintelligence, or
international terrorism investigation
then being conducted pursuant to
lawful authorities; and
‘‘(B) if the court finds, in writing, that
the plaintext or decryption information
being sought is relevant to an ongoing
lawful law enforcement, foreign counter-
intelligence, or international terrorism in-
vestigation and the investigative or law
enforcement officer is entitled to such
plaintext or decryption information.
‘‘(2) The order issued by the court under
this section shall be placed under seal, except
that a copy may be made available to the in-
vestigative or law enforcement officer author-
ized to obtain access to the plaintext of the
encrypted information, or authorized to obtain
the decryption information sought in the ap-
plication. Such order shall, subject to the noti-
fication procedures set forth in section 2804,
also be made available to the person respon-
sible for providing the plaintext or the
decryption information, pursuant to such
order, to the investigative or law enforcement
officer.
‘‘(3) Disclosure of an application made, or
order issued, under this section, is not author-
ized, except as may otherwise be specifically
permitted by this section or another order of
the court.
‘‘(b) RECORD
OF
ACCESS
REQUIRED.—(1)
There shall be created an electronic record, or
similar type record, of each instance in which
an investigative or law enforcement officer,
pursuant to an order under this section, gains
access to the plaintext of otherwise encrypted
information, or is provided decryption infor-
mation, without the knowledge or consent of
the owner of the data, including communica-
tions, who is the user of the encryption product
involved.
‘‘(2) The court issuing the order under this
section may require that the electronic or simi-
lar type of record described in paragraph (1)
is maintained in a place and a manner that
is not within the custody or control of an inves-
tigative or law enforcement officer gaining the
access or provided the decryption information.
The record shall be tendered to the court, upon
notice from the court.
100
‘‘(3) The court receiving such electronic or
similar type of record described in paragraph
(1) shall make the original and a certified
copy of the record available to the attorney for
the Government making application under
this section, and to the attorney for, or directly
to, the owner of the data, including commu-
nications, who is the user of the encryption
product, pursuant to the notification proce-
dures set forth in section 2804.
‘‘(c) AUTHORITY TO INTERCEPT COMMUNICA-
TIONS NOT INCREASED.—Nothing in this chap-
ter shall be construed to enlarge or modify the
circumstances or procedures under which a
Government entity is entitled to intercept or
obtain oral, wire, or electronic communica-
tions or information.
‘‘(d) CONSTRUCTION.—This chapter shall be
strictly construed to apply only to a Govern-
ment entity’s ability to decrypt data, including
communications, for which it has previously
obtained lawful authority to intercept or ob-
tain pursuant to other lawful authorities,
which without an order issued under this sec-
tion would otherwise remain encrypted.
101
‘‘§ 2804. Notification procedures
‘‘(a) IN
GENERAL.—Within a reasonable
time, but not later than 90 days after the filing
of an application for an order under section
2803 which is granted, the court shall cause to
be served, on the persons named in the order
or the application, and such other parties
whose 
decryption 
information 
or 
whose
plaintext has been provided to an investigative
or law enforcement officer pursuant to this
chapter, as the court may determine is in the
interest of justice, an inventory which shall in-
clude notice of—
‘‘(1) the fact of the entry of the order
or the application;
‘‘(2) the date of the entry of the appli-
cation and issuance of the order; and
‘‘(3) 
the 
fact 
that 
the 
person’s
decryption information or plaintext data,
including communications, has been pro-
vided or accessed by an investigative or
law enforcement officer.
The court, upon the filing of a motion, may
make available to that person or that person’s
counsel, for inspection, such portions of the
102
plaintext, applications, and orders as the
court determines to be in the interest of justice.
‘‘(b) POSTPONEMENT
OF
INVENTORY
FOR
GOOD CAUSE.—(1) On an ex parte showing of
good cause by an attorney for the Government
to a court of competent jurisdiction, the serv-
ing of the inventory required by subsection (a)
may be postponed for an additional 30 days
after the granting of an order pursuant to the
ex parte motion.
‘‘(2) No more than 3 ex parte motions pur-
suant to paragraph (1) are authorized.
