The Encryption Control Act: A Necessary Tool for Modern Law Enforcement Statement of Christopher Humphrey Section Chief, Cyber Division Federal Bureau of Investigation Before the House Committee on Energy and Commerce

The Current State of Affairs Scalable Encryption is Publicly Available PGP RC4 and others Scalable Encryption is Always Strong Strong Encryption Makes Digital Searches Useless Seizure of Records Interception of Communications Failed Strategies Classification Brute Force

The Encryption Control Act All encryption products manufactured or imported for sale or use in the United States must include features that permit immediate decryption of the encrypted data upon the receipt of a valid court order. Whoever knowingly manufactures, imports, or sells an encryption product that does not meet the requirements of this Act shall be subject to a term of imprisonment of not more than five years, a fine of not more than two hundred fifty thousand dollars, or both. It shall NOT be unlawful to use any encryption product purchased or in use prior to January 31 of the year following passage of this Act.

Effects of Legislation Stops criminals from evading warranted search Wiretapping and interception effective again Seizure of computer records will yield usable evidence Easy on encryption firms Lets already-manufactured technology to still be used Gives firms ample time to modify algorithms No Constitutional concerns Back-door would only be used on warranted searches and interceptions, not on normal peoples' data System could be designed to keep unwarranted police searches from having access to decryption