Dr. Daniel Bernstein has some ideas about cryptography, the art and science of keeping messages secure, that he wants to share. In particular, he wants to publish his ideas and research in an Internet discussion group named sci.crypt, as well in print. But the Government has told Bernstein that he cannot "export" a document or source code describing the encryption system he developed, called Snuffle, without registering as an arms dealer and obtaining an arms license from the State Department. The Government says these items are on the U.S. Munitions List and covered by the International Traffic in Arms Regulations. But Bernstein claims the Government's actions prevent U.S. citizens from engaging in private, electronic communications with foreign persons, and, as a practical matter, will restrict private domestic electronic communications. Bernstein also argues that by "restricting access to the tools which allow anonymity and privacy, the government puts the communications of all of its citizens at risk." According to Bernstein,
"Without cryptography, what people send via computers is the electronic equivalent of a postcards, open to view by many people while the message is in transit. With cryptography, people can put both messages and money into electronic 'envelopes,' secure in the knowledge that what they send is not accessible to anyone except the intended recipient.
... Continued development of cryptography promises to make it possible for the worldwide computer Internet to offer private, secure and protected communication among billions of people worldwide."
While a Ph.D. candidate in Mathematics at the University of California at Berkeley, Daniel Bernstein worked in the field of cryptography and developed an "encryption algorithm or recipe which he calls 'Snuffle.'" He described Snuffle in English and in mathematical equations, as well as in the "C" computer programming language (Snuffle.c and Unsnuffle.c). Bernstein wants to publish his cryptographic ideas and research results "as part of the normal process of academic, scientific and political exchange of ideas and information," and, in particular, in "text journals as well as in an online discussion group about the science of cryptography, called sci.crypt.
According to Bernstein, "[a]ware of the [Government's] civil and criminal restrictions on cryptography export, [he] asked the Office of Defense Trade Controls ("OTDC"), an arm of the State Department, to find out whether he could publish his ideas." He told OTDC that he wanted to export the document "The Snuffle Encryption System," and the Snuffle.c and Unsnuffle.c source files.
Bernstein filed 5 different commodity jurisdiction requests. OTDC determined that each of the items are on the U.S. Munitions List and covered by the International Traffic in Arms Regulations (ITAR), so he may not "export" them without registering as an arms dealer and obtaining an arms license from the State Department. Bernstein then filed a lawsuit so he might publish his own scientific ideas without such restriction. __Bernstein v. U.S.__, C95-00582 MHP (N.D. Cal.)
In response, the Government asks the Court to dismiss Bernstein's complaint. The Government notes the Arms Export Control Act (17 U.S.C. Section 2778(h)) expressly prohibits judicial review of the determination that cryptographic software should be designated a "defense article" on the U.S. Munitions List. Here, snuffle 5.0 software was designated a defense article under statutory authority, "[i]n furtherance of world peace and the security and foreign policy of the United States." According to the Government, both the Arms Export Control Act and the Constitution prevent the Court from second-guessing the designation -- the question of whether an item should be placed on the Munitions List possessing nearly every trait that would render it "political." In addition, claims the Government,
"No satisfactory or manageable standards exist for judicial determination of the issue, as [the Government itself] acknowledge[s] the disagreement among experts as to whether [the particular item] belongs on the list. Neither the courts nor the parties are privy to reports of the intelligence services on which this decision, or decisions like it, may have been based. The consequences of uninformed judicial action could be grave. Questions concerning what perils our nation might face at some future time and how best to guard against those perils 'are delicate, complex, and involve large elements of prophecy. They are and should be undertaken only by those directly responsible to the people whose welfare they advance or imperil....'" (Citations omitted.)
Bernstein claims the Court of Appeals for the Ninth Circuit has stated that colorable constitutional claims may be reviewed by courts despite the seemingly absolute preclusion of the Arms Export Control Act (AECA). However, he has not raised colorable claims here, asserts the Government, because (1) this case involves not "speech" covered by the First Amendment, "but the conduct of exporting a functioning defense article," and (2) even if "speech" were incidentally involved in the State Department's control of the export of cryptographic software, "such an incidental infringement easily passes First Amendment muster ...."