‘‘(c) ADMISSION INTO EVIDENCE.—The con-
tent of any encrypted information that has
been obtained pursuant to this chapter or evi-
dence derived therefrom shall not be received
in evidence or otherwise disclosed in any trial,
hearing, or other proceeding in a Federal or
State court, other than the court organized
pursuant to the Foreign Intelligence Surveil-
lance Act of 1978, unless each party, not less
than 10 days before the trial, hearing, or pro-
ceeding, has been furnished with a copy of the
order, and accompanying application, under
which the decryption or access to plaintext
103
was authorized or approved. This 10-day pe-
riod may be waived by the court if the court
finds that it was not possible to furnish the
party with the information described in the
preceding sentence within 10 days before the
trial, hearing, or proceeding and that the
party will not be prejudiced by the delay in re-
ceiving such information.
‘‘(d) CONSTRUCTION.—The provisions of this
chapter shall be construed consistent with—
‘‘(1) the Classified Information Proce-
dures Act (18 U.S.C. App.); and
‘‘(2) the Foreign Intelligence Surveil-
lance Act of 1978 (50 U.S.C. 1801 et seq.).
‘‘(e) CONTEMPT.—Any violation of the provi-
sions of this section may be punished by the
court as a contempt thereof.
‘‘(f) MOTION TO SUPPRESS.—Any aggrieved
person in any trial, hearing, or proceeding in
or before any court, department, officer, agen-
cy, regulatory body, or other authority of the
United States or a State, other than the court
organized pursuant to the Foreign Intelligence
Surveillance Act of 1978, may move to suppress
the contents of any decrypted data, including
104
communications, obtained pursuant to this
chapter, or evidence derived therefrom, on the
grounds that —
‘‘(1) the plaintext was decrypted or
accessed in violation of this chapter;
‘‘(2) the order of authorization or ap-
proval under which it was decrypted or
accessed is insufficient on its face; or
‘‘(3) the decryption was not made in
conformity with the order of authoriza-
tion or approval.
Such motion shall be made before the trial,
hearing, or proceeding unless there was no op-
portunity to make such motion, or the person
was not aware of the grounds of the motion.
If the motion is granted, the plaintext of the
decrypted data, including communications, or
evidence derived therefrom, shall be treated as
having been obtained in violation of this chap-
ter. The court, upon the filing of such motion
by the aggrieved person, may make available
to the aggrieved person or that person’s coun-
sel 
for 
inspection 
such 
portions 
of 
the
decrypted plaintext, or evidence derived there-
105
from, as the court determines to be in the inter-
ests of justice.
‘‘(g) APPEAL BY UNITED STATES.—In addi-
tion to any other right to appeal, the United
States shall have the right to appeal from an
order granting a motion to suppress made
under subsection (f), or the denial of an appli-
cation for an order under section 2803, if the
attorney for the Government certifies to the
court or other official granting such motion or
denying such application that the appeal is
not taken for purposes of delay. Such appeal
shall be taken within 30 days after the date the
order was entered on the docket and shall be
diligently prosecuted.
‘‘(h) CIVIL ACTION FOR VIOLATION.—Except
as otherwise provided in this chapter, any per-
son described in subsection (i) may, in a civil
action, recover from the United States Govern-
ment the actual damages suffered by the per-
son as a result of a violation described in that
subsection, reasonable attorney’s fees, and
other litigation costs reasonably incurred in
prosecuting such claim.
106
‘‘(i) COVERED PERSONS.—Subsection (h) ap-
plies 
to 
any 
person 
whose 
decryption
information—
‘‘(1) is knowingly obtained without
lawful authority by an investigative or
law enforcement officer;
‘‘(2) is obtained by an investigative or
law enforcement officer with lawful au-
thority and is knowingly used or disclosed
by such officer unlawfully; or
‘‘(3) is obtained by an investigative or
law enforcement officer with lawful au-
thority and whose decryption information
is 
unlawfully 
used 
to 
disclose 
the
plaintext of the data, including commu-
nications.
