Skip to main content
Podcast Episode: AI in Kitopia

EFFector - Volume 9, Issue 3 - Encrypted Communications Privacy Act: Enabling Electronic Envelopes


EFFector - Volume 9, Issue 3 - Encrypted Communications Privacy Act: Enabling Electronic Envelopes

     ________________          _______________        _______________
    /_______________/\        /_______________\      /\______________\
    \\\\\\\\\\\\\\\\\/        |||||||||||||||||     / ////////////////
     \\\\\________/\          |||||________\       / /////______\
      \\\\\\\\\\\\\/____      ||||||||||||||      / /////////////
       \\\\\___________/\     |||||              / ////
        \\\\\\\\\\\\\\\\/     |||||              \////

EFFector Online Volume 09 No. 03       Mar. 6, 1996
A Publication of the Electronic Frontier Foundation        ISSN 1062-9424


Encrypted Communications Privacy Act: Enabling Electronic Envelopes
Update on "Decency" Censorship Law Legal Challenges
 Electronic Frontiers Georgia Formed
 AOL Against Government Censorship, For User Empowerment
 US Customs Decides Internet is Not a Place - Fines Those Who Claim Otherwise
Upcoming Events
Quote of the Day
What YOU Can Do

* See or, /pub/Alerts/ for more
information on current EFF activities and online activism alerts! *


Subject: Encrypted Communications Privacy Act: Enabling Electronic Envelopes 

Yesterday, Sen. Patrick Leahy, Rep. Robert Goodlatte, and many other 
Congresspersons introduced two very similar pro-encryption, pro-privacy, 
pro-Internet bills, one in the House, one in the Senate, to mostly deregulate
the export of encryption and to affirm US citizens's rights to use any 
encryption they wish, with no requirement the users' crypto keys be 
"escrowed".  Below is a statement on the Leahy/Burns/Murray version.
Most of the good (and bad) points apply to the Goodlatte version in the 
House as well, though it has stronger protections against imposition of 
government-access-to-keys, a very good sign.  The new felony category 
created by both bills has been narrowed since the release below was 
written, to require that any cryptographic obsctruction of justice be 
done "in the furtherance" of a crime to be subject to additional criminal 
penalties. This is an improvement, though not perfect.

The significance of these bills is that, like the 1994 Cantwell export 
deregulation bill, they raise vital issues relating to privacy, security, 
authentication and responsibility, and competitiveness before Congress, and 
they do so pre-emptively: It is believed that the Clinton administration is 
preparing it's own *anti*-crypto legislation at the behest of the FBI and 
NSA. It is unknown at present what such a bill would look like in detail, 
but it is unlikely to be favorable to Internet user's privacy rights, 
digital commerce, system security, or freedom of expression.  The 
current bills give those of us concerned about these issues a head start 
in educating legislators, the media and the public before the storm hits.

Coupled with the EFF/Bernstein and Karn legal cases' constitutional 
challenge against the crypto export restrictions themselves, the 
Leahy/Goodlatte legislation is an important step toward securing privacy 
and confidentiality for users of all new media.

                                                         +1 415 436 9333
March 5, 1996                               

The Electronic Frontier Foundation (EFF) is encouraged to see
Congressional support for lifting restrictions on encryption and
affirming privacy rights for U.S. citizens.  The bill introduced today
by Senators Pat Leahy (D-VT), Patricia Murray (D-WA) and Conrad Burns
(R-MT) is an important step in reclaiming privacy and encryption
rights for society and business.  The bill would legalize wide use of
"electronic envelopes" to protect private information.  Today this
information travels on "electronic postcards" which can easily be
altered or intercepted.  However, the bill also includes key escrow
and obstruction of justice provisions which would cause problems if

"The bill provides a new opportunity to bring reason into the crypto 
policy debate," said EFF co-founder John Gilmore.  "We support the 
Senators for bringing their energy into the process.  The bill is a
good start, and with healthy debate and modification, it could become
acceptable legislation."

