Cold War era In the early days of the
Cold War, the U.S. and its allies developed an elaborate series of
export control regulations designed to prevent a wide range of Western technology from falling into the hands of others, particularly the
Eastern bloc. All export of technology classed as 'critical' required a license.
CoCom was organized to coordinate Western export controls. Two types of technology were protected: technology associated only with weapons of war ("munitions") and dual use technology, which also had commercial applications. In the U.S., dual use technology export was controlled by the
Department of Commerce, while munitions were controlled by the
State Department. Since in the immediate post WWII period the market for cryptography was almost entirely military, the encryption technology (techniques as well as equipment and, after computers began to play a larger role in modern life, crypto software) was included as "Category XI - Miscellaneous Articles" and later "Category XIII - Auxiliary Military Equipment" item into the
United States Munitions List on November 17, 1954. The multinational control of the export of cryptography on the Western side of the cold war divide was done via the mechanisms of CoCom. By the 1960s, however, financial organizations were beginning to require strong commercial encryption on the rapidly growing field of wired money transfer. The U.S. Government's introduction of the
Data Encryption Standard in 1975 meant that commercial uses of high quality encryption would become common, and serious problems of export control began to arise. Generally these were dealt with through case-by-case export license request proceedings brought by computer manufacturers, such as
IBM, and by their large corporate customers.
PC era Encryption export controls became a matter of public concern with the introduction of the
personal computer.
Phil Zimmermann's
PGP encryption software and its distribution on the
Internet in 1991 was the first major 'individual level' challenge to controls on export of cryptography. The growth of
electronic commerce in the 1990s created additional pressure for reduced restrictions. VideoCipher II also used DES to scramble satellite TV audio. In 1989, non-encryption use of cryptography (such as access control and message authentication) was removed from export control with a Commodity Jurisdiction. In 1992, an exception was formally added in the USML for non-encryption use of cryptography (and satellite TV descramblers) and a deal between NSA and the
Software Publishers Association made
40-bit RC2 and
RC4 encryption easily exportable using a Commodity Jurisdiction with special "7-day" and "15-day" review processes (which transferred control from the State Department to the Commerce Department). At this stage Western governments had, in practice, a split personality when it came to encryption; policy was made by the military cryptanalysts, who were solely concerned with preventing their 'enemies' acquiring secrets, but that policy was then communicated to commerce by officials whose job was to support industry. Shortly afterward,
Netscape's
SSL technology was widely adopted as a method for protecting credit card transactions using
public key cryptography. Netscape developed two versions of its
web browser. The "U.S. edition" supported full size (typically 1024-bit or larger)
RSA public keys in combination with full size symmetric keys (secret keys) (128-bit RC4 or 3DES in SSL 3.0 and TLS 1.0). The "International Edition" had its effective key lengths reduced to 512 bits and 40 bits respectively (
RSA_EXPORT with 40-bit RC2 or RC4 in SSL 3.0 and TLS 1.0). Acquiring the 'U.S. domestic' version turned out to be sufficient hassle that most computer users, even in the U.S., ended up with the 'International' version, whose weak
40-bit encryption can currently be broken in a matter of days using a single computer. A similar situation occurred with
Lotus Notes for the same reasons.
Legal challenges by
Peter Junger and other civil libertarians and privacy advocates, the widespread availability of encryption software outside the U.S., and the perception by many companies that adverse publicity about
weak encryption was limiting their sales and the growth of e-commerce, led to a series of relaxations in US export controls, culminating in 1996 in President
Bill Clinton signing the [https://www.govinfo.gov/content/pkg/FR-1996-11-19/pdf/96-29692.pdf Executive Order 13026 transferring the commercial encryption from the Munition List to the
Commerce Control List. Furthermore, the order stated that, "the software shall not be considered or treated as 'technology'" in the sense of
Export Administration Regulations. The Commodity Jurisdiction process was replaced with a Commodity Classification process, and a provision was added to allow export of 56-bit encryption if the exporter promised to add "key recovery" backdoors by the end of 1998. In 1999, the EAR was changed to allow 56-bit encryption (based on RC2, RC4, RC5, DES or CAST) and 1024-bit RSA to be exported without any backdoors, and new SSL cipher suites were introduced to support this (
RSA_EXPORT1024 with 56-bit RC4 or DES). In 2000, the
Department of Commerce implemented rules that greatly simplified the export of commercial and
open source software containing cryptography, including allowing the key length restrictions to be removed after going through the Commodity Classification process (to classify the software as "retail") and adding an exception for publicly available encryption source code.
Current status , non-military cryptography exports from the U.S. are controlled by the Department of Commerce's
Bureau of Industry and Security. Some restrictions still exist, even for mass market products; particularly with regards to export to "
rogue states" and
terrorist organizations. Militarized encryption equipment,
TEMPEST-approved electronics, custom cryptographic software, and even cryptographic consulting services still require an export license. In addition, other items require a one-time review by, or notification to, BIS prior to export to most countries. Export regulations have been relaxed from pre-1996 standards, but are still complex. have similar restrictions. On March 29, 2021, the Implementation of Wassenaar Arrangement 2019 Plenary Decisions was published in the Federal Register. This rule included changes to license exception ENC Section 740.17 of the EAR. ==U.S. export rules==