The Applied Cryptography Case: Only Americans Can Type!

In January 14, 2000, new US crypto export regulations went into effect. Publicly available encryption source code, such as that at issue in my lawsuit, is now effectively freely exportable. Therefore, we decided to allow our case to be dismissed as moot. While this was admittedly not as satisfying as actually winning in court, for all practical purposes I got everything I wanted.

My own case was narrowly focused on the government's ridiculous distinction between crypto source code printed on paper and crypto source code on electronic media. The other two challenges to US encryption export regulations, the Bernstein and Junger cases, are broader Constitutional attacks, and they continue through the appeals process. Junger got a ringing endorsement from the 6th Circuit Court of Appeals that was even more noteworthy in coming out after the January regulations. With two separate appellate courts now holding that source code is protected by the First Amendment, I think things are in much better shape than they were when I started my quest six and a half years ago.

There are still some legal documents that I have not yet put up here. I will do that as I get the chance. (21 Jun 2000)

The US State Department Office of Defense Trade Controls has ruled that this book, Applied Cryptography by Bruce Schneier (copyright 1994, John Wiley & Sons; ISBN 0-471-59756-2) is freely exportable from the United States even though it contains complete source code for several strong cryptographic algorithms.

[Picture of AC floppy disk] But this floppy disk, a verbatim copy of the source code printed in the book, was formally designated as a "defense article under category XIII(b)(1) of the United States Munitions List"!

More recently, it was reclassified as a controlled "Encryption Item" (EI) that still cannot be legally exported from the US even though this code (and more) has been on non-US Internet sites for years.

In early 1994, I filed with the US State Department a pair of Commodity Jurisdiction Requests (CJRs) designed to challenge their silly rules restricting the export of cryptographic software, even software in the public domain. I chose Applied Cryptography because it was widely available and contained extensive source code listings of strong ciphers such as IDEA and DES.

The State Department ruled that even though the book itself is "in the public domain" and hence outside their jurisdiction, a floppy disk containing the exact same source code as printed in the book is a "munition" requiring a license to export. It's old news that the US Government believes only Americans (and maybe a few Canadians) can write C code, but now they have apparently decided that foreigners can't type either!

In the past three years I have taken my case to all three branches of the federal government. Here is the full case history in the Executive and Judicial branches, including all my correspondence with the US State Department, the Bureau of Export Administration (BXA) in the Commerce Department, the US District Court for the District of Columbia, and the Court of Appeals for the DC Circuit.

Judge Richey, who originally heard my case, died in March 1997. He has been replaced by Judge Louis Oberdorfer, in whose court we have filed an amended complaint after Commerce turned us down under the new rules.

On June 26, 1996 I described my case in testimony to the US Senate Subcommittee on Science, Space and Technology chaired by Senator Conrad Burns. On March 20, 1997 I appeared before the House Subcommittee on Courts and Intellectual Property. Here is an archive of my testimony to those two Congressional panels.

Other Information about the case

More fun and games with export controls

I never could have done this without the help of EFF and my attorneys Ken Bass, K4EVH and Tom Cooper of Venable, Baetjer, Howard & Civiletti, a big DC area law firm. After I had started the Commodity Jurisdiction process with the State Department on my own, Ken and Tom found me and volunteered their services; they never charged me a dime though they were able to recover some of their costs from the government. Ken passed away from cancer in April 2009. I miss him; he was smart and knowledgeable, a fun guy to talk to.

Disclaimer: As a computer networking engineer deeply concerned about computer network security, personal privacy and free speech, I pursued this case entirely on my own personal initiative. I did not act on behalf of my employer, Qualcomm Incorporated, nor did they support my action.

Back to Phil Karn's Home Page

Last updated: 8 Oct 2010