7431 Teasdale Ave
						San Diego, CA 92122
						June 7, 1994
						619-587-8281 (voice)
						619-587-1825 (fax)
						[email protected]


Dr. Martha C. Harris
Deputy Assistant Secretary For Export Controls
United States Department of State
Room 7325A
Washington DC 20522
202-647-1346 (fax)

Also references: CJ Case 038-94, "Applied Cryptography", a book by Bruce Schneier

APPEAL OF COMMODITY CLASSIFICATION

INTRODUCTION

1. The information included on the Diskette is, for all practical purposes and contrary to ODTC's claim, identical to that printed in the book "Applied Cryptography" ("the Book"), which ODTC previously ruled was in the public domain and outside their licensing jurisdiction;
2. Even if the information on the Diskette had not already appeared in a publicly available book, by ODTC's own prior interpretation of the ITAR in CJ Case 038-94 it should nonetheless have qualified for the very same "public domain" exemption; and
3. The First Amendment protects the freedom of speech and of the press regardless of the medium of expression (diskette or printed textbook). Therefore, the dissemination of the publicly available Diskette is not within the licensing jurisdiction of your office.

DISCUSSION

1. The Diskette Should Qualify For The ITAR Public Domain Exemption As A Result of ODTC's Decision in CJ Case 038-94

In its Response, ODTC said:

The text files on the subject disk are not an exact representation of what is found in "Applied Cryptography." Each source code listing has been partitioned into its own file and has the capability of being easily compiled into an executable subroutine.

This appears to be the basic rationale for ODTC's decision in this matter. I respectfully submit that the statement presents an arbitrary and capricious distinction, but no meaningful difference, between the information which is found in the Book and the Diskette. That characterization of the Diskette provides no basis in either law, regulations, or logic for ODTC's decision.

The Diskette is as close to Part Five of the Book as one could make it. The typographic layout of the Book makes it absolutely clear, even to the non-programmer, where each cryptographic subroutine begins and ends. The name of each routine appears in bold font before the routine itself and in the header of each page. Moreover, the Diskette uses these same names for its files.

The Response goes on to list the cryptographic routines included in the Diskette and says that they would not be exportable if they were incorporated into a product. But this is irrelevant to the present matter, since all of these routines appear in the Book, which ODTC had already ruled in CJ Case 038-94 to be outside its licensing jurisdiction and therefore exportable. The decision in this case must be based on a comparison to the Book, which is functionally identical to the Diskette, not to some hypothetical product.

The only real difference between the Book and the Diskette is the one stated in my original request: the medium on which the information is recorded.

Presumably, ODTC's phrase "added value" referred to the easy machine-readability of the Diskette. But "machine-readability" is no longer well defined; it cannot be limited to information stored on computer disks. With the widespread availability of optical character recognition (OCR) equipment and software, even printed information such as the Book is easily turned into "machine readable" disk files equivalent to those on the Diskette. Moreover, this only need be done once. It is then absolutely trivial to duplicate and disseminate the resulting files by telephone modem or over the Internet.

And even without OCR capabilities, anyone with typing skills could easily type in the routines from the Book, again producing machine readable disk files.

2. The Diskette Should Qualify For The ITAR Public Domain Exemption Regardless of the Decision in CJ Case 038-94 Because the Diskette Is Itself Already in the Public Domain

The ITAR at 120.10(5) exempts from the definition of controlled "technical data" "information in the 'public domain' as defined in 120.11", and 120.11 defines "public domain" as "information which is published and which is generally accessible or available to the public" from libraries or through subscription, among other means. Of particular interest is the lack of any mention of the allowable media or medium on which the information must be recorded to qualify for "public domain" status. This is hardly surprising in that any such restriction would be at once illogical and offensive to the First Amendment.

This Diskette is obviously within the "public domain". Anyone may obtain it by mail order from the author for a nominal charge to cover duplication and mailing. (The restriction to US and Canadian addresses exists only because of uncertainty about US export regulations.) Furthermore, much of the source code contained on the disk is in the public domain, in the even broader sense of the original authors having granted blanket copying and use permission, or relinquished copyright altogether.

