THE WHITE HOUSE Office of the Press Secretary ________________________________________________________________________ For Immediate Release September 16, 1999 PRESERVING AMERICA'S PRIVACY AND SECURITY IN THE NEXT CENTURY: A STRATEGY FOR AMERICA IN CYBERSPACE A REPORT TO THE PRESIDENT OF THE UNITED STATES September 16, 1999 William Cohen Janet Reno Secretary of Defense Attorney General Jacob J. Lew William Daley Director of the Office Secretary of Commerce of Management and Budget PRESERVING AMERICA'S PRIVACY AND SECURITY IN THE NEXT CENTURY: A STRATEGY FOR AMERICA IN CYBERSPACE 1. A TIME OF PIVOTAL CHANGE American history has been punctuated by periods in which the Nation had to respond to sweeping social, economic and technological developments. In the best of times, people working together in government and industry became the engine of progress that shaped the character of the time and facilitated new prosperity and opportunity for Americans. Three examples illustrate this point. Opening the Heartland and expanding the frontier. Beginning with the Louisiana Purchase in 1803, the government initiated a remarkably successful policy to open up a vast new area. Over the next five decades, the United States doubled the size of its territory. Under the government's plan, land grants were given to railroads to open the Midwest and in turn to create a future market for rail services. Land was awarded to homesteaders, and yet other parcels were reserved as income sources for institutions of higher education. The technological advance of the railroad was the engine pulling this growth. From the 1820s to 1900, American railroads added an average of more than 2,000 miles of track each year. By the close of the 19th century, the combination of these factors had served to triple the size of our nation. The Administration and the Congress, working together and in concert with technology advances, created an infrastructure for a new society. Industrialization and the Great Depression Produce a New Society. Around the turn of the century, the country was firmly in the Industrial Age. Technical innovations in automation and machinery spurred the growth of factories, assembly lines and mass-production in our nation's cities. The Ford assembly line for the Model T and the Wright brother's flight catapulted us into a mobile society and drove further technological innovations. Telephones became more commonplace and the nation began to shrink as news and information traveled faster. As a nation, we created new opportunities in industries never heard of, and created a new class of wealth, based on opportunity and innovation, not birthright. The economy moved from an agrarian society to an industrial society. But the growth and prosperity experienced by many halted when the Great Depression gripped the country. In response, the government developed a series of creative policies and programs that brought government and business to the common task of restoring productivity to America. While there were a number of social programs, government support for technology was key to driving development. For example, the government took a pivotal role in expanding the electrical grids that would become the backbone of our national infrastructure, first with the creation of the Tennessee Valley Authority in 1933 and two years later with the creation of the Rural Electrification Administration. Electrical technology, in the ensuing years, radically altered the capabilities of America's rural farms and industry. Just as important, it created a transmission belt that further disseminated the ideas and technology being generated in the nation's cities. A World War Produces a Global Community and the American Century. In a third case, World War II shattered the international political system at the same time that it brought an end to 19th century colonialism. The creation of the World Bank, the International Monetary Fund, and the rules for a global trading system became the cornerstones of the emerging global economy. The urgent need for increased production and the burst of scientific funding associated with the war effort -- sustained by a continuing Federal commitment to new science and technology in the following years -- vaulted the United States into the age of electronics and computers - the beginning of the Information Age. Advances in telecommunications, such as broad-band carrier systems and switching devices, combined with innovations in the computer industry to give individuals more power than ever to process large amounts of information and transmit that information at ever-greater speeds. Further, this country's goal to reach the moon by the end of the 1960s fueled development of advanced electronics, increased computing power and communications capabilities. At the same time, technological leaps in computer memory and data storage enabled the centralized use (and, unfortunately, misuse) of information to examine or profile individuals, consumers, and groups. As these issues emerged, our legal system responded. Looking back, the "Information Economy" that Americans recognize today could be seen emerging as early as the late 1940s. Each of these examples was a pivotal episode in American history in which complex social, economic, and technological forces came together. Facing the challenges of the day, America's governmental, societal and technical leaders crafted a new vision of the future, and in the process became pioneers on a new frontier of opportunity and promise. America now faces a new time of pivotal change, enormous opportunity, and promise. This time, technology itself presents both an opportunity and a threat to global society increasingly dependent on, and connected by, advanced computing and communications. Continuing a balanced strategy that advances our national interests is the challenge of our day. 2. Cyber America: Great Promise and Serious Risks America now stands on the brink of revolution fueled by machines - computers - and networks of computers that facilitate the instant exchange of and access to ideas and information. The computer has and will continue to revolutionize virtually all aspects of American society, just as electricity, the power grid and the railroad changed our forefathers' society. The Computer as an Economic Engine. It is well known that the computer, and its application in business, commerce, education and recreation has transformed the American economy. America is becoming