text of info file on Cantwell bill

[Mike Godwin <mnemonic@eff.org>]

Forwarded message:
From postmaster Tue Feb  8 12:50:56 1994
Date: Tue, 8 Feb 1994 12:50:52 -0500
Message-Id: <199402081750.MAA21823@eff.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: eff-staff
From: ssteele@eff.org (Shari Steele)
Subject: text of info file on Cantwell bill
Cc: eff-board

Following are Representative Maria Cantwell's remarks to the House of
Representatives when she introduced H.R. 3627, Legislation to Amend the
Export Administration Act of 1979.  Her synopsis of the bill appears at the
end.  These remarks appeared in the Congressional Record on November 24,
1993, at Volume 139, Page 3110.

Please write to Rep. Cantwell today at cantwell@eff.org letting her know
you support her bill. In the Subject header of your message, type "I
support HR 3627." In the body of your message, express your reasons for
supporting the bill. EFF will deliver printouts of all letters to Rep.
Cantwell. With a strong showing of support from the Net community, Rep.
Cantwell can tell her colleagues on Capitol Hill that encryption is not
only an industry concern, but also a grassroots issue. *Again: remember to
put "I support HR 3627" in your Subject header.*

The text of the Cantwell bill can be found with the any of the following
URLs (Universal Resource Locaters):

ftp://ftp.eff.org/pub/Policy/Legislation/cantwell.bill
http://www.eff.org/ftp/EFF/Policy/Legislation/cantwell.bill
gopher://gopher.eff.org/00/EFF/legislation/cantwell.bill


**********************************************************************

        Mr. Speaker, I am today introducing legislation to amend the Export
Administration Act of 1979 to liberalize export controls on software with
encryption capabilities.

        A vital American industry is directly threatened by unilateral U.S.
Government export controls which prevent our companies from meeting
worldwide user demand for software that includes encryption capabilities to
protect computer data against unauthorized disclosure, theft, or
alteration.

        The legislation I am introducing today is needed to ensure that
American companies do not lose critical international markets to foreign
competitors that operate without significant export restrictions. Without
this legislation, American software companies, some of America's star
economic performers, have estimated they stand to lose between $6 and $9
billion in revenue each year. American hardware companies are already
losing hundreds of millions of dollars in lost computer system sales
because increasingly sales are dependent on the ability of a U.S. firm to
offer encryption as a feature of an integrated customer solution involving
hardware, software, and services.

        The United States' export control system is broken. It was designed
as a tool of the cold-war, to help fight against enemies that no longer
exist. The myriad of Federal agencies responsible for controlling the flow
of exports from our country must have a new charter, recognizing today's
realities.

        Next year, the House Foreign Affairs Subcommittee of Economic
Policy, Trade and the Environment, of which I am a member, will be marking
up legislation to overhaul the Export Administration Act. It is my hope
that the legislation I introduce today will be included in the final Export
Administration Act rewrite.

        This legislation takes some important steps to resolve a serious
problem facing some of our most dynamic industries. It would give the
Secretary of Commerce exclusive authority over dual use information
security programs and products, eliminates the requirement for export
licenses for generally available software with encryption capabilities, and
requires the Secretary to grant such validated licenses for exports of
other software with encryption capabilities to any country to which we
already approve exports for foreign financial institutions.

        The importance of this legislation cannot be overstated. America's
computer software and hardware companies, including such well-known
companies as Apple, DEC, Hewlett-Packard, IBM, Lotus, Microsoft, Novell,
and WordPerfect, have been among the country's most internationally
competitive firms earning more than one-half of their revenues from
exports.

        The success of American software and hardware companies overseas is
particularly dramatic and the importance of foreign markets is growing.
Currently, American software companies hold a 75 percent worldwide market
share and many derive over 50 percent of their revenues from foreign sales.
American computer hardware manufacturers earn more than 60 percent of their
revenues from exports.

        As my colleagues are well-aware, we are participants in a new
information age that is quickly transforming local and national
marketplaces and creating new international marketplaces where none
previously existed. President Clinton and Vice President Gore have both
spent considerable time explaining their vision of the National Information
Infrastructure that is essential to our continued economic growth.

        Part of that infrastructure is already in place. International
business transactions that just a few years ago took days or weeks or
months to complete can now be accomplished in minutes.

        Driving this marketplace transformation is the personal computer.
And, at the heart of every personal computer is computer software. Even the
most computer illiterate of us recognize that during the past decade,
computer prices have dropped dramatically while computer capabilities have
increased exponentially. That combination has made it possible to exchange
information and conduct business at a scale that was considered science
fiction only a few years ago.

