Journal of Information, Law and Technology

Who Holds the Key? – A Comparative Study of US and European Encryption Policies

Sarah Andrews
Policy Analyst
Electronic Privacy Information Center (EPIC)
Washington, DC, USA

andrews@epic.org

This is a refereed article published on: 30 June 2000

Citation: Andrews S, 'Who Holds the Key? – A Comparative Study of US and European Encryption Policies', 2000 (2) The Journal of Information, Law and Technology (JILT). <http://elj.warwick.ac.uk/jilt/00-2/andrews.html>

Abstract
With everyday transactions now being carried out electronically, people need to trust that their private communications are not intercepted or altered as they make their way across global networks. Encryption is currently the only reliable means of securing the confidentiality of such communications and can help citizens and businesses defend themselves against fraud, electronic vandalism and the improper disclosure of confidential information. However, because of its unique ability to conceal data, encryption may also be deployed for illegitimate purposes. This prospect has urged law enforcement agencies and governments to call for restrictions on its use and development. Privacy advocates and business interest groups resist any attempts to limit encryption arguing that to do so would unfairly compromise the privacy of individuals and jeopardise the development of electronic commerce. This paper looks at the tension between the two sides to this heated debate and studies how law makers in the US and Europe have chosen to meet the challenge of regulating this area.

Keywords: Encryption, Digital Signatures, Key Escrow, Key Recovery, Trusted Third Parties, Lawful Access, Export Controls, E-Commerce, Law Enforcement, Privacy Advocates, Human Rights.

1. Introduction
In a society where more and more personal and sensitive data is held in centralised storage units and transferred across digital networks, security and privacy are of utmost importance. With everyday transactions now being carried out electronically, people need to trust that their private communications are not intercepted or altered as they make their way across global networks. If people cannot depend on the confidentiality and authenticity of electronic information, they may revert to more traditional methods of communication and effecting business transactions. As such, the full potential of electronic commerce may never be exploited and the revolutionary opportunity for a global information society may be missed.

Against this backdrop, new and developing cryptographic techniques are of widespread appeal. Cryptography is used to conceal or verify the contents of electronic documents and to protect files from unauthorised access, alteration and theft. The two most important applications of cryptography today are digital signatures and encryption.

Digital signatures can combat the illicit use of information by guaranteeing that the contents of a file have not been altered (integrity) and establishing the identity of a party (authentication). In a world where hand written signatures are no longer appropriate, digital signatures provide a way to protect electronic orders, demands, statements and transfers against fraud. They are created by techniques similar to those used for encryption. Two complementary keys are generated and allotted to a user. One key is kept private and is used for signing, whereas the other key, which is published, is used for verification. This is the less contentious application of cryptographic techniques because it involves authenticating rather than concealing information. Digital signatures are widely recognised as important for the development of e-commerce and the ability to make binding, trust worthy and non-repudiable contracts on-line.

Encryption on the other hand involves coding a text so that it cannot be read if it is intercepted. It is used when people need information to stay confidential. Developed first by the military, in present times it is an ever increasing feature in business and private worlds, where it is used to protect privacy, intellectual property rights and to prevent against fraud. Encryption involves a mathematical process whereby algorithms use a key to encrypt and decrypt messages by turning plaintext to ciphertext and vice versa. With single key encryption both sender and receiver use the same key to encrypt and decrypt messages. The disadvantage of this system is that the sender must get the key to the receiver somehow without it being intercepted. For this reason one of the most important advances in modern encryption was ‘public key encryption’. Developed in 1976 by Whitfield Diffie and Martin Hellman, this asymmetric encryption process revolutionised modern encryption. Under this method, algorithms encrypt messages with one key (public) and permit encryption by a separate, but mathematically related (private) key. Users simply publish their public key, which others use to send them information and then they decrypt that information using their private key. Unless, of course, one has access to the private keys, the only way to read an intercepted message in ciphertext is to break the code. To do this one must try every possible key combination until one gets the readable text. This process is called a brute force search. Naturally, the longer the key the more computing required to crack the code. As the cost of such a search is substantial, and unlikely to be carried out by accidental intruders, even weak encryption can offer a reasonable standard of protection to users against interception.

In the modern world privacy is equated with security of personal information. There are now such vast amounts of valuable information available electronically that the freedom to store, transfer and communicate that information in confidence, constitutes the basic ‘right to left alone’ in information age terms. In this respect encryption is a critical, and presently the only reliable, way of safeguarding the security of electronic information. First developed by governments to protect military and diplomatic communications, encryption is now vital to wide variety of people. For example, human rights groups and journalists rely on encryption to protect their identity and communications against surveillance by the governments they are monitoring. Businesspeople need encryption to safeguard sensitive business materials, such as client records, professional communications or trade secrets. Consumers depend on encryption to secure their personal and credit card details against theft or misuse when transacting in the on-line world. Finally, ordinary individuals, who have come to view privacy as integral part of life in a democracy, demand encryption for their electronic communications.

Used legitimately, therefore, encryption can help citizens and businesses defend themselves against fraud, electronic vandalism and the improper disclosure of confidential information. Unfortunately, however, because of its unique ability to conceal data, encryption may also be deployed for illegitimate purposes. This prospect has urged law enforcement agencies to call for restrictions on unbreakable encryption. Privacy advocates and business interest groups resist any attempts to restrict encryption arguing that to do so would unfairly compromise the privacy of individuals and jeopardise the development of electronic commerce. The search for a cryptographic policy, which balances the needs of users, governments and the international community, has not been smooth, and in certain countries the debate has become the centre of considerable controversy.

This paper studies how law makers in the US and Europe have chosen to meet the challenge of regulating this area. The paper begins by summarising the main arguments of pro and anti-encryption groups. It then outlines international instruments governing this area before moving on to comparatively study various legislative proposals in the US and Europe. These policies are analysed within their political backgrounds and where possible, explanations for their adoption are suggested. The reader will note that this is not an exhaustive study. In particular, with the exception of the UK, individual policies of European Member States are not looked at separately but rather treated under the heading of the European Union. The reason for this is that, in general, the policies of European countries are aptly reflected by European Union initiatives and may be easily contrasted with those of the US. The UK, on the other hand, has taken a different approach to its European partners and for many years has mirrored US proposals to restrict the use of strong encryption. It therefore, seems appropriate to divide encryption policies in the Western world into three main sections the US, the European Union and the UK.

2. A Polarised Debate
2.1 The Arguments Against Strong Encryption
As the use of cryptography moves out of the defence world and becomes accessible to private individuals and companies, governments and law enforcement agencies fear that it will lead to an increase in crime. They argue that, in the extreme, it could lead to a breakdown in society, where criminals and terrorists will plot their schemes free from interception using encrypted communications. FBI Director Louis Freeh, in his speech to US Senate Subcommittee on Terrorism, Technology & Government Information, stated:

‘If we are unable to access and decrypt real-time…conversations of criminals and people who would commit horrible crimes…we will be hard up to defend the country in many respects…Unbreakable encryption will allow drug lords, spies, terrorists and even violent gangs to communicate about their crimes and their conspiracies with impunity.’ (Freeh; 1997)

In response to these fears many governments would like to restrict the import, export and domestic use of encryption technologies. Whereas absolute restrictions on the right to use encryption products are uncommon among Western countries, some have proposed a more subtle type of restriction which implement key recovery or key escrow systems. The difference between key escrow and key recovery systems is a technical one and they are treated as one concept within this paper.  Both involve third party covert access to private keys or the ability to access data in the plaintext outside the normal decrypting process. Essentially these systems mandate storing copies of private encryption keys, or information about these keys, with government agencies or with independent commercial bodies, known as Trusted Third Parties (‘TTP’s’). These central storage units would then be obliged to hand over private keys to law enforcement officials when served with a court warrant. Surprisingly, for a nation that lays such claims to true democratic freedom, it is the US which has been the chief advocator of such restrictions. Consequently, they are primarily dealt with in this paper as a US issue and will be concentrated on in further detail below.