Bernstein claims the State Department seeks to regulate his right to "publish" a "scientific paper" or "to engage in academic inquiry" and "to openly discuss" ideas related to cryptography. But, says the Government, the State Department did "no such thing." The State Department simply determined Bernstein cannot export his cryptographic software without an export license. As explained by Bernstein and confirmed by the National Security Agency, Snuffle 5.0 is a functioning cryptographic product -- software capable of maintaining the secrecy or confidentiality of data.
The Government observes that "conduct" is protected by the First Amendment only if it is or could be "sufficiently imbued" with elements of communication. The Supreme Court looks for "[a]n intent to convey a particularized message ..., and [whether] the likelihood was great that the message would be understood by those who viewed it." Here, export of cryptographic software is not sufficient imbued with communicative elements, says the Government, and does not "'convey a particularized message' to its foreign recipients." Despite claims this case involves Bernstein's right to publish a paper, the Government argues that Bernstein did not submit to the State Department an academic discourse on algorithmic theories -- he submitted "source code for data encryption, along with instructions on how to make it operational on a computer so that users could have an interactive, zero-delay, encrypted conversation." The dissemination of Snuffle would have a functional -- not communicative -- purpose, and its designation as a defense article "does not," therefore, "constitute the regulation of expression upon which a colorable constitutional claim may be based."
Even if the First Amendment applied to Bernstein's export of cryptographic software, the Government argues that "[t]he State Department's commodity jurisdiction determinations do not run afoul of First Amendment principles because any impact on [Bernstein's] 'speech' would be incidental to the government's regulation of the conduct of exporting cryptographic software."
According to the Supreme Court, an incidental restriction on speech will be supported if,
"(i) it is within the constitutional power of the government; (ii) it furthers an important or substantial governmental interest; (iii) the governmental interest is unrelated to the suppression of free expression; and (iv) the incidental restriction on alleged First Amendment freedoms is no greater than is essential to the furtherance of that interest."
Here, says the Government, the first two elements are readily met. Regulation of the export of defense articles is within the power of Congress to provide for the common defense and regulate foreign commerce. And there is a substantial governmental interest in "control[ling] the availability of cryptography from the United States so that critical foreign intelligence gathering functions are not harmed...." Further, "the determination that cryptographic software like [S]nuffle should be considered a 'defense article' subject to export control '[i]n furtherance of world peace and the security and foreign policy of the United States,' 22 U.S.C. Section 2788(a)(1), is not one for courts to evaluate."
On the third element, the Government also believes the regulation of the export of defense articles and services under ITAR (22 C.F.R. Subchapter M, Parts 120 - 130) does not suppress free expression. The U.S. Munitions List (USML) and ITAR cover Snuffle software, asserts the Government, because of its function and capability to encrypt information, and is, therefore, "unrelated to the suppression of speech."
Fourth, the Government claims the inclusion of certain cryptographic software on the USML is an incidental restriction on alleged First Amendment freedoms no greater than is essential "in furtherance of a substantial national security interest to protect the United States' signals intelligence capabilities that are utilized to provide essential information to national security policymakers and military commanders." ITAR, in fact, "excludes certain cryptographic software that does not maintain data confidentiality or secrecy (such as for data authentication and financial functions), as well as mass market software products with limited encryption capabilities." In so doing, ITAR excludes cryptographic software that does not pose a risk to national security, and "responds precisely to the substantive security problems which legitimately concern the [Government]." Looking to a decision by the Ninth Circuit Court of Appeals, __U.S. v. Elder Industries__, 579 F.2d 516 (9th Cir. 1978), the Government argues that,
"[I]f the government may incidentally restrict the transmission of technical data by making it unlawful to assist a foreign national in the development of a functioning defense article, it may, consistent with the First Amendment, regulate the exportation of the functioning defense article itself, even if such regulation may, in certain cases, incidentally inhibit 'expression.'"
To the extent Bernstein claims the Government's actions constitute a "prior restraint" on the "publication of scientific papers," the Government argues the claim is "the product of his own misinterpretation of the facts and the ITAR." According to the Government,
"[N]owhere do the commodity jurisdiction determinations indicate that [Bernstein] is barred from publishing a scientific paper concerning the theory of [S]nuffle, or expressing ideas about cryptography in general. What [Bernstein] cannot do is export [S]nuffle software without first obtaining a license from the State Department."