        Indeed, we all now rely on computer networks to conduct business
and exchange information. Whether it be the electronic mail or "e-mail"
system that we all now use in our congressional offices or the automated
teller system relied on to conduct our personal financial affairs, we rely
on computer networks of information.

        In the future, individuals will use information technologies to
conduct virtually any of the routine transactions that they do today in
person, over the telephone, and through paper files. From personal
computers at home, in schools, and in public libraries, they will access
books, magazine articles, videos, and multimedia resources on any topic
they want. People will use computer networks to locate and access
information about virtually any subject imaginable, such as background on
the candidates in local political races, information on job opportunities
in distant cities, the weather in the city or country they will be visiting
on their vacation, and the highlights of specific sports events.

        Consumers will use their computers and smart televisions to shop
and pay for everything from clothing and household goods to airline
tickets, insurance, and all types of on-line services. Electronic records
of the items they purchase and their credit histories will be easy to
compile and maintain.

        Individuals will access home health programs from their personal
computers for instant advice on medical questions, including mental health
problems, information about the symptoms of AIDS, and a variety of personal
concerns that they would not want other family members, or their neighbors
and employers to know about. They will renew their prescriptions and obtain
copies of their lab results electronically.

        The U.S. economy is becoming increasingly reliant on this
information network. While we may not often think about these networks,
they now affect every facet of our professional, business, and personal
lives. They are present when we make an airline reservation; when we use a
credit card to make a purchase; or when we visit a doctor who relies on a
computer network to store our medical information or to assist in making a
diagnosis. These networks contain information concerning every facet of our
lives.

        For businesses, the reliance on information security is even
greater. While businesses rely on the same commercial use networks that
individual consumers use, in addition, businesses are now transmitting
information across national and international borders with the same ease
that the information was once transmitted between floors of the same office
building.

        While all of this information exchange brings with it increased
efficiencies and lower operating costs, it has also brought with it the
need to protect the information from improper use and tampering.

Information security is quickly becoming a top priority for businesses that
rely on computer networks to conduct business. According to a recent survey
of Fortune 500 companies conducted for the Business Software Alliance, 90
percent of the participants said that information security was important to
their operations. Indeed, almost half of the Fortune 500 companies surveyed
recently stated that data encryption was important to protect their
information. One third of those companies said they look for encryption
capabilities when buying software.

        The challenge for information security can be met by America's
computer companies. American companies are deeply involved in efforts to
ensure that the information transmitted on computer networks is secure.
Numerous companies have developed and are developing software products with
encryption capabilities that can ensure that transmitted information is
received only by the intended user and that it is received in an unaltered
form. Those encryption capabilities are based on mathematical formulas or
logarithms of such a size that makes it almost impossible to corrupt data
sources or intercept information being transmitted.

        I wish I could stand here today and tell my colleagues that U.S.
export control laws were working and encryption technology was only
available to American software companies.

        However, this is not the case. Sophisticated encryption technology
has been available as a published public standard for over a decade and
many private sources, both domestic and foreign, have developed encryption
technology that they are marketing to customers today. It is an industry
where commercial competition is fierce and success will go to the swift.

        Software is being developed and manufactured with encryption
capabilities for the simple reason that software customers are demanding
it. Computer users recognize the vulnerability of our information systems
to corruption and improper use and are insisting on protection. That
protection will be purchased or obtained from American companies or from
foreign software companies. The choice is not whether the protection will
be obtained, but from which company.

        Incredible as it may seem to most of my colleagues, the Executive
Branch has seen fit to regulate exports of American computer software with
encryption capabilities -- that is, the same software that is available
across the counter at your local Egghead or Computerland software store --
munitions and thereby substantially prohibit its export to foreign
customers. This policy, which has all the practical effect of shutting the
barn door after the horses have left in preventing access to software with
encryption capabilities, does have the actual detrimental effect of
seriously endangering sales of both generally available American software
and American computer systems.

        This is because increasingly sales are dependent on the ability of
a U.S. firm to offer encryption as a feature of an integrated customer
solution involving hardware, software and services.

        Indeed, software can be exported abroad by the simplest measures
and our intelligence gathering agencies have no hope of ever preventing it.
Unlike most munitions that are on the prohibited export list, generally
available software with encryption capabilities can be purchased without
any record by anyone from thousands of commercial retail outlets, or
ordered from hundreds of commercial mail order houses, or obtained for free
from computer bulletin boards or networks. Once obtained, it can be
exported on a single indistinguishable floppy disk in the coat pocket of
any traveler or in any business envelope mailed abroad.

