Phil Karn’s Export Control Appeal on the Applied Cryptography Diskette December 5, 1994 (BY HAND DELIVERY) Mr. Thomas E. McNamara Assistant Secretary United States Department of State Bureau of Politico-Military Affairs Room 7325A Washington, DC 20520 Dear Mr. McNamara: We represent Mr. Philip R. Karn, Jr. of San Diego, California. This letter is an appeal pursuant to 22 C.F.R. 120.4(g) of the International Traffic in Arms Regulations (“the ITAR”) of the determination by Deputy Assistant Secretary Martha C. Harris with regard to Mr. Karn’s appeal of an adverse determination by the State Department’s Office of Defense Trade Controls (“ODTC”) in CJ case 081-94. The issue in this case, simply stated, is whether textual material in digital form on a floppy disk can legally be classified differently, for export control purposes, from the identical textual material in printed form in a published book. Under the State Department’s rulings, material on the floppy disk has been held to be a defense article, while the same material in a published book has been properly held to not be within the Department’s export control jurisdiction. The specific case arises from inconsistent Commodity Jurisdiction (“CJ”) determinations concerning cryptographic source code published in the book Applied Cryptography. This case presents a significant opportunity for the State Department to demonstrate genuine commitment to the Administration’s efforts to strengthen our economy in the information age through the Global Information Infrastructure program. If the decisions of Dr. Harris and the ODTC stand, this case illustrates a fundamental inability of our government to deal with computerized information in a rational manner. The Department of State’s Result in This Case Is Wrong and Insupportable on the Facts and the Law The ODTC and Deputy Assistant Secretary’s (“DAS”) decisions in this case are wrong and insupportable on the facts and applicable law. The decisions are based on distinctions between printed and computer media that are, quite frankly, specious, arbitrary and capricious. The DAS’ explicit rejection of the application of the First Amendment to computer information is both unprecedented and indefensible. ODTC and the DAS have exceeded their statutory and regulatory authority in this instance. The result is that the decisions thus far are not only irrational as a matter of policy, but are, in our view, vulnerable to judicial invalidation with serious consequences for the entire export control regime. We assume that the result set out in the DAS letter was based on various unstated policy goals of the State Department and other agencies, most significantly the National Security Agency. Whatever these goals, the indisputable facts should lead a fair-minded person to the conclusion that the article involved in this appeal -- the Applied Cryptography Source Code Disk (“the Diskette”) -- does not belong on the U.S. Munitions List (“USML”) and should be transferred to the Commerce Control List (“CCL”), just as jurisdiction over the book itself was transferred to the CCL. To conclude otherwise is to ignore the facts, the electronic age in which we live, and the First Amendment. The Information on the Diskette Is Identical to the Information in the Book ODTC and the DAS classified the Diskette as a defense article under Category XIII(b)(1) of the USML. The information on the Diskette is the same as the information printed in a published book (“the Book”). The Book is Applied Cryptography by Bruce Schneier; it was published by John Wiley & Sons, Inc. in 1994 and is now in its 3rd printing. It has ISBN 0-471-59756-2. The Book is available for sale in bookstores. The retail price of the book is $44.95 a copy. We understand that approximately 20,000 copies have been sold worldwide. We are advised that a substantial number of copies have been sold in the Far East. We bought a copy at Borders’ Bookstore at Tysons’ Corner, Virginia. In short, this is a published book like so many others that you and we have at our homes and offices. The floppy disk that is the subject of this appeal is an exact duplicate, in digitized form, of the cryptographic source code that is printed as Part Five (pages 456 to 570) of the Book. The History of the Case At this juncture, it is useful to review the history of this case. This part of our appeal will also set forth our disagreement with the basis of the prior determinations on the matter. Our comments will show that the initial adverse determination and the affirmation of that decision in response to Mr. Karn’s appeal were based on an irrational distinction, constitutionally flawed interpretations of the law and an erroneous view of the facts. These flaws are pervasive throughout both prior administrative decisions in this matter. Initially the ODTC considered whether the Book was subject to controls under the ITAR and in a letter to Mr. Karn, dated March 2, 1994, concluded that it was not. The letter from the Office stated that the Book was in “the public domain.” The Book was accordingly transferred to the CCL. That ruling expressly did not extend to the computer diskettes offered for sale on the last page of the Book. Following this ruling, on March 9, 1994, Mr. Karn submitted a second Commodity Jurisdiction Request (“CJR”) for the Diskette, which contained the text of the source code, and only the source code, which was set out in Part Five of the Book. As Mr. Karn stated in his submission: Character by character, the information [in the Diskette] is exactly the same [as in the Book]. The only difference is the medium: magnetic impulses on mylar rather than inked characters on paper. The Diskette is available from the author of the Book by mail-order for $15. In this connection, please note that the Diskette that is the subject of this appeal is not the two-diskette set advertised on the last page of the book. The two diskette set advertised in the Book contains data and information that is not on the Diskette that is the subject of this appeal. The Diskette at issue here contains