Electronic privacy and encryption policy is extremely complex because
it intertwines our constitutional rights of free speech, publication,
association, and protection from self-incrimination and unreasonable
search, with issues of wiretapping, spying, military security,
personal privacy, and computer security.  This bill would pick a new
balance among these competing interests, with long-term impacts on our
society and economy.  EFF is committed to working with government,
industry and public interest organizations to raise the level of
understanding and debate in resolving these complex issues.


The Encrypted Communications Privacy bill would make long-overdue changes 
to the export restrictions currently hampering the deployment of privacy 
and security "envelopes" for Windows, Unix, the Mac, and the Internet.  

The bill:

  *  Moves export control of all non-military information security products,
     incuding encryption, to the Commerce Dept., whose rules protect 
     constitutional rights and reflect market realities.

  *  Requires that no license be required to export generally available
     mass-market software, public domain software, and computers that
     include such software.

  *  Requires that export be authorized for non-military encryption 
     software to any country where similar software is exportable from 
     the U.S. to foreign financial institutions.

  *  Requires that export be authorized for encryption hardware if a 
     comparable product is available overseas.

The above changes would significantly improve the nation's crypto
policy.  But they make detailed changes in a very complex section of
the law and regulations.  There is a significant risk that they will
be implemented by the Administration in a different fashion than
Congress intended.  This happened in 1987, for example, when
Congress tried to eliminate NSA meddling with civilian computers by
passing the Computer Security Act.  It was subverted by a series of
Presidential directives and agreements among Executive Branch
departments.  The result today is that NSA is still in control of
domestic security and privacy policy.

We would encourage futher deregulation as a simpler, more effective, 
and far more reliable solution.  The bill should simply eliminate all export 
controls on non-military encryption.


The following provisions raise serious concerns about the imbalance 
between the rights of the people and the desires of the goverment. EFF 
feels that the impact of these provisions must be closely considered, 
and will work to modify or remove them to better serve the public 
interest. The bill:

  *  Makes it a new crime to "use encryption to obstruct justice", with
     5-10 year sentences, plus fines.  In plain language, this is a
     extra criminal charge that can be applied when police are frustrated
     in an investigation but happen to catch someone breaking the law in 
     some other way. It's like  Adding an extra ten-year jail term if you 
     close your curtains while committing a crime.  Americans have the 
     right to protect their own privacy by any nonviolent means, and we 
     expect that encryption will soon be built into all computers, 
     phones, and networks.  

  *  Provides a legal infrastructure for key escrow, a system in which
     all users' keys are copied to permit government access.  The
     Clinton Administration has been pushing key escrow to replace its
     failed "Clipper chip", out of fear that if Americans have real
     privacy they will abuse it.  These provisions in the bill would
     encourage people to use the flawed key-copying system.


The are a number of areas of the bill that would benefit from additional
debate and clarification.  Specifically, where the bill:

  *  Explicitly does not mandate key escrow, but fails to prohibit
     the Administration from attempting to impose it with regulations.

  *  Outlaws disclosure of others' keys except to the government, with
     1-2 year sentences, plus fines, but includes a broad "good 
     faith" exemption for when the government does something illegal or 

  *  Requires disclosure of other peoples' keys to the government, under
     the same procedures currently used for wiretaps, searches of online
     records and backup tapes, and fishing expeditions in billing records.
     The provision does not always require adversary legal process, in
     which citizens can argue for their privacy before a judge, but instead
     relies solely on the integrity of prosecutors.

  *  Legalizes the use any encryption "except as provided in this 
     Act...or in any other law". 


EFF's Cryptography and Privacy Policy Principles, which were
originally written during the Clipper Chip debate, are the touchstone
by which we measure privacy legislation and policy issues:

  * Private-sector access to encryption technology must not be hindered, 
    either by regulation of what crypto may be used domestically, or by 
    restriction on what may be exported.

  * Government policy on encryption usage and standards must be set in open 
    forums with proper attention paid to public input. Secret hearings and
    classified algorithms have no part to play in a democratic process.

