(a) The development of the information superhighway is fundamentally changing the way we interact. The nation's commerce is moving to networking. Individuals, government entities, and other institutions are communicating across common links.

(b) The Internet has provided our society with a glimpse of what is possible in the information age, and the demand for information access and electronic commerce is rapidly increasing. This demand is arising from all elements of society, including individuals, banks, manufacturers, online merchants, service providers, State and local governments, and educational institutions.

(c) At the same time, society's increasing reliance on information systems in this new environment exposes U.S. citizens, institutions, and their information to unprecedented risks.

(d) In order for the global information infrastructure and electronic commerce to achieve their potential, information systems must overcome these risks and must provide trusted methods to identify users and keep data and communications confidential.

(e) Cryptography can meet these needs. In particular, cryptography, through the technique of encryption, is an important tool in protecting the confidentiality of wire and electronic communications and stored data. Thus, there is a national need to encourage the development, adoption, and use of cryptographic products that are consistent with the foregoing considerations and are appropriate for use by private parties and by the United States Government.

(f) While encryption is an important tool for protecting the privacy of legitimate communications and stored data, it has also been used to facilitate and hide unlawful activity by terrorists, drug traffickers, child pornographers, and other criminals.

(g) The advent and eventual widespread use of encryption poses significant and heretofore unseen challenges to law enforcement and public safety. While under existing law, both statutory and constitutional in nature, law enforcement is provided with different means to collect evidence of illegal activity -- in the form of communications, stored data on computers, etc. -- these means are rendered wholly insufficient when encryption is utilized to scramble the information in such a manner that law enforcement, acting pursuant to lawful authority, cannot decipher the evidence.

(h) Technology does not presently exist that allows law enforcement timely to decrypt such information. In the context of law enforcement operations, for example, stopping a terrorist attack or seeking to recover a kidnaped child, time is of the essence and may mean the difference between success and catastrophic failure. While existing means of obtaining evidence would remain applicable in a fully-encrypted world, the failure to provide law enforcement with the necessary ability to obtain the plaintext, or decrypted "readable" version, of the evidence makes existing authorities useless.

(i) A sound and effective public policy must support the development and use of encryption for legitimate purposes but allow access to plaintext by law enforcement when encryption is utilized by criminals. Law enforcement entities have a critical need to decrypt communications and stored data that they are lawfully authorized to access in order to obtain the plaintext that is necessary to conduct investigations and prosecutions of such unlawful activity, and there is a compelling national interest in preserving law enforcement entities' ability to obtain such plaintext. Appropriate means must be available to fulfill these law enforcement objectives, consistent with existing legal authorities and constitutional principles, in order to protect public safety. This requires an approach which properly balances critical privacy interests with the need to preserve public safety.

(j) While means to aid investigators' and prosecutors' efforts to obtain plaintext are needed, this Act is not intended to make it unlawful for any person to use encryption in the United States for otherwise lawful purposes, regardless of the encryption algorithm selected, key length chosen, or implementation technique or medium used. Similarly, this Act is not intended to require anyone to use third parties for storage of decryption keys, and this Act does not establish any regulatory regime for entities engaging in such an activity. Finally, this Act is not intended to affect export controls on cryptographic products.

(a) Subsection 2703(d) of title 18, United States Code, is amended by striking "described in section 3127(2)(A) and".

(b) Section 2707 of title 18, United States Code, is amended --

"Section 2711. Disclosure or use of stored recovery information and customer information by recovery agents; notification of storage location

"(a) Prohibitions and requirements. --

"(b) Authorizations for disclosure or use. --

"(c) Confidentiality. -- Except as otherwise provided by law, or by order of a court of competent jurisdiction, a recovery agent who is requested or ordered to disclose stored recovery information to, or to use stored recovery information on behalf of, a governmental entity pursuant to paragraph (b)(1) above shall not reveal to any person or entity the fact that the governmental entity has requested or received stored recovery information from, or has required the use of stored recovery information by, the recovery agent, and shall not disclose to any other person or entity any decrypted data or communications that are provided to the governmental entity.

"(d) Exclusions. -- Nothing in this section or section 2712 of this title shall be construed to prohibit a recovery agent from:

"(e) Criminal sanctions. -- Whoever knowingly violates or attempts to violate subsection (a) or subsection (c) of this section shall be fined under this title, or imprisoned for not more than one year, or both.

"(a) Compelled disclosure and use of stored recovery information in the possession of recovery agents. -- A governmental entity may require a recovery agent to disclose stored recovery information to the governmental entity, or to use stored recovery information to decrypt data or communications --

"(b) Requirements for court order for disclosure or use of stored recovery information by a recovery agent. -- A court order requiring a recovery agent to disclose stored recovery information to a governmental entity or to use stored recovery information to decrypt data or communications on behalf of a governmental entity shall be issued by a court of competent jurisdiction upon a finding, based on specific and articulable facts, that --

An order under this section directing the disclosure of stored recovery information shall be limited to the extent practicable to directing the disclosure of only that stored recovery information that is necessary to allow access to the plaintext of the relevant data and communications.