2.2 The Arguments Against Key Recovery
As might be expected, civil liberties and business interest groups around the world have vehemently rejected all government initiatives, such as key escrow or key recovery, which compromise the total security offered by encryption. Although these anti-restriction organisations concede that terrorism and violence must be controlled, they do not regard the threat of increased terrorist or criminal activity as justifying the level of invasion of privacy proposed by some governments. International privacy advocates, such as the Electronic Privacy Information Centre <http://www.epic.org/> the Electronic Frontier Foundation <http://www.eff.org/>, Privacy International <http://www.privacyinternational.org/>, Cyber Rights & Cyber Liberties (UK) <http://www.cyber-rights.org/>, and the Global Internet Liberty Campaign <http://www.gilc.org/>, have rallied together to present a unified resistance to any such restrictions on user rights to choose strong, unescrowed encryption. These groups regard controls on encryption as detrimental to the security of electronic communications and an unjustified restriction on fundamental privacy rights.

Similarly, the business industry is strongly critical of all restrictions on encryption, arguing that they weaken the potential of electronic commerce. From their viewpoint, encryption stands alone as the most reliable way to protect on-line users against fraud and misuse of their personal information. Compromising this, they say, may deter ordinary individuals from transacting business on-line, thus stifling the growth of electronic commerce in general. The following are the among the most common arguments put forward by these civil liberties and business interest groups.

2.2.1 Key Recovery Systems Violate the Right to Privacy
Privacy advocates contend that the only way to protect the privacy of digitally held information is by encryption and thus that any restriction on use, or demands for lawful access, run directly counter to the basic human right to privacy which is enshrined in many international treaties, constitutions and laws. Although they recognise that privacy of information has always been compromised in the interests of national security, they claim that key recovery proposals would allow considerably more access to private information than traditional laws authorising the interception of communications networks and are, therefore, heavily weighted in favour of law enforcement and government agencies rather than private individuals.

2.2.2 Key Recovery Systems are Ineffective Crime Prevention Methods
The basis of this argument is that key recovery systems will be ineffective against criminals who will simply use other non-escrowed methods or multi-layered encryption to avoid detection. Anti-restriction activists comment that criminals are highly unlikely to use key recovery products as the penalties they will face for unlawfully using restricted encryption products will be much less severe than those for the crimes they are plotting. (Akdeniz et al; 1997, p9) Thus, they claim that key recovery jeopardises the safety of millions of users in the vain hope of catching a few law breakers.

2.2.3 Key Recovery Systems are Inherently Dangerous, Costly and Insecure
It is generally thought that key recovery systems, whereby the private keys of encryption users are stored with government agencies or independent Trusted Third Parties, open up a huge potential for abuse. Critics of key recovery systems say that any centralised structure storing such valuable information will undoubtedly become a target for attack by invaders, who will exploit either systems failure or human weakness to illegally gain access to private information. (Clayton, R., 1998, p4) Moreover, it is argued that to build and maintain such a complex infrastructure at a global level is beyond current technical capacities and would involve unacceptably high costs.

2.2.4 Key Recovery Systems Jeopardise Digital Signatures
As we have seen, because digital signatures merely authenticate rather than conceal information, they are not the focus of law enforcement concerns. However, it is argued that key recovery systems may also be detrimental to the effectiveness of these authentication services as in reality most people use the same key for both digital signatures and encryption. Thus, it is shown that even where key recovery proposals do not mandate storing signature keys with a government agency or Trusted Third Party, implementing them will deny individuals and businesspeople not only the right to conceal private information but also the capacity to fully endorse their communications. (NRC, 1996, chapter 4.1.3)

2.2.5 Key Recovery Systems Are Ultimately Damaging to Electronic Commerce
Anti-restriction advocates, particularly members of the business community, are concerned that if people cannot rely on the confidentiality of their electronic communications they may reject this system in favour of the traditional one, under which all of their documents are not subject to the scrutiny of the government.

Although there has always been provision for the interception of communications, the prohibitive cost of doing so often served as a deterrent to wide-scale surveillance. New surveillance capabilities, however, make it much easier and cheaper to track electronic communications and could be used to monitor all citizens rather than only those under suspicion of illegal activity. It is thus argued that without strong unescrowed encryption people may shy away from modern services such as teleshopping, telebanking, teleworking, and teleconferencing, which depend on large amounts of information being available on line, and that the full potential of electronic commerce may never be reached. (COM (97) 503, p17.) (EC; 1997b.)

Finally, advocates of strong encryption point out that encryption can actually benefit law enforcement and government agencies. Electronic crime today has significant costs for governments, businesses and private individuals. (COM (97) 503, p17.) (EC; 1997b.) Encryption can help reduce these costs by preventing the piracy of intellectual property and the interception of sensitive information such as credit card and pin numbers, corporate secrets, medical records and personal communications. As the job of law enforcement and national security agencies is ultimately to prevent crime, electronic or otherwise, in this respect, at least, their interests converge with those of private individuals and businesses in favour of the free use and availability of strong encryption.

3. International Instruments
Electronic commerce is essentially a global phenomenon and therefore international organisations have an interest in harmonising the development national policies in this area. Although there are, as yet, no binding international instruments governing encryption, important initiatives have been taken to set out a framework for its use, availability and export.

3.1 The Organisation for Economic Co-operation and Development (OECD)
To emphasise the importance of cryptography in today’s society and to promote international co-operation in the development of cryptography policies, in 1996 the Organisation for Economic Co-operation and Development (OECD) <http://www.oecd.org/>, set up an ad hoc group of experts to draft ‘Guidelines for Cryptography Policy’. During the consultation period, the OECD came under increasing pressure from the US, who was trying to use this as an opportunity to gain international support for their key recovery proposals. The OECD proved more influenced by civil liberties concerns however, and the final Recommendation of the Council concerning Guidelines for Cryptographic Policy <http://www.oecd.org/dsti/sti/it/secur/prod/e-crypto.htm>, released on March 27, 1997, set out a out a generous framework for encryption policies. Containing eight principles in total, the guidelines stress the importance of the availability and choice of strong encryption products subject to proportionate and effective measures to safeguard law enforcement needs. For example, principle 2 proposes that users should be entitled to choose any cryptographic product; principle 5 sets out that the fundamental right to privacy should be respected in national cryptography products and principle 6 states that national policies ‘may’ provide for lawful access in certain situations but makes no mention of key recovery methods and concludes firmly that these policies must ‘respect the other principles contained in the guidelines to the greatest extent possible.’

Although, resolutions by the OECD do not form binding international law, they are highly influential and provide clear principles for member states when developing national policies. For this reason, it was of crucial significance for pro-encryption activists world-wide, that these guidelines did not explicitly endorse key recovery proposals. In particular, the OECD stance was seen as an indirect criticism of the US attempts to implement such polices at home.

3.2 The Wassenaar Arrangement on Export Controls for Dual-Use Goods and Technologies and Conventional Arms
The Wassenaar Arrangement (WA) <http://www.wassenaar.org/> replaces the Co-ordinating Committee on Multilateral Export Controls (COCOM) which existed during the Cold War-era. It was established in 1995, and seeks to foster regional and international stability among its 33 member states by controlling trade in conventional arms and dual use-goods and technologies. Like the above OECD resolution, the WA is not a binding international treaty or law. It merely sets out a framework for national policies by specifying the items to be subject to export controls on a Control List. This list is then implemented into national export control policies on a discretionary basis. All decisions relating to individual export licences remain the responsibility of each Signatory State.

As cryptography products are recognised as having both civilian and military capabilities they are subject to export restrictions under the WA Dual-Use Control List. Prior to 1998 all encryption products, except mass market or public domain software, were classified as dual-use items. During the December 1998 review of the lists, however, new cryptography guidelines removed controls over some products, including those used solely for authenticity purposes (e.g. Digital Signatures) and encryption products not exceeding 56 bit algorithms. On the other hand, the new List increased control over encryption hardware and software products with algorithms of over 64 bits. There was extensive lobbying of Participating States by privacy advocates prior to these 1998 Plenary meetings. For example the Global Internet Liberty Campaign (GILC) <http://www.gilc.org/>, issued a Member Statement <http://www.gilc.org/crypto/wassenaar/gilc-statement-998.html>, calling for the removal of all encryption products from the Wassenaar Arrangement, arguing that controls on cryptography, a defensive mechanism, are not justified under the terms of the WA. This campaign was successful to a limited extent only and critical cryptographic products still find themselves regulated under the WA. It is significant to note, however, that once again US efforts to gain international approval for their key recovery proposals failed and the new Control List makes no concessions for the export of such products.

