Despite Senator Patrick Leahy's insistence that encryption policy is not a "black-and-white issue" divided between law enforcement and free-marketers, the Vermont Democrat's fellow senators clearly lined up on one side or the other at a Judiciary Committee hearing Wednesday like kids being picked for softball teams.
But, in the end, no one at the hearing on the Public Networks Security Act - not FBI director Louis Freeh or National Security Agency deputy director William Crowell, not the senators, and not the industry experts present, like Novell vice president Mike MacKay - could wholeheartedly support the legislation at hand. The bill's chief sponsors, Senators Bob Kerrey (D-Nebraska) and John McCain (R-Arizona), have had the bill on a fast track until this point.
"The legislation does not go far enough, especially concerning the liberalization of export controls," said Senator John Kyle (R-Arizona), who was clearly on the law-enforcement team. "I don't want to be sitting up here a few years from now having law enforcement tell us we had the opportunity to do something [to fight terrorism] and did not."
The bill, presented at the hearing by Kerrey, has been viewed among industry leaders and civil libertarians as an administration-sponsored initiative that would curb privacy on the Net and hurt American companies in the name of protecting national security. It holds fast to current administration export controls, and calls for a domestic key recovery system for all encrypted communications - whether computer or fax - so that law enforcement can act quickly when it needs to get hold of data it wants. The bill also offers strict penalties for using encryption to further a crime. But the FBI's Freeh also said that he could not support the bill in its current form.
"I would go a little bit further with respect to domestic use," Freeh told the committee. While Freeh said he did not think domestic key recovery should be mandatory, the bill, which calls for voluntary domestic key recovery, should have more incentives for participation.
Freeh argued that participation in domestic key recovery by all Americans using encryption products was important in crime-solving, especially as more Americans use encryption to participate in electronic commerce, because of what one might call the slip-up factor. Sure, most kingpins and crime lords would know not to hand over a key to their encrypted data to a designated third party approved by the American government, but you never know.
This better-safe-than-sorry approach was embraced by Senator Dianne Feinstein (D-California), whose state has arguably benefited more than any other from a lack of regulation of the high-tech industry, and who left the hearing before the industry experts testified.
"I would urge you to be as dominant in this area as possible," Feinstein told Freeh and Crowell. "And not get downtrodden because of companies' individual interests."
But others testifying emphatically said that not just the McCain/Kerrey bill, but the whole idea of key recovery is too new to endorse through legislation at this point.
"Key recovery is a promising technology, but it is unproven, and comes with its own risks," warned Kenneth W. Dam, chair of the committee to study cryptography policy at the National Research Council. He and others urged a "policy of deliberate exploration, not aggressive promotion."
Senator John Ashcroft (R-Missouri), who wondered "what this bill really achieves by limiting business," and Leahy, the ranking Democrat on the committee and whose own market-friendly encryption bill is growing cold in committee, agreed.
Committee chairman Senator Orrin Hatch (R-Utah), who at first seemed to be heading for the law-enforcement team, appeared to be questioning his pick by the end of the hearing.
"I'm worried about Congress really screwing this up," he said. "We have that tendency, they tell me."
The committee still must pass the bill for it to move to the Senate floor for a full vote.