  * Encryption must become part of the "information infrastructure" to 
    protect personal, commercial and governmental privacy and security.  
    Cryptographic tools must not be crippled or weakened for the convenience
    of government agents, and users must be free to choose what encryption
    they prefer and whether and to whom they will reveal encryption keys.
    Law enforcement must obtain court orders, not simply administrative 
    subpoenas to seize keys or decrypt and search encrypted information.

  * Government policy regarding emerging technologies like encryption
    must not erode Constitutional protections. In particular, any such
    policies must be compatible with the rights to freedom of speech,
    press and association, freedom from coerced self-incrimination,
    and freedom from unreasonable search and seizure.
  * Encryption will be built into all next-generation Internet, 
    communications and computer technology. There must be no government 
    policy equating use of encryption with evidence of criminal 
    behavior, nor the creation of any new crime category that holds 
    encryption users liable for making criminal investigation more

  * Government at all levels should explore cryptography's potential to
    replace identity-based or dossier-based systems - such as driver's
    licenses, credit cards, social security numbers, and passports - with 
    less invasive technology.

The Encrypted Communications Privacy bill at this time passes some of these
tests, and we are committed to working with industry, government, and public
interest organiations to address the remaining issues.


The Electronic Frontier Foundation (EFF) is a nonprofit public interest
organization devoted to the protection of online privacy and free 
expression.  EFF was founded in 1990, and is based in San Francisco, 

The International Traffic in Arms Regulations (ITARs), administered by 
the State Department, and in the background by the National Security 
Agency, unreasonably treat encryption software and hardware as if they 
were weapons of war, like rockets and bombs.  It has proven very difficult
to deploy U.S.-made encryption products in an increasingly important global
market due to these regulations, at a time when the need for online 
security systems for personal and commercial use has never been more 
keenly felt.

EFF has for several years led efforts to fend off governmental attempts 
to restrict the development and public availability of secure 
privacy technology.  In 1993-4, EFF and other civil liberties organizations 
successfully opposed implementation of the U.S. Administration's "Clipper" 
or "Skipjack" system - hardware encryption for voice and data 
communications in which all encryption keys are held by government for 
the convenience of law enforcement and intelligence agencies. In 1994, we 
helped ensure that crypto export became a major legislative topic, 
laying the groundwork for eventual liberalization of the ITARs. In 
1994 and 1995 EFF opposed implementation of and helped defeat funding for 
the FBI's "Digital Telephony" scheme, in which up to one person on every 
city block could be simultaneously wiretapped.  In 1995, we filed an ongoing
federal lawsuit with mathematician Daniel Bernstein, challenging the 
constitutionality of the export control laws.


Please see EFF's Internet archives for more details on this and other issues.

EFF Privacy & Encryption Archive:
EFF Legal Issues & Policy Archive:

Action Alerts:

Topical Index of the EFF Archive:


The Electronic Frontier Foundation
1550 Bryant St., Suite 725
San Francisco CA 94103 USA
+1 415 436 9333 (voice)
+1 415 436 9993 (fax)

John Gilmore, Co-founder and Member of the Board  +1 415 221 6524


Subject: Update on "Decency" Censorship Law Legal Challenges

The Communications Decency Amendment to the Telecom Act, and another 
Telecom Act provision in a different section of that huge piece of 
legislation, have come under concerted attack in no less than four 
federal lawsuits filed nearly immediately after passage.

EFF, the ACLU, and many other organizations and invividual plaintiff, 
most of them online content producers, filed suit in the US District 
Court for the Eastern Dist. of Pennsylvania, Feb. 8, 1996, before Judge 
Ronald Buckwalter.  

The judge commended the plaintiffs on a well preprated case, and issued a 
temporary restraining order against enforcement of certain provisions of 
the CDA (in particular the "indecency" ban, but not the "patently 
offensive material" ban), calling the CDA "unconstitutional".  Subsequent 
to this, attorneys for our side obtained an agreement from the Justice 
Department, who also appear to recognize the new laws 
unconstitutionality, to not enforce any of the CDA's challenged provisions.
This case is ACLU, et al. v. Reno, and will soon be before a 3-judge 
panel who are expected to issue a longer-lasting and more complete 
preliminary injunction against CDA enforcement until the Supreme Court 
can hear the meat of the case.  This case is likely to be fast-tracked, 
and may reach the highest court in the land before the year is out.