3.3 The Council of Europe
The Council of Europe was established in 1949 with the aim of bringing European states closer together in the ‘pursuit of peace based upon justice and international co-operation’ and the ‘preservation of human society and civilisation’ (Statute of the Council of Europe; 1949). There are currently 41 signatory members. Unlike European Union law, Conventions and Agreements passed by the Council of Europe are not statutory acts. Therefore, in order to become binding law, a treaty must be signed and ratified by the signatory states.

The Council of Europe has previously issued recommendations on the issue of computer crime. In 1995 it issued a Recommendation <http://www.privacyinternational.org/intl_orgs/coe/info_tech_1995.html> concerning ‘Problems of Criminal Procedure Law Connected with Information States’ in which it recommended measures ‘to minimise the negative effects of the use of cryptography on the investigation of criminal offences.’ It is currently working to produce a Convention on Cybercrime which would harmonise national computer crime provisions and encourage international co-operation among law enforcement bodies. On April 27, 2000 the Committee of Experts on Crime in Cyberspace released a draft <http://conventions.coe.int/treaty/en/projets/cybercrime.htm> of this convention for public comment. The proposal deals with international law enforcement issues and is said to have been written in part by U.S Department of Justice officials. (McCullagh, D; 2000). It would make mutual legal assistance and extradition available on a permanent basis, authorise computer searches and seizures and require lawful access to encryption keys and plaintext. Provisions on the interception of data are also being discussed but have not yet been included in the draft. The text is expected to be finalised by a group of experts by December 2000 and could be adopted for signature as early as Autumn 2001. Non-member states such as Canada, Japan, South-Africa and the United States have also been active in the drafting process and are expected to approve the final treaty. Civil libertarians and privacy advocates worldwide are currently working on a united opposition to these expanded powers.

3.4 Group of 8 (G8)
The Group of 8 (G8) is made up of the leaders of the world’s top industrialised countries. The group has met on many occasions to discuss the problems facing law enforcement in the digital era and the need for co-operated efforts to reduce cybercrime. At the urging of the United States, the heads of State recently met with industry leaders in Paris to develop recommendations for the G8 summit to be held in Okinawa in July 2000. Citing this years denial of service attacks and the recent ‘Love Bug’ as examples of threats to security and confidence in cyberspace, the G8 leaders unanimously called for the public and private sector to work together to find solutions to criminal behaviour on the internet. Despite concerns from the industry groups, the heads of state expressed support for the Council of Europe’s draft Convention and re-iterated the need for international co-operation among law enforcement.

4. US Policies
Turning now to national encryption policies, it is perhaps appropriate to begin with a study of the situation in the US. As the undisputed leader in the technological fields, the US is uniquely poised to influence international trade and policies on encryption. Consequently, any resolution of the controversial encryption debate in that country may have an impact far beyond national borders. In addition, the US policies in this area are particularly interesting when we consider that, although the US prides itself on being a free and open society, it has been one of the most avid advocators of restrictions on the right to use and export encryption in the democratic world.

4.1 Export Restrictions and Constitutional Challenges
In an effort to safeguard national security and foreign intelligence gathering capabilities, the US Government has long placed strict export controls on encryption technologies. Its policy has been to exploit the confidentiality benefits of strong encryption to protect US military and diplomatic communications, while denying them to foreign adversaries. (NRC; 1996, Chapter 8.1.3.) Although the more repressive of these controls have recently been relaxed, (see below) restrictions on the export of encryption products still exist and continue to attract public criticism.

Originally, export controls were regulated under the International Traffic in Arms Regulations (ITAR), which placed restrictions on programs using algorithms of greater than 40 bit key length. ITAR provided for a ‘commodity jurisdiction’ procedure by which a determination could be made as to whether a specific item came under the United States Munitions List. If it was found to do so, the item required a licence before it could be exported. Munitions licences were granted by the Department of State on a case by case basis.

In the well-known trilogy of cases referred to as Bernstein I, II and III, the constitutional validity of this licensing system was challenged. Daniel Bernstein had developed an encryption program, called ‘Snuffle’ while a graduate student at the University of California at Berkley. As ITAR defined ‘export’ to include divulging data to any foreign person, whether in the United States or abroad, he was advised that he might infringe the regulations by publishing his work on the Internet or teaching it to foreign nationals in his classes. He, thus, applied to the Department of State for a ‘commodity jurisdiction’ determination to see whether his program was classified as a munition under ITAR. He filed separate commodity jurisdiction requests for the source code of Snuffle and three accompanying academic papers explaining the program. The export authority classified both items as munitions and held them to be subject to controls. He was denied permission to distribute his software and academic files. Bernstein subsequently took an action against the Department of State claiming that the licensing scheme under ITAR violated his First Amendment right to free speech.

In Bernstein I, (Berstein v United States Department of State, 922 F. Supp. 1426) the District Court for the Northern District of California rejected the Department of State’s motion to dismiss the case for lack of justiciability, holding that source code constitutes speech within the meaning of the First Amendment.

In Bernstein II, the Court looked at the substantive issue and held that the licensing system under ITAR, which gave the export authority exclusive and absolute discretion to decide whether or not to grant licences, was a ‘paradigm of standardless discretion’ and constituted an unconstitutional prior restraint of speech. (Berstein V United States Department of State, 945 F. Supp. 1279 at 1289) The effect of this ruling was to remove cryptographic technologies from the export controls list. To thwart the result of this decision, the Clinton Administration transferred responsibility for exports of cryptographic technologies from the Department of State to the Department of Commerce and amended the Export Administration Regulations (EAR) of the Department of Commerce to essentially replicate the impugned ITAR controls on cryptographic technologies.

In Bernstein III (Bernstein v. United States Department of State, 974 F. Supp. 1288) these new regulations were subject to challenge. The Californian District Court upheld it’s earlier ruling and found them to be unconstitutional. The Government appealed this decision to the US Court of Appeals. On May 6th, 1999 the Ninth Circuit Court of Appeals once again decided the case in favour of Bernstein. In September 1999, the Court granted the government’s petition for rehearing ‘en banc’ of this case. However, this hearing was postponed in light of an announcement by the government that it intended to issue new export regulations. The case has now been remanded to the District Court to rule on the constitutionality of these new regulations.

It is difficult to predict definitively the outcome of this case. As we will see the export rules have now been liberated to such an extent that the Court may no longer be able to find them as blatantly unconstitutional. However, whatever the final decision may be, this case has so far represented a major triumph for all encryption advocates and has no doubt been a driving force behind the new export regulations.

4.2 Liberalisation of Export Policies
Apart from first amendment challenges, the US export policy has been criticised for other reasons. Civil liberties groups, for example, have always opposed any export restrictions claiming that they constitute de facto restrictions on the domestic use of strong encryption. They argue that as software companies are slow to produce different versions of the same product, one for domestic use and one for export, imposing strict export controls leaves US citizens with access only to unacceptably weak encryption products. (Froomkin, 1996, p3) Business interest groups have also disapproved of these controls on the grounds that they undermine the competitiveness of US software companies. They consider that restricting these companies from exporting strong encryption products excludes them from the global market and allows foreign competitors to take the lead in this area. Influential support for these arguments was found in the 1996 report by the National Research Council’s entitled, ‘Cryptography’s Role in Securing the Information Society’ (CRISIS Report). There it was concluded that as encryption ‘diffuses readily through national boundaries’, it is not possible to delay its use and availability abroad on the long term and thus that the strict export policy should be ‘progressively relaxed’. (NRC; 1996, Chapter 8.2)

Ceding finally to this pressure for reform, in September 1998 the Clinton administration announced a new policy to somewhat liberalise the strict export regime. These regulations, however, did not satisfy privacy advocates, who complained that by encouraging key recovery products in the new export laws, the government was still jeopardising individual privacy rights and computer security in favour of law enforcement interests. (EFF; 1998) These activists continued to fight export controls and pushed for public support of legislative proposals such as the ‘Security and Freedom through Encryption (SAFE) Act’ to liberalise the export regime.

