|
On January 14, 2000 the U.S. government published new encryption export regulations [.pdf] [.txt] in the Federal
Register that represent a fundamental change in U.S.
policy. The new regulations, to go into affect immediately upon
publication, make it much easier for companies and individuals in the
United States to widely export strong encryption in common products
regardless of their strength or the type of technology they use. The regulations implement the policy announcement
on encryption made by the White House in September 1999.
The new rules do not decontrol encryption, and many concerns about free expression and privacy remain. The rules also set the stage for a new debate about appropriate legal protections for decryption keys and other personal data online.
Major features of the January 2000 regulations include:
- "Retail" encryption products are widely exportable to all but certain "terrorist" nations though still subject to a government review and reporting requirements.
- Non-retail products are also exportable, subject to similar requirements, to most non-government users.
- Encryption products with less than 64-bits are freely exportable.
- Some non-proprietary source code is exportable to most countries after notice to the government.
Reference Documents, CDT Analysis and Commentary
Newspaper Articles
Concerns
While CDT welcomed efforts by the Administration to grant greater export
relief, the new regulations left some privacy and free speech concerns unresolved:
- The regulations do not decontrol encryption or remove complex requirements that may prove daunting to many individuals and small businesses.
- Some types of encryption source code are still restricted.
For a detailed history of encryption policy initiatives under the Clinton Administration, please visit our Administration Initiatives page.
|
