23 April 1997
Thanks to Greg Broiles
IR
| UNITED STATES DEPARTMENT OF COMMERCE
| The Under Secretary for Export Administration
[Stamp] | Washington. D.C. 20230
RECEIVED |
17 JAN 2 PM 1997 | DEC 24 1996 FT
T1176
The Honorable Newt Gingrich
Speaker of the House of Representatives
Washington, D.C. 20515
Dear Mr. Speaker:
I hereby notify Congress that the Department of Commerce is
imposing U.S. foreign policy export controls on commercial
encryption items, including products with key recovery features.
I am taking this action, with the concurrence of the Secretary of
State, in the belief that these controls are necessary to further
significantly the foreign policy of the United States.
Pursuant to Section 6 of the Export Administration Act of 1979,
as amended (the Act), the Commerce Department must submit a
report to Congress when it imposes, expands or extends export
controls. The Department of Commerce is acting under the
authority conferred by Executive Order No. 12924 of August 19,
1994 (extended by notices of August 15, 1995 and August 14,
1996), whereby the President, by reason of the lapse of Act,
invoked his authority, including that under the International
Emergency Economic Powers Act, to continue the system of export
controls that were in effect, to the extent permitted by law.
Under a policy of conforming actions under the Executive Order to
those under the Act, insofar as appropriate, the Department is
following the provisions of Section 6 of the Act in taking this
action.
On November 15, 1996, the President issued a Memorandum and
Executive Order 13026 (November 15, 1996, 61 FR 58767) concerning
the transfer to the Commerce Control List of all encryption items
controlled on the U.S. Munitions List, except those specifically
designed, developed, configured, adapted, or modified for
military applications. The Memorandum also sets forth certain
additional provisions with respect to controls on such encryption
items to be imposed by the Department of Commerce. The Executive
Order also provides for appropriate controls on the export and.
foreign dissemination of encryption items controlled on the U.S.
Munitions List that are placed on the Commerce Control List.
The Secretaries of Commerce and State as directed by the
President have proceeded to implement the transfer of commercial
encryption items, including products with key recovery
technologies, from the U.S. Munitions List to the Commerce
Control List. Consistent with the provisions of Section 6 of the
Act, the Secretary of Commerce is imposing foreign policy export
controls on these products to supplement the national security
controls to be applied to these items. These controls are
imposed to ensure that encryption products are not exported to
destinations or end-uses of concern.
[1]
The purpose of the control is to protect U.S. national security
and foreign policy interests. The United States is maintaining
such controls because of potential military and terrorist
applications for the products in a manner contrary to U.S
security or foreign policy interests. Moreover, such products,
when used by international criminal organizations, can threaten
the safety of U.S. citizens here and abroad, as well as the
safety of the citizens of other countries.
The United States will require an export license for all
destinations, except Canada, for exports and reexports of certain
encryption items, including products containing key recovery
features. The United States will review license applications for
the above items, on a case-by-case basis, to determine whether
the export or reexport is consistent with U.S. national security
and foreign policy.
These controls are part of the Administration initiative to
facilitate a worldwide key management infrastructure with the
use of key recovery and key escrow encryption items to promote
electronic commerce and secure communications while protecting
national security and public safety. To provide for a transition
period for the development of this key management infrastructure,
this rule permits the export and reexport of 56-bit key length
DES or equivalent strength encryption items under the authority
of a License Exception, if an exporter makes satisfactory
commitments to build or market recoverable encryption items and
to help build the supporting international infrastructure. This
policy will apply to hardware and software.
Pursuant to authority delegated by the Secretary of Commerce,
I am now imposing foreign policy export controls on commercial
encryption items, including products with key recovery features.
In addition, as required by section 6 of the Act, I determine
that foreign policy controls for replacement parts and for parts
in goods subject to control should remain in effect. The
attached report describes the imposition of controls, including
the potential economic impact on U.S. industry and the prospects
for enforcement of the controls. This action is taken in
consultation with the Secretary of State.
We have consulted with the appropriate Congressional Committees
and have provided them copies of the report. The Department of
Commerce will publish regulations implementing this action in the
Federal Register.
Sincerely,
[Signature]
William A. Reinsch
Enclosure
[2]
REPORT TO THE CONGRESS
IMPOSITION OF FOREIGN POLICY EXPORT CONTROLS
on
COMMERCIAL ENCRYPTION ITEMS,
INCLUDING PRODUCTS WITH KEY RECOVERY FEATURES
I. INTRODUCTION
This report notifies the Congress of the imposition of foreign
policy export controls as provided in Section 6 of the Export
Administration Act of 1979, as amended (the Act). Pursuant to
the provisions of Section 6 of the Act, whenever the U.S.