The injunction trial has tentatively been scheduled for March 21 and 22, 
with the government getting a hearing Apr. 11 and 12. April 1 has also 
been reserved in case it is needed. The 3 judges will be Appeals Judge 
Sloviter, District Judge Dalzell, and and District Judge Buckwalter.

The CDA provisions of the bill are also being challenged by another suit 
filed around the same time by an online newspaper, _The_American_Reporter_,
in the New York State Southern District US Court. This case and the 
EFF/ACLU case raise most of the same issues, though with different 
focusses in some areas. The cases dove-tail quite nicely.

In simultaneous action, Arthur Sanger, the Center for Reproductive 
Law & Policy, Planned Parenthood of New York, and several other 
plaintiffs filed a suit in challenging the constitutionality of Rep. 
Henry Hyde's last-minute amendment to the Telecom Bill making it illegal 
to post certain kinds of abortion-related information online.  This 
statute is arguably duplicative with current law - the old Comstock 
obscenity code, which is not medium dependent and therefore already 
includes the Internet, has banned this abortion info since the 19th 
Century, but has simply not be enforced much.  The case seeks to strike 
down the abortion part of it completely.  The judge in this case did not 
issue a restraining order, apparently finding that the lack of 
enforcement, and the Dept. of Justices (fairly weak) assurances that they 
would not enforce this portion of the Telecom Bill either, as indicactive 
of little enough risk to let the case proceed without directly enjoining 
enforcement.  This case, Sanger v. Reno, is ongoing in the US District 
Court for the Eastern Dist. of New York State.  The Justice Department 
has openly acknowledged the unconstitutionality of the abortion-related 


Feb. 26, the Center for Democracy and Technology, the Am. Library Assoc., 
Wired Magazine, and additional plaintiffs from the online services 
industry, filed a fourth suit, in the same district as the ACLU & EFF 
suit, again challenging the unconstitutional "decency" provisions of the 
Telecom bill.  This case has a rather unique feature: You can add 
yourself as a plaintiff at no expense! One of the plaintiffs is the 
Citizen's Internet Empowerment Coalition - a coaltion you can join by 
filling out a WWW form at:

DEADLINE: March 15, 1996!

As of March 1, the CIEC members numbered over 5000. 

This latest case does not conflict with the other cases in anyway, and 
may be merged with the EFF/ACLU case.

The CIEC/CDT plaintiffs have also filed for a preliminary injunction. 
Hearing date is set for March 21.

Updates on these cases will be made at

on a regular basis.


Subject: NewsNybbles

* Electronic Frontiers Georgia Formed

A new state-level grassroots action organization has formed in Atlanta.
"Electronic Frontiers Georgia is a civil liberties organization that has
been formed to fight for freedom, privacy, and access on [the US
State of] Georgia's computer networks."  Monthly physical meetings are
held in Atlanta.

For a list of other such groups (and other organization of various kinds 
that have something to do with online civil liberties, access and 
society), see our Online Activism Organizations FAQ at:, cd /pub/Activism/, get activ_groups.faq, path: 1/Activism, get activ_groups.faq

* AOL Against Government Censorship, For User Empowerment

According to an AP newswire, America Online chairman Steve Case said 
Tues. that Internet censorship "is a very difficult, very sensitive issue 
which requires a dialogue...for what the right balance is going to 
be...this is a new medium and it does require a different perspective, 
and we're going to be calling for a new framework that recognizes [that]."

Case said online content filtration, that would allow parents to block 
child access to inappropriate materials, is the right solution, rather than

* US Customs Decides Internet is Not a Place - Fines Those Who Claim Otherwise

A "virtual" software corporation, ACD, with software engineers in both 
California and Hungary, but no real physical business infrastructure, was 
recently slapped with an $85 fine by US Customs.

