United States Department of Commerce
                        The Under Secretary for Export Administration
                        Washington, DC 20230

                        November 17, 1997

Kenneth C. Bass III, Esq.
Thomas J. Cooper, Esq.
Venable, Baetjer, Howard & Civiletti, L.L.P.
1201 New York Avenue, N.W., Suite 1000
Washington, D.C. 20005-3917

Re: Appeal of Commodity Classification G007075

Dear Messrs. Bass and Cooper:

This is in response to your appeal of commodity classification G007075, dated July 23, 1997, that the Bureau of Export Administration (BXA) provided to your client, Philip R. Karn. You are appealing BXA's determination that a diskette containing encryption software was classified under Export Control Classification Number ("ECCN") 5D002. Specifically, BXA determined that because certain software on the diskette (identified as DES, ENIGMA, FEAL-8, FEAL-NX, IDEA, LOKI91, LUCIFER, NEWDES, REDOC3, SHARING (SECRET SHARING) and VIGENERE) is controlled under 5D002, the entire diskette was classified as ECCN 5D002. [1]

I have reviewed your appeal. I have also reviewed the classification issued by BXA, including the information contained in the cover letter from James A. Lewis, Director of the Office of Strategic Trade and Foreign Policy Controls, both dated August 22, 1997. Based on this review, I hereby affirm the original classification issued by BXA.

Your appeal is, in reality, a request that BXA reconsider its entire regulatory structure regarding controls on the export of encryption software. There is no dispute between BXA and you that, as written, the EAR apply to the software on the diskette and that a license is required under the EAR to export those software programs. Rather, the nature of your appeal is a request that BXA revisit the regulations themselves and the encryption export policy generally. Although Section 756.1 of the EAR specifically provides that the "issuance, amendment, revocation, or appeal of a Regulation" is not subject to the appeals procedures set forth in Part 756 of the EAR, I am taking this opportunity to address some of the issues raised in your letter.

Several of the arguments you raise assert that the controls on the export of encryption items, including encryption source code, are unconstitutional or otherwise contrary to law. As you point out, these issues are currently the subject of litigation in the Federal court system. However, you also raise questions regarding the distinction the encryption controls draw between source code in a book and source code in electronic media, such as on a diskette. In addition, you contend that, if an encryption product is available overseas, then no control should be maintained on exports of encryption products from the United States. Based on these arguments, you request that I determine that the software covered by the appeal is not subject to the EAR.

In Executive Order 13026, 61 Fed. Reg. 58767 (Nov. 19, 1996) (hereinafter "E.O. 13026"), the President determined that the export of encryption products, including software, that function to maintain the secrecy of information may harm the national security and foreign policy interests of the United States. Consistent with the President's directive, the Export Administration Regulations ("EAR") provide that encryption items controlled under ECCN 5D002 are subject to "EI" licensing controls for all destinations, except Canada. See 15 C.F.R. para 742.15.

In addition, in the Executive Order, the President directed the Department of Commerce to regulate cryptographic software as an encryption product, rather than as technical data or technology, because the export of encryption source code is regulated for its functional capacity rather than for any possible informational value. Accordingly, for export licensing purposes, encryption software included in ECCN 5D002 is effectively treated "in the same manner as a[n] [encryption] commodity included in ECCN 5A002." Supp. 1 to 15 C.F.R. Part 774, ECCN 5D002.

It is particularly important to underscore that the controls on encryption products are imposed because of their functional capacity, rather than because of the information that any such product might contain. Thus, the controls relate to the capability that a particular product provides to any person that obtains it. Contrary to your suggestion, the EAR imposes controls on the export of the diskette because it contains software that can function to encrypt communications, not because it contains "information" or in order to regulate the informational value of the software. The diskette does not contain mere "text" that can be "read", but software programming instructions directed to a computer microprocessor that can, with minimal additional effort, readily enable a computer to perform a cryptographic function. Moreover, in electronic form, source code can be more easily enhanced and modified and automatically compiled on a computer in a matter of seconds into object code for direct execution to encrypt data. Such source code is also more "portable" for use with different computer operating systems, such as MS-DOS or Macintosh. In his prior submission of this diskette to the State Department, Mr. Karn acknowledged the technical capacity provided by the diskette in stating in his March 9, 1994, letter that "the software on this diskette is provided for those who wish to incorporate encryption into their applications." It is, therefore, inaccurate to describe the contents of the diskette as mere "text" or "information" that can be "read" when, in fact, it contains software programs in electronic form that can, with minimal additional steps, be executed to encrypt data on a computer.

In addition, the source code in electronic form on the diskette can more readily be used to encrypt data on a computer than source code in printed form. In order to attempt to make the printed source code functional, a number of steps must be undertaken before it may be used on a computer to encrypt. There are any number of problems that can occur in the process, from errors in the printed text to errors that can occur in scanning or typing the printed text into a computer, that must be overcome before any printed software program will be functional on a computer. Accordingly, it is entirely rational for the United States Government to continue to control encryption software programs, including source code in electronic form as it exists on the diskette, since this item can more readily and easily facilitate the spread of an encryption capability abroad.

Your foreign availability arguments are similarly unavailing. In his Executive Order, the President determined that the export of encryption products formerly regulated under the United States Munitions List ("USML") (such as the diskette at issue here) "could harm national security and foreign policy interests even where comparable products are or appear to be available from sources outside the United States." E.O. 13026, supra, at 58767. The President further determined that "facts and questions concerning the foreign availability of such encryption products cannot be made subject to public disclosure or judicial review without revealing or implicating classified information that could harm United States national security and foreign policy interests." Id. The President therefore directed that the provisions relating to the foreign availability of items controlled under the EAR shall not apply to encryption items transferred from the USML. Id. The EAR reflect that directive. See, e.g., 15 C.F.R. para 768.1(b). Thus, the policy basis for the export controls at issue remains in place even if foreign availability of encryption software does not negate the need for, or purpose of, export licensing requirements in order to prevent the unrestricted export of existing or new products from reliable providers and developers in the United States.

The EAR controls on the export of encryption products are consistent with the Presidential directive; I confirm that the commodity classification provided to you on July 23, 1997 was in accordance with those regulations.

This decision constitutes final agency action on this matter, as provided in Section 756.2(c)(2) of the EAR.

                                Sincerely,

                                [signed]

                                William A. Reinsch