Government imposes, expands or extends export controls, the
Commerce Department must submit a report to Congress.
In light of the expiration of the Act, the President, invoking
his authority, including that under the International Emergency
Economic Powers Act, issued Executive Order 12924 of August 19
1994, and continued, to the extent permitted by law, the system
of export controls in effect under the Act. Under a policy of
conforming actions under Executive Order 12924 to those under the
Act insofar as appropriate, the Commerce Department is following
the provisions of Section 6 of the Act in taking this action.
The Secretaries of Commerce and State as directed by the
President, have proceeded to implement the transfer of
commercial encryption items, including products with key recovery
features, from the U.S. Munitions List (USML) to the Commerce
Control List (CCL). The Secretary of Commerce is imposing
foreign policy controls on these products to supplement the
national security controls to be applied to these items.
A. Export Control Program Description
In accordance with the delegated authority granted in Section 6
of the Act, the Secretary of Commerce is imposing foreign policy
export controls on commercial encryption items, including
encryption products with key recovery features. These controls
are imposed to ensure that exports of these items do not
adversely affect important U.S. interests.
On November 15, 1996, the President issued a Memorandum and
Executive Order 13026 (15 November 1996, 61 FR 58767) concerning
the transfer to the Commerce Control List of all encryption items
controlled on the U.S. Munitions List, except those specifically
designed, developed, configured, adapted, or modified for
military applications. The Memorandum also sets forth certain
additional provisions with respect to controls on such encryption
items to be imposed by the Department of Commerce. The Executive
Order also provides for appropriate controls on the export and
foreign dissemination of encryption items controlled on the U S.
Munitions List that are placed on the Commerce Control List.
[1]
Non-recoverable encryption items up to 56-bit key length DES or
equivalent strength will be permitted for export and reexport
after a one-time review, if an exporter makes satisfactory
commitments to develop, produce, and/or market products that
support recoverable encryption items and to support an
international key management infrastructure. This policy will
apply to hardware and software.
The relaxation of export and reexport controls on non-recoverable
encryption items up to 56-bit key length DES or equivalent
strength will last until December 31, 1998. The temporary
relaxation of controls is one part of a broader encryption policy
initiative designed to promote electronic information security
and public safety.
The interim rule that will be issued by the Bureau of Export
Administration amends the Export Administration Regulations (EAR)
by imposing national security and foreign policy controls on
certain encryption items. These items do not include those that
are specifically designed, developed, configured, adapted or
modified for military applications (including command, control
and intelligence applications). Such items remain on the U.S.
Munitions List, and continue to be controlled by the Department
of State, Office of Defense Trade Controls. The controls imposed
by the rule apply to encryption software, transferred from the
U.S. Munitions List to the Commerce Control List pursuant to, the
President's Memorandum of November 15, 1996 (61 FR 58767).
The interim rule also amends the Export Administration
Regulations to require a license for exports and reexports to all
destinations, except Canada, of certain controlled encryption
items.
The interim rule implements the President's directive to the
Secretary of Commerce to take actions to control the export of
assistance to foreign persons in the same manner and to the same
extent as the export of such assistance is controlled under the
Arms Export Control Act.
The rule involves no new curtailment of exports, because the
transfer or removal of items from the United States Munitions
List to the CCL maintains a continuity of controls. Therefore,
the provisions of the Export Administration Act regarding the
impact of new controls do not apply, and contract sanctity also
does not apply to this imposition of controls.
B. Licensing Requirements and Policy
1. In general, the United States will require a validated
license for all destinations, except Canada, for exports and
reexports of commercial encryption items. However, certain
exceptions to the licensing requirements may apply.
2
2. Export license applications for commercial encryption items
will be reviewed on a case-by-case basis, to determine whether
the export or reexport is consistent with U.S. national security
and foreign policy interests.
3. Exporters of non-recoverable 56-bit DES or equivalent
encryption products will be required to make commitments
develop and market products that support key escrow or recovery.
The Administration believes that the worldwide use of recoverable
encryption products will promote electronic commerce and the
security of communications, while protecting national security
and public safety.
