December 5, 1994 (BY HAND DELIVERY) Mr. Thomas E. McNamara Assistant Secretary United States Department of State Bureau of Politico-Military Affairs Room 7325A Washington, DC 20520Dear Mr. McNamara:
We represent Mr. Philip R. Karn, Jr. of San Diego, California. This letter is an appeal pursuant to 22 C.F.R. 120.4(g) of the International Traffic in Arms Regulations ("the ITAR") of the determination by Deputy Assistant Secretary Martha C. Harris with regard to Mr. Karn's appeal of an adverse determination by the State Department's Office of Defense Trade Controls ("ODTC") in CJ case 081-94.
The issue in this case, simply stated, is whether textual material in digital form on a floppy disk can legally be classified differently, for export control purposes, from the identical textual material in printed form in a published book. Under the State Department's rulings, material on the floppy disk has been held to be a defense article, while the same material in a published book has been properly held to not be within the Department's export control jurisdiction.
The specific case arises from inconsistent Commodity Jurisdiction ("CJ") determinations concerning cryptographic source code published in the book Applied Cryptography. This case presents a significant opportunity for the State Department to demonstrate genuine commitment to the Administration's efforts to strengthen our economy in the information age through the Global Information Infrastructure program. If the decisions of Dr. Harris and the ODTC stand, this case illustrates a fundamental inability of our government to deal with computerized information in a rational manner.
We assume that the result set out in the DAS letter was based on various unstated policy goals of the State Department and other agencies, most significantly the National Security Agency. Whatever these goals, the indisputable facts should lead a fair-minded person to the conclusion that the article involved in this appeal -- the Applied Cryptography Source Code Disk ("the Diskette") -- does not belong on the U.S. Munitions List ("USML") and should be transferred to the Commerce Control List ("CCL"), just as jurisdiction over the book itself was transferred to the CCL. To conclude otherwise is to ignore the facts, the electronic age in which we live, and the First Amendment.
The Book is Applied Cryptography by Bruce Schneier; it was published by John Wiley & Sons, Inc. in 1994 and is now in its 3rd printing. It has ISBN 0-471-59756-2. The Book is available for sale in bookstores. The retail price of the book is $44.95 a copy. We understand that approximately 20,000 copies have been sold worldwide. We are advised that a substantial number of copies have been sold in the Far East.
We bought a copy at Borders' Bookstore at Tysons' Corner, Virginia. In short, this is a published book like so many others that you and we have at our homes and offices. The floppy disk that is the subject of this appeal is an exact duplicate, in digitized form, of the cryptographic source code that is printed as Part Five (pages 456 to 570) of the Book.
Initially the ODTC considered whether the Book was subject to controls under the ITAR and in a letter to Mr. Karn, dated March 2, 1994, concluded that it was not. The letter from the Office stated that the Book was in "the public domain." The Book was accordingly transferred to the CCL. That ruling expressly did not extend to the computer diskettes offered for sale on the last page of the Book.
Following this ruling, on March 9, 1994, Mr. Karn submitted a second Commodity Jurisdiction Request ("CJR") for the Diskette, which contained the text of the source code, and only the source code, which was set out in Part Five of the Book. As Mr. Karn stated in his submission:
Character by character, the information [in the Diskette] is exactly the same [as in the Book]. The only difference is the medium: magnetic impulses on mylar rather than inked characters on paper.The Diskette is available from the author of the Book by mail-order for $15. In this connection, please note that the Diskette that is the subject of this appeal is not the two-diskette set advertised on the last page of the book. The two diskette set advertised in the Book contains data and information that is not on the Diskette that is the subject of this appeal. The Diskette at issue here contains only the identical information that is contained in Part Five of the Book.
Each source code listing has been partitioned into its own file and has the capability of being easily compiled into an executable subroutine. The subject disk contains source code listings [for certain cryptographic algorithms] ... Also, the subject disk contains source code listings for certain algorithms that would not be exportable if they were incorporated into a product.The Response also indicated that the intended use of the Diskette, as stated in Mr. Karn's communication was to provide code to persons who wished to "incorporate encryption into their "applications." The response went on to say that:
There are fourteen (14) separate source code files that amount to thousands of lines of easily executable code contained on the subject disk. This is certainly an added value to any end-user that wishes to incorporate encryption with a product.The two foregoing quotations constitute the entire rationale of the Response.
This rationale, at best, begs the central issue in this matter, namely that the contents of the Diskette are in fact identical to the source code listings set out in the Book that is available at technical and non-technical book stores or by mail. In so doing, the Response ignores the First Amendment, as it should be applied to electronic and computer publications.
Moreover, the Response erred on relying on the conclusion that the Diskette source code could be "easily compiled into an executable subroutine." The source code in fact covers only the encryption algorithms and any executable application could be produced only by linking the Diskette source code with other source code, such as input/output routines, to produce an executable program.