‘‘(j) LIMITATION.—A civil action under sub-
section (h) shall be commenced not later than
2 years after the date on which the unlawful
action took place, or 2 years after the date on
which the claimant first discovers the viola-
tion, whichever is later.
‘‘(k) EXCLUSIVE REMEDIES.—The remedies
and sanctions described in this chapter with
respect to the decryption of data, including
107
communications, are the only judicial rem-
edies and sanctions for violations of this chap-
ter involving such decryptions, other than vio-
lations based on the deprivation of any rights,
privileges, or immunities secured by the Con-
stitution.
‘‘(l) TECHNICAL ASSISTANCE BY PROVIDERS.—
A provider of encryption technology or network
service that has received an order issued by a
court pursuant to this chapter shall provide to
the investigative or law enforcement officer
concerned such technical assistance as is nec-
essary to execute the order. Such provider may,
however, move the court to modify or quash the
order on the ground that its assistance with
respect to the decryption or access to plaintext
cannot be performed in fact, or in a timely or
reasonable fashion. The court, upon notice to
the Government, shall decide such motion ex-
peditiously.
‘‘(m) REPORTS
TO CONGRESS.—In May of
each year, the Attorney General, or an Assist-
ant Attorney General specifically designated
by the Attorney General, shall report in writ-
ing to Congress on the number of applications
108
made and orders entered authorizing Federal,
State, and local law enforcement access to
decryption information for the purposes of
reading the plaintext of otherwise encrypted
data, including communications, pursuant to
this chapter. Such reports shall be submitted
to the Committees on the Judiciary of the
House of Representatives and of the Senate,
and to the Permanent Select Committee on In-
telligence for the House of Representatives and
the Select Committee on Intelligence for the
Senate.
‘‘§ 2805. Lawful use of plaintext or decryption infor-
mation
‘‘(a) AUTHORIZED USE OF DECRYPTION IN-
FORMATION.—
‘‘(1) CRIMINAL INVESTIGATIONS.—An in-
vestigative or law enforcement officer to
whom plaintext or decryption information
is provided may only use such plaintext or
decryption information for the purposes of
conducting a lawful criminal investiga-
tion, foreign counterintelligence, or inter-
national terrorism investigation, and for
109
the purposes of preparing for and pros-
ecuting any criminal violation of law.
‘‘(2) CIVIL REDRESS.—Any plaintext or
decryption information provided under
this chapter to an investigative or law en-
forcement officer may not be disclosed, ex-
cept by court order, to any other person
for use in a civil proceeding that is unre-
lated to a criminal investigation and
prosecution for which the plaintext or
decryption 
information 
is 
authorized
under paragraph (1). Such order shall
only issue upon a showing by the party
seeking disclosure that there is no alter-
native means of obtaining the plaintext,
or decryption information, being sought
and the court also finds that the interests
of justice would not be served by non-
disclosure.
‘‘(b) LIMITATION.—An investigative or law
enforcement officer may not use decryption in-
formation obtained under this chapter to de-
termine the plaintext of any data, including
communications, unless it has obtained lawful
110
authority to obtain such data, including com-
munications, under other lawful authorities.
‘‘(c) RETURN
OF
DECRYPTION
INFORMA-
TION.—An attorney for the Government shall,
upon the issuance of an order of a court of
competent jurisdiction—
‘‘(1)(A) return any decryption informa-
tion to the person responsible for pro-
viding it to an investigative or law en-
forcement officer pursuant to this chap-
ter; or
‘‘(B) destroy such decryption informa-
tion, if the court finds that the interests of
justice or public safety require that such
decryption information should not be re-
turned to the provider; and
‘‘(2) within 10 days after execution of
the court’s order to return or destroy the
decryption information—
‘‘(A) certify to the court that the
decryption 
information 
has 
either
been returned or destroyed consistent
with the court’s order; and
111
‘‘(B) if applicable, notify the pro-
vider of the decryption information of
the destruction of such information.