SAFE was first introduced in 1996 by Representative Bob Goodlatte and proposed a prohibition on domestic use restrictions and the liberalisation of export controls. During the summer of 1999 a re-draft of this Bill (H.R. 805) passed through five Committees in the House of Representatives and was due to be voted on by House members some time in late September. Commanding an overwhelming public support and with 258 bipartisan cosponsors, this Bill looked set to be approved by Congress. The final vote on its passage, however, was stalled at the last minute in light of a White House Announcement <http://www.pub.whitehouse.gov/uri-res/I2R?urn:pdi://oma.eop.gov.us/1999/9/16/15.text.1> on Sept 16, 1999 declaring an intention to revise the export laws.

These much awaited regulations implementing the September announcement were issued <http://204.193.246.62/public.nsf/docs/60D6B47456BB389F852568640078B6C0> on Jan 12, 2000 by the US Department of Commerce Bureau of Export Administration (BXA) and took effect on January 14 following publication in the Federal Register.  The following is a summary of the major changes implemented by the new regulations:

•	encryption products of any key length may now be exported to non-government end users after a one time technical review of the product.

•	‘Retail’ encryption products, defined as ‘those which are widely available and can be exported and re-exported to anyone..... and can be used to provide any product or service’ (Dept. of Commerce (US); 2000) are eligible for export to any end user including foreign governments.

•	In accordance with the 1998 revisions of the Wassenaar Arrangement, mass market products with key lengths of up to 64 bits key length may now be exported without a license after a technical review.

•	Foreign nationals working within the US no longer need an export licence to work for U.S. firms on encryption. In addition, U.S. firms may export encryption items of any key length to their foreign subsidiaries without a technical review.

•	The export controls for source code are relaxed in that encryption source code freely available to the public may now be exported under a license exemption without a technical review. The exporter must, however, submit a copy of the source code, or a written notification of its Internet location, to the Bureau of Export Administration by the time of export. There is no longer a review requirement for the re-export of foreign products made with the unrestricted source code. Most ‘open source’ software will benefit from this license exception.

Although business industry groups are stated to be ‘extremely gratified’ by this breakthrough in the export regime, privacy advocates argue that the new regulations do not go far enough. In a joint statement <http://www.epic.org/crypto/export_controls/joint_release_1_00.html> issued by the Electronic Privacy Information Center (EPIC) <http://www.epic.org/>, the American Civil Liberties Union (ACLU) <http://www.aclu.org/>, and the Electronic Frontier Foundation (EFF) <http://www.eff.org/>, the new rules were criticised as placing a ‘regulatory maze’ in the way of the free export of encryption and thus a truly secure Internet. In particular, the requirement to notify the government of the electronic export of ‘publicly available’ source code and to obtain a license for ‘restricted’ source codes or those not ‘publicly available’ was said to impose unconstitutional requirements on Internet speech.

In light of these criticisms the outcome of the Bernstein case is eagerly awaited. It will be interesting to note whether the Court will again accept the views of privacy advocates and boldly denounce these latest regulations as a continuing violation of the right to free speech, thereby opening the door, once and for all, for a decontrolled export regime for encryption products.

4.3 Domestic Use Proposals
Over the last number of years, the US government has proposed domestic controls on the use of encryption which would enable law enforcement officials to legally access encryption keys when necessary. Despite repeated attempts, this objective has not yet formally succeeded, and to this day there are no restrictions on the domestic availability of strong encryption products.

The first attempt to restrict domestic use came in 1993 when the Government developed the Escrowed Encryption Standard Initiative. This initiative, which was implemented in the Clipper Chip, was aimed at providing citizens with a good level of security for communications while at the same time preventing transmission of data in total secrecy. ‘Clipper’ was a hardware solution using key escrow technology. It proposed that every single modem, telephone, fax machine or other piece of communications equipment manufactured or sold in the United States would have had to carry a Clipper Chip, to which a master key would be held in escrow for access by law enforcement. This special key would be held in two parts by the US Justice Department and the National Institute of Standards and Technology. In order to decrypt data, law enforcement agencies would have to get a court order permitting the retrieval of the two components. An outraged public and computer industry, claiming that this proposal would both violate fundamental civil liberties and greatly reduce foreign demand for national products, ensured that this highly invasive hardware solution never passed into law.  In the years to follow, however, there were several effective reformulations of the Clipper system. Although these new proposals were primarily based on software and involve mandatory key recovery rather than escrow, they essentially relied on the same principle as Clipper and were consistently criticised by privacy advocates and constitutional watchdogs. These groups argued, in particular, that such proposals violated the Fourth Amendment to the U.S. Constitution. This Amendment protects the right to freedom from unreasonable searches and seizures and lays down specific requirements for the issuing of warrants. Key recovery was said to violate this provision by not respecting the traditional ‘notice and knock provisions that must be satisfied before a warrant could be executed’ and by vesting ‘vast powers in third-party agents who have neither the incentive nor knowledge to contest any government intrusion.’ (Epstein R. A.; 1998, p8) In addition, key recovery and escrow proposals were criticised on Fifth Amendment grounds. It was claimed that by compelling a user to disclose his/her private key to the government, these proposals could result in uncompensated taking of private property contrary to the Fifth Amendment. (Rotenberg, M.; 1993)

Although the government now seems to have moved away from key recovery, unfortunately this does not mean the end of attempts to authorise access to encryption keys. In February 2000, the Department of Justice published ‘The Electronic Frontier: The Challenge of Unlawful Conduct involving the Use of the Internet’, (Dept. of Justice (US); 2000), in which it expressed concerns about anonymity on the internet and called for expanded law enforcement authority and access to information. As we have seen the U.S has repeated these recommendations on the international front with the recent developments by the Council of Europe and the G8 being accused of showing all the signs of US policy laundering. (Banisar D.; 2000)

Also pending in the US is the Cyberspace Electronic Security Act of 1999 <http://www.epic.org/crypto/legislation/cesa/bill_text.html> which was drafted by Department of Justice officials and transmitted to Congress on September 16, 1999. As it currently stands the Bill has four central prongs

•	Recovery agents are prohibited from disclosing or using recovery information to decrypt data, except where those disclosures are authorised by law.

•	Government agents may obtain court orders to access to decryption information where

‘(1) the use of the stored recovery information is reasonably necessary to allow access to the plaintext of data or communications;
(2) such access is otherwise lawful;
(3) the governmental entity will seek such access within a reasonable time; and
(4) there is no constitutionally protected expectation of privacy in such plaintext, or the privacy interest created by such expectation has been overcome by consent, warrant, order, or other authority.’ (2712 (b))

•	A fund of $80 million is authorised for the FBI’s Technical Support Centre to bolster law enforcement capabilities to respond to the use of encryption by criminals.

•	The confidentiality of sensitive investigative and decryption techniques of government entities are protected by prohibiting their disclosure in litigation or criminal trials.

The Bill contains no provisions to promote key recovery and, in contrast to the earlier draft, does not include draconian search and seizure provisions which would have enabled law enforcement agents to obtain search warrants to surreptitiously enter private homes and offices, search computers for passwords and decryption keys, and to install recovery devices to override encryption programs. Nevertheless, civil liberties groups are still critical of the Bill claiming that it does not adequately protect the privacy of decryption keys. The powers laid down for police seizure of keys are said to be contrary to the Fourth Amendment, because they do not require ‘probable cause’ and contemporaneous notice for the issue of a search warrant in accordance with the Constitutional requirement. Rather, CESA bases issue of a search warrant upon obscure requirements such as a finding that there is ‘no constitutionally protected expectation of privacy in such plaintext.’ Notice must only be given within 90 days of the disclosure and there is even provision for the indefinite postponement of notice ‘on the government’s ex parte showing of good cause’. (Section 2712 (c)). In addition it is argued that by allowing government agencies to use decrypted evidence in court without revealing how they descrambled it, denies the defendants’ rights to a fair trial under the Due Process clause and the Sixth Amendment.

