________________________________________ ) PHILIP R. KARN, JR. ) ) Plaintiff, ) ) Civ. A No. 95-1812 (CRR) v. ) ) (Judge Charles R. Richey) U.S. DEPARTMENT OF STATE, and ) THOMAS E. MCNAMARA, Assistant ) Secretary of State, Bureau of ) Political-Military Affairs, in ) his official capacity. ) ) Defendants. ) ) ________________________________________)
Pursuant to Local Rule 108(h), defendants, through their undersigned counsel, submit the following statement of material facts as to which there is no genuine issue.
1. By letter dated February 12, 1994, plaintiff Philip R. Karn submitted to the State Department a commodity jurisdiction request for the book Applied Cryptography by Bruce Schneier. Declaration of William J. Lowell, Director of the Office of Defense Trade Controls, ¶ 10 and Tab 4.
2. By letter dated March 2, 1994, the Office of Defense Trade Controls responded to plaintiff's CJ request, indicating that the book is not subject to the licensing jurisdiction of the Department of State because it is in the public domain. Lowell Decl ¶ 11 and Tab 5. As stated therein, this determination did not extend to the two disks containing source code that the book references and that are available from the author. Id.
3. By letter dated March 9, 1994, Mr. Karn submitted a second commodity jurisdiction request for a diskette which he stated contained source codes for data encryption that are printed in Appendix Five of the Applied Cryptography book. Lowell Decl. ¶ 12 and Tab 6.
4. Plaintiff stated in his March 9, 1994, CJ request that "the diskette contains source code for encryption software that provides data confidentiality." Tab 6 to Lowell Declaration at 2.
5. Plaintiff stated in his March 9, 1994, CJ request that "the software on this diskette is provided for those who wish to incorporate encryption into their applications." Tab 6 to Lowell Declaration at 2.
6. By letter dated May 11, 1994, the Department of State, Office of Defense Trade Controls, responded to plaintiff's second CJ request, indicating that the source code diskette is subject to the licensing jurisdiction of the Department of State. Lowell Decl. ¶ 15 and Tab 9. The Department indicated that the diskette is designated as a defense article under Category XIII(b)(1) of the United States Munitions List ("USML"), 22 C.F.R. § 121.1 XIII(b)(l), and that a license from the State Department was required prior to its export. Id.
7. By letter dated June 10, 1994, plaintiff appealed the CJ determination concerning the source code diskette to Deputy Assistant Secretary of State, Dr. Martha Harris. Lowell Decl. ¶ 16 and Tab 10.
8. By letter dated October 7, 1994, Deputy Assistant Secretary Harris decided plaintiff's appeal and upheld the CJ determination made by ODTC. Lowell Decl. ¶ 18 and Tab 11. In this appeal determination, the State Department again concluded that the source code diskette is covered by Category XIII(b)(1) of the USML and subject to the export licensing jurisdiction of the State Department. Id.
9. By letter dated December 5, 1994, plaintiff appealed Dr. Harris's determination to the Assistant Secretary of State for Political-Military Affairs, Thomas E. McNamara. Lowell Decl. l9 and Tab 12.
10. By letter dated June 13, 1995, the Assistant Secretary decided plaintiff's appeal, affirmed the decision made by Deputy Assistant Secretary Harris, and upheld the CJ determination made by ODTC. Lowell Decl. ¶ 22 and Tab 14. In this appeal determination, Assistant Secretary McNamara concluded that the source code diskette is covered by Category XIII(b)(l) of the USML and subject to the export licensing jurisdiction of the State Department. Id.
11. The National Security Agency ("NSA") is the agency with technical expertise for evaluating whether cryptographic devices and software fall within Category XIII(b)(1) of the USML. See Lowell Decl. ¶ 24; Declaration of William P. Crowell, Deputy Director of the National Security Agency, ¶¶ 3, 5.
12. The commodity at issue in this case is a computer diskette which contains cryptographic algorithms expressed in source code. Crowell Decl. ¶ 7.
13. A cryptographic algorithm is a mathematical function or equation that can be applied to transform data into an unintelligible form (i.e., into ciphertext.) Crowell Decl. ¶ 7.
