(11)
Encryption is subject to U.S. export controls under both the Arms Export Control Act (AECA) and the Export Administration Act of 1979 (EAA). Originally, virtually all encryption was classified as a defense article and regulated under the AECA. (20) As a general policy, theState Department allowedexports of commercial encryption with 40-bit keys, although some software with DES could be exported toU.S.-controlledsubsidiaries and financial institutions. (24)
Further relaxation of encryption export controls took place in September 1999, when the Clinton Administration announcedthat encryption items of any key length may now be exported under a license exception, after a technical review,toindividuals, firms, and other non-government end-users in any country except for seven state supporters ofterrorism. Following criticism by companies, privacy groups, and Internet proponents, the Administration postponedpublication ofthe implementing regulations and expanded certain aspects of the earlier proposal in new rules that were issuedJanuary 14,2000. (31) Federal district courts addressing this issue overthe last three years have both upheld and dismissed First Amendment challenges to export licensing schemes forencryption. (35) The court later ruled that AECA licensing requirementswere an unconstitutional prior restraint on such speech. (78) The court allowed the plaintiffto proceed with his constitutional challenge, directing the district courtto examine the new encryption regulations issued in January 2000 to examine whether the plaintiff could bring afacialchallenge on First Amendment grounds. 106th Congress Legislative Proposals

Two bills introduced in the 106th Congress, H.R. (79)S. 798 , the Promote Reliable On-Line Transactions toEncourage Commerce and Trade (PROTECT) Act, was introduced April 14, 1999, by Mr. McCain and 5 (later 7)co-sponsors. 850 was reported by the House Judiciary Committee, the House Commerce Committee, the House International Relations Committee, the House Armed Service Committee, and the House Permanent SelectCommittee onIntelligence, resulting in differing versions of the bill, two of which would allow strict export controls on encryption. No further action was taken on any of these bills. The House Commerce Committee reported the bill as amended July 2 ( H.Rept. 106-117 , Part2). The amended version would have alsoexpanded the 15-day technical review periods to 30 "working days"; required DOC to consult with the SecretariesofDefense and State, the Attorney General, and the Director of Central Intelligence before the licensing policiesprovided forin the bill took effect; allowed DOC to prohibit exports of strong encryption and specific encryption products to endusersin specific countries for the additional reasons of harm to U.S. national security, use in sexual exploitation ofminors, or usein illegal activities involving organized crime; and provided that encryption products could be controlled for anyreasonother than their encryption capability and that nothing in the SAFE Act or its amendment of the EAA altered theability ofthe Secretary of Commerce to control exports for reasons other than encryption. The House Permanent Select Committee on Intelligence July 23 reported an amendment to H.R. An encryption product of 64bits or less would have been eligible for a license exception, provided (1) the product was submitted for a one-timetechnical review (a maximum 45-day process with required information to be determined by the President); (2) theitem didnot require licensing under otherwise applicable regulations; (3) the item was not intended for a country, end user,or enduse that was by regulation ineligible to receive the product and the encryption was otherwise qualified for export;(4) theexporter, within 180 days after export, submitted a certification identifying the intended end use of the products andthename and address of the intended recipient, if available; (5) the exporter, within 180 days after export, provided thenamesand addresses of its distribution chain partners; and (6) the exporter, at the time the product was submitted fortechnicalreview, provided proof that its distribution chain partners had contractually agreed to abide by all U.S. laws andregulationsinvolving the export or reexport of U.S.-origin encryption products.
Encryption exports are controlled under the Arms Export Control Act (AECA) and the Export Administration Act (EAA),the latter statute to expire August 20, 2001. The more stringent AECA controls, administered by the StateDepartment,apply to encryption items classified as defense articles or services. Items not so classified are subject to regulationby theDepartment of Commerce (DOC) under the extended EAA authorities. DOC requires licenses for certaincommodities andsoftware, but allows other encryption items to be exported under license exceptions.
The U.S. Government has traditionally maintained that controls over strong encryption are necessary for nationalsecurity, foreign policy, and law enforcement reasons. Industry has argued that federal regulatory policiesinsufficientlyaddress rapid technological developments, prevent manufacturers from marketing products available abroad, andharm U.S.national interests by making strong U.S. encryption unobtainable by legitimate users worldwide. While mostencryptionwas originally controlled under the AECA, in late 1996 the President transferred jurisdiction over nonmilitary itemstoDOC, which at the same time eased controls over commercial encryption that used a key recovery feature or wasdestinedfor financial institutions. In 1998 the Administration further relaxed controls over 56-bit technology generally andstrongerencryption destined for U.S. subsidiaries, insurance companies, and other end-users, retreating from earlier keyrecoveryrequirements. Further modifications were announced in September 1999, allowing license exceptions for the exportofencryption of any key length after a technical review to most end-users in all but terrorist countries; draft regulationswereissued in late 1999. Following criticism by companies, privacy groups and Internet proponents, DOC expandedaspects ofits original proposal and issued new regulations in January 2000. Regulations issued in October 2000 furtherstreamlinedcontrols over encryption exports to 23 countries including European Member states. Restrictive export licensingregulations have raised constitutional concerns, some arguing that they impose a prior restraint on speech inviolation of theFirst Amendment. Federal courts have both upheld and dismissed First Amendment challenges to export controls,theoutcome generally turning on whether the court viewed the encryption item and its export as essentially expressiveorfunctional. Courts in California and Ohio have allowed challenges to proceed, holding that encryption source codeisprotected speech for First Amendment purposes.
Legislation introduced in the 106th Congress would have required increased liberalization of encryption export controls. H.R. 850 , the Security and Freedom Through Encryption (SAFE) Act, was reported fromthe HouseJudiciary Committee, House Commerce Committee (as amended), and House International Relations Committee(asamended); significantly more restrictive versions of the bill had been reported by the House Armed ServicesCommitteeand House Permanent Select Committee on Intelligence ( H.Rept. 106-117 , Pts 1-5). S. 798 , the PromoteReliable On-Line Transactions to Encourage Commerce and Trade (PROTECT) Act of 1999, was reported favorablyandwithout amendment by the Senate Commerce Committee ( S.Rept. 106-142 ). No further action was taken on thesebills. This report will be updated periodically.