‘‘(d) OTHER DISCLOSURE OF DECRYPTION IN-
FORMATION.—Except as otherwise provided in
section 2803, decryption information or the
plaintext of otherwise encrypted data, includ-
ing communications, shall not be disclosed by
any person unless the disclosure is—
‘‘(1) to the person encrypting the data,
including communications, or an author-
ized agent thereof;
‘‘(2) with the consent of the person
encrypting the data, including pursuant
to a contract entered into with the person;
‘‘(3) pursuant to a court order upon a
showing of compelling need for the infor-
mation that cannot be accommodated by
any other means if—
‘‘(A) the person who supplied the
information is given reasonable no-
tice, by the person seeking the disclo-
sure, of the court proceeding relevant
to the issuance of the court order; and
112
‘‘(B) the person who supplied the
information is afforded the oppor-
tunity to appear in the court pro-
ceeding and contest the claim of the
person seeking the disclosure;
‘‘(4) pursuant to a determination by a
court of competent jurisdiction that an-
other person is lawfully entitled to hold
such decryption information, including
determinations arising from legal pro-
ceedings associated with the incapacity,
death, or dissolution of any person; or
‘‘(5) otherwise permitted by law.
‘‘§ 2806. Identification of decryption information
‘‘(a) IDENTIFICATION.—To avoid inadvertent
disclosure of decryption information, any per-
son who provides decryption information to an
investigative or law enforcement officer pursu-
ant to this chapter shall specifically identify
that part of the material that discloses
decryption information as such.
‘‘(b) RESPONSIBILITY
OF INVESTIGATIVE
OR
LAW ENFORCEMENT OFFICER.—The investigative
or law enforcement officer receiving any
decryption information under this chapter
113
shall maintain such information in a facility
and in a method so as to reasonably assure
that inadvertent disclosure does not occur.
‘‘§ 2807. Definitions
‘‘The definitions set forth in section 101 of
the Encryption for the National Interest Act
shall apply to this chapter.’’.
(b) CONFORMING AMENDMENT.—The table of
chapters for part I of title 18, United States
Code, is amended by inserting after the item
relating to chapter 121 the following new item:
‘‘125. Encrypted data, including communications ............... 2801’’.
TITLE II—GOVERNMENT
PROCUREMENT
SEC. 201. FEDERAL PURCHASES OF ENCRYPTION PROD-
UCTS.
(a) DECRYPTION CAPABILITIES.—The Presi-
dent may, consistent with the provisions of
subsection (b), direct that any encryption
product or service purchased or otherwise pro-
cured by the United States Government to pro-
vide the security service of data confidentiality
for a computer system owned and operated by
the United States Government shall include
recoverability features or functions that en-
able the timely decryption of encrypted data,
114
including communications, or timely access to
plaintext by an authorized party without the
knowledge or cooperation of the person using
such encryption products or services.
(b) CONSISTENCY WITH INTELLIGENCE SERV-
ICES AND MILITARY OPERATIONS.—The President
shall ensure that all encryption products pur-
chased or used by the United States Govern-
ment are supportive of, and consistent with,
all statutory obligations to protect sources and
methods of intelligence collection and activi-
ties, and supportive of, and consistent with,
those needs required for military operations
and the conduct of foreign policy.
SEC. 202. NETWORKS ESTABLISHED WITH FEDERAL FUNDS.
The President may direct that any commu-
nications network established for the purpose
of conducting the business of the Federal Gov-
ernment shall use encryption products that—
(1) include features and functions
that enable the timely decryption of
encrypted data, including communica-
tions, or timely access to plaintext, by an
authorized party without the knowledge
115
or cooperation of the person using such
encryption products or services; and
(2) are supportive of, and consistent
with, all statutory obligations to protect
sources and methods of intelligence col-
lection and activities, and supportive of,
and consistent with, those needs required
for military operations and the conduct of
foreign policy.
SEC. 203. GOVERNMENT CONTRACT AUTHORITY.
The President may require as a condition
of any contract by the Government with a pri-
vate sector vendor that any encryption product
used by the vendor in carrying out the provi-
sions of the contract with the Government in-
clude features and functions that enable the
timely decryption of encrypted data, including
communications, or timely access to plaintext,
by an authorized party without the knowledge
or cooperation of the person using such
encryption products or services.
SEC. 204. PRODUCT LABELS.
