I. New Tools for Information Security and Privacy. As a nation, we have become increasingly dependent on computers and telecommunications. These new technologies create vast opportunities for personal expression and electronic commerce, while also creating new risks to public safety and national security. Computers and telecommunications rely on open protocols and ultra-accessibility, thus making individuals' and organizations' words and actions vulnerable to outsiders in new and potentially frightening ways. A first pillar of our new paradigm must be to promote information security and privacy--to assure the security and privacy of stored and transmitted data from unauthorized and unlawful access.

The President has recognized the challenge of updating privacy for new technologies: "We've been at this experiment in Government for 223 years now. We started with a Constitution that was rooted in certain basic values and written by some incredibly brilliant people who understood that times would change, and that definitions of fundamental things like liberty and privacy would change, and that circumstances would require people to rise to the challenges of each new era by applying old values in practical ways."

In updating enduring constitutional values for the computer age, we need to assure that our citizens' personal data and communications are appropriately protected. Businesses need to privately communicate with their employees and manufacturing partners without risk that their proprietary information will be compromised through unauthorized access. Encryption is one of the necessary tools that can be used in this technological environment to secure information. Therefore, we encourage the use of strong encryption by American citizens and businesses to protect their personal and commercial information from unauthorized and unlawful access.

We must also recognize the inherent security risks posed by the spread of and dependence on "open systems" and ready accessibility. The Defense Department's situation is typical. Twenty years ago the Defense Department operated largely proprietary communications systems over government owned switches and circuits. DOD software technology was homebuilt and tightly controlled. Today, the U.S. DOD has more computer users than any other organization in the world--2.1 million computers access over 10,000 networks on an average work day. Even so, 95% of DOD's communications occur over public circuits or with commercial software and hardware. The Defense Department's experience reliance on commercial products and services is repeated throughout the country by government agencies and the private sector.

If the Department of Defense is to function safely in cyberspace, it must adopt use strong tools for encryption and identity authentication. It is not just military operations, orders and data that must be protected. All government agencies and all business activities will increasingly need a full set of security tools to insure ensure access, privacy and absolute confidence in business operations that utilize computer technology.

We recognize that information technology is changing rapidly and constantly providing both new security capabilities and challenges and, hence, we will never reach a "perfect solution." Nevertheless, there are many efforts underway throughout the gGovernment to address the need for moresecurity information secure systems. By adopting Adapting commercial approaches, where appropriate, and sponsoring R&D to fill needed capabilities, we believe the Federal gGovernment should, by example, lead the way for America to develop and use the tools and procedures for information security and privacy in the next century.

The Department of Defense, for example, has adopted a policy and allocated over $500 million to develop a comprehensive security management infrastructure. This infrastructure will utilize a range of encryption products (with stronger products for more sensitive applications involving higher levels of classification), and a public key infrastructure (PKI) to identify and authenticate those who use our information networks. The Department is also adopting stronger standards for network configuration and operator qualification and certification, and is taking steps to better detect unauthorized intrusions into DOD networks.

The Federal government must continue to promote the development of stronger encryption technologies for federal use. The advanced encryption standard (AES) is in the final stages of a public selection process. Once promulgated, AES could become as ubiquitous as today's digital encryption standard (DES) which has contributed greatly to the growth of electronic commerce.

In the Federal government, the Department of Defense is a leading proponent of information security through its information assurance initiative, and other agencies are recognizing the need for increased diligence in maintaining adequate security of Federal information and systems. We encourage each agency to vigilantly build security enhancements into their business operations in risk-based and cost-effective ways that enable, not impede, the agency's ability to perform its mission.

Further, we believe that the Congress and Executive Branch should work together to promote both the awareness of information privacy and security and the development of appropriate tools and resources by the private sector, and to consider whether tangible incentives are appropriate. develop legislation that creates tangible incentives for the private sector to invest in information assurance tools and resources Given the rapid changes in technology, we We do not believe and advocate a technology neutral approach. This approach would have the public and private sectors working together to encourage development of a broad range of privacy and security products and processes and share promising practices with one another. Neither do we believe that authentication keys should be mandated for use. Rather, we believe that identity authentication must be a choice, not a requirement. ButWe we believe equally strongly that security infrastructures and the deployment of security products authentication keys -- should neither be mandated nor prohibited. Public and private Organizations organizations must determine their risks and be free to choose their own solutions.