ACD's product, EPublisher for the Web, was developed over the Internet 
with no physical meetings or other contact between the developers. When 
Hungarian developers sent versions of the software on diskette to their 
US counterparts, the shipment was stopped by Customs at LAX (the major 
Los Angeles airport) for "mark violation".  The Hungarians had marked 
"Country of Origin" on the forms as "Internet", as the product was not 
decidably made in Hungary or the US, and the owners of the intellectual 
property rights to the product are in no single physical location.
ACD's Laslo Chaki says, "We had to pay an $85 fine for mark violation.
Virtual company, in virtual city with $85 real fine!"

Though the intent of the "Country" section on customs forms is to ascertain 
where a particular package was shipped from, and the listing of the country
of origin as "Internet" is somewhat silly in this context, the lack of any 
sense of humor on the part of Customs is not particularly encouraging. 
You might want to be careful with those RSA t-shirts - Customs just might 
handle them as munitions after all, and regard you as an unlicensed 
international arms dealer, at this rate.


Subject: Calendar of Events

This schedule lists events that are directly EFF-related. A much more
detailed calendar of events likely to be of interest to our members and
supporters is maintained at:

ftp:, /pub/EFF/calendar.eff
gopher:, 1/EFF, calendar.eff

Mar. 14 - National Silence Protest against the CDA!
          See WWW site for more info.

Mar. 15 - LAST CHANCE to add your name as a plaintiff in lawsuit against Net
          censorship bill! See WWW site for more info.

Mar. 27-
     30 - CFP96, the Sixth Conference on Computers, Freedom, & Privacy;
          MIT, Cambridge, Massachusetts. Sponsored by ACM SIGCOMM,
          SIGCAS, SIGSAC, and the World Wide Web Consortium.  This is
          THE electronic privacy conference. Speakers include EFF
          representatives (and CFP is also the time and place of the
          EFF Pioneer Awards ceremony.)

June 30 - Electronic Freedom March on Washington!
          See WWW site for more info.


Subject: Quote of the Day

"Two-point-five million use America Online. That's like a city. Parents
wouldn't let their kids go wandering in a city of 2.5 million people
without them, or without knowing what they're going to be doing."
  - Pam McGraw, America Online spokesperson, in "Children Lured From Home
    by Internet Acquaintances" by David Foster, Associated Press, June 
    13, 1995

Find yourself wondering if your privacy and freedom of speech are safe 
when bills to censor the Internet are swimming about in a sea of of 
surveillance legislation and anti-terrorism hysteria?  Worried that in 
the rush to make us secure from ourselves that our government 
representatives may deprive us of our essential civil liberties? 
Concerned that legislative efforts nominally to "protect children" will 
actually censor all communications down to only content suitable for 
the playground?  Alarmed by commercial and religious organizations abusing
the judicial and legislative processes to stifle satire, dissent and 

Join EFF!

Even if you don't live in the U.S., the anti-Internet hysteria will soon 
be visiting a legislative body near you.  If it hasn't already.


Subject: What YOU Can Do

* The Communications Decency Act & Other Censorship Legislation

The Communications Decency Act and similar legislation pose serious 
threats to freedom of expression online, and to the livelihoods of system 
operators.  The legislation also undermines several crucial privacy 


Business/industry persons concerned should alert their corporate govt.
affairs office and/or legal counsel.  Everyone should write to their own
Representatives and Senators, letting them know that such abuses of 
public trust will not be tolerated, that legislators who vote against
your free speech rights will be voted against by you in the next elections.

Join in the Blue Ribbon Campaign - see


Support the EFF Cyberspace Legal Defense Fund:

For more information on what you can do to help stop this and other 
dangerous legislation, see:, /pub/Alerts/, 1/Alerts

If you do not have full internet access (e.g. WWW), send your request
for information to

* New Crypto-Privacy Legislation

Urge your Senators and Representatives to call for hearings!  Not much 
else needs to be done on this right this moment, but expect this issue to 
heat up rapidly.  Pointers to Congress contact info are below.