Interestingly, it has been suggested that CESA was introduced at the same time as the government announced its intention to relax export controls, in order to re-institute law enforcement powers ‘taken away’ by the new export regulations. (Koops, B. J.; 2000) It is, therefore, critical that civil liberties groups continue to monitor the passage of this bill and US activities on the international level in order to stop the introduction of unacceptable powers for law enforcement. Only then will there be a realistic translation of the traditional right to personal freedom and privacy into the cyber-law era.

5. The European Union
Although there has not yet been formal harmonisation of encryption policies among EU Member States, in general and with the exception of the UK, these countries are unified in their commitment to a liberal framework for encryption regulations. For this reason, rather than detail the individual policies of every Member State this paper treats the policies of the European Community as reflecting the overall mood of European countries towards this issue.

5.1 Export Restrictions
The export laws of Member States concerning encryption products are uniformly regulated under European law. At present the governing legislation is the Dual Use Regulation, (EC) No. 3381/94 which was introduced in 1994 and is closely modelled on the Wassenaar Arrangement. This regulation establishes a common framework for export of all dual use goods and sets out a list of dual use goods, destinations and guidelines which all Member States must recognise. Under this regulation, most encryption products may only be exported to countries outside the EU on foot of a licence. Member States are also obliged to exercise a licence procedure, for a transitional period, for intra-Community trade of certain particularly sensitive products, including encryption technologies. A ‘General Technology Note’ and a ‘General Software Note’ exclude information and software within the public domain from the Controls List. The control list was updated in March 1999, by Council Decision 1999/193/GASP to take account of the new Wassenaar regulations. Now, mass-market cryptography of any key length can be exported within the EU on a general license.

In 1998, responding to criticisms of this regime, the European Council published its Proposal for a Council Regulation (EC) setting up a Community regime for the Control of Exports of Dual-use Goods and Technology, (COM (1998) 257 final). This document proposed a new regulation to replace the current export system which was stated to be ‘too cumbersome to be useful in practice’. The new regulation, would have replaced the current licence procedure for Intra-Community trade with a simple notification procedure. As the free movement of goods is one of the fundamental principles of the EU itself, there is a clear need for a new system to facilitate the easy and efficient trade in encryption among community members. As of time of writing, however, there is still no record of its implementation.

5.2 Domestic Use Restrictions
Divergences in laws on encryption among EU member states are widely recognised as damaging, not only to the working of the internal European market, but to electronic commerce in general. Unfortunately, however, as yet, there is no definitive guidance from the European Union concerning the domestic use and availability of encryption products, and member states can only rely on policy statements to take their lead when regulating this area.

One of the first suggestions of a measure to regulate the use of encryption came in 1997. In its April 1997 Communication document, ‘A European Initiative in Electronic Commerce’ (COM (97) 157 final), (EC; 1997a), the European Commission announced an intention to create a policy aimed at guaranteeing the free movement of encryption products as well as preparing a specific initiative on digital signatures. The next significant activity took place with the Global Information Networks Conference <http://158.169.50.95:10080/bonn/conference.html> when ministers of 29 European countries met in an effort to agree on key principles governing the use of global information networks. Organised jointly by the European Commission and the Federal Republic of Germany this conference was held in Bonn in July 1997. Participating members re-iterated the OECD guidelines and stressed the vital role of strong encryption technology in the development of the global information society. They made a commitment to achieving the ‘international availability and free choice of cryptography products and interoperable services’ and specifically provided that all measures taken to ensure lawful access must be ‘proportionate and effective and respect applicable provisions relating to privacy’. (Bonn Ministerial Declaration, No. 36 <http://158.169.50.95:10080/bonn/final.html>).

Following this conference and perhaps encouraged by the unanimity of participants, in October 1997, the European Commission released a Communication paper entitled ‘Towards a European Framework for Digital Signatures and Encryption’ (COM (97) 503) (EC; 1997b). In this document, the Commission emphasised the exigency of the situation and signalled an intention to establish uniformity at European level, stating:

‘An EU Policy framework for ensuring security and trust in electronic communication and safeguarding the functioning of the Internal Market is therefore urgently needed. The European Union simply cannot afford a divided regulatory landscape in a field so vital for the economy and society.’ (COM (97) 503, p1) (EC; 1997b)

Advancing along the lines of the OECD guidelines and the Bonn Ministerial Declaration, the Communication paper clearly recognised encryption as an indispensable component of secure and trustworthy electronic commerce. Finally, the prospect of a harmonised and liberal framework for encryption policies appeared within reach. In contrast to the US attempts to promote key escrow and key recovery systems which were taking place at the time, the Commission expressed such restrictions on the use of encryption to be dangerous, costly and ineffective and concluded that any regulations should be ‘limited to what is absolutely necessary.’ (COM (97) 503, p17) (EC; 1997b).

In trying to understand why the European Commission took such a radically different approach to the US in respect of encryption, it may be useful to look at the fundamental role of informational privacy in both the US and Europe. In the US, for example, there is no specific law protecting the right to privacy of personal information. Protection in this area is governed by a piecemeal collection of constitutional and statutory laws, and self imposed industry regulations. In Europe, on the other hand, privacy rights in personal information are protected by binding EU Data Protection Directives. For example, Directive (95/46/EC) places stringent controls on the use of data and requires controllers to use state of the art technologies to ‘protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network...’ (Article 17). In addition, Directive 97/66/EC requires Member States to ‘ensure via national regulations the confidentiality of communications…….(and to) prohibit listening, tapping, storage or other kinds of interception or surveillance of communications, by others than users, without the consent of users concerned,’ (Article 5). As cryptographic techniques are the only realistic means of ensuring data security and confidentiality, a case could, therefore, be made that any restrictions on the right to use encryption are contrary to the provisions of these Directives.

5.3 Need for More Definitive European Guidance
As Communication papers are generally taken as an indication that there will be a Council Directive issued in that area, it was believed that the Commission would go on to implement these liberal policies in a measure which would be binding on all EU Member States. Three years later however, hopes are beginning to fade and the much-desired guidance from the Commission is not forthcoming. The only recent evidence of Europe’s continued position in favour of secure communications is a vague reference in the recent Electronic Commerce Directive <http://europa.eu.int/comm/internal_market/en/media/eleccomm/index.htm>.  Recital 15 of that Directive acknowledges that Article 5 of Directive 97/66/EC guarantees the confidentiality of communications and requires Member States to ‘prohibit any kind of interception or surveillance of such communications by others than the senders and receivers.’

Although it is significant that cryptography is seen as an important part of establishing a coherent legal framework for electronic commerce within the Single Market, this is no supplement for definitive guidance on encryption. A fragmented approach to encryption technologies among European countries would be uneconomical and impractical. In addition, given the repeated attempts of the UK to implement strict restrictions on the free use and availability of encryption (see below), such guidance may be needed to safeguard the privacy rights and fundamental freedoms of European citizens.

6. UK Proposals
Notable for its historical support of the US position, the UK stands alone in Europe regarding encryption policies. This support is evidenced by its proposals to restrict the use and availability, rather than export, of encryption technologies.

6.1 Export Controls
The UK regulates the export of cryptographic products in accordance with the EU Dual Use Regulation and the Wassenaar Arrangement on Export Controls for Dual-Use Goods and Technologies and Conventional Arms. The implementing legislation is the UK through the Export of Goods (Control) Order 1994 as amended by the Dual-Use and Related Goods (Export Control) Regulations 1996. The is currently no regulation of exports by intangible means although this was recommended in a 1998 Department of Trade and Industry (DTI) White Paper on Strategic Export Controls, (section 3.2.1) (DTI; 1998b). The government has also suggested that streamlining the procedures for ‘the export of cryptographic products which facilitate legal access through a third party’ (DTI; 1999a, paragraph 47), however, this proposal has been uniformly rejected and is unlikely to resurface.

