Although the December 1998 Interim Rule raises the previous 40-bit ceiling to 56-bits, this is not strong enough to protect privacy and security online. Several independent sources have demonstrated that 56 bit-length encryption systems are vulnerable to attack. As early as 1996, an ad-hoc group of cryptographers and computer scientists published a study saying that 56-bit DES was "cheaper and easier to break than many believe." [ 1 ] At the January 1999 RSA Data Security Conference, a coalition of encryption enthusiasts were able to break a 56-bit code in 22 hours and 15 minutes. [ 2 ]

The Department of Commerce’s own National Institute of Standards and Technology (NIST) has also recognized that 56-bit encryption systems are weak. In a draft publication released in January, NIST revised the encryption standard for government use to Triple DES, citing the vulnerability of 56-bit DES to attack. "With regard to use of single DES, exhaustion of the DES (i.e. breaking a DES encryption ciphertext by trying all possible keys) has become increasingly more feasible with technology advances. Following a recent hardware based DES key exhaustion attack, NIST can no longer support the use of single DES for many applications." [ 3 ] If the government does not trust 56-bit level security, everyday Americans should not be expected to rely on this weaker level of security to protect their electronic data.

Furthermore, 128-bit encryption systems are rapidly becoming the global standard for adequate online security. The US government should recognize the changing global marketplace and allow American businesses and consumers to keep pace with the technology.

B. The current export regulations continue to promote key recovery and plaintext access.

The current regulations continue to create a strong incentive for widespread adoption of key recovery by maintaining license exemptions for encryption items with key recovery features. [ 4 ] License Exception KMI forces encryption users to choose between inadequate bit-lengths and risky key recovery features, both of which jeopardize privacy and security online.

Several recent studies have confirmed that key recovery imposes both serious security risks and economic costs on encryption users. A 1998 report by a group of encryption experts confirms that "[t]he deployment of key-recovery-based encryption infrastructures to meet law enforcement’s stated specifications will result in substantial sacrifices in security and greatly increased costs to the end-user." [ 5 ] The Business Software Alliance recently published a study citing the cost of key escrow systems at $7.7 billion per year and $38.5 billion over a five year period. [ 6 ]

In addition these security risks posed, a key recovery infrastructure leaves encryption end-users vulnerable to law enforcement intrusions because current law does not provide legal access standards. The Administration has made an attempt to recognize changes in the encryption technology market by expanding the criteria necessary for classification under key escrow or key recoverable products to include plaintext access through a network administrator. [ 7 ] However, the revised definition continues to mandate plaintext access without the knowledge or assistance of the end-user, retaining the fundamental features of key recovery that have proven most problematic.

C. Stifling the growth of encryption technology is actually contrary to the goal of protecting national security.

The Administration has a legitimate goal in promoting the needs of law enforcement officials. However, preventing the use and development of strong encryption does not effectively achieve this goal. According to a study on cyberterrorism conducted by the Center for Strategic and International Studies, "Continued reliance on limited availability of strong encryption without the development of alternative sources and means seriously harms law enforcement and national security." [ 8 ]

Rather than preventing crime, export controls keep strong security out of the hands of law-abiding American citizens, leaving them vulnerable to hackers and terrorist attacks. Encryption protects Internet users from criminals who would like to exploit their sensitive personal and financial information, helping law enforcement to protect US citizens. Without encryption, our nation’s critical infrastructure is at serious risk and vulnerable to attack. As the seminal report by the National Research Council argues, "If cryptography can help protect nationally critical information systems and networks against unauthorized penetration (which it can), it also supports the national security of the United States." [ 9 ]

D. While American encryption users are forced by export controls to adopt weak security systems, the availability of strong encryption abroad continues to grow.

Despite the intended goals, the Administration’s export controls on encryption technologies do not prevent hackers and criminals from gaining access to strong encryption. Encryption software can be purchased from many other countries across the globe, and easily downloaded over the Internet. [ 10 ] According to a recent study by the Economic Strategy Institute, 1,601 encryption products were available as of September 1997 from 941 firms in thirty countries. Of this total, 653 are made outside the United States by 472 foreign firms. [ 11 ]

Several US companies have established foreign subsidiaries to avoid US export controls. For example, RSA Data Securities, a leading encryption software supplier, recently established a branch plant in Australia [ 12 ] to enable the production of technology that can compete on the global market. Zero Knowledge Systems, a company that creates anonymizer software programs, distributes their products through their headquarters in Canada [ 13 ] to avoid US encryption policies on worldwide shipping.

E.Contrary to U.S. government predictions, foreign governments have liberalized their export control.

Despite economic and diplomatic pressure from the United States to adopt export restrictions, other countries are affirming the rights of users to choose encryption systems with strong security features, as well as calling for international standards that keep pace with changing technology. The OECD Cryptography Policy Guidelines and the Ministerial Declaration of the European Union, both released in 1997, argue for the liberalization of controls on cryptography and the development of market-based, user-driven cryptography products and services. In the past year, Canada, Ireland [ 14 ] and Finland [ 15 ] have announced national encryption policies based on the OECD Guidelines, favoring the free use of encryption. Even France, a country with traditionally conservative policies on encryption export, recently liberalized their policies to allow export of 128-bit systems. [ 16 ]

While the United States is a global leader in technology development, our export policies are outdated in comparison to other governments. According to a recent international cryptography survey by the Global Internet Liberty Campaign, "in the vast majority of countries, cryptography may be freely used, manufactured, and sold without restriction….The policies of the United States are the most surprising, given the fact that virtually all of the other democratic, industrial nations have few if any controls on the use of cryptography. The position may be explained, in part, by the dominant role that state security agencies in the U.S. hold in the development of encryption policy." [ 17 ] The United States is sacrificing its position as a global leader by failing to participate in the international consensus for liberalization of encryption export controls. In negotiating the Wassenaar Arrangement, the US government agreed with 32 other nations to set a 64-bit length ceiling on encryption exports, but then continues to domestically enforce a key length limitation that is much weaker than this global standard.

F. A piecemeal approach to export liberalization neglects the needs of individual encryption users to communicate securely online.

The December 1998 Interim Rule acknowledges the importance of encryption in promoting the growth of electronic commerce by granting export relief to industry groups and US subsidiaries abroad under License Exception ENC. However, the current regulations continue to ignore the needs of individual Internet users, for mass market, strong encryption products. The current regulations specifically prohibit customer-to-customer communications, an essential part of the global Internet community. Individual consumers are the backbone of electronic commerce. The Internet can not thrive without individuals who trust the privacy and security of their networked communications.

Furthermore, those engaged in electronic commerce should not have an exclusive right to communicate securely online. Everyday Americans who conduct personal communications — from home banking to e-mail — over the Internet should have the right to protect their information online. These basic civil liberties are true for domestic encrypted communications, as well as on an international level. Human rights groups are increasingly using encrypted communications to protect their work and the lives of investigators, witnesses, and victims overseas. [ 18 ] These groups and individuals have a legitimate need to preserve their privacy and security on the Internet.