By James P. Moran
Friday, June 6, 1997; Page A27

The Post's assumption that U.S. encryption software poses a national security threat in the wrong hands [editorial, May 25] ignores both the rapid advances in technology and the reality of today's market for encryption software.

Current U.S. policy prohibits export of high-powered encryption software unless the key to decoding its messages is filed with a third-party "key recovery agent." The U.S. software industry and many consumers oppose this policy for any number of reasons, but in the end it will be pure economic arguments that force the United States to update its encryption policy.

The last decade has seen tremendous growth in the use of encryption technology. With the explosion of the Internet and the relative ease with which Internet communications can be monitored, encryption technology is of increasing importance to businesses that wish to keep trade secrets private or consumers who wish to prevent unauthorized access to their credit card numbers. The fact that encryption technology is necessary for U.S. businesses and consumers is shown by the recent arrest of a California man who allegedly sold 100,000 credit card numbers he obtained from unsecure Internet messages.

Unfortunately, U.S. policy has not recognized that encryption software has moved from being a Cold War tool of the intelligence community to a necessary ingredient in modern commerce. The fact that encryption is regulated under the Arms Export Control Act and the International Traffic in Arms Regulations only emphasizes the fact that our regulatory system of encryption is far behind the times.

The simple fact is that, whatever regulations the United States chooses to adopt, the worldwide market for encryption software will approach $200 billion annually by the year 2000. It is currently dominated by U.S. companies, which earn three-fourths of all its net profits. But software industries in dozens of foreign countries are already marketing encryption software stronger than U.S. export rules permit. Some U.S. companies are investing in foreign subsidiaries to get around export laws and still reap profits from the encryption market. Perhaps the most telling absurdity is that while U.S. law prohibits exporting strong encryption software, U.S. courts have held that the same computer code written in hard copy is protected free speech and may be sold and even exported.

The economic impact of current encryption policy will be devastating to U.S. industry. Key recovery for sophisticated export products means that U.S. software developers will need to develop two kinds of products: those whose code can be broken by our intelligence or law enforcement agencies, for the export market, and those without key recovery, for domestic sales. It's true that the U.S. software industry often makes different versions of programs for different markets, but the industry does so to enter new markets or increase market share in existing markets.

By forcing the industry to develop two versions while foreign competitors need only develop one, this policy will increase marginal costs of production without bringing a corresponding increase in market share. In fact, market share is likely to decrease, because even if U.S. firms offer competitively priced software, purchasers know that someone else will have a key to their encryption. Given the choice between buying software with or without a key recovery agent, most purchasers will opt for the latter.

Today U.S. software developers dominate the world market, boasting a 70 percent share. The U.S. industry employs more than 600,000 people directly and another 1.5 million indirectly. If the United States is, in effect, kept out of the encryption market, U.S. businesses stand to lose $60 billion over the next four years, and thousands of jobs and billions of dollars in tax revenue. There are no estimates as to how much market share the United States will lose in related software markets, but it is likely to be substantial.

Given that technology is advancing at such a rapid pace, technology and software regulations are best regulated flexibly by the Department of Commerce and not carved by Congress into statutory stone. Yet the administration's refusal to abandon mandatory key recovery will likely force Congress to act. Unless we are willing to pull the plug on the U.S. software industry's foreign market, we must adopt new, economically sensible regulations as soon as possible.

The writer is a Democratic representative from Virginia.