The Federal Government must continue to promote the development of stronger encryption technologies. The advanced encryption standard (AES) is in the final stages of a public selection process. Once promulgated, AES should become as ubiquitous as today's Digital encryption standard (DES) which has contributed greatly to the growth of electronic commerce.

The government's requirement to protect its own sensitive and privacy information is matched by individual's and the private sector's own interests in proper handling of sensitive information. Many in industry and elsewhere are already developing and using sophisticated security and privacy products and processes. Government should act as a facilitator and catalyst and help stimulate the development of commercial products that will help all Americans protect their sensitive information.

In sum, the first pillar of the new strategy paradigm calls on the Federal gGovernment, the Congress and all others to partner to lead-in partnership with the privatein promoting ways to bring information security and privacy to the Information age. Working together, we can sector-in developingdevelop tools and procedures for safe operation in cyberspace, applying enduring constitutional values to our new circumstances. The Government must create incentives for the development and use of security management infrastructures by the private sector.

II. Encryption Export Controls for the New Millennium. At the dawn of the new millennium, technology is advancing at such a rapid pace that attempts to control its global spread under the existing export control regime is need to be regularly reevaluated. Encryption facilitates this security andwill continue to enables new economic realities that must be reflected considered in a new way of thinking aboutbalanced approach to export controls.

Encryption provides much more than just secret messages. These products are and services are needed around the world so that electronic commerce may flourishto provide confidence and security for electronic commerce and business. With the growing demand for security, encryption products are increasingly sold on the commodity market, and encryption features are being embedded into everyday operating systems, spreadsheets, word processors, and cell phones. Encryption has become a vital component of the emerging global information infrastructure and digital economy. In this new economy, American companies are leaders in information technology,innovation and imagination are the engines, and it is economic achievement that underpins America's status in the world and provides the foundation of our national security. We recognize that U.S. information technology companies lead the world in product quality and innovation, and it is an integral part of the Administration's policy of balance to see that they retain their competitive edge in the international market place.

We as a nation must, however, balance the our desire and the need to assist industry with a prudent, objective and consistent steady judgment about how to protect national security; a judgment that acknowledges that technological advantages may add new dimensions to an already complicated problem set. We must ensure that the advantages this technology affords us are not extended to those who wish us ill or who harbor criminal intent. The Administration has taken a fresh look at export controls on encryption in order to develop a policy that will promote U.S. economic competitiveness to the maximum extent possible consistent with the need to protect national security. The Administration recognizes that economic realities do not allow export controls to be structured in the traditional way.This judgment must be informed by both foreign and domestic realities.

While the U.S. is a huge market for telecommunications goods and services, the other nations of the globe present markets much larger than our domestic demand. Our networks are inextricably bound to those of our allies and adversaries alike. Likewise, America's interests do not end at our borders. American diplomats, service men and women, as well as countless business people work and live around the globe. America's interests are served by the ability to send and receive proprietary, personal and classified information to exactly where it is needed around the world. Likewise, America's interests are served daily by shared actions with our allies, which require accurate and authentic information be exchanged. Our policy must acknowledge these vital interests.

But even as we do, it is imperative that we uphold international understandings, and strive with other nations to prevent the acquisition of encryption technology to sponsors of terrorism, international criminal syndicates or those attempting to increase the availability of weapons of mass destruction. We must also meet our responsibilities to support our national decision makers and our military war fighters with intelligence information in time to make a difference.

Accordingly, the Administration has revised its approach to encryption export controls that by emphasizings three simple principles that protect important national security interests: a meaningful technical review of encryption products in advance of sale, a systematic reporting system for export sales of non-mass market softwarestreamlined post-export reporting system that provides us an understanding of where encryption is being exported but is aligned with industry's business and distribution models, and a license process that preserves the right of government to review and, if necessary, deny the sale of strong encryption products to foreign government and military organizations onlyand to nations of concern. With these three principles in place, the Federal Government would remove almost all remove all other export restrictions on encryption products. This new paradigmapproach will provide a stable framework that also will allow U.S. industry to participate in constructing and securing the global networked infrastructureenvironment. This paradigm approach also maintains reasonable national security safeguards by monitoring the availability of encryption products and limiting their use in most danger-proneappropriate situations.

The Administration intends to codify this new paradigm policy in new export regulations procedures with a goal of implementing them not later than the end of this year by December 15, 1999, following consultations on details with affected industries and other private sector organizations.

