Encryption Software Marketing Survey Bureau of Export Administration Office of Strategic Industries & Economic Security Economic Analysis Division President Clinton has directed that the Administration undertake a study of the competitiveness of U.S. companies in the international market for computer software with encryption. In support of this effort, BXA has initiated a study to evaluate the impact of current export controls on worldwide encryption software sales and the international competitiveness of the U.S. software industry. The results of this study, which will be finalized July 1, 1995, will be used by the Interagency Working Group on Encryption and Telecommunications Policy in evaluating the overall U.S. encryption policy, including export control regulations. NOTE: ALL ANSWERS WILL BE TREATED AND PROTECTED BY THE GOVERNMENT AS COMPANY PROPRIETARY INFORMATION. CONFIDENTIAL BUSINESS INFORMATION WILL NOT BE DISCLOSED WITHOUT PERMISSION OF THE SOURCE, BUT MAY BE AGGREGATED IN SUCH A WAY THAT THE SOURCE OF THE INFORMATION CANNOT BE IDENTIFIED. DIRECTIONS: This survey applies to all software that contains cryptography (password protection, data encoding, digital signatures, etc.), including mass market software for which encryption is not the primary function. The survey is divided into two sections to better delineate between current market data and industry potential. The answers to the questions in Section I will establish the information base necessary for a quantitative analysis of individual products, how they are exported, and their established markets. The responses to the Section II questions will outline the less definitive but equally important encryption software industry evaluation on market growth and potential. ANY INFORMATION YOU CAN PROVIDE IS WELCOME. IF YOUR COMPANY PRODUCES NO ENCRYPTION SOFTWARE PRODUCTS, PLEASE INDICATE BELOW AND RETURN THIS SURVEY TO US. _____ NO SOFTWARE PRODUCTS CONTAINING ENCRYPTION ARE MADE. PLEASE SEND RESPONSES TO: U.S. Department of Commerce Bureau of Export Administration Office of Strategic Industries and Economic Security Economic Analysis Division Attn: Karen Swasey, Division Director Room 1608 14th & Pennsylvania Ave., N.W. Washington, D.C. 20230 Tel: 202-482-5953 Fax: 202-482-3195 THE DUE DATE FOR RESPONSES IS APRIL 15, 1995. I. INDUSTRY PRODUCTS & MARKET 1. Please identify the SOFTWARE products (indicating those which are mass-market) you produce which contain (or versions of which contain) cryptography. Cryptographic or encryption software is that which uses cryptography in any way, including methods to protect passwords, encode data to provide confidentiality, or provide digital signatures for transmission identification. FOR EACH PRODUCT, PLEASE PROVIDE THE FOLLOWING INFORMATION: Product Information a. What is the product's primary function (e.g., word processing, database, security, etc.)? b. What security functions using cryptography are included (e.g., data encryption, data integrity, user authentication, digital signature, etc.)? c. For each security function, what cryptographic algorithm is used, and with what key length? Exactly how is the key generated or specified by the user? For example, is it derived through a password or entered in some other manner? d. Are key management features included? Please describe. Market Information e. What were the total sales (in units and re revenue) for the product for each year between 1990-1994 in the U.S.? Outside the U.S. (if possible provide a breakdown by region, e.g., Europe, Asia, etc.)? f. Please categorize the principal customers of the product (e.g., financial, services, manufacturing, government, etc.). g. How is the product marketed in the U.S. (e.g. retail outlets, mail order, etc.).? h. What is the product's estimated share of the U.S. market? Also, give an estimate of the future market share expected for this product. Please explain how you arrived at these estimates. i. How is the product marketed abroad (e.g. retail outlets, mail order, etc.)? If it varies by country, please specify. j. What is the product's estimated share of the non-U.S. market? Please explain how you arrived at this estimate. Please give an estimate of the future foreign market growth for this product and explain how you arrived at this estimate. k. Does the product face competition in the U.S. market from foreign products? If so, please specify the competing foreign product(s) and encryption features. Please also indicate the estimated share such products have of the U.S. market and how you arrived at this estimate. l. Have you had trouble exporting this product to any countries due to foreign import restrictions? If so, please indicate which nation(s) and the restrictions you encountered. m. Have you experienced or are you aware of any restrictions that may apply to the use of this product in other nations? If so, please describe. Export Licensing n. Do you export the product? Which Department (Commerce or State) has export licensing jurisdiction? Have you attempted to get a validated export license or munitions license for the product? IF NOT, PLEASE GO TO QUESTION Q. o. Have export licenses for this product been granted (provide license numbers if possible)? Please give the total number of products licensed for export and the resulting revenue, for each year between 1990-1994. Also, for each year, indicate the average time needed to obtain a license. p. Have export licenses for this product been denied (provide license numbers if possible)? Please indicate the total number of denials for each year between 1990-1994. Where a product was denied export, please document if possible: * The potential customer, destination country, and intended end-use. * Whether a competing product from another vendor subsequently got the sale. If available, what product, from what vendor, in what country? * Whether encryption features of the competing product are comparable to your product. If so, please provide details. * The value of the proposed export. q. Are you aware of potential customers not considering your product because they know it could not be exported? How do you know they did not consider your product and why? Why did they assume your product could not be exported? r. Have you not applied for an export license for the product, assuming that the application would be denied? If so, please document to the extent possible: * Why you assumed it would be denied. * The value of the foregone export. * The potential customer, the destination country, and the intended end-use. * Whether a competing product from another vendor subsequently got the sale. If so, what product, from what vendor, in what country? * Whether the encryption features of the competing product are comparable to your product. Please provide details. 