only the identical information that is contained in Part Five of the Book. The Initial Response From ODTC ODTC responded to Mr. Karn’s second filing on May 12, 1994 (“the Response”). The Response stated that Mr. Karn’s request was “referred to the Departments of Commerce and Defense and the National Security Agency for their review and recommendations.” It went on to indicate that, in the opinion of the ODTC, the Diskette was subject to the licensing jurisdiction of the Department of State and the ITAR. The rationale for the conclusion was that the text files on the subject disk were not an exact representation of the contents of the Book. The Response continued: Each source code listing has been partitioned into its own file and has the capability of being easily compiled into an executable subroutine. The subject disk contains source code listings [for certain cryptographic algorithms] ... Also, the subject disk contains source code listings for certain algorithms that would not be exportable if they were incorporated into a product. The Response also indicated that the intended use of the Diskette, as stated in Mr. Karn’s communication was to provide code to persons who wished to “incorporate encryption into their “applications.” The response went on to say that: There are fourteen (14) separate source code files that amount to thousands of lines of easily executable code contained on the subject disk. This is certainly an added value to any end-user that wishes to incorporate encryption with a product. The two foregoing quotations constitute the entire rationale of the Response. This rationale, at best, begs the central issue in this matter, namely that the contents of the Diskette are in fact identical to the source code listings set out in the Book that is available at technical and non-technical book stores or by mail. In so doing, the Response ignores the First Amendment, as it should be applied to electronic and computer publications. Moreover, the Response erred on relying on the conclusion that the Diskette source code could be “easily compiled into an executable subroutine.” The source code in fact covers only the encryption algorithms and any executable application could be produced only by linking the Diskette source code with other source code, such as input/output routines, to produce an executable program. To the extent that the Response rested on a presumed “added value” because the Diskette contained information that could be “read” by a computer, while the Book contained information that could be read by a person, the ODTC relied on an irrelevant and arbitrary factor. It cannot be that the ITAR allows a book with a normal font to be transferred to the CCL, but precludes similar treatment of the same book on a microfiche which has “added value” to certain users. Unconstitutional Application of the Statute Our Constitutional argument begins with the proposition that the First Amendment applies to -- and protects -- the dissemination of information about cryptography. The Office of Legal Counsel of the Department of Justice (“OLC”) made precisely this determination in an opinion issued on May 11, 1978. J. Harmon, Asst. Atty. Gen., Memorandum to Dr. Frank Press, Science Advisor to the President. That opinion established four fundamental First Amendment principles that apply in this case: 1) The First Amendment applies to dissemination of information about cryptography which is developed without governmental involvement just as it applies to other categories of speech, in other words, cryptologic information -- unlike obscenity -- is not a less-protected category of speech; 2) The ITAR licensing scheme as applied to pure information such as the Book and the Diskette is a system of “prior restraint” that is tested under the most stringent of First Amendment standards; 3) The ITAR scheme is inherently vague and overbroad with respect to information such as that contained in the Book and the Diskette because there is insufficient clarity in what is and what is not covered, as is well illustrated by the decisions in this case to grant the requested CJ for the Book and deny one for the Diskette; and 4) In the absence of a system for prompt judicial review of a denial of a license, the ITAR scheme is facially unconstitutional. The 1978 OLC opinion was not some unique aberration in legal analysis. The principles of that opinion were re-affirmed by OLC on two subsequent occasions. See T. Olson, Asst. Atty. Gen., Memorandum for William B. Robinson, Office of Munitions Controls (July 1, 1981); L. Simms, Dep. Asst. Atty. Gen., Memorandum for Davis R. Robinson, Legal Adviser, Dept. of State (July 5, 1984). Thus the principles first stated by OLC in the Carter Administration have remained the views of OLC in both Democratic and Republican Administrations. To the best of our knowledge, those OLC opinions remain the latest and most authoritative legal opinions within the Executive Branch on the applicability of the First Amendment to the dissemination of cryptologic information. We contend that speech in digital form on a diskette is not legally different from speech in a printed book. The distinctions drawn by ODTC and the DAS in this case are analogous to a hypothetical decision by a government agency in the 1940s that the First Amendment had no application to television because it wasn’t speech. Whether the cryptographic information is communicated orally, in writing in a traditional book, or in electronic form on a diskette, CD-ROM or electronic bulletin board, it retains its status under the First Amendment as protected speech. The Response is a well-nigh classic example of the overbroad application of a statute (in this instance the Arms Export Control Act) by a government agency. As Justice Brennan wrote in NAACP v. Button, 317 U.S. (1963) 415, 431 The instant decree may be invalid if it prohibits privileged exercises of First Amendment rights whether or not the record discloses that the petitioner has engaged in privileged conduct. For in appraising a statute’s inhibitory effect on