The 105th Congress began 1997 looking like it might be the first Congress to really begin tackling some of the important legislative issues facing cyberspace. In a flurry of activity, lawmakers introduced bills on topics like encryption regulation, privacy and Internet gambling. At the halfway point for the current Congress, we have lots of introduced legislation, plenty of hearings, but not much new law.
Encryption Regulation
Encryption is a legislative hot button in the United States. Encryption involves taking an original message, and putting it through a software process to produce an unreadable, encoded message that looks like gibberish. To recover the original readable message, the recipient passes the encrypted message and a decryption key (password) through a reverse of the encryption process using the same or compatible software.
Encryption has many useful and legitimate applications. For example, inexpensive programs are available that allow you to encrypt e-mail messages that you send and decrypt messages you receive. Banks need encryption so that they can safely transmit sensitive financial data through cyberspace.
On one side, you have those who feel that strong encryption is essential to maintain privacy when sending messages over the Internet and even when storing it on a computer's hard drive. They argue that without encryption anybody can theoretically read e-mail and other private information sent through cyberspace. They also emphasize that encryption is the only effective method of securing private information on your own computer.
The other side of this debate sees strong encryption as a threat to national security and public safety. Not too long ago, only the intelligence community had access to strong encryption. Now you can buy excellent encryption software for less than $100. Police agencies are concerned that with good encryption, criminals find it too easy to hide information from police. Certainly, convicting a bookie of bookmaking is difficult if he encrypts the books.
The Clinton administration would like to see legislation encouraging what's called a "key escrow" system. Under it, anyone using encryption must put a copy of the decoding program on file with a "trusted" third-party agency that would give it to the government if the government meets certain statutory requirements. For example, the law could require that the government get a subpoena. Some have compared "key escrow" to being required to give the police a key to your house just in case they ever get a search warrant authorizing them to use it.
The House and Senate have moved on encryption bills that are vastly different.
The Senate has moved on the Clinton administration supported Secure Public Networks Act. This bill provides incentives for the development of a key escrow system and would continue to regulate the export of encryption.
The House has focused on the Security and Freedom Through Encryption Act (don't you just love these names?). In its original form, it greatly eased export restrictions on encryption products. Committees have amended it, but it remains less restrictive than the Senate bill.
My bet is that we'll continue to hear talk about new encryption laws, but that the 105th won't pass any. This is an extremely controversial area and nothing close to a consensus or workable compromise is likely to appear soon.
Privacy Legislation
The House saw four bills introduced that are designed to enhance privacy on the Net. For now, they appear to be going nowhere.
The Consumer Internet Privacy Protection Act of 1997 and the Social Security Online Privacy Protection Act of 1997 would generally prohibit online computer services like AOL or your Internet service provider from disclosing certain specified personal information about you without your prior informed written consent.
The Communications Privacy and Consumer Empowerment Act would give you some control over the use of your personal information by requiring that you be told that your information is being collected and that it will be reused or sold. It would also give you the right to prohibit sale of your personal information. This bill would also require that Internet service providers offer parents "filtering" software that is designed to allow them to limit access to material that's inappropriate for children.
The last of the four, the Data Privacy Act of 1997, would establish an industry working group to develop some voluntary guidelines in this area. Wow! I feel better already.
Internet Gambling
Online casinos are a hot new business. The anti-gambling forces have a friend in the Internet Gambling Prohibition Act of 1997. This bill would impose a fine of up to $ 2,500 and six months in prison for placing or receiving a bet over the Internet. I think that this one may just get passed by Congress.
Putting aside the issue of gambling, this bill, if passed, sets a horrible precedent for the Internet. It would create a presumption that the mere transmission of a message over the Net, without any more contact, gives state and local governments at both ends of the message jurisdiction. If this is the direction the law goes, you'll have to comply with 50 sets of laws within the United States alone before you can transact any Internet business.
This may be a lawyer's dream, but it's not good for electronic commerce.