2. For ALL the encryption software products sold by your company, what is the administrative cost of verifying that upgrades of the software are in compliance with State and Commerce export control levels? 3. How many jobs (full-time equivalent) in your company depend on sales of software products with encryption features which make them subject to individual munitions licensing requirements by the Department of State? Please indicate the number of jobs and the percentage of total employees. Sales of such products accounted for what percentage of your company's total revenues for each of the years 1990-1994? 4. How many jobs (full-time equivalent) in your company depend on sales of software products containing encryption which are eligible for bulk or distribution licensing by the Department of State? Please indicate the number of jobs and the percentage of total employees. Sales of such products accounted for what percentage of your company's total revenues for each of the years 1990-1994? 5. How many jobs (full-time equivalent) in your company depend on sales of software products containing encryption which are eligible for general license under the Department of Commerce? Please indicate the number of jobs and the percentage of total employees. Sales of such products accounted for what percentage of your company's total revenues for each of the years 1990-1994? II. MARKET GROWTH & POTENTIAL 1. Product Features a. Have current export controls prevented you from implementing security functions, specific algorithms, key strengths, or key management in mass market products? Please explain. b. Which of the above encryption features have you omitted or reduced the key length for products destined for foreign markets? Please identify the products and provide market information if not included above. c. What impact would the inclusion of these omitted encryption features have on the products -- would it change the intended end-use or attract new end-users? Please provide market assessment leading to this conclusion. d. Did your company consider including additional encryption features in the products it is currently selling but rejected such inclusion because it knew the resulting product would not be approved for export? How did the company know it would not be approved for export? Why did your company initially consider including such features? If customer demand, how did your company assess that demand? e. What products have you considered producing that would be viable in foreign markets but you did not produce owing to current export controls on encryption technology? Describe the proposed product, projected foreign sales, and how you arrived at that projection. 2. Market Potential a. Please estimate the total value (in $U.S.) of foreign sales you would expect, over and above potential sales of products you currently can export, from exports of products with stronger security features. Please explain how you arrived at this estimate. Who are the principal customers or types of customers for these products you feel you cannot bring to market under current export controls, and why do you believe export controls restrict access to these markets? Break the foreign markets down by region if possible, and identify the destination countries and intended end use(s). Please be as specific as possible (e.g. cite examples). b. Please estimate the total value (in $U.S.) of sales of encryption products in the U.S. that you believe you forego as a result of U.S. export controls. Please explain how you arrived at this estimate. c. How many (alternately, what percentage) and what type of your existing customers have inquired about security features? What type of features are they interested in (password, authentications, confidentiality)? What strength? Do they consider security to be an important feature? How important? Please quantify your answers and explain how you arrived at them. d. What type of potential customers do you believe have never inquired about purchasing one or more of your company's products because they know you could not meet their security demands? What is the basis for this belief? Please estimate the loss of sales to your firm attributable to this foreign customer perception, and explain how you arrived at this estimate. e. Do you know of competing foreign products being sold which have security features that you can't provide due to export controls? If possible, please identify the products, their vendors, and in what countries they are available. Please explain in each case how export controls prevent you from providing competitive security features. If possible, please provide sales and market share information for the foreign products you cite, and indicate the source of that information. ANY ADDITIONAL COMMENTS ON OR RELEVANT EXAMPLES OF LOST SALES, REVENUE, AND MARKET BY U.S. COMPANIES WOULD BE MOST WELCOME. BURDEN ESTIMATE AND REQUEST FOR COMMENTS. Public reported burden is estimated to average 3 hours per response for those companies who choose to participate in this voluntary project. Should you have any comments on this burden estimate or any other aspect of this survey, please contact the BXA Reports Clearance Office, Bureau of Export Administration, Room 6883, U.S. Department of Commerce, Washington, D.C., 20230, and the U.S. Office of Management and Budget, Paperwork Reduction Project (Control # 0694-0087), Washington, D.C. 20503.