a country of "knowledge workers," with the ubiquitous application of computer technology at its core. America's productivity today is grounded in computer applications and networks. Barcodes speed us through shopping lines and simultaneously facilitate store manager recordkeeping and reordering. Airline reservations can be booked from home computers. Everything from clothes to books to software can be purchased over the Internet. American companies are discarding their proprietary computer systems and using the Internet and the Web to increase productivity, network their entire chain of suppliers, and deliver "just-in-time" training to their employees. American students can conduct original research with colleagues on machines around the world with but a few keystrokes. Travelers can monitor current weather conditions in another country. Scientists can "conference" electronically and transmit astounding volumes of information in seconds to colleagues on other continents. As remarkable as today's innovations are, the years ahead hold even greater promise. Computers will become virtual partners in all aspects of our lives. Homes will be centrally wired to allow integrated alarms, electronics, appliances, telephones, and computers to simplify our lives. Education will become more adaptive to the routines of individual students, and banking, finance, and shopping will increasingly migrate to the home and portable computing devices. And in this process and through networking, computers have created the well-known "cyberspace" that eliminates the traditional boundaries of time and place and links governments, businesses, and individuals in the same electronic environment. The Dangers of Cyberspace. Like any new tool in previous eras, computers can be used by those who prey on the innocent. International narcotics traffickers now routinely communicate with each other via computer messages. Hostile governments and even some transnational organizations are establishing cyber-warfare efforts, assigned the mission of crippling America's domestic infrastructure through computer attacks. Hackers destroy cyber-property by defacing homepages and maliciously manipulating private information. Pedophiles stalk unsuspecting children in computer chat rooms. Individuals post homepages with instructions to manufacture pipebombs, chemical weapons, and even biological agents. Crooks break into business computers, either stealing funds directly or extorting payments from companies anxious to avoid more expensive disruption. Disgruntled employees, with valid access to their companies' system, can take steps to disrupt the business operations or steal proprietary, sensitive, and financial information. And our personal data is at risk of being unlawfully accessed and read by malicious individuals, without our knowledge, as it resides on or traverses communications and computer networks. These concerns are not hypothetical. We have seen these types of activities, and other equally dangerous activity, in past and on-going cases. The danger posed by evil individuals using these powerful new tools grows by the day. Just as other technologies have the risk of being abused, it is necessary for us to evaluate how to respond. Without protective action, we will not be safe. America must take responsible steps to ensure that this promising electronic environment is safe for law abiding citizens and businesses. 3. Balancing America's Bedrock Values While these problems seem unprecedented, in fact they represent a return to the bedrock problems faced by America's constitutional founders. American democracy became and remains a new experiment in government--balancing the rights of individuals against the imperatives of society and limiting the reach of government into personal, private lives, while mandating a government responsibility for public safety and security for all citizens. Computers are now at the center of competing American values. In honest, law abiding citizens' hands, the computer becomes an indispensable tool for education, personal and commercial business, research and development, and communications. In criminal hands, the same computer becomes a tool of destruction and criminality. Enter encryption. Over the past decade, another information technology has emerged that amplifies this tension - encryption. Encryption includes special instructions that scramble a clear readable message in complex ways that make it unreadable. For the strongest forms of encryption, only the intended recipient can unscramble the message and read the original plain text, unless someone else has gained access to the corresponding decoding software and decryption key. Originally only available and used by military agencies, strong encryption is now available to many and has become a building block for the new digital economy. It is essential to provide security and privacy for electronic commerce and e-business. Encryption is critical because it allows individuals, businesses, and other organizations to share information privately without it being unlawfully intercepted or accessed by a third party, to establish their identities, and to maintain the integrity of information. Without the use of encryption, it is difficult to establish the trust that people and firms need to do business with each other, or to have confidence to run their business electronically. With the use of encryption: - Individuals and consumers can securely conduct their finances and communicate with each other over the Web. - Firms can transmit their software, music, movies, reports and other forms of intellectual property over the Internet while minimizing the risks of widespread piracy. - Businesses can protect their company proprietary information over the Internet, with confidence that the information is secure from prying eyes. - Firms can develop products more rapidly, as teams of engineers around the world can collaborate on their designs in real-time over secure high-speed networks. However, while the majority of users will use encryption for legitimate, lawful purposes, we must recognize that terrorists, pedophiles and drug gangs are increasingly using encryption to conceal their activities. Hence, encryption has posed a serious public policy challenge over the past decade. The Federal Government has sought to maintain a balance between privacy and commercial interests on one hand and public safety and national security concerns on the other by limiting the