September 24, 1997

Dear Chairman Bliley:

As representatives of the leading scientific, mathematics, and engineering societies in the United States, we are writing to protest current and proposed U.S. cryptography policies that restrict the open exchange of scientific information and the progress of scientific research and development. We object to national policies that criminalize the use of cryptography that is not approved by the Administration or that mandate domestic key recovery schemes.

The leadership that the United States currently enjoys in research and development of encryption algorithms, cryptographic products, and computer security technology will be seriously eroded, if not essentially eliminated, by misguided proposals to restrict the domestic use of encryption.

  • The development of strong cryptographic technology is crucial to the further growth of our electronic infrastructure. Encryption protects the security and privacy of communications and stored data. A lack of strong universally available encryption exacerbates security problems on personal computers, intranets, and the world-wide Internet. A recent National Academy of Sciences study warned against the government's premature reliance on key recovery as an encryption technique. It urged that the method be deployed in test situations first to work out problems. This has not been done.

  • Our organizations publish numerous scientific journals and conference proceedings, often relying on the Internet for publication. The free exchange of scientific information facilitated by our organizations has significantly increased the economic strength of the United States. But the proposed new laws would continue to force us to exclude members living outside the United States from this free exchange. The result would diminish the scientific reputation of the United States and weaken us economically.

  • It is unreasonable and probably unconstitutional to distinguish between printed and electronic distribution of encryption source code. U.S. policy should not create an artificial distinction between paper and electronic versions of a document.

  • U.S. scientists and engineers involved with research and development of cryptographic tools cannot publish their results using electronic media, are restricted in their efforts to educate the next generation of computer scientists, and cannot communicate with their international colleagues. For example, the U.S. cryptography community has not been able to participate in the Internet Protocol Security project, an effort to develop new international standards for Internet security.

  • Publication restrictions relating to cryptography have a negative impact on peer review and the development of robust algorithms. To demonstrate that encryption algorithms are secure, cryptographers publish their algorithms and other cryptographers try to break them. Not only does this process tend to identify faulty algorithms, but it is also a precondition for the public to have confidence that the algorithm is secure.

  • Computer systems currently are plagued by considerable security and privacy weaknesses. These problems will become more widespread as electronic commerce develops and computer systems become ubiquitous. Cryptographers in the U.S. face numerous barriers when addressing computer security issues, and some security researchers may be unwilling to continue their work because they will be restricted in publishing and discussing their research.

    • In conclusion, we urge you to eliminate current policies that stifle the ability of researchers and implementers to study and build cryptographic algorithms, secure information systems, and secure network protocols. Otherwise, U.S. leadership in many areas of science and technology is likely to be jeopardized with no discernible benefits to our National Interests.

    For more information please contact Barbara Simons at 408/256-3661, Alex Fowler at 202/326-7016 or Lauren Gelman at 202/544-4859.

    Sincerely,