Keep an eye on

* Digital Telephony/Comms. Assistance to Law Enforcement Act

The FBI is now seeking both funding for the DT/CALEA wiretapping provisions,
and preparing to require that staggering numbers of citizens be 
simultaneously wiretappable.  

To oppose the funding, write to your own Senators and Representatives 
urging them to vote against any appropriations for wiretapping. 

We are aware of no major action on this threat at present, but keep your
eyes peeled. It will be back.

* Anti-Terrorism Bills

Numerous bills threatening your privacy and free speech have been introduced
this year.  None of them are close to passage at this very moment, but 
this status may change. Urge your Congresspersons to oppose these 
unconstitutional and Big-Brotherish bills.

* The Anti-Electronic Racketeering Act

This bill is unlikely to pass in any form, being very poorly drafted, and 
without much support.  However, the CDA is just as bad and passed with 
flying colors [the jolly roger?] in the Senate. It's better to be safe 
than sorry. If you have a few moments to spare, writing to, faxing, or 
calling your Congresspersons to urge opposition to this bill is a good 

* Medical Privacy Legislation

Several bills relating to medical privacy issues are floating in Congress 
right now. Urge your legislators to support only proposals that *truly* 
enhance the medical privacy of citizens.

More information on this legislation will be available at soon.  Bug to make 
it appear there faster. :)

* Find Out Who Your Congresspersons Are

Writing letters to, faxing, and phoning your representatives in Congress
is one very important strategy of activism, and an essential way of
making sure YOUR voice is heard on vital issues.

EFF has lists of the Senate and House with contact information, as well
as lists of Congressional committees. (A House list is included in this
issue of EFFector). These lists are available at:, /pub/Activism/Congress_cmtes/, 1/EFF/Issues/Activism/Congress_cmtes

The full Senate and House lists are senate.list and hr.list, respectively.
Those not in the U.S. should seek out similar information about their
own legislative bodies.  EFF will be happy to archive any such
information provided.

If you are having difficulty determining who your Representatives are,
try contacting your local League of Women Voters, who maintain a great 
deal of legislative information, or consult the free ZIPPER service
that matches Zip Codes to Congressional districts with about 85%
accuracy at:

Computer Currents Interactive has provided Congress contact info, sorted 
by who voted for and against the Communcations Decency Act:

* Join EFF!

You *know* privacy, freedom of speech and ability to make your voice heard
in government are important. You have probably participated in our online
campaigns and forums.  Have you become a member of EFF yet?  The best way to
protect your online rights is to be fully informed and to make your
opinions heard.  EFF members are informed and are making a difference.  Join
EFF today!

For EFF membership info, send queries to, or send any
message to for basic EFF info, and a membership form.



EFFector Online is published by:

The Electronic Frontier Foundation
1550 Bryant St., Suite 725
San Francisco CA 94103 USA
+1 415 436 9333 (voice)
+1 415 436 9993 (fax)
Membership & donations:
Legal services:
General EFF, legal, policy or online resources queries:

Editor: Stanton McCandlish, Online Activist, Webmaster (
Assoc. Editors: Ryan Thornburg, Communications Intern (
                Dennis Derryberry, Communications Intern (

This newsletter is printed on 100% recycled electrons.

Reproduction of this publication in electronic media is encouraged.  Signed
articles do not necessarily represent the views of EFF.  To reproduce
signed articles individually, please contact the authors for their express
permission. Press releases and EFF announcements may be reproduced individ-
ually at will.

To subscribe to EFFector via email, send message body of "subscribe
effector-online" (without the "quotes") to, which will add
you to a subscription list for EFFector.

Back issues are available at:, /pub/EFF/Newsletters/EFFector/, 1/EFF/Newsletters/EFFector

To get the latest issue, send any message to (or, and it will be mailed to you automagically.  You can also get
the file "current" from the EFFector directory at the above sites at any 
time for a copy of the current issue.  HTML editions available at: 
at EFFweb.  HTML editions of the current issue sometimes take a day or 
longer to prepare after issue of the ASCII text version.


End of EFFector Online v09 #03 Digest


Back to top

JavaScript license information