        Moreover, both generally available and customized software can be
exported without anyone ever actually leaving the United States. All that
is necessary are two computers with modems, one located in the United
States and one located abroad. A simple international phone call and a few
minutes is all that it takes to export any software program.

        Once a software program with encryption capabilities is in a
foreign country, any computer can act as a duplicating machine, producing
as many perfect copies of the software as needed. The end result is that
the software is widely available to foreign users.

        All this was demonstrated at a hearing held on October 12 by
Chairman Gejdenson's Economic Policy Trade and Environment Subcommittee of
the Foreign Affairs Committee.

        Furthermore, while current Executive Branch policy regulates the
export of American manufactured software with encryption capabilities, it
is obviously powerless to prevent the development and manufacture of such
software by foreign competitors. Not surprisingly, that is exactly what is
happening. We heard testimony at the subcommittee's hearing that over 200
foreign hardware, software and combination products for text, file, and
data encryption are available from 20 foreign countries. As a result,
foreign customers, that have, in the past, spent their software dollars on
American-made software, are now being forced, by American policy, to buy
foreign software -- and in some cases, entire foreign computer systems. The
real impact of these policies is that customers and revenue are being lost
with little hope of regaining them, once lost. All precipitated by a
well-intentioned, but completely misguided and inappropriate policy.

        There were efforts, in the last Congress to correct this policy. In
response, the Bush Administration did, in fact, marginally improve its
export licensing process with regard to mass market software with limited
encryption capabilities. However, those changes are simply insufficient to
eliminate the damage being done to American software companies.

        My legislation is strongly supported by the Business Software
Alliance. The Business Software Alliance represents the leading American
software businesses, including Aldus, Apple Computer, Autodesk, Borland
International, Computer Associates, GO Corp., Lotus Development, Microsoft,
Novell, and WordPerfect. In addition, Adobe Systems, Central Point, Santa
Cruz Operation, and Symantec are members of BSA's European operation.
Together, BSA members represent 70 percent of PC software sales.

        The legislation is also supported by the Industry Coalition on
Technology Transfer, an umbrella group representing 10 industry groups
including the Aerospace Industries Association, American Electronic
Association, Electronics Industry Association, and Computer and Business
Equipment Manufacturing Association.

        All these companies are at the forefront of the software
revolution. Their software, developed for commercial markets, is available
throughout the world and is at the core of the information revolution. They
represent the finest of America's future in the international marketplace,
and the industry has repeatedly been recognized as crucial to America's
technological leadership in the 21st century.

        My legislation is straightforward. It would allow American
companies to sell the commercial software they develop in the United States
to their overseas customers including our European allies -- something that
is very difficult if not impossible under present policies.

        I urge my colleagues to support this legislation and ask unanimous
consent that the text of the bill and a section-by-section explanation be
printed at this point.

************************************************************************

Section-By-Section Analysis of Report Control Liberalization for
Information Security Programs and Products

Section 1

        Section 1 amends the Export Administration Act by adding a new
subsection that specifically addresses exports of computer hardware,
software and technology for information security including encryption. The
new subsection has three basic provisions.

        First, it gives the Secretary of Commerce exclusive authority over
the export of such programs and products except those which are
specifically designed for military use, including command, control and
intelligence applications or for deciphering encrypted information.

        Second, the government is generally prohibited from requiring a
validated export license for the export of generally available software
(e.g., mass market commercial or public domain software) or computer
hardware simply because it incorporates such software.

        Importantly, however, the Secretary will be able to continue
controls on countries of terrorists concern (like Libya, Syria, and Iran)
or other embargoed countries (like Cuba and North Korea) pursuant to the
Trading With The Enemy Act or the International Emergency Economic Powers
Act (except for instances where IEEPA is employed to extend EAA-based
controls when the EAA is not in force).

        Third, the Secretary is required to grant validated licenses for
exports of software to commercial users in any country to which exports of
such software has been approved for use by foreign financial institutions.
Importantly, the Secretary is not required to grant such export approvals
if there is substantial evidence that the software will be diverted or
modified for military or terrorists' end-use or re-exported without
requisite U.S. authorization.

Section 2

        Section 2 provides definitions necessary for the proper
implementation of the substantive provisions. For example, generally
available software is offered for sale or licensed to the public without
restriction and available through standard commercial channels of
distribution, is sold as is without further customization, and is designed
so as to be installed by the purchaser without additional assistance from
the publisher. Computer hardware and computing devices are also defined.