14. A source code is a computer program that expresses a cryptographic algorithm in a precise set of operating instructions that allow a computer to perform cryptographic functions. Crowell Decl. ¶ 7.
15. Source code can be converted by another computer program, called a compiler, into "object code." Object code is a series of "ones" and "zeros" that may be directly executed by a computer. Crowell Decl. ¶ 7.
16. The diskette submitted by the plaintiff for the commodity jurisdiction determination at issue in this case "contains source code for encryption software that provides data confidentiality." Tab 6 to Lowell Declaration, March 9, 1994, CJ Request at 2; see also Crowell Decl. ¶ 8.
17. The diskette at issue does not merely contain "text" files that can be read on a computer screen, like the page of a book can be read. Crowell Decl. ¶ 10. Rather, the source codes on the diskette can be used to enable a computer to perform cryptographic functions, i.e., to encrypt and decrypt information. Id.
18. The diskette at issue may be inserted into the floppy disk drive of a computer and the directory of its contents called to the screen, displaying a list of source codes on the disk. Crowell Decl. ¶ 11 and Tab A.
19. The source codes on the diskette are named after the cryptographic algorithms that they implement. Crowell Decl. ¶ 11.
20. The source codes on the diskette that can encrypt information to maintain data confidentiality, such as TRIPLE DES, can be executed to encrypt communications on a computer by:
(a) writing additional instructions to the computer called "input and output" routines that allow for the plaintext of a document or message to be "passed through" the source code resulting in the output of scrambled ciphertext;
(b) compiling the source code into object code by using commercially available software; and
(c) typing a command to the computer to encrypt the text of a document or message. Crowell Decl. ¶ ¶ 14 and Tab B.
21. The command to the computer to encrypt plaintext and decrypt ciphertext includes a "key," which is information known only by the parties sending and receiving the text that acts as a "password" so that the text can be encrypted and decrypted. Crowell Decl. ¶ 14.
22. An optical "scanner" is a device that can be passed over a printed text and which "reads" the text into a computer. Optical character recognition ("OCR") technology then converts the picture of the printed text scanned into the computer into an electronic format which can be edited. Crowell Decl. ¶ 15.
23. OCR technology may not produce error free reproductions of the scanned material. Any errors of character recognition that occur in the scanning process must be detected and corrected before compiling may begin and information encrypted. Crowell Decl. ¶ 17.
24. If a source code printed on paper contains an error or "bug," verifying the accuracy of the source code requires the expertise of someone who is familiar with the particular source code language and with the fundamentals of cryptography. Crowell Decl. ¶ 17.
25. Scanning the FEAL-8 source code as printed in Appendix Five of original editions of the book Applied Cryptography would create a malfunctioning source code because the printed code contains an error. Crowell Decl. ¶ 18.
26. The error in the printed FEAL-8 source code has been corrected on the diskette at issue and the source code on the diskette would function properly. Crowell Decl. ¶ 18.
27. Compared to the task of scanning printed text, using a ready-made, error-free diskette is much simpler. Crowell Decl. ¶ 19.
28. The software on the diskette enables users to incorporate encryption into their applications. Tab 6 to Lowell Declaration, March 9, 1994, CJ Request.
29. The diskette permits the direct use of source codes to encrypt data on a computer with minimum effort. Crowell Decl. ¶ 19.
Respectfully Submitted, FRANK W. HUNGER Assistant Attorney General ERIC H. HOLDER United States Attorney [signed] VINCENT M. GARVEY Deputy Branch Director [signed] ANTHONY J. COPPOLINO Trial Attorney U.S. Department of Justice Civil Division - Federal Programs Branch 901 E Street, N.W. - Room 1084 Washington, D.C. 20530 (202) 514-4782 Attorneys for the Defendants. Date: November 15, 1995.
Kenneth C. Bass, III
Thomas J. Cooper
Teresa Trissell
VENABLE, BAETJER, HOWARD & CIVILETTI, LLP
1201 New York Avenue, N.W. Suite 1000
Washington, D.C. 20005
ANTHONY J. COPPOLINO