II. PURPOSE OF CONTROLS AND REQUIRED DETERMINATIONS
A. The Purpose of the Control
The purpose of the control is to protect U.S. national security
and foreign policy interests, including the safety of U.S.
citizens. Encryption can be used to conceal other foreign
communications that have foreign policy and national security
significance for the United States. For example, encryption can
be used to conceal communications of terrorists, drug smugglers
or others intent on taking hostile action against U.S.
facilities, personnel, or security interests.
In issuing the November 15 Memorandum the President stated:
Encryption products, when used outside the United States,
can jeopardize our foreign policy and national security
interests. Moreover, such products, when used by
international criminal organizations, can threaten the
safety of U.S. citizens here and abroad, as well as the
safety of the citizens of other countries. The exportation
of encryption products must be controlled to further U.S.
foreign policy objectives, and promote our national
security, including the protection of the safety of U.S.
citizens abroad.
This initiative will make it easier for Americans to use strong
encryption items to protect their privacy, intellectual property
and other valuable information. It will support the growth
electronic commerce, increase the security of the global
information infrastructure, and sustain the economic
competitiveness of U.S. encryption product manufacturers during
the transition to a key management infrastructure.
To ensure that a U.S. key management infrastructure is one that
our major trading partners can accept, the United States is
working bilaterally with countries that are already developing
encryption products and encryption technology policy, and with
the Organization for Economic Cooperation and Development, to
create an international framework to promote the use of
3
encryption through key management. A global voluntary key
management infrastructure provides the best means of using strong
encryption in a way that balances U.S. national security, foreign
policy, and law enforcement interests with the need for strong
encryption in international commerce. The controls demonstrate a
leadership role of the United States in developing a global key
management infrastructure.
B. Determinations of the Secretary of Commerce Regarding the
Criteria Set Forth in Section 6(b) of the Act:
1. Probability of Achieving the Intended Foreign Policy Purpose
The Secretary of Commerce has determined that the control is
likely to achieve the intended purpose of denying the export of
commercial encryption items, including products with key recovery
features, if its export would be contrary to U.S. national
or foreign policy interests.
2. Compatibility with Foreign Policy Objectives.
Th Secretary has also determined that the controls are
compatible with the foreign policy objectives of the United
States. The control is consistent with U.S. foreign policy goals
to promote peace and stability and to prevent U.S. exports that
might contribute to destabilizing military capabilities and
assisting international terrorist or criminal activities against
the United States. The controls will also contribute to public
safety by promoting the protection of U.S. citizens overseas.
3. Reaction of Other Countries.
The Secretary, in consultation with the Secretary of State, has
determined that the reaction of other countries to this control
is not likely to render the control ineffective in achieving its
intended foreign policy purpose or to be counterproductive to
U.S. foreign policy interests. Other allied countries recognize
the need to control exports of encryption products for national
security and law enforcement reasons. These countries also
recognize the desirability of restricting goods that could
compromise shared security and foreign policy interests.
4. Economic Impact on U.S. Industry.
The Secretary has determined that the transfer of commercial
encryption items, including products with key recovery features,
from the USML to the CCL will benefit industry positively and
make U.S. manufacturers more competitive in the world market.
Removal of these products from the USML may actually improve
their marketability to foreign, civil end-users who prefer not to
trade in items classified as a munition by the United States
Government. Moreover, since recoverable encryption products pose
fewer security and law enforcement risks, their export will be
4
treated more liberally than exports of encryption products with
no recovery features. This will allow U.S. manufacturers and
exporters to capture a larger share of the growing world demand
for recoverable encryption.
5. Enforcement of Control.
The Secretary has determined that the United States has the
ability to enforce these controls effectively. The Department
expects to meet the enforcement challenges of this control. Some
encryption software will be included in mass market software sold
to retail customers, many of whom may be unfamiliar with export
controls. It may be stored on media which are small and easily
concealed and it may be transmitted electronically. The media
containing encryption items that are eligible exports under a
license exception may be identical in appearance to media
containing encryption items that require a license for export.
All of these features increase the difficulty of enforcing the
control.
Nevertheless, a number of factors are expected to offset these
difficulties. A number of manufacturers and exporters are aware
of the license requirements because they have been dealing with
State Department license requirements for the same items.
Through outreach efforts the Commerce Department will attempt to
increase the awareness of these controls by potential exporters.
Enforcing these controls is a priority for the Commerce
Department. The agency intends to train, in 1997, its
enforcement personnel in these controls and in investigative
techniques for detecting and preventing violations. Finally,
since these items are also under multilateral control, we can
expect cooperation from foreign enforcement agencies in
preventing violations and punishing violators.