Control of the export of [S]nuffle software does not implicate the First Amendment, says the Government, because the software functions to encrypt data and "control of its export is unrelated to any incidental restriction on expression that such an export may entail."
Bernstein's claim the Government restrained publication of explanatory information fails, says the Government, because the State Department's determination did not assess the explanatory information separately for export control purposes. The Government believes Bernstein only sought a determination for [S]nuffle and certain technical data. The State Department advised Bernstein that it reviewed the explanatory information only to evaluate the software. To the extent technical data was included, the State Department advised that Bernstein would need a license to export the data if his objective were to assist a foreign person or enterprise in obtaining or developing his cryptographic software.
In response to Bernstein's claim the AECA and ITAR violate the First Amendment on overbreadth grounds, particularly because they prevent him from "discussing or revealing his ideas in any public forum in the United States on the grounds that it might have the effect of disclosing the information contained therein to a foreign person," the Government urges that the Ninth Circuit Court of Appeals has already ruled that the relevant ITAR provisions are not unconstitutionally overbroad. Bernstein's overbreadth claim is, therefore, foreclosed. The Government notes that the definition of technical data under ITAR excludes "information concerning general scientific, mathematical or engineering principles commonly taught in schools, colleges, and universities," as well as information in the "public domain."
The Government also rejects Bernstein's claim the AECA and ITAR are impermissibly vague. In part, the Government observes, "[t]he definition of cryptographic software as that 'with the capability of maintaining secrecy or confidentiality' is surely susceptible to common understanding by 'a person of ordinary intelligence.'"
In opposition to the requested dismissal, Bernstein notes that the definition of "export" under ITAR includes "disclosing (including oral or visual disclosure) or transferring technical data to a foreign person, whether in the United States or abroad." Under this definition, says Bernstein,
"1. [He] cannot even teach his ideas to his students in a classroom without government permission, unless he ensures that none of his students is a 'foreign person.'
2. [He] would export his ideas if he were to disclose them at an academic conference, because said publication would surely disclose his ideas to a 'foreign person.'
3. [He] would export his ideas if he were to post a message containing them to the sci.crypt newsgroup. Export includes distributing the ideas over the Internet by posting them to internationally available newsgroups, since this might disclose them to a 'foreign person."
Bernstein claims "he cannot even stand on a street corner and talk about his ideas, because this might 'export arms' if a foreign person was listening."
Bernstein agrees he cannot challenge the designation of an item on the USML, but notes his challenge is, in fact, to the constitutionality and ultra vires nature of the entire regulatory scheme, on grounds that it restrains his right to communicate without meeting the Constitutional standards for such restraints. Here, says Bernstein, it is not conduct that ITAR restricts, but disclosure and communication. No export license is required under ITAR to actually use encryption.
According to Bernstein, the Government is "attempting a bit of sleight-of-hand here, hoping to narrow the scope of this lawsuit." The Government wrongly construes the State Department's determinations as referring only to "cryptographic software, deliberately ignoring his other submissions, and then argue that publishing 'software' never can be protected expression." But, says Bernstein, the Government "did extend ... control to both the code and non-code items submitted by [him]."
ITAR controls much more than encryption software. The definition of "software" under ITAR, says Bernstein, "includes but is not limited to the system functional design, logic flow, algorithms, applications programs, operating systems and support software for design, implementation, test, operation, diagnosis and repair." As non-code items arguably include logic flow and algorithms that are part of Bernstein's ideas, they could be included within the definition of "software." And even if non-code items do not constitute defense articles, they still may be controlled as technical data or to the extent they may furnish "assistance" to persons in the use of controlled cryptographic software. In light of the above, Bernstein claims he has presented colorable Constitutional claims the Government's action "constituted a prior restraint on his right to publish non-software expressions of his ideas, as well as those written in computer code."
Bernstein notes that in a 1978 memorandum, the Justice Department concluded that "existing provisions of the ITAR are unconstitutional insofar as they establish a system of prior restraint on the disclosure of cryptographic ideas and information developed by scientists and mathematicians in the private sector."