An encryption product may be labeled to
inform Government users that the product is
authorized for sale to or for use by Government
116
agencies or Government contractors in trans-
actions and communications with the United
States Government under this title.
SEC. 205. NO PRIVATE MANDATE.
The United States Government may not re-
quire the use of encryption standards for the
private sector except as otherwise authorized
by section 204.
SEC. 206. EXCLUSION.
Nothing in this title shall apply to
encryption products and services used solely
for access control, authentication, integrity,
nonrepudiation, digital signatures, or other
similar purposes.
TITLE III—EXPORTS OF
ENCRYPTION
SEC. 301. EXPORTS OF ENCRYPTION.
(a) AUTHORITY TO CONTROL EXPORTS.—The
President shall control the export of all dual-
use encryption products.
(b) AUTHORITY TO DENY EXPORT FOR NA-
TIONAL SECURITY REASONS.—Notwithstanding
any provision of this title, the President may
deny the export of any encryption product on
117
the basis that its export is contrary to the na-
tional security.
(c) DECISIONS NOT SUBJECT TO JUDICIAL RE-
VIEW.—Any decision made by the President or
his designee with respect to the export of
encryption products under this title shall not
be subject to judicial review.
SEC. 302. LICENSE EXCEPTION FOR CERTAIN ENCRYPTION
PRODUCTS.
(a) LICENSE EXCEPTION.—Upon the enact-
ment of this Act, any encryption product with
an encryption strength of 64 bits or less shall
be eligible for export under a license exception
if—
(1) such encryption product is sub-
mitted for a 1-time technical review;
(2) such encryption product does not
require licensing under otherwise appli-
cable regulations;
(3) such encryption product is not in-
tended for a country, end user, or end use
that is by regulation ineligible to receive
such product, and the encryption product
is otherwise qualified for export;
118
(4) the exporter, within 180 days after
the export of the product, submits a cer-
tification identifying—
(A) the intended end use of the
product; and
(B) the name and address of the
intended recipient of the product,
where available;
(5) the exporter, within 180 days of the
export of the product, provides the names
and addresses of its distribution chain
partners; and
(6) the exporter, at the time of submis-
sion of the product for technical review,
provides proof that its distribution chain
partners have contractually agreed to
abide by all laws and regulations of the
United States concerning the export and
reexport of encryption products designed
or 
manufactured 
within 
the 
United
States.
(b) ONE-TIME TECHNICAL REVIEW.—(1) The
technical review referred to in subsection (a)
shall be completed within no longer than 45
119
days after the submission of all of the informa-
tion required under paragraph (2).
(2) The President shall specify the infor-
mation that must be submitted for the 1-time
technical review referred to in this section.
(3) An encryption product may not be ex-
ported during the technical review of that
product under this section.
(c) PERIODIC REVIEW OF LICENSE EXCEPTION
ELIGIBILITY LEVEL.—(1) Not later than 180 days
after the date of the enactment of this Act, the
President shall notify the Congress of the max-
imum level of encryption strength, which may
not be lower than 64-bit, that may be exported
from the United States under license exception
pursuant to this section consistent with the
national security.
(2) The President shall, at the end of each
successive 180-day period after the notice pro-
vided to the Congress under paragraph (1), no-
tify the Congress of the maximum level of
encryption strength, which may not be lower
than that in effect under this section during
that 180-day period, that may be exported from
the United States under a license exception
120
pursuant to this section consistent with the
national security.
(d) FACTORS NOT TO BE CONSIDERED.—A li-
cense 
exception 
for 
the 
exports 
of 
an
encryption product under this section may be
allowed whether or not the product contains a
method of decrypting encrypted data.
SEC. 303. DISCRETIONARY AUTHORITY.
Notwithstanding the requirements of sec-
tion 305, the President may permit the export,
under a license exception pursuant to the con-
ditions of section 302, of encryption products
with an encryption strength exceeding the
maximum level eligible for a license exception
under section 302, if the export is consistent
with the national security.
SEC. 304. EXPEDITED REVIEW AUTHORITY.
