Human rights and encryption
United States
### United States

There has been a broad, active and contentious policy debate on encryption in the US since the 1990s beginning with the "[Crypto Wars](/wiki/Crypto_Wars "Crypto Wars")". This involved the adoption of the [Communications Assistance for Law Enforcement Act](/wiki/Communications_Assistance_for_Law_Enforcement_Act "Communications Assistance for Law Enforcement Act") (CALEA), containing requirements for telecommunications providers and equipment manufacturers to ensure the possibility of effective [wiretapping](/wiki/Telephone_tapping "Telephone tapping").Pub. L. No. 103\-414, 108 Stat. 4279, codified at 47 USC 1001–1010 It also involved a debate over existing export controls on strong encryption products (considering their classification as munition) and a criminal investigation into cryptographic email software developer and activist [Phil Zimmermann](/wiki/Phil_Zimmermann "Phil Zimmermann"). The case was dropped and the general debate resolved after the [liberalization](/wiki/Liberalization "Liberalization") of export controls on most commercial products with strong encryption features and the transfer of these items from the U.S.A. Munitions List ([USML](/wiki/United_States_Munitions_List "United States Munitions List")), administered by the [Department of State](/wiki/United_States_Department_of_State "United States Department of State"), to the [Commerce Control List](/wiki/Commerce_Control_List "Commerce Control List") (CCL), administered by the [Department of Commerce](/wiki/United_States_Department_of_Commerce "United States Department of Commerce"). The USA Department of Commerce maintains some controls over items on the CCL, including registration, technical reviews and reporting obligations, and continues to impose licensing and other requirements for sensitive encryption items and sales of such items to foreign governments.

The debate ignited after the [Edward Snowden](/wiki/Edward_Snowden "Edward Snowden") revelations and the well\-documented increase in deployed encryption measures by Internet services, device makers and users, as well as a concerted call from the technical community and civil society to increase encryption use and security to address [mass surveillance](/wiki/Mass_surveillance "Mass surveillance") practices.See Ira Rubinstein and Joris van Hoboken. Privacy and Security in the Cloud, Maine Law Review 2014\. Notably, the debate on encryption was already taking place before the Snowden revelations, as US law enforcement actors were arguing for the extension of wiretap obligations (CALEA) for internet services. For a discussion, see Adida et al. 2013\. The increased adoption of encryption by the industry has been received critically by certain government actors, the [FBI](/wiki/Federal_Bureau_of_Investigation "Federal Bureau of Investigation") in particular. This led to the widely reported [FBI–Apple encryption dispute](/wiki/FBI%E2%80%93Apple_encryption_dispute "FBI–Apple encryption dispute") over the possibility to gain access to information on the [iPhone](/wiki/IPhone "IPhone") in assistance to law enforcement. In 2016, several bills were introduced in the [US Congress](/wiki/United_States_Congress "United States Congress") that would place new limits encryption under USA law. The USA's legal system promotes and requires security measures to be implemented in the relevant contexts, including cryptographic methods of various kinds, to ensure security in commerce and trade. Relevant laws are the [Federal Information Security Modernization Act](/wiki/Federal_Information_Security_Modernization_Act_of_2014 "Federal Information Security Modernization Act of 2014") (FISMA) of 2014, the [Gramm\-Leach\-Bliley Act](/wiki/Gramm%E2%80%93Leach%E2%80%93Bliley_Act "Gramm–Leach–Bliley Act"), the [Health Insurance Portability and Accountability Act](/wiki/Health_Insurance_Portability_and_Accountability_Act "Health Insurance Portability and Accountability Act") (HIPAA) and also the [Federal Trade Commission Act](/wiki/Federal_Trade_Commission_Act_of_1914 "Federal Trade Commission Act of 1914"). These acts contain security requirements and thereby indirectly require or stimulate the use of encryption in certain circumstances. Finally, many state breach notification laws treat encrypted data as a [safe harbor](/wiki/Safe_harbor_%28law%29 "Safe harbor (law)") by exempting firms that have encrypted data from notice obligations.

Constitutional considerations and [human rights](/wiki/Human_rights_in_the_United_States "Human rights in the United States") play a role of significance in the USA debate about the legal treatment of encryption methods. Restrictions on distribution of cryptographic protocols, and the publication of cryptographic methods are considered an interference with the [First Amendment](/wiki/First_Amendment_to_the_United_States_Constitution "First Amendment to the United States Constitution"), the USA constitutional safeguard protecting freedom of expression. The USA has particularly active and strongly developed civil society actors involved in cryptographic policy and practice.

The United States of America is a primary site for cryptology research and engineering, development and implementation of cryptographic service innovations. There is an active community of Non\-Governmental Organizations engaged in the national and international debate on encryption policy.See e.g. the Encrypt all the Things Campaign. The predominant interference's with strong encryption that take place or are being considered take place in the field of [national security](/wiki/National_Security_Agency "National Security Agency"), [law enforcement](/wiki/Law_enforcement "Law enforcement") and [Foreign Affairs](/wiki/Foreign_Affairs "Foreign Affairs"). In this area and in answering the contentious question of whether and how lawful access to specific communications could be ensured, the US Government has internationally explained its policy as one aiming to ensure that 'responsibly deployed encryption' helps to *"secure many aspects of our daily lives, including our private communications and commerce",* but also *"to ensure that malicious actors can be held to account without weakening our commitment to strong encryption"*.


What organizations interfere with strong encryption in national security, law enforcement, or foreign affairs?