Bernstein explains he is a scientist and an academic who seeks to publish his ideas for scientific and academic discussion. He seeks discussion by the worldwide community. His communication meets the First Amendment value of the search for truth through the "marketplace of ideas." His desire for peer review fulfills the First Amendment value of self-expression. Bernstein's activities, therefore, fall within First Amendment protections for academic discourse.
Bernstein also seeks to engage in political speech. He observes,
"There has been considerable public debate over the role of cryptography in society and whether the government's current regulatory scheme is appropriate. Government agencies are major players in this debate. When the agencies which administer laws and regulations which can act as a prior restraint are also involved in policy formulation about the same subject, there is a clear risk that these agencies may interfere with that process of political and social change, and 'raise[s] the specter that the Government may effectively drive certain ideas or viewpoints from the marketplace.' Here, [Bernstein's] speech contributes to the cryptography policy debate by demonstrating that nonrestricted hash functions are in truth as powerful as the most heavily restricted items, and that one may be easily converted to the other. To [Bernstein's] audience of scientists and cryptography policymakers, his speech argues that the government's policy is arbitrary and ineffective, rebutting the government's public assertions to the contrary."
The Government cannot avoid the traditional tests of prior restraints simply by labeling the publication of computer code as "conduct of export," says Bernstein. Here it is disclosure that is regulated. Bernstein desires to communicate his ideas, and there must not be a Constitutionally cognizable distinction between communication of ideas in English or mathematical symbols and the communication of those ideas written in the language of computer code. Among other things, Bernstein recalls that "software" is treated as expression under copyright law, and that the Supreme Court holds that the First Amendment prohibits the Government from restricting the languages used by its citizens.
Notably, Bernstein argues the Government's scheme has the effect of controlling private speech by controlling the tools necessary for it. But, "the Supreme Court has long held that the government cannot target the tools of expression in order to improperly restrict expression itself." Claims Bernstein,
"The First Amendment includes the right to speak confidentially. It prevents 'compelled speech', and preserves the autonomy to control one's own speech. It protects anonymous speech. It prevents compelled disclosure of those with whom one associates and speaks. It requires ... that the government allow people to speak in any language they choose. It extends to a person's right to communicate with foreigners.
If the government is successful here, it will undermine all of these protections. It will prevent U.S. citizens from engaging in private, electronic communications with foreign persons. As a practical matter, it will also restrict private domestic electronic communications. ... By restricting access to the tools which allow anonymity and privacy, the government puts the communications of all of its citizens at risk." (Citations omitted.)
Bernstein argues that the Government has exceeded its authority in applying ITAR to him, as Congress "never intended that the AECA be applied to the publication academic or scholarly publication of scientific and technical information." Neither the statutory language nor legislative history reflect an intent to control academic publications, as noted by the Justice Department in its 1978 Memorandum.
In further detail, Bernstein argues that judicial review is not precluded under the political question doctrine, noting the Supreme Court struck an injunction against publication of the Pentagon Papers even though the Vietnam War was still in progress. Bernstein also claims jurisdiction here is proper under the Administrative Procedures Act, 5 U.S.C. Section 704.
Accordingly, Bernstein concludes his claims are sufficient to prove jurisdiction exists. "Real constitutional issues are at stake; [Bernstein's] communication, not his conduct was restrained. ... The appropriate test for judging the prior restraint of [Bernstein's] speech here is laid out in the Pentagon Papers case: whether publication of the items 'will surely result in direct, immediate and irreparable damage to our Nation or its people.'"
CyberLaw (tm) is published solely as an educational service. The author, a California attorney, is Executive Editor of LEXIS COUNSEL CONNECT CALIFORNIA. He may be contacted at cyberlaw.us@counsel.com or cyberlaw@cyberlaw.com. Questions and comments may be posted on America Online (go to keyword "CYBERLAW") or CyberLaw World Wide (http://www. cyberlaw.com/), made possible with support from Best Internet Communications, Inc. (ph. 415/964-2378). CyberLaw is a trademark of Jonathan Rosenoer. Copyright © 1995 Jonathan Rosenoer; All Rights Reserved.
![[return to top]](/web/20051201184530im_/http://www.cyberlaw.com/rtrntp.GIF)
