Federal Policy and Actions
OSI-94-2: Published: Nov 4, 1993. Publicly Released: Nov 5, 1993.
Pursuant to a congressional request, GAO examined whether federal policies negatively affect U.S. corporations' ability to protect themselves against economic espionage, focusing on: (1) the need for information privacy in computer and communications systems to prevent economic espionage; (2) federal agency authority to develop cryptographic standards for protection of sensitive, unclassified information and the actions and policies of various agencies regarding the selection of federal cryptographic standards; (3) the National Security Agency's (NSA) and the Department of State's export control policies for encryption-capable products and the industry's rationale for requesting liberalization of such controls; and (4) the Federal Bureau of Investigation's (FBI) proposed legislation regarding telephone systems that use digital communications technology.
GAO found that: (1) the U.S. computer industry has increasingly used computer and communications equipment with encryption capabilities to protect proprietary information because of the increased risk of economic espionage; (2) national security and law enforcement concerns have led to federal policies that limit the use and export of U.S. commercial encryption technology and hinder its development; (3) the National Institute of Standards and Technology (NIST) and NSA have developed federal cryptographic policies and standards for sensitive, unclassified information, but they have not sought input from affected business interests, academia, and others; (4) although the Departments of State and Commerce are responsible for setting exports controls, NSA plays a major role in determining rules for exporting U.S. products with encryption capabilities; (5) stringent export controls limit U.S. industry's ability to compete in international markets for encryption products; and (6) FBI proposed legislation would compel telecommunications service providers and private branch exchange operators to ensure that wiretapping needs could be met and prohibit any technology that would impede government interception of electronic communications.