Administration Encryption Efforts with Wassenaar Arrangement Come up Short

Washington, D.C., December 9, 1998 -- The American Electronics Association (AEA) responded today to the Administration’s announcement that 33 countries, which have signed the Wassenaar Arrangement, have agreed to eliminate reporting requirements for 56-bit encryption technology. The Wassenaar Arrangement is an organization of 33 countries seeking regional and international security and stability by promoting transparency and greater responsibility in transfers of conventional arms and dual-use goods and technologies. It represents a multilateral effort to establish uniform export controls.

AEA offered the following points for consideration on the Administration’s announcement:

Decontrol of Cryptographic Products up to 56 bits is step in right direction—but inadequate:

Members of the Wassenaar Arrangement apparently agreed to decontrol cryptographic products with key lengths not exceeding 56 bits. This represents progress, because previously all cryptographic hardware and non-mass market software products were controlled in principle, regardless of key length. Nonetheless, this still falls far short of the liberalization needed to satisfy customer demands for the mass market encryption products that will ensure the security and privacy of their data.

Recontrol of Mass Market Software Exceeding 64 bits is a Rollback:

The Wassenaar members also apparently agreed to re-impose controls on mass market software with key lengths exceeding 64 bits. This is a rollback because previously there were no limits on key length for mass market software. The mass market exception was originally included in the Wassenaar Arrangement (and its predecessor, COCOM) because it was generally acknowledged that mass market software is not susceptible to controls. Since that time, the use of the Internet for software distribution, the number of foreign encryption suppliers, and the ubiquity of mass market software have all increased dramatically, making such software even more uncontrollable. It defies simple logic to suggest that mass market software products with 65 bit keys is now susceptible to controls, but mass market software with 64 bit keys are not.

This is Not a Level Playing Field:

Wassenaar members' agreement to control a common list of products does NOT mean that there is a level playing field with respect to those products. Wassenaar members will now be "authorized" to require licenses (or not) and to issue licenses (or not) at their national discretion for certain encrypted mass market products. American companies will continue to face the risk of sales lost to competitors that are subject to less stringent export licensing policies than those found in the U.S. In fact, this risk extends to both mass market software and hardware products.

# # #

Advancing the business of technology, AeA is the nation's largest high-tech trade association. AeA has more than 3,500 member companies that span the high-technology spectrum, from software, semiconductors and computers to Internet technology, advanced electronics and telecommunications systems and services. With 18 regional U.S. councils and offices in Brussels and Beijing, AeA offers a unique global policy grassroots capability and a wide portfolio of valuable business services and products for the high-tech industry. AeA has been the accepted voice of the U.S. technology community since 1943.

This page was last updated in 1999.