The President shall establish procedures
for the expedited review of commodity classi-
fication requests, or export license applica-
tions, involving encryption products that are
specifically approved, by regulation, for ex-
port.
121
SEC. 305. ENCRYPTION LICENSES REQUIRED.
(a) UNITED STATES PRODUCTS EXCEEDING
CERTAIN
BIT
LENGTH.—Except as permitted
under section 303, in the case of all encryption
products with an encryption strength exceed-
ing the maximum level eligible for a license ex-
ception under section 302, which are designed
or manufactured within the United States, the
President may grant a license for export of
such encryption products, under the following
conditions:
(1) There shall not be any require-
ment, as a basis for an export license, that
a product contains a method of—
(A) 
gaining 
timely 
access 
to
plaintext; or
(B) 
gaining 
timely 
access 
to
decryption information.
(2) The export license applicant shall
submit—
(A) the product for technical re-
view;
(B) a certification, under oath,
identifying—
(i) the intended end use of the
product; and
122
(ii) the expected end user or
class of end users of the product;
(C) proof that its distribution
chain partners have contractually
agreed to abide by all laws and regu-
lations of the United States con-
cerning the export and reexport of
encryption products designed or man-
ufactured within the United States;
and
(D) the names and addresses of its
distribution chain partners.
(b) TECHNICAL REVIEW FOR LICENSE APPLI-
CANTS.—(1) The technical review described in
subsection (a)(3)(A) shall be completed within
45 days after the submission of all the infor-
mation required under paragraph (2).
(2) The information to be submitted for the
technical review shall be the same as that re-
quired to be submitted pursuant to section
302(b)(2).
(3) An encryption product may not be ex-
ported during the technical review of that
product under this section.
(c) POST-EXPORT REPORTING.—
123
(1) UNAUTHORIZED USE.—All exporters
of encryption products that are designed
or manufactured within the United States
shall submit a report to the Secretary at
any time the exporter has reason to be-
lieve any such exported product is being
diverted to a use or a user not approved
at the time of export.
(2) 
PIRATING.—All 
exporters 
of
encryption products that are designed or
manufactured within the United States
shall report any pirating of their tech-
nology or intellectual property to the Sec-
retary as soon as practicable after dis-
covery.
(3) DISTRIBUTION CHAIN PARTNERS.—All
exporters of encryption products that are
designed or manufactured within the
United States, and all distribution chain
partners of such exporters, shall submit to
the 
Secretary 
a 
report 
which 
shall
specify—
(A) the particular product sold;
(B) the name and address of—
124
(i) the ultimate end user of the
product, if known; or
(ii) the name and address of
the next purchaser in the distribu-
tion chain; and
(C) the intended use of the product
sold.
(d) EXERCISE OF OTHER AUTHORITIES.—The
Secretary, the Secretary of Defense, and the
Secretary of State may exercise the authorities
they have under other provisions of law, in-
cluding the Export Administration Act of 1979,
as continued in effect under the International
Emergency Economic Powers Act, to carry out
this title.
(e) WAIVER AUTHORITY.—
(1) IN GENERAL.—The President may by
Executive order waive any provision of
this title, or the applicability of any such
provision to a person or entity, if the
President determines that the waiver is
necessary to advance the national secu-
rity. The President shall, not later than 15
days after making such determination,
submit a report to the committees referred
125
to in paragraph (2) that includes the fac-
tual basis upon which such determination
was made. The report may be in classified
format.
(2) COMMITTEES.—The committees re-
ferred to in paragraph (1) are the Com-
mittee on International Relations, the
Committee on Armed Services, and the
Permanent Select Committee on Intel-
ligence of the House of Representatives,
and the Committee on Foreign Relations,
the Committee on Armed Services, and the
Select Committee on Intelligence of the
Senate.
(3) DECISIONS NOT SUBJECT TO JUDICIAL
REVIEW.—Any determination made by the
President under this subsection shall not
be subject to judicial review.
SEC. 306. ENCRYPTION INDUSTRY AND INFORMATION SE-
CURITY BOARD.
(a) ENCRYPTION INDUSTRY
AND INFORMA-
TION SECURITY BOARD ESTABLISHED.—There is
hereby established an Encryption Industry
and Information Security Board. The Board
126
shall undertake an advisory role for the Presi-
dent.
