First Step Toward More Lenient Encryption Laws

September 10th, 2007

The House received proposed legislation this week that would reduce export restrictions on encryption programs and products.

At a House science subcomittee hearing Tuesday, Representative Bob Goodlatte, a Virginia Republican, criticized encryption export controls. He argued that every American should have the right to use encryption to enhance security. Further, he said, encryption research must not be hindered.

The lack of the U.S.’s ability to export encryption affects development, Goodlatte said.
Currently the law states that the maximum encryption strength that can be exported is 40 bit. Recently a student at the University of California at Berkeley cracked a 40-bit code in 3.5 hours using university computers. There is an exception allowing the export of 56-bit or better encryption under certain conditions including entrusting the key to a third party.

Goodlatte spoke at a hearing on security and the Internet. He asked a panel of six security experts to endorse his bill, which, he said, already has the support of 50 lawmakers. All experts agreed that the bill was a good start.

The proposed legislation would amend current law to permit the export of generally available computer products with security features if products with comparable security features are available from foreign manufacturers.

The bill also would prohibit the government from establishing a mandated data bank where encryption keys would be escrowed. It would also make it a crime to use encryption to commit or cover up a crime.

Daniel Farmer, an independent security consultant and co-author of SATAN software, which is designed to find holes in Web site security systems, disagreed with the provision calling for punishment of encryption users.

With the Internet, most of the burglars are very intelligent, Representative Vernon Ehlers, a Michigan Democrat, said. People don’t see it as a crime, rather as an intellectual game.

But allowing the free-market flow of security measures is a good industry-supported first step.
It seems silly. Why can’t we use the strongest tools to protect ourselves, said Daniel Lynch, a co-founder of the Internet-user group Pretty Good Privacy. They say it can be used for bad things, but so can cars and knives. And that doesn’t stop us from selling them.

Entry Filed under: Compare