such rights, this Court has not hesitated to take into account possible applications of the statute in other factual contexts besides that at bar. Pervasive Availability of the Information on the Diskette Beyond its failure to appreciate applicable Constitutional doctrine, the Response ignores a more pragmatic difficulty. As noted, the contents of the Diskette and the Book are the same, and the Book has sold approximately 20,000 copies worldwide. The Diskette is available from the author of the Book. ODTC is, therefore, telling Mr. Karn that he cannot export, without an ITAR license, information that has already achieved pervasive public availability. Moreover, we understand that the entire contents of the Diskette are included in a two disk set of cryptographic source code described on the last page of the Book. As evidenced by the attached printout of information posted on a WorldWideWeb Internet server, binary copies of the source code for several of the algorithms published in Part Five of the Book are publicly available from anonymous file transfer protocol (FTP) sites outside the United States. In these circumstances, trying to prohibit the dissemination of the cryptographic algorithms in digital format on the Diskette, given the widespread availability of that information in text and digital format, reflects the pursuit of an irrational goal that bears no relationship to the real world. The ITAR defines the term “public domain” to mean: information which is published and which is generally accessible or available to the public: (1) Through sales at newsstands and bookstores; (2) Through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information: . . . . (4) At libraries open to the public or from which the public can obtain documents (emphasis added) The Book is available through sales at bookstores and is certainly available at some libraries, and, again, the Diskette is available through mail-order from the author of the book. ODTC was, therefore, clearly correct in concluding that the Book is within the ITAR’s public domain exception. It follows that the Diskette is also within that same exception since it consists of the same information as is found in the Book. The key operative part of the definition is the critical term: information. The regulation makes no distinction as to the format or media in which the information is disseminated, but properly focuses on whether it is information : which is published and which is generally accessible as available to the public While we recognize that the regulatory definition does not explicitly recognize the public availability of information through electronic media, we doubt that you would seriously argue that the only recognized or sanctioned forms of public availability were those used by printers in 1787 when the Constitution was adopted. More importantly, even if the State Department were to adhere to such a media-based distinction, we seriously doubt that a reviewing court would agree with such an arbitrary differentiation. The basis of the Response quoted above boils down to formatting differences between the Book and the Diskette. To be sure, a printed book has a different format than an “audio” or “talking book” contained on a disk. One can watch a performance of a play or read the same material in the play’s script. One can watch the performance of an opera or read the libretto. While there may be a difference in artistic impact, the information received in each instance is the same. The implications of the Response are unsettling particularly as the publishing industry moves from print to multi-media distribution. The novelist Tom Clancy has, in all likelihood, set out technical data, as the term is defined in the ITAR, in one or more of his books which focus on military and intelligence activities. Does the State Department contend that the export of a CD-ROM version of Red Storm Rising or The Hunt For Red October would require an ITAR license? In Mr. Karn’s case, there is no difference in the informative impact between the Diskette and the Book. Whatever formatting differences are present are irrelevant. ODTC’s distinction in the Response is a make-weight which does not even accomplish the function of providing a substantive rationale for the decision. Moreover, the Response ignores the wide-spread availability of optical scanners and computer keyboards, both of which could easily render the Book every bit as systems-ready and systems-friendly as the Diskette. The Appeal to The DAS Mr. Karn filed an appeal (“the Appeal”) from the Response on June 7, 1994. The Appeal made a number of arguments, which are helpful in a review of this matter. The Appeal noted that the information on the Diskette and in the Book were the same; that the information in the Diskette qualified for the ITAR’s public domain exception; and that the First Amendment protected expression regardless of the medium of expression. In addition to the written appeal, we met on June 30, 1994 with Dr. Harris, her staff and a representative of another federal agency to explain our arguments and to visually demonstrate that the information on the Diskette is identical to that in Part Five of the Book. Dr. Harris provided a response to the Appeal (“the Second Response”) on October 7, 1994. The Second Response did not squarely address Mr. Karn’s clearly presented arguments or the discussion we had with Dr. Harris in our June meeting. It simply concluded that the Diskette was a defense article, notwithstanding the fact that the information on the Diskette is the same as the information in the Book. Quite frankly this result is untenable. No logical rationale based on the ITAR is provided for the Second Response, which, with respect, is a paradigm of an “arbitrary and capricious” governmental decision. The Second Response failed to give any meaningful attention to the First Amendment, passing that issue off with the terse comment that “continued control over the export [of the Diskette] is consistent with the protections of the First Amendment.” This is simply not