What Happened to Export Controls on Cryptography (Crypto Wars)?

The 'Crypto Wars' represent a pivotal period in the history of digital rights and national security, originating in the Cold War era when cryptography was predominantly a military asset. Governments, led by the United States, classified encryption technology as munitions, imposing strict export controls to prevent adversaries from acquiring strong cryptographic capabilities that could thwart intelligence gathering. This stance was codified under regulations like the International Traffic in Arms Regulations (ITAR). The rationale was rooted in national security, aiming to maintain a strategic advantage in signals intelligence and ensure law enforcement could access communications when necessary.

A key turning point arrived with the advent of personal computing and the internet in the early 1990s. The public distribution of Phil Zimmermann's Pretty Good Privacy (PGP) software in 1991 directly challenged these controls, making strong encryption accessible to individuals globally and sparking a criminal investigation against Zimmermann. The US government's introduction of the Clipper Chip in 1993, a hardware encryption device with a built-in 'backdoor' for law enforcement, ignited widespread public and industry backlash over privacy concerns and technical vulnerabilities, ultimately leading to its abandonment by 1996. Concurrently, the growth of e-commerce created immense pressure from the tech industry, which argued that export restrictions on strong encryption hampered their ability to compete internationally.

By the late 1990s and early 2000s, the tide began to turn. President Bill Clinton's administration progressively loosened export controls, shifting oversight of commercial encryption from the State Department to the Department of Commerce's Bureau of Industry and Security (BIS). This deregulation allowed for the export of increasingly stronger encryption, including 56-bit DES and 1024-bit RSA, and eventually removed key length restrictions for mass-market retail products. The Wassenaar Arrangement, established in 1996, emerged as a multilateral export control regime for conventional arms and dual-use goods, including information security items, providing an international framework for managing these technologies.

Today, as of June 20, 2026, the original 'Crypto Wars' over broad export restrictions on strong encryption are largely considered over, with strong encryption, particularly end-to-end encryption, being widely adopted and technically difficult to restrict. However, the underlying tension between privacy, national security, and technological advancement persists in new forms. Export controls on cryptography are now primarily managed under dual-use regulations, focusing on specific high-strength or custom cryptographic software and hardware, especially concerning 'rogue states' and terrorist organizations. Countries like Israel have recently (March 2026) reformed their domestic encryption export controls to align with the Wassenaar Arrangement, reflecting a global trend towards harmonized, albeit still present, regulations.

New fronts in this ongoing struggle include the implications of quantum computing and artificial intelligence. The potential for quantum computers to break current public-key cryptography has led to a global push for post-quantum cryptography (PQC) and new considerations for export controls on quantum-related technologies. Furthermore, the US government is actively addressing the export of advanced AI models, as demonstrated by the Commerce Department's June 2026 directive to Anthropic, blocking foreign access to certain AI models due to national security concerns. Legislative efforts, such as the US Remote Access Security Act (RASA), passed by the House in January 2026 and awaiting Senate action, aim to expand BIS authority to regulate remote access to controlled technologies via cloud services, highlighting the evolving nature of export control in the digital age.