To the extent that the Response rested on a presumed "added value" because the Diskette contained information that could be "read" by a computer, while the Book contained information that could be read by a person, the ODTC relied on an irrelevant and arbitrary factor. It cannot be that the ITAR allows a book with a normal font to be transferred to the CCL, but precludes similar treatment of the same book on a microfiche which has "added value" to certain users.
The 1978 OLC opinion was not some unique aberration in legal analysis. The principles of that opinion were re-affirmed by OLC on two subsequent occasions. See T. Olson, Asst. Atty. Gen., Memorandum for William B. Robinson, Office of Munitions Controls (July 1, 1981); L. Simms, Dep. Asst. Atty. Gen., Memorandum for Davis R. Robinson, Legal Adviser, Dept. of State (July 5, 1984). Thus the principles first stated by OLC in the Carter Administration have remained the views of OLC in both Democratic and Republican Administrations. To the best of our knowledge, those OLC opinions remain the latest and most authoritative legal opinions within the Executive Branch on the applicability of the First Amendment to the dissemination of cryptologic information.
We contend that speech in digital form on a diskette is not legally different from speech in a printed book. The distinctions drawn by ODTC and the DAS in this case are analogous to a hypothetical decision by a government agency in the 1940s that the First Amendment had no application to television because it wasn't speech. Whether the cryptographic information is communicated orally, in writing in a traditional book, or in electronic form on a diskette, CD-ROM or electronic bulletin board, it retains its status under the First Amendment as protected speech.
The Response is a well-nigh classic example of the overbroad application of a statute (in this instance the Arms Export Control Act) by a government agency. As Justice Brennan wrote in NAACP v. Button, 317 U.S. (1963) 415, 431
The instant decree may be invalid if it prohibits privileged exercises of First Amendment rights whether or not the record discloses that the petitioner has engaged in privileged conduct. For in appraising a statute's inhibitory effect on such rights, this Court has not hesitated to take into account possible applications of the statute in other factual contexts besides that at bar.
Moreover, we understand that the entire contents of the Diskette are included in a two disk set of cryptographic source code described on the last page of the Book. As evidenced by the attached printout of information posted on a WorldWideWeb Internet server, binary copies of the source code for several of the algorithms published in Part Five of the Book are publicly available from anonymous file transfer protocol (FTP) sites outside the United States. In these circumstances, trying to prohibit the dissemination of the cryptographic algorithms in digital format on the Diskette, given the widespread availability of that information in text and digital format, reflects the pursuit of an irrational goal that bears no relationship to the real world.
The ITAR defines the term "public domain" to mean:
information which is published and which is generally accessible or available to the public: (1) Through sales at newsstands and bookstores; (2) Through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information: . . . . (4) At libraries open to the public or from which the public can obtain documents (emphasis added)The Book is available through sales at bookstores and is certainly available at some libraries, and, again, the Diskette is available through mail-order from the author of the book.
ODTC was, therefore, clearly correct in concluding that the Book is within the ITAR's public domain exception. It follows that the Diskette is also within that same exception since it consists of the same information as is found in the Book. The key operative part of the definition is the critical term: information. The regulation makes no distinction as to the format or media in which the information is disseminated, but properly focuses on whether it is information :
which is published and which is generally accessible as available to the publicWhile we recognize that the regulatory definition does not explicitly recognize the public availability of information through electronic media, we doubt that you would seriously argue that the only recognized or sanctioned forms of public availability were those used by printers in 1787 when the Constitution was adopted. More importantly, even if the State Department were to adhere to such a media-based distinction, we seriously doubt that a reviewing court would agree with such an arbitrary differentiation.
The basis of the Response quoted above boils down to formatting differences between the Book and the Diskette. To be sure, a printed book has a different format than an "audio" or "talking book" contained on a disk. One can watch a performance of a play or read the same material in the play's script. One can watch the performance of an opera or read the libretto. While there may be a difference in artistic impact, the information received in each instance is the same.
The implications of the Response are unsettling particularly as the publishing industry moves from print to multi-media distribution. The novelist Tom Clancy has, in all likelihood, set out technical data, as the term is defined in the ITAR, in one or more of his books which focus on military and intelligence activities. Does the State Department contend that the export of a CD-ROM version of Red Storm Rising or The Hunt For Red October would require an ITAR license?
In Mr. Karn's case, there is no difference in the informative impact between the Diskette and the Book. Whatever formatting differences are present are irrelevant. ODTC's distinction in the Response is a make-weight which does not even accomplish the function of providing a substantive rationale for the decision. Moreover, the Response ignores the wide-spread availability of optical scanners and computer keyboards, both of which could easily render the Book every bit as systems-ready and systems-friendly as the Diskette.
Dr. Harris provided a response to the Appeal ("the Second Response") on October 7, 1994. The Second Response did not squarely address Mr. Karn's clearly presented arguments or the discussion we had with Dr. Harris in our June meeting. It simply concluded that the Diskette was a defense article, notwithstanding the fact that the information on the Diskette is the same as the information in the Book. Quite frankly this result is untenable. No logical rationale based on the ITAR is provided for the Second Response, which, with respect, is a paradigm of an "arbitrary and capricious" governmental decision.
The Second Response failed to give any meaningful attention to the First Amendment, passing that issue off with the terse comment that "continued control over the export [of the Diskette] is consistent with the protections of the First Amendment." This is simply not so. Rather, the DAS' position is jarringly at odds with the First Amendment. To brush this issue aside with a conclusory statement totally lacking in legal analysis reflects a surprising insensitivity to the importance of the Constitutional rights that are involved in this case.
We noted earlier in this paper that OLC relied in part on the overbreadth issue. DAS' position in this matter would also not withstand scrutiny under the overbreadth doctrine's cousin, the void for vagueness doctrine. The "cryptographic exception," which is so often cited by ODTC with respect to this sort of issue is an example of a regulation that would not withstand scrutiny under the doctrine.
The ITAR is so murky in this area so that it may well have a chilling effect that will deter persons from engaging in Constitutionally protected speech. Moreover, inasmuch as the cryptographic exception is the basis or part of the basis of ODTC's position in this area, it infringes on Mr. Karn's right to equal protection of the law and is, therefore, in violation of the First and Fifth Amendment to the Constitution. More specifically, the result of the Second Response is that Mr. Karn's speech about a particular subject, i.e., cryptography is not given the same protection as other speech in which he engages.
At the very least, Mr. Karn's desired activity, i.e. the export of the partial contents of a published book is symbolic speech, a clearly expressive act with a high communicative content. Such speech has been recognized by the Supreme Court for decades. See Stromberg v. Carlson, 283 US 359 (1931).
We also note that comment in the Second Response that OTC has made a determination "that the source code on the disk . . . is of such a strategic value as to warrant continued State Department listing." National security interests do not automatically supersede the First Amendment. In a recent opinion, Judge Green wrote that it is recognized "that the government has an interest in protecting the National Security, and, at times, that security interest may be grave. However, the issue in this instant case is not whether the government has such an interest but whether that interest is so all-encompassing that it requires ... [a denial of] virtually every fundamental feature of due process." See Rafedie v. Immigration and Naturalization Service, 795 F. Supp 13, 19 (D.D.C. 1992). In The City of Houston v. Hill, Justice Brennan wrote that "speech is often provocative and challenging ... [but it] is nevertheless protected against censorship or punishment, unless shown likely to produce a clear and present danger of a serious substantive of evil that rises far above public and convenience, annoyance or unrest." 482 U.S. 451, 461, (1987). The Supreme Court also addressed this issue in the "Pentagon Papers" case:
Thus, only governmental allegation and proof that publication must inevitably, directly and immediately cause the occurrence of an event kindred to the safety of a transport already at sea can support even the issuance of an interim restraining order. New York Times v. United States, 403 U.S. 713, 726-272 (Stewart, J. concurring).
The crux of the ODTC/DAS position appears to be that the information on one medium--the Book -- may be exported while the identical information on another -- mylar -- may not. This is no position at all. It is particularly ironic that representatives of an Administration, which is publicly so supportive of the coming Information Super Highway, could take a policy position that is so at odds with its implementation and reality.
In considering our Constitutional arguments, it is important to recognize that the applicability of First Amendment protections to communications of cryptography information is not merely an argument crafted by Mr. Karn's counsel, but is the legal position already taken the OLC. Opinions of that office, within the Executive Branch, have the authority of binding rulings. If there are any unpublished OLC opinions which support the DAS' position, we are not aware of them. Accordingly we submit that the DAS conclusion is not only wrong, it is inconsistent with standing Executive Branch legal authority.
For the reasons stated, the Diskette should be held to not be a defense article, not covered by the Munitions List and not subject to any controls under the ITAR.
If you believe a meeting might assist in a rapid resolution of this appeal, please let us know. Based on our prior personal experience as attorneys in the Executive Branch, our understandings of the role of the National Security Agency in these matters, and the disposition of Mr. Karn's prior appeals, we are -- quite frankly -- pessimistic about the outcome of this appeal. We are taking this step only because our request that the State Department agree to waive any arguments based on "failure to exhaust administrative remedies" prior to our seeking judicial relief was rejected. We are here before you on appeal primarily because we may be required to appeal to you before going to court. We hope that our pessimism proves unfounded, but the decisions in this case to date do not justify any expectation that a favorable decision is, as a practical matter, available within the Executive Branch.
Sincerely, __/s/_________________ Kenneth C. Bass, III __/s/_________________ Thomas J. Cooper Mr. Thomas E. McNamara December 5, 1994 Page 12DC2DOCS1.2040