However, with this new framework for export controls, the national security organizations will need to develop new technical tools and capabilities to deal with the rapid expansion of encrypted communications in support of its mission responsibilities. The Congress will need to support such new tools and technical capabilities through necessary appropriations.

To accommodate this new paradigm, our national security organizations will have to develop new tools to deal with the rapid expansion of encrypted communications. The Congress will need to support these new tools with necessary appropriations.

III. Updated tools for Law Enforcement. Because of the need for and use of strong encryption globally, governments need to develop new tools to deal with the rapid expansion of encrypted communications. Stronger Updated tools for law enforcement that specifically address the challenges of encryption constitute the third pillar of the new strategy. We cannot ignore the fact that encryption will be used in harmful ways - by child pornographers seeking to hide pictures of exploited children, or commercial spies stealing trade secrets from American corporations, or terrorists communicating plans to destroy property and kill innocent civilians. Even more significant, since because cyberspace knows no boundaries and since because it is not immediately clear if a cyberattack involves Americans or foreigners, America's national security which traditionally involves military might now will increasingly depends depend on strong and capable law enforcement organizations. This is because By custom and practice the United States military and intelligence agencies have long been is restricted by law from undertaking defense operations inside the United States against American citizens. As suchAccordingly, America's national defense is now inextricably increasingly reliant on tied to a ensuring that our law enforcement community is capable of protecting America in cyber space.

Under existing law and judicial supervision, of course, law enforcement agents are provided with a variety of legal tools to collect evidence of illegal activity. The use of such tools is of course subject to judicial supervision, but Wwith appropriateappropriate court orders, law enforcement may conduct electronic surveillance or search for and seize evidence. In an encrypted world-where the communications, law enforcement may obtain the legal authority to access a suspect's communications or data, but overheard or the data seized is encrypted-these tools are rendered wholly insufficientthe communications or data are rendered worthless, because they cannot be understood and cannot be decoded by law enforcement in a timely manner. In the context of a law enforcement operation, for example, Sstopping a terrorist attack or seeking to recover a kidnapped child may require timely access to plain text, and such access may be defeated by encryption. Hence, law enforcement's legal tools should be updated, consistent with constitutional principles, so that when law enforcement obtains legal authority to access a suspect's data or communications, law enforcement will also be able to read it.

The imperative for judicially-authorized access in a world of ubiquitous encryption means thatQuite simply, even in a world of ubiquitous encryption, law enforcement with court approval must be able to obtain plaintext so that it can protect public safety and national security. Therefore, we must undertake several important and balanced initiatives.

First, we need to give ensure that law enforcement maintains its ability to access to decryption information stored with third parties, but allowed this only pursuant to rules that ensure appropriate privacy protections are in place. To ensure this result, the Administration and the Congress must develop legislation to create a legal framework that enhances privacy over current law and permits decryption information to be safely stored with third parties (by prohibiting, for example, third party disclosure of decryption information), but allows for law enforcement access when permitted by court order or some other appropriate legal authority.

Second, since criminals will not always store keys with third party recovery agents, we must ensure that law enforcement has the personnel, equipment, and technical skillstools necessary to investigate crime in an encrypted world. This requires that the Congress fund the Technical Support Center as proposed by the Administration, and work with the Administration to ensure that the confidentiality of the sources and methods developed by the Technical Support Center can be maintained.

Third, it is well recognized that industry is designing, deploying and maintaining the information infrastructure, as well as providing encryption products for general use. Industry has always expressed support, both in word and in action, for law enforcement, and has itself worked hard to ensure the safety of the public. Clearly, industry must continue to do so, and firms must be in a position to share proprietary information with government without fear of that information's disclosure or that they will be subject to liability. Therefore, the law must protect such information from disclosure whenever appropriateprovide protection for industry and its trade secrets as it works with law enforcement to support public safety and national security. The law must also assure that sensitive investigative techniques remain useful in current and future investigations by protecting them from unnecessary disclosure in litigation. These protections must be consistent with fully protecting defendants' rights to a fair trial under the Constitution's Due Process clause and the Sixth Amendment.

The Administration and the Congress need to work jointly to pass legislation that provides these new updated authorities. The Administration is in the final stages of drafting legislation and will shortly submit it to the Congress for consideration.

It is imperative to emphasize that this the malicious use of encryption is not just a law enforcement issue - it is also a national security issue. The new regime framework for export controls must be complemented by providing updated, but limited authorities to law enforcement.