Congress should not legislate the behavior of employees, networks sysadmins, or companies as some have been suggesting. The primary areas where Congress should be concerned are:
1. Vulnerability of our commerce systems to domestic or international attack.
2. Creating an environment that encourages companies and consumers to protect themselves.
3. Ability to obtain properly authorized evidence in the event of a warrant to pursue suspected criminals.

Item one is the most critical, and what seems to be completely ignored by our current legislators. Any scheme of encryption cracking that is available to our goverment in the event of a warrant, is also available to our enemies. Yes, the FBI may be able to read Bin Ladin's email if no encryption exists, but, terrorists would also be able to have full access to our e-commerce infrastructure, private information, etc... and have the ability to cause significant damage, especially since e-commerce is becoming a more significant part of our economy every day.
2 implies educational programs, and sponsorship of groups that promote real security.
3 is important, but may not be realistic in the context of 1.