(b) PURPOSES.—The purposes of the Board
are—
(1) to provide a forum to foster com-
munication and coordination between in-
dustry and the Federal Government on
matters relating to the use of encryption
products;
(2) to enable the United States to ef-
fectively and continually understand the
benefits and risks to its national security,
law enforcement, and public safety inter-
ests by virtue of the proliferation of strong
encryption on the global market;
(3) 
to 
evaluate 
and 
make 
rec-
ommendations regarding the further de-
velopment and use of encryption;
(4) to advance the development of
international standards regarding inter-
operability and global use of encryption
products;
(5) to promote the export of encryption
products manufactured in the United
States;
127
(6) to recommend policies enhancing
the security of public networks;
(7) to encourage research and devel-
opment of products that will foster elec-
tronic commerce;
(8) to promote the protection of intel-
lectual property and privacy rights of in-
dividuals using public networks; and
(9) to evaluate the availability and
market share of foreign encryption prod-
ucts and their threat to United States in-
dustry.
(c) MEMBERSHIP.—(1) The Board shall be
composed of 12 members, as follows:
(A) The Secretary, or the Secretary’s
designee.
(B) The Attorney General, or his or
her designee.
(C) The Secretary of Defense, or the
Secretary’s designee.
(D) The Director of Central Intel-
ligence, or his or her designee.
(E) The Director of the Federal Bu-
reau of Investigation, or his or her des-
ignee.
128
(F) The Special Assistant to the Presi-
dent for National Security Affairs, or his
or her designee, who shall chair the
Board.
(G) Six representatives from the pri-
vate sector who have expertise in the de-
velopment, operation, marketing, law, or
public policy relating to information secu-
rity or technology. Members under this
subparagraph shall each serve for 5-year
terms.
(2) The six private sector representatives
described in paragraph (1)(G) shall be ap-
pointed as follows:
(A) Two by the Speaker of the
House of Representatives.
(B) One by the Minority Leader of
the House of Representatives.
(C) Two by the Majority Leader of
the Senate.
(D) One by the Minority Leader of
the Senate.
(e) MEETINGS.—The Board shall meet at
such times and in such places as the Secretary
may prescribe, but not less frequently than
129
every four months. The Federal Advisory Com-
mittee Act (5 U.S.C. App.) does not apply to the
Board or to meetings held by the Board under
this section.
(f) FINDINGS AND RECOMMENDATIONS.—The
chair of the Board shall convey the findings
and recommendations of the Board to the
President and to the Congress within 30 days
after each meeting of the Board. The rec-
ommendations of the Board are not binding
upon the President.
(g) LIMITATION.—The Board shall have no
authority to review any export determination
made pursuant to this title.
(h) FOREIGN AVAILABILITY.—The consider-
ation of foreign availability by the Board shall
include computer software that is distributed
over the Internet or advertised for sale, license,
or transfer, including over-the-counter retail
sales, mail order transactions, telephone order
transactions, electronic distribution, or sale
on approval and its comparability with United
States products and its use in United States
and foreign markets.
130
(i) TERMINATION.—This section shall cease
to be effective 10 years after the date of the en-
actment of this Act.
TITLE IV—LIABILITY
LIMITATIONS
SEC. 401. COMPLIANCE WITH COURT ORDER.
(a) NO LIABILITY FOR COMPLIANCE.—Subject
to subsection (b), no civil or criminal liability
under this Act, or under any other provision
of law, shall attach to any person for dis-
closing or providing—
(1) the plaintext of encrypted data, in-
cluding communications;
(2) the decryption information of such
encrypted data, including communica-
tions; or
(3) technical assistance for access to
the plaintext of, or decryption information
for, encrypted data, including commu-
nications.
(b) EXCEPTION.—Subsection (a) shall not
apply to a person who provides plaintext or
decryption information to another in violation
of the provisions of this Act.
131
SEC. 402. COMPLIANCE DEFENSE.