export of strong encryption software. Preserving this balance has become increasingly difficult with the clear need for strong encryption for electronic commerce, growing sophistication of foreign encryption products and the proliferation of software vendors, and expanded distribution mechanisms. In the process, all parties have become less satisfied with the inevitable compromises that have had to be struck. U.S. companies believe their markets are increasingly threatened by foreign manufacturers in a global economy where businesses, consumers, and individuals demand that strong encryption be integrated into computer systems, networks, and applications. National security organizations worry that the uncontrolled export of encryption will result in diversion of powerful tools to end users of concern. Law enforcement organizations see criminals increasingly adopting tools that put them beyond the reach of lawful surveillance. At the end of the century, these are the important national interests that must be reconciled. Determining a policy direction for encryption has become more complex, and more urgent, for all those affected. A strategic paradigm that better achieves balance is needed. 4. A New Paradigm to Protect Prosperity, Privacy and Security To support America's prosperity and protect her security and safety, we propose a new paradigm to advance our national interests. The new paradigm should be comprised of three pillars - information security and privacy, a new framework for export controls, and updated tools for law enforcement. We discuss each in turn. I. Information Security and Privacy. As a nation, we have become increasingly dependent on computers and telecommunications. These new technologies create vast opportunities for personal expression and electronic commerce, while also creating new risks to public safety and national security. Computers and telecommunications rely on open protocols and ultra-accessibility, thus making individuals' and organizations' words and actions vulnerable to outsiders in new and potentially frightening ways. A first pillar of our new paradigm must be to promote information security and privacy - to assure the security and privacy of stored and transmitted data from unauthorized and unlawful access. The President has recognized the challenge of updating privacy for new technologies: "We've been at this experiment in Government for 223 years now. We started with a Constitution that was rooted in certain basic values and written by some incredibly brilliant people who understood that times would change, and that definitions of fundamental things like liberty and privacy would change, and that circumstances would require people to rise to the challenges of each new era by applying old values in practical ways." In updating enduring constitutional values for the computer age, we need to assure that our citizens' personal data and communications are appropriately protected. Businesses need to privately communicate with their employees and manufacturing partners without risk that their proprietary information will be compromised through unauthorized access. Encryption is one of the necessary tools that can be used in this technological environment to secure information. Therefore, we encourage the use of strong encryption by American citizens and businesses to protect their personal and commercial information from unauthorized and unlawful access. We must also recognize the inherent security risks posed by the spread of and dependence on "open systems" and ready accessibility. The Defense Department's situation is typical. Twenty years ago the Defense Department operated largely proprietary communications systems over government owned switches and circuits. DOD technology was homebuilt and tightly controlled. Today, the U.S. DOD has more computer users than any other organization in the world - 2.1 million computers access over 10,000 networks on an average work day. Even so, 95% of DOD's communications occur over public circuits or with commercial software and hardware. The Defense Department's reliance on commercial products and services is repeated throughout the country by government agencies and the private sector. If the Department of Defense is to function safely in cyberspace, it must use strong tools for encryption and identity authentication. It is not just military operations and data that must be protected. All government agencies and all business activities will increasingly need a full set of security tools to ensure access, privacy and absolute confidence in business operations that utilize computer technology. We recognize that information technology is changing rapidly and constantly providing both new security capabilities and challenges and, hence, we will never reach a "perfect solution." Nevertheless, there are many efforts underway throughout the government to address the need for more secure systems. By adopting commercial approaches, where appropriate, and sponsoring R&D to fill needed capabilities, we believe the Federal government should, by example, lead the way for America to develop and use the tools and procedures for information security and privacy in the next century. The Department of Defense, for example, has allocated over $500 million to develop a comprehensive security management infrastructure. This infrastructure will utilize a range of encryption products (with stronger products for more sensitive applications involving higher levels of classification), and a public key infrastructure (PKI) to identify and authenticate those who use our information networks. The Department is also adopting stronger standards for network configuration and operator qualification and certification, and is taking steps to better detect unauthorized intrusions into DOD networks. The Federal government must continue to promote the development of stronger encryption technologies for federal use. The advanced encryption standard (AES) is in the final stages of a public selection process. Once promulgated, AES could become as ubiquitous as today's digital encryption standard (DES) which has contributed greatly to the growth of electronic commerce. In the Federal government, the Department of Defense is a leading proponent of information security through its information assurance initiative, and other agencies are recognizing the need for increased diligence in maintaining adequate security of Federal information and systems. We encourage each