The software on this Diskette is also readily available to the public from many "anonymous FTP" repositories on the Internet, several of which are outside the United States and Canada. These repositories clearly qualify as "libraries open to the public" under 120.11(4). Indeed, it seems that the subject software is even more strongly "public domain" (in the ITAR sense) in machine readable form than in book form, precisely because the machine readable form is so much more readily obtainable.

3. The First Amendment Protects Absolutely the Freedom of Speech and the Press, Regardless of the Medium of Expression

The US Supreme Court has written that "[t]he liberty of the press is not confined to newspapers and periodicals. It necessarily embraces pamphlets and leaflets.... The press in its historic connotation comprehends every sort of publication which affords a vehicle of information and opinion" (Lovell v. City of Griffin, 1938). Freedom of the press, says the Court, includes "the right of the lonely pamphleteer who uses carbon paper or a mimeograph as much as of the large metropolitan publisher who utilizes the latest photocomposition methods" (Branzburg v. Hayes, 1972).

The computer network, the bulletin board system (BBS) and even "sneakernet" (the manual exchange of diskettes) are clearly the modern successors to the mimeograph machine. Users of these systems have just as much First Amendment protection, including the right to export their works, as John Wiley & Sons, publishers of "Applied Cryptography".

There is opinion that the power to control exports is a Presidential national security and foreign policy function that deserves wide deference by the courts. But the national security power, "like every other governmental power, must be exercised in subordination to the applicable provisions of the Constitution" (US v Curtiss-Wright Corp, 1936). In Baker v Carr (1962), the Supreme Court said "[I]t is error to suppose that every case or controversy which touches foreign relations lies beyond judicial cognizance".

In Bullfrog Films, Inc. vs Wick (1988) the Federal Court of Appeals for the 9th Circuit said "We ... reject ... the suggestion that the First Amendment's protection is lessened when the expression is directed abroad. The cases cited by the government do not support its contention that otherwise protected free speech interests may be routinely subordinated to foreign policy concerns".

And in New York Times Co v US, 1970, popularly known as the "Pentagon Papers" case, the Supreme Court said, "[A]ny system of prior restraints of expressions comes to this Court bearing a heavy presumption against its constitutional validity" and the government "thus carries a heavy burden of showing justification for the imposition of such a restraint".

It thus seems impossible to argue that export controls on information, including software, widely available in the United States, and even already available in published form outside the US (such as the Diskette) are necessary to prevent a "substantial likelihood of serious damage to national security or foreign policy" (Haig v Agee, 1981). Ordinary common sense says that ODTC's ruling in CJ Case 081-94 is arbitrary, capricious and wholly indefensible.

Indeed, in the most celebrated prior restraint case (United States vs The Progressive, 1979), the government gave up all further attempts to control the dissemination of the information in question (design principles for thermonuclear weapons) once the Department of Justice became aware that the information it sought to ban had been published in the United States. Trying to ban further dissemination of that publication would have been both unconstitutional and futile, as are current attempts to control the export of public domain cryptographic software.

Even an Assistant Attorney General of the Department of Justice has expressed the opinion that export controls on publicly available cryptographic information are unconstitutional:

"It is our view that the existing provisions of the ITAR are unconstitutional insofar as they establish a prior restraint on disclosure of cryptographic ideas and information developed by scientists and mathematicians in the private sector". (Memorandum from J. Harmon, Department of Justice, to F. Press, Science Advisor to the President dated May 11, 1978, reprinted in "The Government's Classification of Private Ideas: Hearings Before a Subcommittee of the House Committee on Government Operations", 96th Congress, 2nd Session, 1980.)

This opinion is entitled to special weight because Mr. Harmon was, at that time, in charge of the Office of Legal Counsel, the office which is responsible for preparing all the official opinions of the Attorney General.

CONCLUSION

I hope this will be possible through administrative appeal. Should it become necessary, however, I am fully determined to seek judicial relief.

					Sincerely,



					Philip R. Karn, Jr