Compliance with the provisions of sections
2803, 2804, 2805, or 2806 of title 18, United
States Code, as added by section 103(a) of this
Act, or any regulations authorized by this Act,
shall provide a complete defense for any civil
action for damages based upon activities cov-
ered by this Act, other than an action founded
on contract.
SEC. 403. GOOD FAITH DEFENSE.
An objectively reasonable reliance on the
legal authority provided by this Act and the
amendments made by this Act, authorizing ac-
cess to the plaintext of otherwise encrypted
data, 
including 
communications, 
or 
to
decryption information that will allow the
timely decryption of data, including commu-
nications, that is otherwise encrypted, shall be
an affirmative defense to any criminal or civil
action that may be brought under the laws of
the United States or any State.
TITLE V—INTERNATIONAL
AGREEMENTS
SEC. 501. SENSE OF CONGRESS.
It is the sense of Congress that—
132
(1) the President should conduct nego-
tiations with foreign governments for the
purposes of establishing binding export
control 
requirements 
on 
strong 
non-
recoverable encryption products; and
(2) such agreements should safeguard
the privacy of the citizens of the United
States, prevent economic espionage, and
enhance the information security needs of
the United States.
SEC. 502. FAILURE TO NEGOTIATE.
The President may consider a govern-
ment’s refusal to negotiate agreements de-
scribed in section 501 when considering the
participation of the United States in any co-
operation or assistance program with that
country.
SEC. 503. REPORT TO CONGRESS.
(a) REPORT TO CONGRESS.—The President
shall report annually to the Congress on the
status of the international effort outlined by
section 501.
(b) FIRST REPORT.—The first report re-
quired under subsection (a) shall be submitted
133
in unclassified form no later than September
1, 2000.
TITLE VI—MISCELLANEOUS
PROVISIONS
SEC. 601. EFFECT ON LAW ENFORCEMENT ACTIVITIES.
(a) COLLECTION OF INFORMATION BY ATTOR-
NEY
GENERAL.—The Attorney General shall
compile, and maintain in classified form, data
on—
(1) the instances in which encryption
has interfered with, impeded, or ob-
structed the ability of the Department of
Justice to enforce the laws of the United
States; and
(2) the instances where the Depart-
ment of Justice has been successful in
overcoming any encryption encountered in
an investigation.
(b) AVAILABILITY
OF INFORMATION
TO
THE
CONGRESS.—The information compiled under
subsection (a), including an unclassified sum-
mary thereof, shall be submitted to Congress
annually beginning October 1, 2000.
134
SEC. 602. INTERPRETATION.
Nothing contained in this Act or the
amendments made by this Act shall be deemed
to—
(1) preempt or otherwise affect the ap-
plication of the Arms Export Control Act
(22 U.S.C. 2751 et seq.), the Export Admin-
istration Act of 1979 (50 U.S.C. App. 2401
et seq.), or the International Emergency
Economic Powers Act (50 U.S.C. 1701 et
seq.) or any regulations promulgated
thereunder;
(2) affect foreign intelligence activi-
ties of the United States; or
(3) negate or diminish any intellec-
tual property protections under the laws
of the United States or of any State.
SEC. 603. FBI TECHNICAL SUPPORT.
There are authorized to be appropriated
for the Technical Support Center in the Fed-
eral Bureau of Investigation, established pur-
suant to section 811(a)(1) of the Antiterrorism
and Effective Death Penalty Act of 1996 (Pub-
lic Law 104–132)—
(1) $25,000,000 for fiscal year 2000 for
building and personnel costs;
135
(2) $20,000,000 for fiscal year 2001 for
personnel and equipment costs;
(3) $15,000,000 for fiscal year 2002;
and
(4) $15,000,000 for fiscal year 2003.
SEC. 604. SEVERABILITY.
If any provision of this Act or the amend-
ments made by this Act, or the application
thereof, to any person or circumstances is held
invalid by a court of the United States, the re-
mainder of this Act or such amendments, and
the application thereof, to other persons or cir-
cumstances shall not be affected thereby.
Amend the title so as to read: ‘‘A bill to protect na-
tional security and public safety through the balanced use
of export controls on encryption products.’’.