so. Rather, the DAS’ position is jarringly at odds with the First Amendment. To brush this issue aside with a conclusory statement totally lacking in legal analysis reflects a surprising insensitivity to the importance of the Constitutional rights that are involved in this case. Constitutional Difficulties With the ODTC/DAS Position This document is not a legal brief. However some comments are in order on the Constitutional position of ODTC and the DAS in this matter. Simply put, the position is indefensible. A sampler of the most glaring Constitutional infirmities in the position follows. We noted earlier in this paper that OLC relied in part on the overbreadth issue. DAS’ position in this matter would also not withstand scrutiny under the overbreadth doctrine’s cousin, the void for vagueness doctrine. The “cryptographic exception,” which is so often cited by ODTC with respect to this sort of issue is an example of a regulation that would not withstand scrutiny under the doctrine. The ITAR is so murky in this area so that it may well have a chilling effect that will deter persons from engaging in Constitutionally protected speech. Moreover, inasmuch as the cryptographic exception is the basis or part of the basis of ODTC’s position in this area, it infringes on Mr. Karn’s right to equal protection of the law and is, therefore, in violation of the First and Fifth Amendment to the Constitution. More specifically, the result of the Second Response is that Mr. Karn’s speech about a particular subject, i.e., cryptography is not given the same protection as other speech in which he engages. At the very least, Mr. Karn’s desired activity, i.e. the export of the partial contents of a published book is symbolic speech, a clearly expressive act with a high communicative content. Such speech has been recognized by the Supreme Court for decades. See Stromberg v. Carlson, 283 US 359 (1931). We also note that comment in the Second Response that OTC has made a determination “that the source code on the disk . . . is of such a strategic value as to warrant continued State Department listing.” National security interests do not automatically supersede the First Amendment. In a recent opinion, Judge Green wrote that it is recognized “that the government has an interest in protecting the National Security, and, at times, that security interest may be grave. However, the issue in this instant case is not whether the government has such an interest but whether that interest is so all-encompassing that it requires ... [a denial of] virtually every fundamental feature of due process.” See Rafedie v. Immigration and Naturalization Service, 795 F. Supp 13, 19 (D.D.C. 1992). In The City of Houston v. Hill, Justice Brennan wrote that “speech is often provocative and challenging ... [but it] is nevertheless protected against censorship or punishment, unless shown likely to produce a clear and present danger of a serious substantive of evil that rises far above public and convenience, annoyance or unrest.” 482 U.S. 451, 461, (1987). The Supreme Court also addressed this issue in the “Pentagon Papers” case: Thus, only governmental allegation and proof that publication must inevitably, directly and immediately cause the occurrence of an event kindred to the safety of a transport already at sea can support even the issuance of an interim restraining order. New York Times v. United States, 403 U.S. 713, 726-272 (Stewart, J. concurring). The crux of the ODTC/DAS position appears to be that the information on one medium--the Book -- may be exported while the identical information on another -- mylar -- may not. This is no position at all. It is particularly ironic that representatives of an Administration, which is publicly so supportive of the coming Information Super Highway, could take a policy position that is so at odds with its implementation and reality. In considering our Constitutional arguments, it is important to recognize that the applicability of First Amendment protections to communications of cryptography information is not merely an argument crafted by Mr. Karn’s counsel, but is the legal position already taken the OLC. Opinions of that office, within the Executive Branch, have the authority of binding rulings. If there are any unpublished OLC opinions which support the DAS’ position, we are not aware of them. Accordingly we submit that the DAS conclusion is not only wrong, it is inconsistent with standing Executive Branch legal authority. For the reasons stated, the Diskette should be held to not be a defense article, not covered by the Munitions List and not subject to any controls under the ITAR. If you believe a meeting might assist in a rapid resolution of this appeal, please let us know. Based on our prior personal experience as attorneys in the Executive Branch, our understandings of the role of the National Security Agency in these matters, and the disposition of Mr. Karn’s prior appeals, we are -- quite frankly -- pessimistic about the outcome of this appeal. We are taking this step only because our request that the State Department agree to waive any arguments based on “failure to exhaust administrative remedies” prior to our seeking judicial relief was rejected. We are here before you on appeal primarily because we may be required to appeal to you before going to court. We hope that our pessimism proves unfounded, but the decisions in this case to date do not justify any expectation that a favorable decision is, as a practical matter, available within the Executive Branch. Sincerely, _/s/_____________________ Kenneth C. Bass, III _/s/_____________________ Thomas J. Cooper Disclaimer: The materials on this Website have been prepared for informational purposes only and are not legal advice. You should not act on the basis of these materials. They are not a substitute for obtaining legal advice from your own lawyer. Browsing this Website or contacting us through it does not create an attorney-client relationship. If you contact us through this Website, please do not send us any confidential information.