US Updates Crypto Policy

[John Young <jya@pipeline.com>]

http://library.whitehouse.gov/PressReleases-plain.cgi?date=0&briefing=3

                              THE WHITE HOUSE

                       Office of the Press Secretary

____________________________________________________________________
For Immediate Release
September 16, 1998


                     STATEMENT BY THE PRESS SECRETARY

                 Administration Updates Encryption Policy


     The Clinton Administration today announced a series of steps to update
its encryption policy in a way that meets the full range of national
interests:  promotes electronic commerce, supports law enforcement and
national security and protects privacy.  These steps are a result of
several months of intensive dialogue between the government and U.S.
industry, the law enforcement community and privacy groups that was called
for by the Vice President and supported by members of Congress.

     As the Vice President stated in a letter to Senator Daschle, the
Administration remains committed to assuring that the nation?s law
enforcement community will be able to access, under strictly defined legal
procedures, the plain text of criminally related communications and stored
information.   The Administration intends to support FBI?s establishment of
a technical support center to help build the technical capacity of law
enforcement - Federal, State, and local - to stay abreast of advancing
communications technology.

     The Administration will also strengthen its support for electronic
commerce by permitting the export of strong encryption when used to protect

sensitive financial, health, medical, and business proprietary information
in electronic form.  The updated export policy will allow U.S. companies
new opportunities to sell encryption products to almost 70 percent of the
world?s economy, including the European Union, the Caribbean and some Asian
and South American countries.  These changes in export policy were based on
input from industry groups while being protective of national security and
law enforcement interests.

     The new export guidelines will permit exports to other industries
beyond financial institutions, and further streamline exports of key
recovery products and other recoverable encryption products.  Exports to
those end users and destination countries not addressed by today?s
announcement will continue to be reviewed on a case-by-case basis.

     Very strong encryption with any key length (with or without key
recovery) will now be permitted for export, under license exception, to
several industry sectors.   For example, U.S. companies will be able to
export very strong encryption for use between their headquarters and their
foreign subsidiaries worldwide except the seven terrorist countries (Iran,
Iraq, Libya, Syria, Sudan, North Korea and Cuba) to protect their sensitive
company proprietary information.

     On-line merchants in 45 countries will be able to use robust U.S.
encryption products to protect their on-line electronic commerce
transactions with their customers over the Internet.

     Insurance companies as well as the health and medical sectors in those
same 46 countries will be able to purchase and use robust U.S. encryption
products to secure health and insurance data among legitimate users such as
hospitals, health care professionals, patients, insurers and their
customers.

     The new guidelines also allow encryption hardware and software
products with encryption strength up to 56-bit DES or equivalent to be
exported without a license, after a one time technical review, to all users
outside the seven terrorist countries.    Currently, streamlined exports of
DES products are permitted for those companies that have filed key recovery
business plans.  However, with the new guidelines, key recovery business
plans will no longer be required.

     The Administration will continue to promote the development of key
recovery products by easing regulatory requirements.   For the more than 60
companies which have submitted plans to develop and market key recovery
encryption products, the six month progress reviews will no longer be

required.  Once the products are ready for market, they can be exported,
with any bit length -- without a license -- world-wide (except to terrorist
nations) after a one-time review.   Furthermore, exporters will no longer
need to name or submit additional information on a key recovery agent prior
to export.  These requirements will be removed from the regulations.

     Finally, industry has identified other so-called "recoverable"
products and techniques that allow for the recovery of plaintext by a
system or network administrator and that can also assist law enforcement
access, subject to strict procedures.   The Administration will permit
their export for use within most foreign commercial firms, and their
wholly-owned subsidiaries, in large markets, including Western Europe,
Japan and Australia, to protect their internal business proprietary
communications.

     The Administration welcomes a continued dialogue with U.S. industry
and intends to review its policy in one year to determine if additional
updates may be necessary to continue a balanced approach that protects the
public safety and national security, ensures privacy, enables continued
technology leadership by U.S. industry and promotes electronic commerce.


                                   # # #