6.2 Domestic Controls
As yet there are no import restrictions or domestic use controls on encryption products in the UK. In June 1996 the UK Department of Industry published a paper on ‘Regulatory Intent Concerning Use of Encryption on Public Networks’ (DTI; 1996). This paper was followed by the March 1997 Public Consultation Paper, on ‘Licensing of Trusted Third Parties for the Provision of Encryption Services’ (DTI; 1997). This policy document was alarmingly similar to the US Clipper Chip and subsequent initiatives. Although there was no provision made for official constraints to be placed on user choice of encryption products, the proposed scheme effectively implemented domestic use restrictions in the form of mandatory key recovery. The document proposed that any organisation (rather than individual) offering cryptographic services (such as Certification Authorities, Key Escrow Agencies and other TTPs) would require a licence. Every user would be obliged to lodge his/her private keys with these licensed bodies who would hold the keys in centralised storage units with the possibility of recovery by law enforcement. Law enforcement agents would be able to access these keys on receipt of a judicial warrant and the user would not be informed that his key had been disclosed. Essentially, therefore, this system would give the Government power to intercept and monitor all digital communications between those living within the country and those exchanging information with others outside the country.

These proposals met with considerable criticism from civil liberties groups, who argued that the proposals were technically insecure, subject to abuse, commercially damaging and contrary to fundamental privacy rights. Although the licensing of TTPs was not, of itself, criticised, the mandatory nature of the licensing, which would be linked to a key escrow system, was strongly objected to. The proposals were also specifically rejected by the Labour Party in its electoral campaign. Its manifesto, ‘Communicating Britain’s Future’ declared that it would not endorse key escrow or recovery schemes, stating that:

‘Attempts to control the use of encryption technology are wrong in principle, unworkable in practice, and damaging to the long-term economic value of the information networks...It is not necessary to criminalise a large section of the network-using public to control the activities of a very small minority of law-breakers.’

Unfortunately, there have been indications of a post-election shift in the Labour Party stance. Despite promises to the contrary, Labour’s position in Government did not help to alter the DTI proposal. In April 1998, the DTI issued its Secure Electronic Commerce Statement (DTI; 1998a) - a policy announcement to follow up its earlier discussion paper. This statement indicated only a few minor changes to the original policy, such as abolishing mandatory licensing, and the basic structure and principles of the earlier proposal remained in place. Critics disapproved even of a voluntary system of licensing arguing that by granting ‘safe and secure’ licenses only to those TTPs with key recovery capabilities, the government could pave the way for ‘a position of blanket key recovery later’. (Bowden C., & Akdeniz, Y.; 1999, p39.)

Although this particular initiative was never introduced, the British Government, just like the US government, has since attempted to introduce equally harsh alternatives to restrict the free use of encryption. Around the same time that the US government was moving away from key recovery, the DTI published a public consultation document: ‘Building Confidence in Electronic Commerce’ <http://www.dti.gov.uk/cii/elec/elec_com.html>, which sought to introduce legislation to achieve the government’s goal of making the UK the world’s best environment for electronic commerce by the year 2000. Recognising that making ‘key recovery and third party key recovery a requirement for licensing could hinder the development of electronic commerce in the UK’, the government dropped such proposals in favour of more overt powers of lawful access to decryption keys. On the whole the proposed legislation was not well received. Cyber-Rights & Cyber-liberties (UK), which has lead the opposition to the UK government’s proposals to restrict encryption, argued that the proposed law enforcement powers ignored ‘fundamental human rights such as freedom of expression and right to privacy…’ and were not in line with the European Commission’s 1997 Communication or the OECD Guidelines. (Cyber-Rights & Cyber-liberties (UK); 1999a, p2.) In May 1999, the House of Commons Select Committee on Trade and Industry, responded to the government proposals in its seventh report (House of Commons; 1999a). The report concluded that the ‘Government (should) think twice about the content of its forthcoming Bill and only include in the Bill measures which will promote electronic commerce rather than measures discarded from the previous key escrow policy’.

In July 23, 1999 the Government published its responses to the Trade and Industry Committee’s report in another consultation paper: Promoting Electronic Commerce <http://www.dti.gov.uk/cii/elec/ecbill_2.html>, which included a draft Electronic Communications Bill <http://www.dti.gov.uk/cii/elec/ecbill_1.html>. Part III of this Bill sparked huge controversy and was widely objected to on human rights grounds. It envisaged an alternative system of providing government access to encryption keys which, if implemented, would have authorised law enforcement officials armed with ‘decryption warrants’ to force users to hand over their private encryption keys. Failure to do so would have lead to a presumption that the key was being withheld and would have been punishable by jail sentences of up to two years. The Bill would also have introduced a ‘tipping off’ offence whereby recipients of decryption warrants could have been imprisoned for up to five years for informing others that their own keys were no longer private.

The privacy implications of these far reaching provisions did not escape civil liberties groups. In particular it was argued that requiring individuals, who failed to comply with encryption warrants, to prove that they were not withholding the requested key would violate the presumption of innocence guaranteed by Article 6(2) of the European Convention on Human Rights and the UK Human Rights Act 1998, which incorporated this treaty into national law. (FIPR; 1999, p2) Critics also felt that demanding decryption keys was an over-aggressive invasion of privacy and security. They suggested that a more moderate approach, such as than obliging users to decrypt specific encrypted texts only, would sufficiently allay legitimate law enforcement fears without jeopardising the privacy and security of encryption users and those with whom they correspond. (Cyber-Rights & Cyber-Liberties (UK), 1999b.) Once again the government position on key recovery was criticized. Although the Bill specifically ruled out a mandatory link between the accreditation of TTPs and key recovery, it was feared that there was still scope for the government to encourage a voluntary link. (House of Commons Select Committee on Trade and Industry; 1999b, Part B.) Overall, Part III of the Bill was considered to have no place in legislation with the purported objective of ‘Promoting Electronic Commerce’. On the contrary, it was felt that these law enforcement powers to access private communications could undermine confidence in the UK as a forum for secure electronic commerce, and belonged in legislation dealing with interception of communications. (DTI; 1999b, Paragraph 6.)

6.3 Present Situation
In November 1999, the Queen announced the introduction of a revised Electronic Communications Bill <http://www.publications.parliament.uk/pa/cm199900/cmbills/004/2000004.htm> in her speech to Parliament. This Bill dropped the controversial Part III law enforcement powers and set out a general ‘prohibition on key escrow requirements’. At the same time, however, the Queen also announced the introduction of a Bill to ‘ensure that the interception of communications, and the use or other intrusive techniques, continues to be regulated for the protection both of the rights of Individuals and of society as a whole.’ (Queens Speech, 17 November 1999).

Despite public outcry and the criticism by privacy advocates and libertarians, this new Bill, known as the Regulation of Investigatory Powers Bill, has already passed through the House of Commons and been introduced in the House of Lords. Essentially it replicates Part III of the draft Electronic Communications Act in providing law enforcement agencies the power to require disclosure of encryption keys. Again it places the burden of proof for failing to comply with this decryption warrant upon the accused party and re-introduces the ‘tipping off’ offence for third parties. The Bill also establishes a new £25 million Government Technical Assistance Centre (GTAC) which MI5 will use to monitor internet traffic and e-mail communications.

The reasons for the UK position in an otherwise united Europe remain unclear. Its willingness to implement and essentially replicate draconian US proposals can only suggest that the Home Office is under pressure from the US government. Furthermore, its particular stance reinforces the argument in favour of action at the EU level. This would not only legally prohibit repressive UK laws but would mark an end to US pressures to enforce its views on European countries.

