ACLU Says Latest Actions On Encryption Are a Nightmare for Privacy

FOR IMMEDIATE RELEASE
Thursday, September 11, 1997

WASHINGTON From secret policy meetings to FBI plans for
secretly accessing everyone's phone calls and email to an amendment
that may sink a proprivacy encryption bill, recent actions in
Washington are an evolving nightmare for privacy, the American Civil
Liberties Union said today.

"Privacy in America is being held hostage by a law enforcement community
determined to have access to every email, telephone conversation and digital
communication we transmit," said Donald Haines, Legislative Counsel on
privacy and cyberspace issues for the ACLU's Washington National Office.

"Unfortunately the Clinton Administration, which should be negotiating for
our release, is instead acceding to every demand, while certain members of
Congress are busy gutting proprivacy legislation," Haines added.

The ACLU pointed to several recent developments concerning encryption
legislation that could lead to serious invasions of privacy for all
Americans:
After years of official denials, the FBI has now acknowledged that it is
seeking unprecedented access to domestic communications, including the
ability to read innocent citizens' private email and eavesdrop on all
telephone conversations.

On Tuesday, the House National Security Committee approved by 45 to
1 an amendment to gut H.R. 695, the "Security and Freedom through
Encryption" Act (the "SAFE" bill) by limiting the ability to export
strong encryption abroad. Rep. Adam Smith (DWA) was the one
committee member who voted against the amendment. Today, the House
Intelligence Committee is meeting behind closed doors to vote on the
SAFE bill. These meetings continue to be held in secret despite a
National Research Council report saying that open meetings on this
issue present no danger to national security. "You don't need
decoding software to understand the message of these actions," Haines
said. "All too often, however, that message is never even heard by
the public because decisions are made under the cloak of secrecy."

In perhaps the most ominous development for privacy, the FBI recently
called for legislation allowing the agency access to American's
private email and telephone communications. The agency is now
seeking to build trap doors into encryption products that will
"escrow" (store) the keys for decryption. It is also seeking
authority to force Internet Service Providers, phone companies and
other network operators to provide immediate decryption ability for
any messages that pass through their private systems. Under the FBI's
scheme, neither the service provider nor the agency would give prior
notice to individuals that their encrypted messages are being
intercepted and read.

The agency has said such access is necessary to catch criminals and
terrorists. But FBI Director Louis Freeh conceded that a criminal could
easily avoid detection by using software available from outside of the U.S.
that doesn't contain the key recovery feature.

"The FBI is in effect saying they want a frontdoor key to every American's
house, just in case a criminal happens to be hiding out somewhere. What we
would never tolerate in the physical world the FBI is pushing to make
real in the virtual world," Haines said.

Haines pointed to the closeddoor meeting today of the House Intelligence
Committee to mark up H.R. 695, the SAFE bill, as another example of the
governmental assault on privacy rights. He also noted that every other
committee that has reviewed this bill has done so in open meetings.

A May 1996 report by the National Research Council said that the encryption
policy debate should not be held behind closed doors and that lawmakers did
not need classified information to resolve the issue. "Holding closed
meetings skews the debate in favor of law enforcement and intelligence
agencies seeking wider access to our digital communications," Haines said.

The report's authors, 13 of whom have security clearance to attend
classified meetings, agreed that conducting such policy debates openly would
pose no risk to national security. The report also concluded that current
Administration policy barring strong domestic encryption is bad for law
enforcement and national security because it leaves sensitive U.S.
databases vulnerable to information pirates.

Meanwhile, in Congress, Tuesday's new amendment to the SAFE bill would
undoubtedly lead to a withdrawal of support from the ACLU and others in the
privacy community, Haines said.

The amendment, sponsored by Reps. Curt Weldon (RPA) and Ron Dellums (DCA),
would radically alter the SAFE bill by giving the President and the Defense
Department the power to decide what kind of encryption can be exported.
Allowing strong encryption exports means that American citizens will have
greater access to encryption products.

Encryption programs scramble information so that it can only be read
with a "key" a code the recipient uses to unlock the scrambled electronic
data. Programs that use more than 40 bits of data to encode information are
considered "strong" encryption. Currently, unless these keys are made
available to the government, the Clinton Administration bans export of
hardware or software containing strong encryption, treating these products as
"munitions." The new amendment would have to be reconciled with the original
version of the SAFE bill, sponsored by Rep. Bob Goodlatte (RVA) and Zoe
Lofgren (DCA), and more than 250 other House members. The House Commerce
Committee is also expected to act on this legislation, and it is not clear
whether the bill, with the new amendment, will reach the floor this session.
In response to these continued attacks on privacy rights, the ACLU this
summer launched (A HREF3D"http://www.aclu.org/action/tbyd.html")Take Back
Your Data!(/A), a nationwide citizen campaign to fight for legal reforms to
privacy laws and resist further encroachments on the right to privacy.
Through its website at www.aclu.org, the ACLU urges visitors to contact their
elected officials and voice support for or opposition to pending legislation.
In addition, the ACLU said that it is drafting omnibus privacy legislation
that would, if adopted, fulfill the basic goals of the Take Back Your Data!
campaign. The legislation will be unveiled later this fall, followed by a
broadbased effort to encourage members of Congress to cosponsor the
legislation.