This page has been speech-enabled for Macintosh owners using the Talker Netscape Plug-in. Hit Escape to discontinue speech.
The first case, Karn v. U.S. Department of State, No. 95-1812 (CRR) (D. D.C. Mar. 22, 1996) concerned whether a computer disk containing encryption code is a defense article under the Arms Export Control Act (AECA), 22 U.S.C. Sections 2751-2796d, and the International Traffic in Arms Regulations (ITAR), 22 C.F.R. Sections 120-130, and is thus subject to a licensing requirement in order to export the disk.
In the Karn case, the plaintiff filed a "commodity jurisdiction request" to export the book "Applied Cryptography" by Bruce Schneier. The book explains different aspects of cryptography-- history, politics, different encryption algorithms, and techniques to implement cryptographic algorithms. One part of the book contains computer source code for a number of cryptographic algorithms. Stuck in the back of the book was also a computer disk containing the same source code found printed in the book. The Department of State's Office of Defense Trade Controls declared that it did not have jurisdiction under the ITAR as to the book, but explicitly did not extend this determination to the disks.
Karn then filed a commodity jurisdiction request for the computer disks. The Office of Defense Trade Controls responded that it did have jurisdiction over the disk, and the disk constituted a restricted defense article. This decision was then appealed twice, and the appeal was denied twice-- resulting in the current case.
The U.S. District Court for the D.C Circuit held that the AECA specifically bars judicial review of the President's (or the President's designee-- the Department of State) designation of items as defense articles. The court then held that a challenge based on the Administrative Procedure Act, 5 U.S.C. Section 706(2)(a), constituted an attempted end-run around the non-reviewability provision of the AECA, and thus also failed.
Most importantly though, the court addressed a constitutional challenge to the regulations. The court held that the regulations are content-neutral, regardless of whether they are, as the Plaintiff contended, nonsensical because they allow export of the computer code printed on paper, but not the same code "printed" on a floppy disk. Having determined that the regulations were content-neutral, the court then applied the test for constitutionality which was developed in U. S. v. O'Brien, 391 U.S. 367 (1968). The O'Brien test requires that a regulation be within the constitutional power of the government, that it further an "important and substantial government interest," and that the regulation be narrowly tailored to the government interest.
The plaintiff did not contest the first two elements, but rather claimed that by classifying the disk as a munition, the government would not satisfy its interest in limiting access to strong cryptography. The court found that this argument was another veiled attack on the President's determination that the material at issue should be on the munitions list-- a determination that the court had already found unreviewable. Karn is now on appeal.
Unlike Mr. Karn, Daniel Bernstein fared a bit better in his challenge of the constitutionality of the same regulations. Mr. Bernstein developed an encryption algorithm called "Snuffle." He wrote an academic paper discussing his algorithm, he wrote some source code implementing the algorithm, and he wished to present talks about it at conferences and on the Internet.
Bernstein also requested a Commodity Jurisdiction determination from the Office of Defense Trade Controls regarding his paper, and two portions of his software implementation of the Snuffle algorithm. The Office of Defense Trade Controls declared that his system is considered a defense article, and thus is subject to a licensing requirement before it can be exported. Not knowing which elements this decision referred to, Bernstein requested a separate determination as to five distinct elements-- the paper, the two software components, and two texts on implementation and use of the algorithm. The response to his request was that all of the elements constitute defense articles. This determination resulted in Bernstein v. United States Department of State, No. C-95-0582 (N.D. Cal. April 15, 1996).
After the suit was filed, the Office of Defense Trade Controls wrote to Bernstein to "clarify" that its determination applied only to the software elements, and not to the texts.
In the Bernstein case the Department of State made the same arguments it made in the Karn case. Both cases acknowledged the non-reviewability provision of the regulations, and both acknowledged that the provision will not stop a constitutional challenge. This, however, is largely where the similarity between the two decisions ends.
In addressing the constitutional issues, the court in Bernstein first looked at whether if the encryption system constitutes "speech" or whether it is more appropriately labeled "conduct" (and thus is easier to regulate). The court determined that the encryption system is speech, albeit "functional" speech. Rather than using the analogy that the encryption system is "conduct," like burning a flag, the court held that the computer software is more analogous to speech in a foreign language. The court reasoned, "[n]or does the particular language one chooses change the matter for First Amendment purposes. This court can find no meaningful difference between computer language, particularly high-level [computer] languages... and German or French. All participate in a complex system of understood meanings within specific communities."
The court found further support for the argument that computer languages constitute speech for constitutional purposes by looking to the Copyright Act-- which protects computer software as "literary works" 17 U.S.C. 101, 102(a)-- even purely "functional" speech such as player-piano rolls.
Next, as did the Karn court, the Bernstein court looked to the aforementioned O'Brien test. However, the Bernstein court determined that speech was at issue, and not conduct, and it found the O'Brien test to be an inappropriate standard. However, because the case was only a motion for summary judgment, the court applied the standard to ascertain whether Mr. Bernstein had a colorable claim sufficient to avoid the defendant's motion for summary judgment.
Again, neither party debated much over the first two prongs of the O'Brien test-- that the government has the power to regulate in this area, and that it has an important interest at stake (national security). However, the Bernstein court, noting the presumption against prior restraints on speech, found that the Department of State's only response was that the software is conduct, not speech-- a proposition that the court had already rejected.
Continuing, the court held that Bernstein had a colorable claim that the regulations were overbroad, and that the regulations could compromise protected speech. Furthermore, the court found no difficulty in holding that the regulations were vague. Although the Department of State claimed that the definition of cryptographic software and the exemptions from the definition are clear to a person of ordinary intelligence, the court pointed out that the Office of Defense Trade Controls itself mistakenly categorized Bernstein's academic paper as a defense article. In other words, the court found that Bernstein's vagueness claims were also colorable enough to survive a motion for summary judgment.
In discussing these two cases, one commentator speculated that the two judges must have come from different planets. In the judges' opinions, the courts are clearly speaking different languages. In the past, speaking in different languages (specifically, Navajo) was used to avoid enemy interception of communications during war. According to the Bernstein court, it should not matter whether someone speaks in English, Navajo, or PGP-- all speech has some constitutional protection. On the other hand, I would be interested to see how the Karn Court would handle the matter if the Department of State declared a software algorithm that automatically converts English to Navajo a defense article.