C. Consultation with Industry.
The U.S. Government consulted with various elements within
industry on the proposed change in controls and on the
desirability of development of recoverable encryption products
for both Government and industry use. In preparation for the
USML rationalization exercise, the State Department also
published a number of Federal Register notices dealing with the
and other changes to the USML. Industry comments overwhelmingly
favored inclusion of commercial encryption items, including
products with key recovery features, on the CCL versus the USML.
D. Consultation with Other Countries.
The United States has taken the lead in international efforts to
control sensitive items, urging other supplier nations to adopt
and apply export controls comparable to those of the United
States. The major industrial partners of the United States
maintain export controls on encryption products. Pursuant to
5
agreement to establish a new regime for the control of
conventional arms and sensitive dual-use technologies, the 33
participants in the Wassenaar Arrangement have agreed to control
these items on a global basis and to coordinate export policies
for such items. The President has also named a Special Envoy to
explain U.S. cryptography policy to key allies.
In addition, the United States and other members of the
Organization for Economic Cooperation and Development are
discussing international cryptography policy guidelines to
include the use of encryption products with key recovery
features.
E. Alternative Means
Alternatives to export controls at this time would not be the
most effective means of achieving the intended national security
and foreign policy objectives. The United States has undertaken
a wide range of diplomatic means, both bilateral and
multilateral, to encourage the proper restrictions over these
items. However, these efforts can only supplement, not replace
the effectiveness of actual export controls.
F. Foreign Availability.
The Department of Commerce and the National Security Agency (NSA)
prepared a joint study of the international market for computer
software with encryption. The study found that the U.S. software
industry still dominates world markets for encryption. In those
markets not offering strong encryption locally, U.S. software
encryption remains the dominant choice. However, the existence
of foreign products with labels indicating DES (Data Encryption
Standard) or other strong algorithms, even if they are less
secure than claimed, can nonetheless have a negative effect on
U.S competitiveness. The study also notes that the existence of
strong U.S. export controls on encryption may have discouraged
U.S. software producers from enhancing the security features of
general purpose software products to meet the anticipated growth
in demand by foreign markets.
The study found that all countries that are major producers cf
commercial encryption products control exports of these products
to some extent. A few countries control imports and domestic
of encryption, as well.
In regard to foreign availability as it relates to encryption
items transferred from the USML to the CCL, the President's
Executive Order of November 15, 1996 stated the following:
I have determined that the export of encryption products
[transferred to the Commerce Control List] could harm
national security and foreign policy interests even where
comparable products are or appear to be available from
6
sources outside the United States, and that facts and
questions concerning the foreign availability of such
encryption products cannot be made subject to public
disclosure or judicial review without revealing or
implicating classified information that could harm United
States national security and foreign policy interests.
Accordingly, sections 4(c) and 6(h)(2)-(4) of the Export
Administration Act of 1979, 50 U.S.C. App. 2403(c) and
2405(h)(2)-(4), as amended and as continued in effect by
Executive Order 12924 of August 19, 1994, and by notices
August 15, 1995, and August 14, 1996, all other analogous
provisions of the EAA relating to foreign availability,
the regulations in the EAR relating to such EAA provisions
shall not be applicable with respect to export controls on
such encryption products. Notwithstanding this, the
Secretary of Commerce may, in his discretion, consider the
foreign availability of comparable encryption products in
determining whether to issue a license in a particular case
or to remove controls on particular products, but is not
required to issue licenses in particular cases or to remove
controls on particular products based on such consideration.
U.S. Department of Commerce
Bureau of Export Administration
December 1996
7
[Congressional Record: January 20, 1997 (House)]
[Page H160-H168]
From the Congressional Record Online via GPO Access [wais.access.gpo.gov]
[DOCID:cr20ja97-18]
105th CONGRESS 1st SESSION
HOUSE OF REPRESENTATIVES
EXECUTIVE COMMUNICATIONS, ETC.
*****
Under clause 2 of Rule XXIV, executive communications were
taken from the Speaker's table as follows:
COMMUNICATION 1020 from the Department of Commerce, Under
Secretary for Export Administration transmitting the Department's
report entitled "Imposition of Foreign Policy Export Controls on
Commercial Encryption Items, Including Products with Key Recovery
Features", pursuant to Section 6 of the Export Administration Act
of 1979, as amended.
Referred to the Committee on International Relations. January 20,
1997.