7. Conclusion
‘Human persons need to be able to close out the rest of the world, at appropriate times, but the reconciliation of such a subjective and personal psychological requirement with other human or socio-economic interests is a profound and difficult task’ (Clark R; 1990, preface)

Privacy rights are of primary importance in our society. Indeed they have been recognised as essential for physical and mental health, for the maintenance of a stable and mature individual personality, and to protect personal integrity. (UK Privacy Committee (Younger) Report 1972) For this reason, privacy rights are protected by many legally binding international treaties, such as the Universal Declaration and the European Convention on Human Rights. The exponential growth in global computer networks exposes large amounts of confidential material to the risk of interception and misuse, and potentially jeopardises the private sphere of all citizens. Although encryption products are now the only viable way of avoiding these dangers, other interests, such as the investigation of criminal offences and national security considerations, are hindering wide-scale deployment of these new privacy-enhancing technologies. As the quotation suggests, finding the intricate balance necessary to satisfy these competing interests is not always an easy task and unfortunately has not yet been reached in encryption policies. As we have seen, US and UK measures aimed at restricting the use of encryption involve an unprecedented and unjustified intrusion into the personal lives of individuals, and clearly swing the balance too far in favour of law enforcement interests. For this reason, they have been rejected by a wide international community of civil liberties and business interest groups.

The irony of the situation is that by clinging to unrealistic and unacceptable proposals, the US, in particular, may have done itself more harm than good. Had it initially advocated a more moderate approach to encryption which did not fly in the face of commercial and private needs, the US may well have been able to dominate the development of cryptographic products and policies world-wide. As it is, however, the European Union is now more likely to assume this role and, hopefully, introduce a balanced solution to the encryption dilemma. It once advocated lawful access as this solution suggesting that law enforcement agencies essentially only need access to plaintext rather than keys. (COM (97) 503, p17.) (EC; 1997b.) This enforcement method has the advantage of avoiding the dangers associated with a centralised holding body. However, as is evidenced by recent US and UK proposals, lawful access provisions can also spark privacy and human rights concerns if they do not respect traditional principles governing police searches, seizures, and surveillance. The EU, therefore, needs to refine this recommendation and develop a more balanced and workable measure.

Ultimately, the controversy caused by encryption can only be understood if we see it as part of a broader philosophical debate regarding the state’s right to restrict personal freedoms in the interests of justice. Set against a backdrop of international law enforcement measures aimed at widespread electronic surveillance, we see that the encryption crisis is not really about the threat of a particular new technology but rather about the future of policing in the 21st century. Now is the time to ask whether are willing to sacrifice time honoured privacy rights and allow encryption to be demonised as a tool for criminals merely in order to gain unprecedented access to our personal information.

References
‘The Risks of Key Recovery, Key Escrow and Trusted Third-Party Encryption’. A Report by Cryptography Experts, May 1998. <http://www.cdt.org/crypto/risks98/>.

Akdeniz, Y, et al, ‘Cryptography and Liberty: Can the Trusted Third Parties be Trusted? A Critique of Recent UK Proposals’, 1997 (2) The Journal of Information Law and Technology (JILT). <http://elj.warwick.ac.uk/jilt/cryptog/97_2akdz/default.htm>.

American Civil Liberties Union (ACLU), ‘Big Brother in the Wires: Wiretapping in the Digital Age’, Special Report, March 1998. <http://www.aclu.org/issues/cyber/wiretap_brother.html>.

Americans for Computer Privacy (ACP), Press Release, January 12, 2000. <http://www.computerprivacy.org/news/947779537.shtml>.

Banisar, D, ‘Love Letter’s last Victim’, Security Focus, May 22, 2000. <http://www.securityfocus.com/commentary/39>.

Bowden, C, & Akdeniz, Y, ‘Cryptography and Democracy: Dilemmas of Freedom,’ in Liberty eds., Liberating Cyberspace: Civil Liberties, Human Rights, and the Internet, London: Pluto Press, 1999, 81-125. <http://www.cyber-rights.org/reports/yacb.pdf>.

Campbell, D, ‘Interception Capabilities 2000,’ a working paper for the European Parliament, Science and Technology Options Assessment (STOA). <http://www.europarl.eu.int/dg4/stoa/en/publi/pdf/98-14-01-2en.pdf>.

Campbell, D, et al, ‘Enfopol Timeline 1991-1999’ Telepolis, March, 1999. <http://www.telepolis.de/tp/english/special/enfo/6382/1.html>.

Clark, R, ‘Data Protection Law in Ireland’ (Round Hall Press 1990).

Clayton, R, ‘The DTI Proposals on Encryption: an Overview’, Demon Internet, March 1998.

Cyber-Rights & Cyber-Liberties (UK), ‘First Report on UK Encryption Policy: Response to the DTI Consultation Paper’, May 1997. <http://www.leeds.ac.uk/law/pgs/yaman/ukdtirep.htm>.

Cyber-Rights & Cyber-Liberties (UK), ‘Wassenaar Controls, Cyber-Crime and Information Terrorism’, September 1998. <http://www.cyber-rights.org/crypto/wassenaar.htm>.

Cyber Rights & Cyber Liberties (UK), ‘Response to the March 1999 DTI Paper Building Confidence in Electronic Commerce- A Consultation Document,’ April 1, 1999. <http://www.cyber-rights.org/reports/dti99.htm>.

Cyber-Rights & Cyber-Liberties (UK), ‘Open Letter to IBM and BT in relation to UK Government Electronic Commerce Proposals’, August 5, 1999. <http://www.cyber-rights.org/reports/ibmbt-letter.htm>.

Davies, S, ‘Europe Plans a Huge Spy Web’, Daily Telegraph, January 7, 1999.

Department of Commerce (US), ‘Administration Implements Updated Encryption Export Policy’, Bureau of Export Administration (BXA) Fact Sheet, January 12, 2000. <http://204.193.246.62/public.nsf/docs/60D6B47456BB389F852568640078B6C0>.

Department of Justice (US), ‘The Electronic Frontier: The Challenge of Unlawful Conduct Involving the Use of the Internet’, a report of the President’s Working Group on Unlawful Conduct on the Internet, March 2000. <http://www.usdoj.gov/criminal/cybercrime/unlawful.htm>.

Department of Trade and Industry (UK), ‘Regulatory Intent Concerning use of Encryption on Public Networks’, June 1996. <http://dtiinfo1.dti.gov.uk/cii/encrypt/>.

Department of Trade and Industry (UK), ‘Licensing of Trusted Third Parties for the Provision of Encryption Services’, March 1997.

Department of Trade and Industry (UK), ‘Secure Electronic Commerce Statement’, April 1998. <http://www.dti.gov.uk/CII/ana27p.html>.

Department of Trade and Industry (UK), ‘White Paper on Strategic Export Controls’, July 1998. <http://www.dti.gov.uk/export.control/stratex/>.

Department of Trade and Industry (UK), ‘A Report for the DTI Summarising Responses to Building Confidence in Electronic Commerce: A consultation Document’, June 1999. <http://www.dti.gov.uk/cii/elec/conrep.htm>.

Department of Trade and Industry (UK), ‘Summary of Responses to Promoting Electronic Commerce: A Consultation Document’, 29 October 1999. <http://www.dti.gov.uk/cii/elec/billsumm.html>.

Electronic Frontier Foundation, ‘Inadequate White House Crypto Policy Changes’ Press Release, September 16, 1998. <http://www.eff.org/pub/Privacy/ITAR_export/1998_export_policy/HTML/19980916_policy.html>.

Electronic Privacy Information Center, ‘Cryptography and Liberty: an International Survey of Encryption Policy’, (EPIC, 1999). <http://www.gilc.org/crypto/crypto-survey-99.html>.

Electronic Privacy Information Center and Privacy International, ‘Privacy and Human Rights 1999: An International Survey of Privacy Laws and Developments’, (EPIC, 1999). <http://www.privacyinternational.org/survey/>.

Epstein R A, Testimony before the Senate Judiciary Sub-Committee on the Constitution, Federalism and Property Rights, prepared on behalf of the Americans for Computer Privacy. <http://www.computerprivacy.org/archive/03171998-3.shtml>.

European Commission, ‘A European Initiative in Electronic Commerce’, April 1997 Communication document, (COM (97) 157 final) <http://www.cordis.lu/esprit/src/ecomcom/>

European Commission, ‘Towards a European Framework for Digital Signatures and Encryption’. Communication by the Commission to the European Parliament, The Council, The Economic and Social Committee, and the Committee of Regions Ensuring Security and Trust in Electronic Communication, October 1997, COM (97) 503. <http://www.ispo.cec.be/eif/policy/97503toc.html>.

