CFP96 Plenary Session

Before the Court: Can the US Government Criminalize Unauthorized Encryption?

APPENDIX

The Cryptography Control Act of 1995

[Pertinent Provisions Only]

Section 1. Congressional Findings.

It is the findings of the Congress that: (a) the acquisition and interpretation of oral, written, and data communications over telecommunications networks, and information stored in written and digital media, are tools which have been historically used for domestic law enforcement and national security purposes, and, whether transmitted or not, affect national and global communications and therefore interstate and foreign commerce; (b) that advances in encryption technology pose a serious threat to the continued ability of law enforcement and national security agencies to make effective use of such tools; and (c) that the inability of such agencies to use such tools in the future would pose an unacceptable risk to the domestic tranquility and to the national security of the United States.

Section 2. Definitions

For the purposes of this Act, the following definitions apply:

(a) "Encryption" means a cryptographic system, whether implemented or not, designed for the purpose of encoding information in a manner which (a) enables any person having the key to that cryptographic system, as used to encode such information, to decode such information; and (b) prevents any person not having such key from decodingsuch information.

(b) "Information" means any data, or string of digits, numbers, or characters, (1) whether oral, written, recorded, or electronic, (2) whether in digital, analog, or other format, and (3) whether or not such information is useful or understandable to the person possessing, using, transmitting, maintaining, or encoding it, or to any law enforcement or national security agency

(c) "Bit" means a single digit, either a zero or a one, used by a telecommunications or computer device to store, process, transmit, encode or decode information.

(d) "Key" means a code used to decode or interpret information which has been encoded using an encryption algorithm or technique.

(e) "Key Length" means the number of bits in a key; if more than one technique, device, or algorithm has been used to encode the same information, then the term includes the sum of the number of bits of all the keys necessary to decode the information.

(f) Authorized Key Escrow Agency means either an agency of the U.S. Department of Justice, designated as such by the Attorney General, or the U.S. Department of State, designated as such by the Secretary of State.

(g) Authorized Key Escrow Designate means a domestic entity, private or commercial, designated by the Attorney General pursuant to rules to be promulgated by the Attorney General.

Section 10. Criminal Prohibitions.

(a) Whoever knowingly encodes information using an encryption technique, device, or algorithm having a key in excess of 64 bits, and which key has not been registered with an authorized key escrow agency, shall be subject to a term of imprisonment of not more than five years, a fine of not more than two hundred fifty thousand dollars, or both.

(b) Whoever knowingly and intentionally possesses, maintains, transmits, distributes, uses, or controls information which has been encoded using an encryption technique, device, or algorithm having a key in excess of 64 bits, and which key has not been registered with an authorized key escrow agency or designate, shall be subject to a term of imprisonment of not more than five years, a fine of not more than two hundred fifty thousand dollars, or both.

(c) Whoever knowingly and intentionally manufactures, creates, designs, distributes, sells, transmits, or possesses with the intent to distribute, sell, or transmit any encryption technique, device, or algorithm having a key in excess of 64 bits, and which key has not been registered with an authorized key escrow agency or designate, shall be subject to a term of imprisonment of not more than ten years, a fine of not more than five hundred thousand dollars, or both.

(d) Whoever knowingly and intentionally distributes, sells, or transmits, outside of the boundaries of the United States, or possesses with the intent to distribute, sell, or transmit outside of the boundaries of the United States, any encryption technique, device, or algorithm having a key in excess or 64 bits, and which key has not been registered with an authorized key escrow agency designate, shall be subject to (1) a term of imprisonment of not less than one year but not more than ten years, and (2) a fine of not more than one million dollars, or (3) both.


Back to CFP Moot Court page

Back to CFP96 home page


Last updated March 9, 1996
cfp96@mit.edu