A bill introduced today in both the Senate and House of Representatives would loosen the rules that govern the use of encryption systems and ease export restrictions on encryption products.
The measure, sponsored by Sen. Patrick Leahy (D-Vermont), would let American businesses and individuals use any kind of encryption system they choose to protect the privacy of their electronic communications, instead of the low-powered systems now mandated by the federal government. This would mean that popular encryption software like PGP (Pretty Good Privacy) would be legal to export and use on networks that cross national boundaries.
The bill was supported by witnesses at a hearing last week, including FBI Director Louis Freeh, who said that American businesses are hamstrung by the current restrictions on the export of strong encryption technology and are vulnerable to espionage by foreign governments and companies.
Below is the text of the critical portions of the bill that affect the use of encryption software and the lifting of export restrictions. For comments on the bill from encryption proponents, go to CNET radio.
Sec.4 Freedom to Use Encryption
(a) Lawful Use of Encryption--It shall be lawful for any person within any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, and any territory or possession of the United States and by United States persons in a foreign country to use any encryption, regardless of encryption algorithm selected, encryption key length chosen, or implementation technique or medium used except as provided in this Act and the amendments made by this Act or in any other law.
Section 2805 Freedom to sell encryption products
(2) Items Not Requiring Licenses--No validated license may be required...for the export or reexport of--
(A) any software including software with encryption capabilities, that is--
(i) generally available, as is, and designed for installation by the purchases; or
(ii) in the public domain or publicly available because it is generally accessible to the interested public in any form; or
(B) any computing device solely because it incorporates or employs in any form software (including software with encryption capabilities) exempted from any requirement for a validated license under subparagraph (A).