European Commission, ‘An Amended Proposal for a European Parliament and Council Directive on Certain Legal Aspects of Electronic Commerce in the Internal Market,’ COM (1999) 247.

European Commission, ‘Directive of the European Parliament and of the Council on Certain Legal Aspects of Information Society Services, in particular Electronic Commerce in the Internal Market’ (14263/1/99), 1 September 1999. <http://europa.eu.int/comm/internal_market/en/media/eleccomm/index.htm>.

Foundation for Information Policy Research, Press Release, July 23 1999: ‘Electronic Commerce will Harm UK Industry, Hold Back Growth of E-Commerce, Undermine Consumer Protection, and Violate European Convention on Human Rights’. <http://www.fipr.org/ecommpr.html>.

Freeh, L, Speech to US Senate Sub-Committee on Terrorism, Technology & Government Information, September 3, 1997.

Froomkin, A M, ‘It came from Planet Clipper: The Battle Over Cryptographic Key ‘Escrow’’, 1996 U. CHI. L. Forum 15. <http://www.law.miami.edu/~froomkin/articles/clipper.htm>.

House of Commons Select Committee on Trade and Industry, ‘Seventh Report: on Building Confidence in Electronic Commerce: A Consultation Document’, May 18, 1999. <http://www.parliament.the-stationery-office.co.uk/pa/cm199899/cmselect/cmtrdind/187/18702.htm>.

House of Commons Select Committee on Trade and Industry, ‘Fourteenth Report on Draft Electronic Communications Bill’, October 26, 1999. <http://www.parliament.the-stationery-office.co.uk/pa/cm199899/cmselect/cmtrdind/862/86202.htm>.

Koops, B J, ‘Crypto Law Survey’, Version 17.0, February 2000. <http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm>.

Landrock, P, ‘Opportunities and Barriers in Europe’, speech delivered to the Copenhagen expert hearing on digital signatures and encryption, April 23, 1998. <http://www.fsk.dk/fsk/div/hearing/ses3/barrier.html>.

McCullagh, D, ‘Decoding the Crypto Policy Change’, Wired News, September 17, 1999. <http://www.wired.com/news/politics/0,1283,21810-1,00.html>.

McCullagh, D, ‘Cybercrime Solution has Bugs’, Wired News, May 3, 2000. <http://www.wired.com/news/politics/0,1283,36047,00.html>.

McKay, N, ‘Europe is Listening’, Wired News, December 1998.

National Research Council, ‘Cryptography’s Role in Securing the Information Society’ (CRISIS Report), June 1996. <http://www.nap.edu/readingroom/books/crisis/>.

Report of Day 1 of the European Expert Hearing (Copenhagen Hearing) on Digital Signatures and Encryption, April 23, 1998. <http://www.fsk.dk/fsk/div/hearing/first.html>.

Rotenberg, M, Prepared Testimony and Statement for the Record on Encryption Technology and Policy before the Sub-Committee on Telecommunications and Finance. Committee on Energy and Commerce US House of Representatives, June 9, 1993. <http://www.epic.org/crypto/clipper/cpsr_markey_testimony_6_9.html>.

Statute of the Council of Europe, 1949. <http://conventions.coe.int/treaty/EN/cadreintro.htm>.

Bibliography
Akdeniz, Y, ‘UK Government Encryption Policy’, 1997 (1) Web Journal of Current Legal Issues. <http://webjcli.ncl.ac.uk/1997/issue1/akdeniz1.html>.

Akdeniz,Y, ‘No Chance for Key Recovery: Encryption and International Principles of Human and Political Rights’, 1998 (1) Web Journal of Current Legal Issues. <http://webjcli.ncl.ac.uk/1998/issue1/akdeniz1.html>.

Astor, P, ‘Thin Consensus veils Conflict at G8’, Security Focus, May 17, 2000. <http://www.securityfocus.com/news/37>.

BBC News ‘UK Government Dithers on Encryption Regulation’, Friday 20, 1998.

Blume, P, ‘The Citizens Data Protection’, 1998 (1) The Journal of Information Law and Technology (JILT). <http://elj.warwick.ac.uk/jilt/infosoc/98_1blum/default.htm>.

Campbell, D, ‘Britain Sneaks >>Enfopol<< Plan into Action’, Telepolis, June 1999. <http://www.telepolis.de/tp/english/inhalt/te/2989/1.html>.

Clausing, J, ‘Administration Announces New Concessions on Encryption Policy’, New York Times, September 16, 1999.

Cyber-Rights & Cyber-Liberties (UK), ‘British and Foreign Civil Rights Organisations Oppose Encryption Paper’, Press Release, April 9, 1997.

Cyber Rights & Cyber-Liberties (UK), Press release; ‘Electronic Communications Bill Published and Key Escrow is Dead’, 19 November 1999. <http://www.cyber-rights.org/crypto/>.

Cyber-Rights & Cyber-Liberties (UK), Briefing for the House of Commons, Second Reading Debate of the ‘Regulation of Investigatory Powers Bill’, 6 March, 2000. <http://www.cyber-rights.org/reports/crcl-rip.htm>.

Electronic Frontier Foundation, ‘Legal Cases- Crypto- Berstein v, U.S., Dept. of Justice,’ Archive. <http://www.eff.org/bernstein/>.

Electronic Privacy Information Center, ‘New White House Computer Surveillance Plan Would Pose Unprecedented Threat to Privacy’, Press Release, August 20, 1999.

Electronic Privacy Information Center, American Civil Liberties Union, Electronic Frontier Foundation, Joint Statement Press Release: ‘Civil Liberties Groups Say New Encryption Export Regulations Still Have Serious Constitutional Deficiencies’, January 13, 2000. <http://www.epic.org/crypto/export_controls/joint_release_1_00.html>.

European Commission, A Proposal for a European Parliament and Council Directive on Certain Legal Aspects of Electronic Commerce in the Internal Market; COM (1998) 586. 

Foundation for Information Policy Research, Press Release: ‘Comment on Queens Speech’, November 17, 1999. <http://www.fipr.org/uk_ecomm_bill/qupr.html>.

Global Information Networks Conference 1997, Press Release of 8 July 1997.

Global Internet Liberty Campaign (GILC), Member Statement, 1998, ‘Cryptography is a Defensive Tool, Not a Weapon’. <http://www.gilc.org/crypto/wassenaar/gilc-statement-998.html>.

Goodlatte, B, ‘Let’s Open up Encryption’, Washington Post: Encryption Special Report, June 12, 1997.

Labour Party Policy on Information Superhighway, ‘Communicating Britain’s Future’, 1995. Originally posted at <http://www.labour.org.uk/views/info%2Dhighway/content.html> [no longer available].

Nguyen, T, ‘Cryptography, Export Controls and the First Amendment in Bernstein v. United States Department of Justice’, 1997, 10 Harvard Journal of Law & Technology, 667.

O’Harrow, R, ‘Justice Department Pushes for Powers to Unlock PC Security Systems’, Washington Post, August 20, 1999.

Organisation for Economic Co-operation and Development, Recommendation of the Council Concerning Guidelines for Cryptographic Policy, March 27, 1997. <http://www.oecd.org/dsti/sti/it/secur/prod/e-crypto.htm>.

Organisation for Economic Co-operation and Development, ‘Inventory of Controls on Cryptographic Technologies’, DSTI/ICCP/REG(98)4/FINAL, January 28, 1999.

President’s Export Council Subcommittee on Encryption (PECSE), ‘Liberalisation 2000: Recommendations for Revising the Encryption Export Regulations’, July 1999. <http://cryptome.org/LIB42.htm>.

Rosenoer, J, ‘Cryptography and Speech,’ CyberLaw, 1995. <http://www.cyberlaw.com/cylw1095.html>.

Ross, P, ‘First Amendment: Computer Programming Language: Bernstein v. United States Department of Justice’, 1998, 13 Berkley Technology Law Journal, 405.

Statewatch Report, ‘Global Surveillance System Launched by FBI & European Union’, Statewatch, February 1997. <http://www.can-offshore.com/global_surveillance_FBI.htm>.