agency to vigilantly build security enhancements into their business operations in risk-based and cost-effective ways that enable, not impede, the agency's ability to perform its mission. Further, we believe that the Congress and Executive Branch should work together to promote both the awareness of information privacy and security and the development of appropriate tools and resources by the private sector, and to consider whether tangible incentives are appropriate. Given the rapid changes in technology, we advocate a technology neutral approach. This approach would have the public and private sectors working together to encourage development of a broad range of privacy and security products and processes and share promising practices with one another. We believe equally strongly that security infrastructures and the deployment of security products -- should neither be mandated nor prohibited. Public and private organizations must determine their risks and be free to choose their own solutions. The government's requirement to protect its own sensitive and privacy information is matched by individual's and the private sector's own interests in proper handling of sensitive information. Many in industry and elsewhere are already developing and using sophisticated security and privacy products and processes. Government should act as a facilitator and catalyst and help stimulate the development of commercial products that will help all Americans protect their sensitive information. In sum, the first pillar of the new paradigm calls on the Federal government, the Congress and all others to partner in promoting ways to bring information security and privacy to the Information age. Working together, we can develop tools and procedures for safe operation in cyberspace, applying enduring constitutional values to our new circumstances. II. Encryption Export Controls for the New Millennium. At the dawn of the new millennium, technology is advancing at such a rapid pace that attempts to control its global spread under the existing export control regime need to be regularly reevaluated. Encryption will continue to enable new economic realities that must be considered in a balanced approach to export controls. Encryption products and services are needed around the world to provide confidence and security for electronic commerce and business. With the growing demand for security, encryption products are increasingly sold on the commodity market, and encryption features are being embedded into everyday operating systems, spreadsheets, word processors, and cell phones. Encryption has become a vital component of the emerging global information infrastructure and digital economy. In this new economy, innovation and imagination are the engines, and it is economic achievement that underpins America's status in the world and provides the foundation of our national security. We recognize that U.S. information technology companies lead the world in product quality and innovation, and it is an integral part of the Administration's policy of balance to see that they retain their competitive edge in the international market place. We as a nation must balance our desire and the need to assist industry with a prudent, objective and steady judgment about how to protect national security; a judgment that acknowledges that technological advantages may add new dimensions to an already complicated problem set. We must ensure that the advantages this technology affords us are not extended to those who wish us ill or who harbor criminal intent. This judgment must be informed by both foreign and domestic realities. While the U.S. is a huge market for telecommunications goods and services, the other nations of the globe present markets much larger than our domestic demand. Our networks are inextricably bound to those of our allies and adversaries alike. Likewise, America's interests do not end at our borders. American diplomats, service men and women, as well as countless business people work and live around the globe. America's interests are served by the ability to send and receive proprietary, personal and classified information to exactly where it is needed around the world. Likewise, America's interests are served daily by shared actions with our allies, which require accurate and authentic information be exchanged. Our policy must acknowledge these vital interests. But even as we do, it is imperative that we uphold international understandings, and strive with other nations to prevent the acquisition of encryption technology to sponsors of terrorism, international criminal syndicates or those attempting to increase the availability of weapons of mass destruction. We must also meet our responsibilities to support our national decision makers and our military war fighters with intelligence information in time to make a difference. Accordingly, the Administration has revised its approach to encryption export controls by emphasizing three simple principles that protect important national security interests: a meaningful technical review of encryption products in advance of sale, a streamlined post-export reporting system that provides us an understanding of where encryption is being exported but is aligned with industry's business and distribution models, and a license process that preserves the right of government to review and, if necessary, deny the sale of strong encryption products to foreign government and military organizations and to nations of concern. With these three principles in place, the Federal Government would remove almost all export restrictions on encryption products. This approach will provide a stable framework that also will allow U.S. industry to participate in constructing and securing the global networked environment. This approach also maintains reasonable national security safeguards by monitoring the availability of encryption products and limiting their use in appropriate situations. The Administration intends to codify this new policy in export regulations by December 15, 1999, following consultations on details with affected industries and other private sector organizations. However, with this new framework for export controls, the national security organizations will need to develop new technical tools and capabilities to deal with the rapid expansion of encrypted communications in support of its mission responsibilities. The Congress will need to support such new tools and technical capabilities