[1 October 1996]
Vice President Gore announced today that the United States would permit the export of 56-bit key lenth encryption products under general license after a one-time review, contingent on industry commitments to build and market future products that support key recovery. The policy presumes "that a trusted party (in some cases internal to the user's organization) would recover the user's confidentiality key for the user or for law enforcement officials acting under proper authority. Access to keys would be provided in accordance with destination country policies and bilateral understandings. No key length limits or algorithm restrictions will apply to exported key recovery products." Domestic use of key recovery will be voluntary, and Americans remain free to use any encryption system domestically.
In addition, encryption products would no longer be treated as munitions; "after consultation with Congress, jurisdiction for commercial encryption controls will be transferred from the State Department to the Commerce Department. The Administration also will seek legislation to facilitate commercial key recovery, including providing penalties for improper release of keys, and protecting key recovery agents against liability when they properly release a key."
This policy will last "up to two years," after which time the export of 56-bit products not supporting key recovery would no longer be permitted. Gore asserted that the new policy is "broadly consistent with the recent recommendations of the National Research Council" (see Cipher EI#15).
The announcement followed unattributed reports in today's Washington Post and New York Times of the new policy. Whether the new policy will succed in "cutting off an emotional four-year-old debate with the computer industry over the export of information-scrambling technology," as the Post story suggested, may depend in part on the public perception of the strength of 56-bit key products. The Post also reported that several companies, led by IBM, have a technical plan that will comply with the new policy.
The possible effects of moving the export jurisdiction from State to Commerce are discussed in a piece circulated by Stewart Baker, an attorney with Steptoe and Johnson, formerly General Counsel for the NSA. Mr. Baker writes that while the Commerce Department should have the staff and procedures to avoid imposing unnecessary delays, the FBI and the Justice Department will now be involved, and they are newcomers to this process. Further, the Commerce Department has an established procedure for "foreign availability" reviews, which are intended to determine whether "a product is so widely available abroad that controls are ineffective and should be lifted." The conduct and procedures of such a review may be a point of contention between the Commerce and Justice Departments, according to Baker.