"(c) Notice. -- Within 90 days after receiving stored recovery information or decrypted data or communications from a recovery agent, the governmental entity shall notify the person or entity, if known, who stored the recovery information that stored recovery information was disclosed or used by the recovery agent, and such notice shall state the date on which the stored recovery information or decrypted data and communications were disclosed. On the government's ex parte showing of good cause, the giving of notice may be postponed by a court of competent jurisdiction. Notice under this section shall be provided by personal service, or by delivery by registered or first-class mail.

"(d) Cost reimbursement. -- A governmental entity obtaining stored recovery information from a recovery agent or directing a recovery agent to decrypt the data or communications pursuant to subsection (b) shall pay to the recovery agent a fee for reimbursement for such costs as are reasonably necessary and which have been directly incurred in providing such information or decrypting such data and communications. The amount of the fee shall be as mutually agreed by the governmental entity and the recovery agent, or, in the absence of agreement, shall be as determined by the court which issued the order pursuant to subsection (b).

"(a) Limitations on use. --

"(a) Confidentiality of access techniques. -- In any civil or criminal case where a party seeks (1) to discover or introduce plaintext that had been encrypted or protected by other security techniques or devices, and which plaintext had been obtained by or for a governmental entity using government methods of access to such protected information, or (2) to discover or introduce evidence or information concerning government methods of access to such protected information, if such evidence or information is sought or obtained from a governmental entity or a past or present agent thereof, an attorney for the government (as that term is defined in the Federal Rules of Criminal Procedure), whether or not the government is a party, may file an application requesting that the court enter an order pursuant to subsection (b) protecting the confidentiality of the technique or mechanism that provided access to that evidence or information.

"(b) Confidentiality orders. -- If the court finds that disclosure of a technique or mechanism used by a governmental entity to obtain access to information protected by encryption or other security techniques or devices, or of a trade secret relating to such technique or mechanism --

then the court shall enter such orders and take such other action as may be necessary and appropriate to preserve the confidentiality of the technique used by the governmental entity or the trade secret, consistent with constitutional principles. A confidentiality order under this subsection entered in a civil or criminal case may direct the use of special procedures, as appropriate, relating to the admissibility of evidence obtained through such technique used by a governmental entity. An interlocut ory appeal by the United States shall lie from a decision or order of a district court with respect to a request for an order under this subsection.

"(c) Nondisclosure of trade secrets. -- Notwithstanding any other provision of law, trade secrets (as that term is defined in section 1839 of this title) disclosed to a governmental entity pursuant to section 2518 of this title, or otherwise disclosed to a governmental entity to assist it in obtaining access to information protected by encryption or other security techniques or devices, shall not be disclosed by any governmental entity unless such disclosure is to another governmental entity, is necessary to implement such methods of access, is with the consent of the person or entity that owns the trade secret, is ordered by a court of competent jurisdiction pursuant to a request of the disclosing governmental entity, or is required to be disclosed to a defendant in a criminal case after giving an attorney for the government an opportunity to seek an order pursuant to subsection (b).

"(d) Interaction with the Classified Information Procedures Act. -- Nothing in this section shall be deemed to affect the Classified Information Procedures Act, Pub. L. 96-456, 94 Stat. 2025 (1980), or as hereafter amended.

(a) in paragraph (1), by striking "and";

(b) in paragraph (2), by striking the period and inserting a semicolon; and

(c) by adding at the end the following:

(a) Chapter title. -- The title of chapter 121 of title 18, United States Code, is amended by adding "AND RECOVERY INFORMATION ACCESS" to the end thereof.

(b) Chapter analysis. -- The chapter analysis for chapter 121 of title 18, United States Code, is amended by striking the last item and inserting the following:

(c) Part analysis. -- The part analysis for Part I of title 18, United States Code, is amended by inserting "and recovery information access" after "access" in the item for chapter 121.

(1) $25,000,000 for fiscal year 2000 for building and personnel costs;

(2) $20,000,000 for fiscal year 2001 for personnel and equipment costs;

(3) $20,000,000 for fiscal year 2002; and

(4) $15,000,000 for fiscal year 2003.

(a) Amendment of sentencing guidelines. -- Pursuant to its authority under section 994(p) of title 28, United States Code, the United States Sentencing Commission shall review the federal sentencing guidelines and, if appropriate, shall promulgate guidelines or policy statements or amend existing guidelines or policy statements to --

(b) Emergency authority. -- The Commission may promulgate the guidelines or amendments provided for under this section in accordance with the procedures set forth in section 21(a) of the Sentencing Act of 1987, as though the authority under that Act had not expired.

(a) by striking "or" at the end of subparagraph (C);

(b) by striking the period at the end of subparagraph (D) and inserting "; or" and

(c) by adding at the end the following new subparagraph: