________________________________________ ) PHILIP R. KARN, JR. ) ) Plaintiff, ) ) Civ. A No. 95-1812 (CRR) v. ) ) (Judge Charles R. Richey) U.S. DEPARTMENT OF STATE, and ) THOMAS E. MCNAMARA, Assistant ) Secretary of State, Bureau of ) Political-Military Affairs, in ) his official capacity. ) ) Defendants. ) ) ________________________________________)
Respectfully Submitted, FRANK W. HUNGER Assistant Attorney General ERIC H. HOLDER United States Attorney VINCENT M. GARVEY Deputy Branch Director ANTHONY J. COPPOLINO Trial Attorney U.S. Department of Justice Civil Division - Federal Programs Branch 901 E Street, N.W. - Room 1084 Washington, D.C. 20530 (202) 514-4782 Attorneys for the Defendants. Date: November 15, 1995.
INTRODUCTION . . . 1
STATUTORY AND REGULATORY BACKGROUND . . . 4
FACTUAL BACKGROUND . . . 7
ARGUMENT . . . 11
I. THE DESIGNATION OF A DEFENSE ARTICLE ON THE UNITED STATES MUNITIONS LIST IS NON-JUSTICIABLE . . . 11
II. PLAINTIFF'S FIRST AMENDMENT CLAIMS ARE WITHOUT MERIT . . . 17
A. The State Department's Determination that Plaintiff's Software Diskette is a Defense Article on the USML Does Not Infringe Plaintiff's Speech . . . 17
B. Under O'Brien v. United States, the Regulation of Cryptographic Software on the USML Furthers Legitimate Governmental Interests that are Unrelated to the Suppression of Expression . . . 20
The Government has the Constitutional Power to Control the Export of Encryption Software and Its Interests are Substantial . . . 21
Export Controls on Encryption Software Are Unrelated to the Suppression of Speech . . . 23
i. The Fact that the Source Codes Were Printed in Applied Cryptography Does Not Negate the Designation of the Diskette as Encryption Software Under the USML . . . 26
ii. The Source Code Diskette is Not Analogous to Television or Audio Tape . 31
3. Export Controls on Encryption Software Are Narrowly Tailored . . . 32
C. The ITAR is Not Unconstitutionally Vague . . 36
III. THE DESIGNATION OF PLAINTIFF'S DISKETTE AS A DEFENSE ARTICLE DOES NOT VIOLATE SUBSTANTIVE DUE PROCESS . . . 37
A. Encryption Software is a Defense Article, Not Technical Data in the Public Domain, and Is Properly Controlled for Export 40
B. The Availability of Encryption Software Abroad Does Not Render Export Controls Arbitrary and Capricious . . . 42
CONCLUSION . . . 44
Albright v. Oliver, 114 S. Ct. 807 (1994) . . . 38
American Library Association. et al. v. Reno, 33 F.3d 78 (D.C. Cir. 1994) . . . 20, 23
Baker v. Carr, 369 U.S. 186 (1962) . . . 12-13
Board of Trustees of State University of New York v. Fox, 492 U.S. 469 (1989) . . . 33
Chicago & Southern Air Lines v. Waterman SS. Corp., 333 U.S. 103 (1948) . . . 13
Clark v. Community for Creative Non-Violence, 468 U.S. 288 (1984) . . . 20, 23, 32, 33, 35
Coleman v. Miller, 307 U.S. 433 (1939) . . . 13
Colorado Springs Prod. Credit Ass'n v. Farm Credit Admin., 758 F. Supp. 6 (D.D.C. 1991), aff'd, 967 F.2d 648 (D.C. Cir. 1992) . . . 38
Duke Power Co. v. Carolina Env. Study Group, 438 U.S. 59 (1978) . . . 38
Graham v. Connor, 490 U.S. 386 (1989) . . . 38
Haig v. Agee, 453 U.S. 280 (1981) . . . 18
Harris v. McRae, 448 U.S. 297 (1980) . . . 37
Iskcon of Potomac. Inc. v. Kennedy, 61 F.3d 949 (D.C. Cir. 1995) . . . 34
Members of the City Council of Los Angeles v. Taxpayers for Vincent, 466 U.S. 789 (1984) . . . 35, 36
Mendelsohn v. Meese, 695 F. Supp. 1474 (S.D.N.Y. 1988) . . . 22
Natural Resources Defense Council. Inc. v. SEC, 606 F.2d 1031 (D.C. Cir. 1979) . . . 30
National Organization for Women v. Operation Rescue, 37 F.3d 646 (D.C. Cir. 1994) . . . 36
O'Brien v. United States, 391 U.S. 367 (1968) . . . passim
Pension Benefit Guar. Corp. v. R.A. Gray & Co., 467 U.S. 717 (1984) . . . 38
Posters 'N' Things. Ltd. v. United States, 114 S.Ct. 1747 (1994) . . . 37
SEC v. Chenery Corp., 332 U.S. 194 (1946) . . . 30-31
Spence v. Washington, 418 U.S. 405 (1974) . . . 18
Texas v. Johnson, 491 U.S. 397 (1989) . . . 18, 20
Union of Concerned Scientists v. U.S. Nuclear Regulatory Commission, 880 F.2d 552 (D.C. Cir. 1989) . . . 30
United States v. Albertini, 472 U.S. 675 (1985) . . . 32-33
United States v. Bozarov, 974 F.2d 1037 (9th Cir. 1992), cert. denied, 113 S.Ct. 1273 (1993) . . . 15, 16
United States Civil Serv. Comm'n v. National Ass'n of Letter Carriers, 413 U.S. 548 (1973) . . . 36-37
United States v. Edler Industries, Inc., 579 F.2d 516 (9th Cir. 1978) . . . 7, 41
United States v. Helmy, 712 F. Supp. 1423 (E.D. Cal. 1989) . . . 13
United States v. Mandel, 914 F.2d 1215 (9th Cir. 1990) . . . 14, 15, 16, 22
United States v. Martinez, 904 F.2d 601 (11th Cir. 1990) . . . 12, 13, 16, 41
United States v. Posey, 864 F.2d 1487 (9th Cir. 1989) . . . 41
United States v. Moller-Butcher, 560 F. Supp. 550 (D. Mass. 1983) . . . 15
United States v. Spawr Optical Research, Inc., 864 F.2d 1467 (9th Cir. 1988), cert. denied, 493 U.S. 809 (1989) . . . 14, 21-22
United States v. Thomas, 864 F.2d 188 (D.C. Cir. 1988) . . . 36
Usery v. Turner Elkhorn Mining Co., 428 U.S. 1 (1976) . . . 38
Walsh v. Brady, 927 F.2d 1229 . . . 20
Ward v. Rock Against Racism, 491 U.S. 781 (1989) . . . 23, 32, 33
Wisconsin v. Mitchell, 113 S.Ct. 2194 (1993) . . . 17
Webster v. Doe, 486 U.S. 592 (1988) . . . 16
Administrative Procedure Act, 5 U.S.C. § 701(a)(1) . . . 16
5 U.S.C. §§ 551, 553-559, 701-706 . . . 15
Arms Export Control Act, 22 U.S.C. § 2278 . . . 1
22 U.S.C. § 2778(a)(1) . . . 1, 4-5, 12, 42
22 U.S.C. § 2778(b)(2) . . . 1, 5
22 U.S.C. § 2778(h) . . . 1, 12
Export Administration Act, 50 U.S.C. App. § 2401 et seq . . . 13
50 U.S.C. App. § 2412 . . . 14
22 C.F.R. § 120.1(a) . . . 5
22 C.F.R. § 120.2 . . . 5
22 C.F.R. § 120.4 . . . 37
22 C.F.R. § 120.4(a) . . . 7
22 C.F.R. § 120.10 . . . 6, 40
22 C.F.R. § 120.10(a)(1) . . . 6
22 C.F.R. § 120.10(a)(4) . . . 6, 10, 40
22 C.F.R. § 120.11 . . . 6, 40
22 C.F.R. § 120.11(a)(6), (8) . . . 6
22 C.F.R. § 121.1 XIII(b)(1) ("Category XIII(b)(1)") . . . passim
22 C.F.R. § 121.1 XIII(b)(1)(ii) . . . 34
22 C.F.R. § 121.1 XIII(b)(1)(ix) . . . 34
22 C.F.R. § 121.1 XIII(b)(1)(vi) . . . 34
22 C.F.R. § 121.8(f) . . . 7, 10, 40
Revisions of International Traffic in Arms Regulations (Final Rule) 49 Fed. Reg. 47682, 47683 (Dec. 6, 1984) . . . 7
The export of certain cryptographic devices and software is controlled pursuant to Section 38 of the Arms Export Control Act ("AECA"), 22 U.S.C. § 2778. Section 38(a)(1) of the AECA authorizes the President to designate "defense articles" and "defense services" as subject to export licensing controls "in furtherance of world peace and the security and foreign policy of the United States." § 2778(a)(1). Encryption devices and software are specifically designated as a defense article under Category XIII(b)(1) of the USML. See 22 C.F.R. § 121.1 XIII(b)(1). Defense articles may not be exported without a license from the State Department. See 22 U.S.C. § 2778(b)(2).
As a threshold matter, Congress has specifically precluded judicial review of the designation of defense articles subject to export licensing controls. See 22 U.S.C. § 2778(h). In addition, several courts have also held that the designation of a commodity as subject to export licensing controls is a non- justiciable political question. Plaintiff seeks to circumvent the bar on judicial review applicable in this case by claiming that the designation of his computer software diskette violates his constitutional right to freedom of speech under the First Amendment. Plaintiff's contention is without merit and should be rejected.
Plaintiff bases his entire case on the fact that the government previously concluded that a book, entitled Applied Cryptography by Bruce Schneier (John Wiley & Sons, Inc. 1994), which includes an appendix of the printed text of the cryptographic "source codes" that are on the computer diskette, was not subject to the export licensing scheme.[1]
Plaintiff's argument -- repeated at least eight times in the short span of his Complaint, see ¶ 19, 23, 25, 29, 30, 31, 32, 33 -- is that there is no difference between the information printed on paper in the appendix of the book and the "information" contained on the computer diskette, which contains the encryption source codes in an electronic medium. [2]
Plaintiff's contention misses the essential point. The book appendix and the diskette may well contain the same "information." But the State Department's regulation of the diskette has nothing to do with the nature of any information it may contain. The diskette is controlled for export not because of any expression or information that it might convey, but because of its function, that is, the capability it provides to whomever obtains it. The diskette is designed specifically to enable a computer to perform a cryptographic function. It contains a long assemblage of computer code -- letters and symbols that enable a computer to maintain the secrecy of information. The diskette can be directly inserted into the floppy disk drive of a computer, and the cryptographic software thereon used to scramble information. For this reason -- because the diskette contains functioning cryptographic software -- and not because it may also convey information, the diskette falls squarely under the Category XIII(b)(1) of the United States Munitions List. Control over its export does not restrict expression, but the conduct of exporting a functioning defense article.
Moreover, even if the source codes on plaintiff's diskette were deemed to have theoretical communicative value, and control of its export was deemed to restrict "speech" to foreign persons, such a restriction would be incidental to the conduct of regulating a functioning commodity. Under O'Brien v. United States, 391 U.S. 367 (1968), such an incidental restriction on alleged expression easily passes constitutional muster. The designation of encryption software on the USML is unrelated to any expressive value that its export might have, and the government's interests at issue here are substantial.
A critical national security interest is to maintain an effective capability to gather foreign intelligence information. History is filled with examples of the need for the United States to break foreign codes in order to determine where enemy ships, submarines, and troops have been deployed, and other critical intelligence information. [3] Through export restrictions, the United States seeks to control the foreign availability of cryptographic devices and software that might end up in the wrong hands, be deployed against the United States, hinder the government's foreign intelligence collection efforts, or otherwise undermine crucial national security interests. While plaintiff may characterize this matter as a "First Amendment" issue, what he is challenging is an important national security policy determination that has been committed by Congress to the President, and which this Court is precluded from second- guessing.
The AECA is implemented by the International Traffic in Arms Regulations ("ITAR"). Pursuant to Executive Order 11958, the President delegated to the Secretary of State the President's authority pertaining to the export of defense articles and services. See 22 C.F.R. § 120.1(a). [4] The Secretary of State's authority in this area was, in turn, re-delegated to the (now) Under Secretary for Arms Control and International Security Affairs. The ITAR is primarily administered by the Director of the Office of Defense Trade Controls ("ODTC"), Bureau of Political-Military Affairs. See 22 C.F.R. § 120.1(a).
Part 121 of the ITAR sets forth the United States Munitions List. The category of the USML relevant to this case is Category XIII(b)(1), which lists as defense articles "Information Security Systems and equipment, cryptographic devices, software, and components specifically designed or modified therefor, including:
(1) Cryptographic (including key management) systems, equipment, assemblies, modules, integrated circuits, components or software with the capability of maintaining secrecy or confidentiality of information or information systems, except cryptographic equipment and software [as described under Category XIII(b)]."22 C.F.R. § 121.1 XIII(b)(1).
While this case involves only cryptographic software, plaintiff alleges (erroneously) that his diskette contains what is referred to in the ITAR as "technical data," and that this data is in the "public domain" and exempt from export licensing controls. Technical data is information "which is required for the design[,] development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles." 22 C.F.R. § 120.10(a)(1). This includes, for example, blueprints, drawings, or photographs. Id. The definition of technical data excludes information that is in the "public domain." See 22 C. F.R. § 120.10. Information is deemed to be in the public domain, inter alia, if it is "published and . . . is generally accessible or available to the public" through sales at newsstands and bookstores, subscriptions, the mail, libraries. 22 C.F.R. § 120.11. [5]
The definition of technical data includes certain software, see 22 C.F.R. § 120.10(a)(4), but specifically excludes cryptographic software covered by Category XIII(b)(1) of the USML. 22 C.F.R. §§ 121.8(f) and 121.1 XIII(b)(1). [6]
The commodity jurisdiction procedure is not used for determining whether a particular article may or may not be exported. See Lowell Decl. ¶ 5. Rather, the CJ process merely determines whether a particular commodity is covered by the USML and, therefore, whether its export is controlled pursuant to the AECA and the ITAR. Id. Separate licensing decisions are made for the export of commodities. A licensing decision for a commodity controlled pursuant to the AECA and the ITAR may take into account a combination of factors, including the sensitivity of the technology, the identity of the end-user, the declared end-use of the commodity, and foreign policy and national security interests. Id.
By letter dated February 12, 1994, plaintiff submitted to the State Department a commodity jurisdiction request for the book Applied Cryptography by Bruce Schneier. Lowell Decl. ¶ 10 and Tab 4. By letter dated March 2, 1994, the Office of Defense Trade Controls responded to plaintiff's CJ request, stating that the book is not subject to the licensing jurisdiction of the State Department since it is in the public domain. Id. ¶ 11 and Tab 5. The State Department stated that this determination as to the book did not extend to two computer disks referenced in the book and available from the author. Id. [7]
By letter dated March 9, 1994, plaintiff submitted a second commodity jurisdiction request for a diskette containing source codes for data encryption. Lowell Decl. ¶ 12 and Tab 6. Plaintiff stated that the diskette contained the same source codes printed in Appendix Five of the Applied Cryptography book. [8] See Tab 6 to Lowell Declaration at 1, 2. Plaintiff also stated that "the diskette contains source code for encryption software that provides confidentiality" and that "[t]he software on this diskette is provided for those who wish to incorporate encryption into their applications.¶ Id. at 2.
By letter dated May ll, 1994, the Office of Defense Trade Controls responded to plaintiff's second CJ request. Lowell Decl. 1 15 and Tab 9. ODTC determined that the diskette is designated as a defense article under Category XIII(b)(1) of the United States Munitions List and that a license from the State Department therefore is required prior to its export. Id. ODTC stated in its determination, inter alia:
The text files on the subject disk are not an exact representation of what is found in "Applied Cryptography." Each source code listing has been partitioned into its own file and has the capability of easily being compiled into an executable subroutine. . . . The intended use of this source code disk, as stated in your CJ request, is to provide code for those who wish to incorporate encryption into their applications.Id., Tab 9 at l.
By letter dated June 10, 1994, plaintiff appealed the foregoing CJ determination to the Deputy Assistant Secretary of State for Political-Military Affairs, Dr. Martha Harris. Lowell Decl. ¶ 16 and Tab 10. Plaintiff argued that there is "no meaningful difference" between "the information which is found in the book and the Diskette," that the book was "functionally identical to the Diskette," and that the "only real difference between the Book and the Diskette" is the "medium on which the information is recorded." See Tab 10 to Lowell Declaration at 3 Plaintiff also argued, inter alia, that "[w]ith the widespread availability of optical character recognition ("OCR") equipment and software, even printed information such as the Book is easily turned into 'machine-readable' disk files equivalent to those on the Diskette." Id. Plaintiff also argued that the diskette constitutes "technical data" in the public domain not subject to export licensing requirements. Id.
By letter dated October 7, 1994, Deputy Assistant Secretary Harris upheld the CJ determination made by the Office of Defense Trade Controls. Lowell Decl. ¶ 18 and Tab 11. In this appeal determination, the State Department again concluded that plaintiff's source code diskette is cryptographic software covered by Category XIII(b)(1) of the USML and subject to the export licensing jurisdiction of the State Department. See Tab 11 to Lowell Declaration. The Department specifically noted that, under the ITAR, encryption software is treated as an actual defense article covered by the USML, and not as "technical data" as to which the "public domain" exception might be applicable. Id.[9]
By letter dated December 5, 1994, plaintiff appealed Dr. Harris's determination to the Assistant Secretary of State for Political-Military Affairs, Thomas E. McNamara. Lowell Decl. 19 and Tab 12. Plaintiff again argued, inter alia, that the "information on the Diskette is identical to the information in the Book," see Tab 12 to Lowell Declaration at 2, and that there was no rational distinction between source codes printed on paper in the book and in an electronic medium on the diskette. Id. In addition, plaintiff argued that the information contained on the diskette is in the public domain. Id. at 7-8.
By letter dated June 13, 1995, Assistant Secretary McNamara affirmed the decision made by Deputy Assistant Secretary Harris, and upheld the commodity jurisdiction determination. See Tab 14 to Lowell Declaration. In his appeal determination, the Assistant Secretary concluded that the source code diskette is cryptographic software covered by Category XIII(b)(1) of the USML and subject to the export licensing jurisdiction of the State Department. Id. at 1. The Assistant Secretary explained that encryption software is treated as a defense article
not because it contains "information," but because it can function to encrypt communications [and that] such software can be an integral functioning component of a computer system or device that actually encrypts information.Id. at 2 (original emphasis). In addition, the Assistant Secretary again explained that, under the ITAR, encryption software is treated as an actual defense article covered by the USML, and not as "technical data" as to which the "public domain" exception might be applicable. Id. at 1-2.
The Secretary of State has exercised the statutory authority delegated to him by the President to determine that cryptographic software should be designated a "defense article" on the United States Munitions List and, therefore, subject to export controls "[i]n furtherance of world peace and the security and foreign policy of the United States." 22 U.S.C. § 2778(a)(1). The Secretary, through his designees, further determined that plaintiff's diskette is such a designated defense article.
The Arms Export Control Act provides that the "designation by the President (or by an official to whom the President's functions . . . have been duly delegated), in regulations issued under this section, of items as defense articles or defense services for purposes of this section shall not be subject to judicial review." 22 U.S.C. § 2778(h). Accordingly, plaintiff may not challenge in this Court the wisdom or propriety of the Secretary of State's designation of cryptographic software on the USML, nor the State Department's specific designation of plaintiff's software diskette as a defense article.
Authority upholding the non-reviewability of the designation of commodities as subject to export controls has been developed in other circuits. In United States v. Martinez, 904 F.2d 601, 602 (11th Cir. 1990), the court held that the non-reviewability of the designation of an item on the USML is compelled not only by Section 2778(h), but by the Constitution as well. "The question whether a particular item should have been placed on the Munitions List possesses nearly every trait that the Supreme Court has enumerated [that] traditionally renders a question 'political.'" Id. (citing Baker v. Carr, 369 U.S. 186, 217 (1962)). Accord United States v. Helmy, 712 F. Supp. 1423, 1428- 30 (E.D. Cal. 1989). As the Eleventh Circuit explained:
No satisfactory or manageable standards exist for judicial determination of the issue, as defendants themselves acknowledge the disagreement among experts as to whether [the particular item] belongs on the list. (citing Coleman v. Miller, 307 U.S. 433, 454- 5S (1939)). Neither the courts nor the parties are privy to reports of the intelligence services on which this decision, or decisions like it, may have been based. (citing Chicago & Southern Air Lines [v. Waterman SS. Corp.], 333 U.S. 103, 111 (1948)). The consequences of uninformed judicial action could be grave. Questions concerning what perils our nation might face at some future time and how best to guard against those perils "are delicate, complex, and involve large elements of prophecy. They are and should be undertaken only by those directly responsible to the people whose welfare they advance or imperil. . . ." Id.Martinez, 904 F.2d at 602.
The Court of Appeals for the Ninth Circuit has also addressed the reviewability of the designation of specific commodities as subject to export controls in the closely analogous context of the Export Administration Act ("EAA"), 50 U.S.C.App. § 2401 et seq., administered by the Department of Commerce. Like the AECA and USML, the EAA controls the export of commodities designated on what is now called the "Commerce Control List" (''CCL'').[10] The functions exercised under the EAA are exempt from the provisions of the Administrative Procedure Act, including from judicial review under the APA, see 5 U.S.C. §§ 551, 553-559, 701-706. 50 U.S.C. App. § 2412.
The Ninth Circuit has held that Congress intended that the Secretary of Commerce's designation of a commodity on the CCL, and a determination that a particular item is covered by a CCL category, are not subject to judicial review.
In United States v. Spawr Optical Research. Inc., 864 F.2d 1467 (9th Cir. 1988), �ert. denied, 493 U.S. 809 (1989), the defendant had been convicted of exporting laser mirrors, a commodity included on the CCL, without first obtaining a license. Id at 1469. He argued on appeal that his counsel failed to secure relevant expert testimony that the mirrors were not in fact covered by the CCL. Id. at 1472. The court held that such testimony was not material since the Secretary's determination is not reviewable. Id.
Congress has designated the Secretary as the coordinating official in the area of export administration. It would severely undermine the Secretary's authority if judges and juries in individual criminal proceedings were permitted to reverse licensing determinations. And it would convert the judicial system into a policy-making forum, one in which the judiciary possess significantly less expertise and resources than the Secretary. Congress did not intend this chaotic and potentially dangerous result.Id. at 1220.
In United States v. Mandel, 914 F.2d 1215 (9th Cir. 1990), the defendant, indicted for exporting sophisticated computers without a license, sought discovery into the Secretary's factual basis for a CCL designation. Id. at 1218. As in Martinez, the court relied on the political question doctrine to reject such discovery, holding that whether export controls must be placed on a particular commodity "are quintessentially matters of policy entrusted by the Constitution to the Congress and the President, for which there are no meaningful standards of judicial review." Id. at 1223 (citations omitted).[11]
In United States v. Bozarov, 974 F.2d 1037, 1041-45 (9th Cir. 1992), cert. denied, 113 S.Ct. 1273 (1993), the defendant was indicted for conspiring to export computer disc equipment to Bulgaria without a license, in violation of the EAA. The court of appeals rejected the claim that the EAA's statutory preclusion of review was an unconstitutional delegation of legislative authority to the Executive branch, and held that the designation of a commodity on the CCL was not subject to judicial review. Bozarov, 974 F.2d at 1041-45. The court said:
[T]he need for uniformity in the realm of foreign policy is particularly acute; it would be politically disastrous if the Second Circuit permitted the export of computer equipment and the Ninth Circuit concluded that such exports were not authorized by the [Act].
Accordingly, under the foregoing authority, whether cryptographic software -- and in particular, plaintiff's diskette -- "belongs" on the USML, Martinez, 904 F.2d at 601, whether such software "should have been placed" on the USML, id. at 602, or whether there was "any basis in fact," Mandel, 914 F.2d at 1222- 23, for the Secretary's decision to place such software on the USML and subject it to export licensing, is not justiciable. This is the foundation of the legal analysis to be applied to plaintiff's claims in this case. Hence, for instance, the Court lacks jurisdiction to review plaintiff's claims brought under the APA that the CJ determination at issue was "arbitrary and capricious." See Compl. ¶ 29.[12]
The only possible basis of judicial review here is whether the plaintiff has stated a "colorable" constitutional claim. See Bozarov, 974 F.2d at 1044 (citing Webster v. Doe, 486 U.S. 592 (1988)). As demonstrated below, plaintiff's constitutional claims are neither colorable nor meritorious. First, this case does not concern the regulation of "speech" protected by the First Amendment, but the regulation of conduct -- namely, the conduct of exporting a commodity that can be utilized to encrypt data on a computer. Moreover, even assuming, arguendo, that export control of cryptographic software incidentally infringes on plaintiff's ability to engage in some protected expression, such an incidental infringement easily passes First Amendment muster under O'Brien v. United States, supra.
Plaintiff's insubstantial constitutional claims have been interposed to circumvent the clear preclusion of judicial review in this area. The Court should reject plaintiff's claims and recognize this case for what it is: a challenge to a policy determination that Congress has vested exclusively in the Executive branch.
In his complaint and submissions to the State Department, plaintiff alleges, on various grounds, that the designation of his computer diskette as a defense article infringes on his First Amendment right to freedom of speech. Compl. ¶ 32-34; see also Tab 12 to Lowell Declaration, Second Appeal Letter from Plaintiff's Counsel to Assistant Secretary McNamara (December 5, 1994) at 5, 10-11.
A threshold inquiry for a First Amendment claim is whether any protected "speech" is even at issue. As the Supreme Court stated in O'Brien:
We cannot accept the view that an apparently limitless variety of conduct can be labeled "speech" whenever the person engaging in the conduct intends thereby to express an idea.O'Brien, 391 U.S. at 376. See also Wisconsin v. Mitchell, 113 S. Ct. 2194, 2199 (1993) (conduct is not "speech for constitutional purposes solely because the person engaging in conduct "'intends thereby to express an idea'") (quoting O'Brien, 391 U.S. at 376). Hence, the Court must first determine if plaintiff's desire to export his software diskette "constitut[es] expressive conduct permitting him to invoke the First Amendment" in challenging the CJ determination. Texas v. Johnson, 491 U.S. 397, 403 (1989) (quoting Spence v. Washington, 418 U.S. 405, 409 (1974)). [13]
This case involves plaintiff's desire to export to foreign persons a computer diskette containing encryption source codes. Even assuming, arguendo, that expression to foreigners outside the United States is entitled to the full panoply of First Amendment protection provided to expression within this country, [14] the export of the diskette would not constitute speech or expressive conduct. Rather, plaintiff's export of the diskette at issue would have the purpose and effect of providing foreign persons with a functioning commodity that can be inserted into a computer and used to scramble communications.
The diskette contains several "cryptographic algorithms" expressed in "source code." See Declaration of William P. Crowell, Deputy Director, National Security Agency, ¶ 7. [15] A cryptographic algorithm is a mathematical function or equation that can be applied to transform information into an unintelligible form, i.e., into "ciphertext." Id. [16] A cryptographic "source code" is a computer program that expresses a cryptographic algorithm in a precise set of operating instructions that allow a computer to perform cryptographic functions. Id.
The Karn diskette includes several source codes designed to maintain the secrecy of information. Crowell Decl. ¶ 8. It is controlled under Category XIII(b)(1) of the USML because such software is itself the commodity essential to encrypting data on a computer. Id. ¶ 9. Encryption source codes constitute the "engine" for a cryptographic device: they enable a computer to transmit encrypted communications and to receive and decrypt communications. Id.
Because the export of the diskette would have the effect of enabling foreign persons to encrypt and decrypt data, it cannot reasonably be viewed as "convey[ing] a particularized message" that would be "understood by those who viewed" the diskette. Texas v. Johnson, 491 U.S. at 403. For this reason, plaintiff cannot reasonably assert that export of the diskette would be protected speech in the first instance, and his First Amendment claims must fail.
In O'Brien v. United States, supra, the Supreme Court established the standard for evaluating the government's regulation of conduct which might, in its particular applications, impose incidental restrictions on speech. See also CCNV, 468 U.S. at 294; Walsh v. Brady, 927 F.2d 1229, 1235 (D.C. Cir. 1991); American Library Association. et al. v. Reno, 33 F.3d 78, 84 (D.C. Cir. 1994), cert. denied __ U.S. __, 115 S.Ct. 2610 (1995). "[W]hen 'speech' and 'non-speech' elements are combined in the same course of conduct, a sufficiently important governmental interest in regulating the nonspeech element can justify incidental limitations on First Amendment freedoms." O'Brien, 391 U.S. at 376.
O'Brien set forth a four-part inquiry under which an incidental restriction on speech will be sustained if: (i) it is within the constitutional power of the Government; (ii) it furthers an important or substantial governmental interest; (iii) the governmental interest is unrelated to the suppression of free expression; and (iv) the incidental restriction on alleged First Amendment freedoms is no greater than is essential to the furtherance of that interest. 391 U.S. at 377.
Nor may the policy bases underlying the government's interests be second-guessed, particularly in the area of export controls. In Spawr Optical, the court held the basis for designating a commodity as subject to export controls was "beyond dispute" and not a triable issue of fact, since "the export of certain commodities may have a significant impact on United States' foreign policy and national security." Spawr Optical, 864 F.2d at 1473.
Similarly, in Mandel, the court barred discovery into the basis for controlling a commodity, because "whether the export of a given commodity would make a significant contribution to the military potential of other countries" is a "matter[] of policy entrusted by the Constitution to the Congress and the President . . , . n Mandel, 915 F.2d at 1223. See also Mendelsohn v. Meese, 695 F. Supp. 1474, 1485 (S.D.N.Y. 1988) (in foreign policy area, "a declaration by the coordinate branches of what is and is not in our national interest merits deferential respect").
Even if the government's interest were subject to judicial probing, control of the export of cryptographic software undoubtedly serves a compelling interest. The National Security Agency's "signals intelligence" mission is conducted through sophisticated collection technologies that allow NSA to obtain information from foreign electromagnetic signals, many of which are encrypted. Crowell Decl. ¶ 4. A core NSA activity is "cryptanalysis" -- the science of determining the content of coded messages. Id.
Based on information derived from these activities, NSA provides reports on a rapid-response basis to national policy- makers and military commanders. Crowell Decl. ¶ 4. Such intelligence gathering efforts are critical, for example, to ensuring the effective accomplishment of military missions with minimal loss of life. Lowell Decl. ¶ 9. Policies concerning the export control of cryptographic products are based principally on the fact that proliferation of such products will make it easier for foreign intelligence targets to deny the United States access to information vital to national security interests. Crowell Decl. 1 4-
Accordingly, the governmental interest at stake here is as compelling, if not more so, than other interests the Supreme Court has recognized as significant. [17]
The third O'Brien prong -- that the regulation be unrelated to the suppression of free expression -- is also satisfied here. [18] On its face, Category XIII(b)(1) of the USML pertains to cryptographic products and software "with the capability of maintaining secrecy or confidentiality of information systems . ." 22 C.F.R. ¶ 121.1 XIII(b)(1). The encryption source codes on plaintiff's disk are not regulated because of any scientific ideas that are implicit in them. The focus of the regulation is on the function of a commodity.
A demonstration of the step-by-step process by which the Karn diskette can be inserted into a computer and used to encrypt information is set forth in the Crowell Declaration. [19] This shows the execution of one of the source codes on the diskette to produce a "scrambled" ciphertext, and then to "unscramble" or decrypt the ciphertext and restore it to its original, understandable form.
First, the Karn diskette may be inserted into the floppy disk drive of a computer and the directory of its contents called to the screen, displaying the list of source codes on the disk. [20] Crowell Decl. ¶ 11. One of the source codes may be selected from the directory and used to encrypt information. Id. The demonstration utilizes the source code for the "Triple DES" algorithm. Id.
The next step in the process of using Triple DES to encrypt information is to add some simple instructions to the computer that allow for a document or message in its original, understandable form (i.e., the "plaintext") to be "input" or "passed through" the Triple DES source code, resulting in the "output" of a scrambled ciphertext. Crowell Decl. ¶ 12. [21]
Next, "compiling" software is applied to the source code. Crowell Decl. q 13. Compiling turns the source code into so- called "object code" -- which is the same code transformed into a series of "ones" and "zeroes" to be executed by the computer. Id. Compiling is another simple process accomplished in a matter of seconds through the use of commercially available software. Id.
At this point, a user is ready to encrypt communications. Crowell Decl. 1 14. The text of a document may then be turned into ciphertext, and then restored to its original, understandable form. See id. In the example, the text "we are planning an all-out attack against the enemy in the vicinity of Aitape about July 10" is encrypted and decrypted. Id. and Tab B. One need only type a single line of commands to the computer to instantly convert such text into gibberish. Id. Both the encryption and decryption process is undertaken through the use of a "key" -- a "password" known only to the two parties to the communication, which must be entered in order to perform the encryption/decryption function. Id.
This demonstration shows, beyond dispute, that the Karn diskette includes source codes that, with a few simple steps, allow a user to encrypt information on a computer. Crowell Dec. 1 14. It is because of this function that the diskette falls squarely within Category XIII(b)(1) of the United States Munitions List, not because of any ideas or expression to foreign entities that may be implicit in its export.
Throughout his commodity jurisdiction submissions, plaintiff spends little time questioning the notion that the diskette of encryption source codes can function to encrypt data on a computer. Indeed, plaintiff concedes in his CJ request that "the software on this diskette is provided for those who wish to incorporate encryption into their applications." Tab 6 to Lowell Declaration, March 9, 1994 CJ Request at 2.
Instead, plaintiff focuses his argument not on substance, but form. He argues that the "information" on the diskette is identical to the "information" in Appendix Five of Applied Cryptography, which the State Department did not regulate as a defense article. Plaintiff stated in this CJ request:
Character by character, the information is exactly the same. The only difference is the medium: magnetic impulses on mylar rather than inked characters on paper.Tab 6 to Lowell Declaration, March 9, 1994 CJ Request at 2. The diskette is also described as "an exact duplicate, in digitized form, of the cryptographic source code that is printed as Part Five (pages 456-570) of the Book." Tab 12 to Lowell Declaration, December 5, 1994, Second Appeal Letter at 3.
Plaintiff's argument obscures the most essential point: whatever may be said about the source codes printed on paper in the book, the diskette at issue in this case unquestionably can be used to maintain the secrecy or confidentiality of information, and for this reason is covered by Category XIII(b)(1) of the USML. It may be, as plaintiff suggests, that the encryption source codes on the diskette reflects the same "information" printed on paper in the appendix of the book. But that is beside the point. The diskette is regulated not because of whatever alleged informational or expressive value it may have, but because of its functional use. The "paper or plastic" argument on which plaintiff's case hinges is therefore irrelevant.
Perhaps recognizing that the "identical information" argument is flawed, plaintiff also suggests that Appendix Five of Applied Cryptography has the same functional capability as the diskette, on the theory that the printed source codes can be converted into an electronic format by "scanning" them into a computer through Optical Character Recognition ("OCR") technology. See Tab 10 to Lowell Declaration, June 10, 1994 First Appeal Letter at 3. An optical scanner is a device which can be passed over a printed text and which "reads" the text into a computer. Crowell Decl. ¶ 15. OCR technology converts the picture of the printed text scanned into the computer into an electronic format which can be edited. Id.
The availability of optical scanning does not favor plaintiff's position, but defendants'. Plaintiff's argument that encryption source codes may be transcribed into an electronic media and executed on a computer, much like a diskette, is one that may compel reconsideration of the status of printed source codes under Category XIII(b)(1) of the USML. Particularly as scanning technology improves, plaintiff's argument underscores that the focus may properly be on the source code itself, not the particular medium in which it is contained. [22]
Nonetheless, even if the government chooses not to regulate printed source codes, that decision would not affect the status of the diskette, since the differences between the two remain important. See Crowell Decl. ¶ 16. A user may simply insert the Karn diskette into the floppy drive of a computer, write minimal additional instructions, apply compiling software in a matter of seconds, and have executable object code that scrambles data. Id.
The process of optically scanning printed source codes into a computer is quite different. OCR technology, while improving, may not always produce error-free reproductions of the scanned material. Crowell Decl. ¶ 16. Any errors of character recognition that occurred in the scanning process must be detected and corrected before compiling may begin and information encrypted. Id. Also, the source code, as printed on paper, may have errors which, even if scanned correctly, would prevent it from being compiled and executed. Id. ¶ 17. Verifying the accuracy of the printed source code requires the expertise of someone familiar with the particular source code and the with fundamentals of cryptography. Id.
This very problem exists in this case with the FEAL-8 source code. Merely scanning the FEAL-8 source code as printed in original editions of the Applied Cryptography book would create a malfunctioning code because the printed code contained an error. Crowell Decl. ¶ 18. However, on the diskette, this error has been corrected, and the FEAL-8 source code would function properly. Id. This demonstrates further the importance of the diskette.
Ultimately, the technical impediments posed by optical scanning may be overcome to create executable source code. Crowell Decl. ¶ 19. However, compared to the task of scanning, using a ready-made, error free diskette is much simpler. Id. The diskette provides users with the most important component of computer-executable software: source code on a diskette that allows for direct use on a computer to encrypt data with the minimum of effort. Id.
Accordingly, while scanning technology presents issues that the government may consider, a distinction between the book and the diskette is reasonable. Indeed, the presumption underlying plaintiff's case -- that, because the government did not regulate the book, it may not regulate the diskette -- is not supported by law. An agency has the discretion not to regulate a given activity -- such as the source codes printed in the book -- based on factors not inherently susceptible to judicial resolution. Natural Resources Defense Council. Inc. v. SEC, 606 F.2d 1031, 1046 (D.C. Cir. 1979). One such factor may be that the area is one of "rapid technological development" and that the "scientific state of the art" may not yet have produced sufficient data for a decision. Id. [23]
Thus, the State Department's action in not regulating the source codes in the book does not require that it forego regulatory controls with respect to the diskette, nor preclude the government, if necessary, from re-visiting the question of printed source codes, in view of plaintiff's assertion that software in such a medium could also be executed on a computer.
[T]he agency may not have had sufficient experience with a particular problem to warrant rigidifying its tentative judgment into a hard and fast rule. Or the problem may be so specialized and varying in nature as to be impossible to capture within the boundaries of the general rule. In those cases, the agency must retain power to deal with the problems on a case-by-case basis if the administrative process is to be effective.SEC v. Chenery Corp., 332 U.S. 194, 202-203 (1946).
In any event, the determination at issue in this case concerns the diskette's status under USML Category XIII(b)(1). The fact that the government regulated encryption source codes in this ready to use, electronic format, and not printed on paper in the Applied Cryptography book, does not change the fact that the diskette, considered by itself, is encryption software covered by the United States Munitions List, the regulation of which is unrelated to any "expression" that plaintiff might intend to convey through its export.
Plaintiff attempts to show that the diskette constitutes "speech" by comparing it with other media for the publication of information. He argued to the State Department that the distinction drawn between the diskette and the printed source codes is "analogous to a hypothetical decision by a government agency in the 1940s that the First Amendment had no application to television because it wasn't speech." Tab 12 to Lowell Declaration, December 5, 1995 Second Appeal Letter at 6. He also compared the diskette to an "audio" tape or "talking book." Id. at 8. Finally, he compared the diskette to the "CD-ROM" version of a novel that would allow for the book to be read on a computer screen. Id. at 9.
The analogies plaintiff seeks to draw are wide of the mark. The Karn diskette does not merely allow for the source codes to be read like a novel or watched like a TV program on a computer screen. Unlike a TV program or audio tape that are observed or heard, the software allows someone to do something -- to maintain the secrecy of communications on a computer.
* * *
For the foregoing reasons, control of the export of plaintiff's source code diskette is unrelated to the suppression of free expression and satisfies the third prong of the O'Brien analysis.
Inclusion of cryptographic software on the USML easily satisfies this standard. Such software is regulated in furtherance of a substantial national security interest to protect the United States' intelligence-gathering capabilities, which provide essential information to national security policy- makers and military commanders. Plaintiff seeks to export a diskette that contains several source codes -- the engines that enable a computer to perform cryptographic functions. The governmental interest in protecting its foreign intelligence- collection efforts would be "more exposed to harm" without export controls on cryptographic software than with them. CCNV, 468 U.S. at 297.
At the same time, however, controls on the export of cryptographic software do not preclude individuals from otherwise publishing or discussing scientific ideas related to cryptography and cryptographic algorithms (such as that contained in the narrative text of the Applied Cryptography book itself). Thus, the regulation of the diskette would not have "a substantial deleterious effect," Ward, 491 U.S. at 801, on the ability of persons to disseminate information about cryptography, and would "leave open ample alternative channels of communication," id. at 802. See also Iskcon of Potomac. Inc. v. Kennedy, 61 F.3d 949, 955 (D.C. Cir. 1995). The focus of export controls is on a software commodity that can function to encrypt -- not on scientific expression.
In addition, even with respect to cryptographic software, the scope of ITAR controls is not unlimited. Under Category XIII(b), encryption products that do not function to maintain the "secrecy and confidentiality of data" are not encompassed by Category XIII(b). Once such a function is "data authentication," which ensures that no alteration of a text has taken place in its transmission, or authenticates the actual users involved in the transaction, but does not allow the encryption of data. See 22 C.F.R. § 121.1 XIII(b)(1)(vi). A common example of this is an identification number used to prevent unauthorized access to a bank account.
In addition, cryptographic products specially designed, developed or modified for use in machines for banking transactions, and restricted to use only in such transactions, are also not controlled by the USML. See 22 C. F.R. § 121.1, XIII(b)(1)(ii). Examples of such products include point-of-sale terminals (e.q., cash registers) and banking automatic teller machines.
Also, export jurisdiction over certain "mass-market" software products may be transferred to the Commerce Department. See 22 C.F.R. §121.1, XIII(b)(1)(ix) note and Tab 3 to the Lowell Declaration. Mass market software is computer software with encryption capabilities, that is available to the public via sales from stock at retail selling points by means of over-the- counter, mail, or telephone transactions, and which meets specified encryption criteria. See Tab 3 to Lowell Declaration. The treatment of the foregoing types of cryptographic software further demonstrates the narrow-tailoring of Category XIII(b).
Finally, the fact that a particular commodity is covered by the USML does not preclude its export. Separate licensing decisions may be made, that take into account the sensitivity of the technology, the end-user and end-use. Lowell Decl. ¶ 5; Crowell Decl. ¶ 5. Through the licensing process as well, the scope of USML controls on encryption software are narrowly tailored.
For all of these reasons, control on the export of encryption software "'responds precisely to the substantive problems which legitimately concern the [Government].'" CCNV, 468 U.S. at 297 (quoting Members of the City Council of Los Angeles v. Taxpayers for Vincent, 466 U.S. 789, 810 (1984)). The final O'Brien prong is therefore satisfied.
"[C]ourts do not require that an enactment touching on First Amendment interests set forth the precise line dividing proscribed from permitted behavior, or that a person contemplating a course of behavior know with certainty whether his or her act will be found to violate the proscription." Id. at 195. Rather, a court must look to whether the statute is "'set out in terms that the ordinary person exercising ordinary common sense can sufficiently understand and comply with, without sacrifice to the public interest.'" Id. (quoting United States Civil Serv. Comm'n v. National Ass'n of Letter Carriers, 413 U.S. 548, 578-79 (1973)).
Under these principles, plaintiff's vagueness challenge clearly fails. The only ITAR provision plaintiff cites is Section 120.4, see Compl. ¶ 34, concerning the commodity jurisdiction process. See 22 C.F.R. § 120.4. The obvious rejoinder is that, in contrast to a case where an individual has already been charged with violating an allegedly vague prohibition, plaintiff here cannot assert that he lacks notice of what is proscribed. Plaintiff sought a commodity jurisdiction determination and was expressly informed that his diskette was subject to export controls. Thus, the very action and procedure plaintiff challenges is that which provided him specific notice that the diskette was covered by the USML. In other words, plaintiff inquired and was warned before any enforcement action might be taken. He cannot now state a claim that the ITAR is vague as applied, since the only "application" here was to provide the notice that automatically defeats such a claim. [27]
Control over the export of encryption software satisfies this most deferential standard. The governmental interest in protecting its foreign intelligence-collection efforts is clearly a strong one, see Crowell Decl. ¶ 4 and Lowell Decl. ¶ 9, and export controls on cryptographic software are rationally related to furthering this legitimate goal.
Plaintiff contends that the government's action here is "irrational" on the theory that the source codes on the diskette, should be deemed to be in the "public domain" under the ITAR and exempt from licensing controls. He argues that such software has "achieved pervasive public availability" such that it is arbitrary and capricious to control its export from the United States. See, e.q., Tab 12 to Lowell Declaration, Dec. 5, 1994 Second Appeal Letter at 7-8. He argues that the Applied Cryptography book, which includes the printed source codes, has been widely exported. Id. He also argues that encryption software is available on Internet "file transfer protocol" ("FTP") sites outside of the United States. Id.
This contention seems to raise two issues: (i) whether the "public domain" provision of the ITAR has any applicability here; and (ii) whether the alleged availability of encryption source codes abroad renders irrational the decision to regulate the export of plaintiff's software diskette.
The reason for this distinction is that the diskette is a commodity that can function to encrypt. It does not contain mere "know-how" that explains how cryptography works, or merely a description of scientific ideas or information related to cryptography. See Crowell Decl. € 9. Cryptographic software is a defense article because it is the actual item that enables a computer to perform cryptographic functions. Id.
In addition, while the fact that technical data is widely available ("in the public domain") may be relevant in determining whether its export should be regulated, the public availability of a functioning defense article does not alter the fact that wider, uncontrolled, dissemination of a greater number of those articles in foreign lands may increase the harm to the government's interests. If the "public domain" exemption applied to defense articles, then all items on the USML publicly available in the United States would be automatically exempt from export licensing controls. Application of the public domain standard to encryption software would effectively repeal Category XIII(b) of the USML. Moreover, courts have recognized that this would make no sense -- that "public availability" does not bar the government from nonetheless maintaining export controls. In the Martinez case, for example, the court upheld the non- justiciability of a USML designation, rejecting arguments that the encryption equipment at issue in that case was publicly available. Martinez, 904 F.2d at 601. [30]
For these reasons, plaintiff's reliance on the fact that the Applied Cryptography book was found to be in the "public domain" is not relevant to whether the source code diskette is subject to export controls.
For purposes of argument, the Court can assume that encryption software is available abroad. Nations other than the United States may have the capability to develop or obtain cryptographic devices and software, just as they can develop or obtain other munitions, such as guns, tanks, and missiles. This does not render a policy of controlling the export of U.S. munitions a violation of substantive due process.
The Arms Export Control Act broadly authorizes the President to designate defense articles "in furtherance of world peace and the security and foreign policy of the United States." 22 U.S.C. § 2778(a)(1). Even though a foreign nation may possess tanks and missiles, the United States may control the export of U.S. tanks and missiles, either to control the spread of better U.S. technology, or simply to keep the foreign nation from getting more tanks. Similarly, even if encryption software is available abroad, the United States has decided to control the spread of U.S. encryption software for national security reasons. The government is not constitutionally required to "throw in the towel" on all encryption software controls just because encryption technology abroad may make its task more difficult.
It also bears noting that this case concerns a determination as to which regulatory scheme applies to the export of a particular commodity. The export of encryption software is not prohibited by the ITAR, but controlled through the licensing process to ensure that such exports are consistent with foreign policy and national security concerns. See Lowell Decl. ¶ 5. The government looks to the "end-use" and "end-user" of the commodity at issue: where it is going, who it will be used by, and for what purpose. Id.
Hence, the "substantive due process" issue plaintiff presents is whether there is no conceivable rational basis for requiring him to apply for a license prior to exporting his encryption software diskette. Plaintiff is claiming a constitutional right to indiscriminately export, to any foreign country, foreign entity, or foreign person, a diskette containing several encryption source codes that can be used to encrypt communications. In the face of the important governmental interests at stake, the idea that government cannot have any say in where, to whom, and for what purpose, powerful encryption technology is being exported is the "irrational" position. Ultimately, plaintiff's argument about the public availability of encryption abroad goes to policy issues within the Executive branch's discretion to assess, and does not implicate the Constitution. Plaintiff's challenge in this case is to the wisdom of the ITAR controls on encryption software, and this is a determination that Congress has vested in the President.
Respectfully Submitted,
FRANK W. HUNGER
Assistant Attorney General
ERIC H. HOLDER
United States Attorney
[signed - Anthony J Coppolino for]
VINCENT M. GARVEY
Deputy Branch Director
ANTHONY J. COPPOLINO
Trial Attorney
U.S. Department of Justice
Civil Division - Federal Programs Branch
901 E Street, N.W. - Room 1084
Washington, D.C. 20530
(202) 514-4782
Attorneys for the Defendants.
Date: November 15, 1995.
1 A "source code" is a computer program that expresses a cryptographic algorithm in a precise set of operating instructions that allow a computer to perform cryptographic functions. See Declaration of William P. Crowell, Deputy Director, National Security Agency, ¶ 7.
2 The diskette at issue in this case does not contain the portion of Applied Cryptography that discusses topics and ideas concerning cryptography. At issue are the encryption source codes on the diskette.
3 See, e.g., The Code Breakers: The Story of Secret Writing, by David Kahn (MacMillan Publishing Inc. 1967).
4 The designation of defense articles and services by the Secretary of State, and changes in such designations, must have the concurrence of the Secretary of Defense. 22 C.F.R. § 120.2.
5 Information is also deemed to be in the public domain if it is available "through unlimited distribution at a conference, meeting, seminar, trade show or exhibition, generally accessible to the public, in the United States" or "through fundamental research in science and engineering at accredited institutions of higher learning in the U.S. where the resulting information is ordinarily published and shared broadly in the scientific community." 22 C.F.R. § 120.11(a)(6), (8).
6 The State Department regulates the export of technical data consistent with the constitutional requirements described in United States v. Edler Industries, Inc., 579 F.2d 516, 522 (9th Cir. 1978). See Preamble to Revisions of International Traffic in Arms Regulations (Final Rule) 49 Fed. Reg. 47682, 47683 (Dec. 6, 1984).
7 As noted above and explained further below, the public domain exception does not apply to cryptographic software covered by Category XIII(b)(1) of the USML.
8 As the CJ request indicates, this diskette is different from the two-disk set available from the author. See Tab 6 at l.
9 As noted, the ITAR specifically provides that cryptographic software is not to be treated as mere technical data. See 22 C.F.R. §§ 121.10(a)(4), 121.8(f), 121.1 XIII(b)(1).
10 The essential distinction between the two schemes is that the AECA and USML are concerned with the export of designated defense articles and services. Generally, a commodity not covered by the USML is subject to the export jurisdiction of the Commerce Department.
11 Accord United States v. Moller-Butcher, 560 F. Supp. 550, 553-54 (D. Mass. 1983) ("[t]he power to classify goods on the CCL -- and to restrict them for export on national security grounds -- can (and should) be turned over to the executive branch, as it has the dominant role in conducting foreign policy").
12 Judicial review under the APA is not permitted where it has been precluded by statute. 5 U.S.C. § 701(a)(1).
13 The conduct must be "'sufficiently imbued with elements of communication to fall within the scope of the . . . [First Amendment].'" Texas v. Johnson, 491 U.S. at 403 (quoting Spence, 418 U.S. at 410-11). In deciding whether certain conduct is "sufficiently imbued with elements of communication," the court looks to "whether '[a]n intent to convey a particularized message was present, and [whether] the likelihood was great that the message would be understood by those who viewed it.'" Id. Examples of expressive conduct held to be protected by the First Amendment are wearing black armbands or military uniforms to protest the Vietnam war, a "sit-in" to protest segregation, and picketing. Id. at 404 (citations omitted).
14 In Haig v. Agee, 453 U.S. 280 (1981), the Supreme Court similarly assumed, arguendo, that "First Amendment protections reach beyond our national boundaries" to include speech to foreigners abroad. Id. at 308. The Supreme Court has never had occasion to resolve the scope of the First Amendment's applicability overseas, and this Court, likewise, need not reach the issue because the defendants are entitled to judgment even on the assumption that the First Amendment has full force and effect with respect to international communications.
15 The National Security Agency is the agency with technical expertise for evaluating whether cryptographic devices or software fall within Category XIII(b) of the USML. Crowell Decl. 5.
16 A rudimentary example of an algorithm to transform plaintext into ciphertext would be a formula that replaces each letter in a word with the next letter in the alphabet, i.e., A+l=B, B+1=C . . . Z+1=A. Thus, the sentence "Proceed at dawn" becomes "Qspdffe bu ebxo".
17 In O'Brien itself, the Court gave substantial deference to the government's stated basis for its policy of prohibiting the destruction of draft cards, and did not second-guess the matter. 367 U.S. at 381 ("we think it apparent that the Nation has a vital interest in having a system for raising armies that functions with maximum efficiency . . ."). Similarly, in CCNV, the court deferred to the government's interest in protecting parks. 468 U.S. at 299 (the government's interest in conserving park property is "plainly served by" measures such as the proscription of sleeping therein).
18 In determining whether a regulation is related to the suppression of free expression, just as in determining whether a time-place-or-manner restriction is content-neutral, "[t]he government's purpose is the controlling consideration," and the third prong of O'Brien is satisfied so long as the regulation is "justified without reference to the content of the regulated speech." Ward v. Rock Against Racism, 491 U.S. 781, 791 (1989) (citations omitted). See also American Library Association, 33 F.3d at 84.
19 Plaintiff provided the government with a copy of the source code diskette at issue. See Lowell Decl. ¶ 13.
20 Each source code on the diskette is named after the cryptographic algorithm that it implements. See Tab A to Lowell Declaration.
21 As plaintiff notes in his second administrative appeal, the source codes on the diskette do not already have these "input and output routines." Tab 12 to Lowell Declaration, Dec. 5, 1994 Second Appeal Letter at 5. Composing these additional instructions is not a significant task, however. Crowell Decl. 1 12. This step could be easily undertaken by anyone with an ability to program in the "C" language. Id. The demonstration uses a rudimentary set of instructions and were written by an NSA analyst in less than one hour. Id.
22 Indeed, the status under the USML of source codes printed in a book is again under consideration by the State Department through another pending CJ request.
23 See also Union of Concerned Scientists v. U.S. Nuclear Regulatory Commission, 880 F.2d 552, 558 (D.C. Cir. 1989) (agency may apply technical judgments to regulatory standard on a case- by-case basis due to changes in technology and variation in circumstances).
24 Though Ward was a case regarding restrictions on the "time, place, and manner" of speech, the Court explained that it treats the time-place-and-manner test and the O'Brien test as being largely identical. 491 U.S. at 797-98. Accord CCNV, 468 U.S. at 298. Thus the narrow-tailoring test in Ward is applicable to an O'Brien analysis.
25 See also Board of Trustees of State University of New York v. Fox, 492 U.S. 469, 478 (1989).
26 Plaintiff also purports to claim the ITAR is overbroad "as applied." Compl. ¶ 34. However, the First Amendment overbreadth doctrine "typically concerns facial challenges to statutes or regulations that impermissibly burden third parties' protected speech interests." National Organization for Women v. Operation Rescue, 37 F.3d 646, 654 n. l (D.C. Cir. 1994) (citation omitted) (original emphasis). Since plaintiff challenges the ITAR as applied to him, an overbreadth analysis is not applicable. City Council v. Taxpayers for Vincent, 466 U.S. at 801-02. Rather the court must apply the appropriate First Amendment standard -- in this case the O'Brien analysis -- to the particular application in this case of the regulation being challenged. See i. at 804 (applying O'Brien to county ordinance barring political signs on public property).
27 In addition, the criminal sanctions in the AECA are for "willful" violations. See 22 U.S.C. § 2778(c). Such a scienter requirement forecloses potential vagueness problems as to criminal enforcement. Posters 'N' Things, Ltd. v. United States, 114 S.Ct. 1747, 1754 (1994); Harris v. McRae, 448 U.S. 297, 311 n. 17 (1980).
28 As with his purported "overbroad as applied" claim, to the extent plaintiff is recasting his First Amendment claim as a substantive due process violation of a "fundamental right," this does not constitute a distinct constitutional claim. See Albright v. Oliver, 114 S.Ct. 807, 813 (1994) (plurality opinion) ("[w]here a particular amendment 'provides an explicit textual source of constitutional protection' against a particular sort of governmental behavior, 'that Amendment, not the more generalized notion of "substantive due process," must be the guide for analyzing these claims'") (quoting Graham v. Connor, 490 U.S. 386, 395 (1989)).
29 A party asserting a due process violation cannot prevail simply by showing that there exists "another rational formula, perhaps even a more rational formula," for regulating the matter at issue. Colorado Springs Prod. Credit Ass'n v. Farm Credit Admin., 758 F. Supp. 6, 9 (D.D.C. 1991), aff'd, 967 F.2d 648 (D.C. Cir. 1992). Instead, the challenger must establish that the chosen scheme is "demonstrably arbitrary or irrational." Duke Power Co. v. Carolina Env. Study Group, 438 U.S. 59, 84 (1978). As long as the "statute is supported by a legitimate legislative purpose furthered by rational means, judgments about the wisdom of such legislation remain within the exclusive province of the legislative and executive branches." Gray, 467 U.S. at 729.
30 Also, in two cases involving technical data, the court rejected First Amendment claims that the public availability of scientific information in the United States precluded the government from seeking to regulate the transmission of technical data undertaken to assist a foreign entity in the development of a munition. United States v. Edler Industries. Inc., supra, 579 F.2d at 522; see also United States v. Posey, 864 F.2d 1487, 1496-97 (9th Cir. 1989) (national security concerns may be more sharply implicated by export abroad than by domestic disclosure).
Kenneth C. Bass, III Thomas J. Cooper Teresa Trissell VENABLE, BAETJER, HOWARD & CIVILETTI, LLP 1201 New York Avenue, N.W. Suite 1000 Washington, D.C. 20005 [signed] ANTHONY J. COPPOLINO