through necessary appropriations. III. Updated tools for Law Enforcement. Because of the need for and use of strong encryption globally, governments need to develop new tools to deal with the rapid expansion of encrypted communications. Updated tools for law enforcement that specifically address the challenges of encryption constitute the third pillar of the new strategy. We cannot ignore the fact that encryption will be used in harmful ways - by child pornographers seeking to hide pictures of exploited children, or commercial spies stealing trade secrets from American corporations, or terrorists communicating plans to destroy property and kill innocent civilians. Even more significant, because cyberspace knows no boundaries and because it is not immediately clear if a cyberattack involves Americans or foreigners, America's national security will increasingly depend on strong and capable law enforcement organizations. This is because the United States military and intelligence agencies have long been restricted by law from undertaking operations inside the United States against American citizens. Accordingly, America's national defense is now increasingly reliant on ensuring that our law enforcement community is capable of protecting America in cyber space. Under existing law and judicial supervision, law enforcement agents are provided with a variety of legal tools to collect evidence of illegal activity. With appropriate court orders, law enforcement may conduct electronic surveillance or search for and seize evidence. In an encrypted world, law enforcement may obtain the legal authority to access a suspect's communications or data, but the communications or data are rendered worthless, because they cannot be understood and cannot be decoded by law enforcement in a timely manner. Stopping a terrorist attack or seeking to recover a kidnapped child may require timely access to plaintext, and such access may be defeated by encryption. Hence, law enforcement's legal tools should be updated, consistent with constitutional principles, so that when law enforcement obtains legal authority to access a suspect's data or communications, law enforcement will also be able to read it. Quite simply, even in a world of ubiquitous encryption, law enforcement with court approval must be able to obtain plaintext so that it can protect public safety and national security. Therefore, we must undertake several important and balanced initiatives. First, we need to ensure that law enforcement maintains its ability to access decryption information stored with third parties, but only pursuant to rules that ensure appropriate privacy protections are in place. To ensure this result, the Administration and the Congress must develop legislation to create a legal framework that enhances privacy over current law and permits decryption information to be safely stored with third parties (by prohibiting, for example, third party disclosure of decryption information), but allows for law enforcement access when permitted by court order or some other appropriate legal authority. Second, since criminals will not always store keys with third party recovery agents, we must ensure that law enforcement has the personnel, equipment, and tools necessary to investigate crime in an encrypted world. This requires that the Congress fund the Technical Support Center as proposed by the Administration, and work with the Administration to ensure that the confidentiality of the sources and methods developed by the Technical Support Center can be maintained. Third, it is well recognized that industry is designing, deploying and maintaining the information infrastructure, as well as providing encryption products for general use. Industry has always expressed support, both in word and in action, for law enforcement, and has itself worked hard to ensure the safety of the public. Clearly, industry must continue to do so, and firms must be in a position to share proprietary information with government without fear of that information's disclosure or that they will be subject to liability. Therefore, the law must provide protection for industry and its trade secrets as it works with law enforcement to support public safety and national security. The law must also assure that sensitive investigative techniques remain useful in current and future investigations by protecting them from unnecessary disclosure in litigation. These protections must be consistent with fully protecting defendants' rights to a fair trial under the Constitution's Due Process clause and the Sixth Amendment. The Administration and the Congress need to work jointly to pass legislation that provides these updated authorities. The Administration is in the final stages of drafting legislation and will shortly submit it to the Congress for consideration. It is imperative to emphasize that the malicious use of encryption is not just a law enforcement issue - it is also a national security issue. The new framework for export controls must be complemented by providing updated, but limited authorities to law enforcement. 5. Conclusion America stands on the pivot point of a crucial time in its ongoing development, and we face once again the on-going debate in this country between individuals' rights and the collective needs of society. The genius of our Constitution is in the balanced way it addressed that debate and in the procedures it created for continuing that discussion as the society and the economy evolved. For our own part, we enter that debate determined to preserve that same balance of the rights and responsibilities that has characterized our country through its history, but we are equally determined not to be thoughtlessly bound to old approaches and old technologies. Our challenge is to adapt our historical approach to the technological challenges we face. We believe the new paradigm described above achieves that objective. We can now see a future with great promise and - and serious consequences - posed by the same technical developments. How well we handle these important challenges will shape the next century. It is far better that we approach these problems from a cooperative perspective. The past years of confrontation must be replaced by an era of collaboration. For only by working together, which is the rich history of this nation, can we ensure our economic viability and protect ourselves from those who would do us harm. # # #
Return to the EPIC Crypto Policy Archive