[No date]
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF OHIO
EASTERN DIVISION
PETER D. JUNGER, ) CASE NO. 96 CV 1723
) Plaintiff ) ) JUDGE DONALD C. NUGENT v. ) ) ) PLAINTIFF'S PROPOSED
MADELEINE K. ALBRIGHT, et al. ) MEMORANDUM OF OPINION
) ) Defendants. ) Nugent, J. INTRODUCTION This action is brought by a law professor under the First Amendment challenging United States export laws that he claims infringe upon his rights to speak and publish encryption software and other encryption information. Recognizing that encryption software is protected by the First Amendment, the court finds merit in the plaintiff's claims. I. Procedural Background The plaintiff originally brought this action challenging the export controls on encryption under the International Traffic in - 1 -
Arms Regulations (ITAR), 22 C.F.R. §§ 120 et seq. On November 15, 1996, the President issued an executive order and memorandum transferring control of most encryption from the Department of State under the ITAR to the Department of Commerce under the Export Administration Regulations (EAR), 15 C.F.R. Parts 730-774. Executive Order No. 13026, dated November 15, 1996. With the Executive Order, the President issued draft regulations under the EAR. On December 30, 1996, the new encryption regulations became effective. 61 Fed. Reg. 68572-87 (December 30, 1996).1 On the same date, the ITAR was amended to exclude encryption (cryptographic)2 software and related information that was not specifically designed for military applications. 61 Fed. Reg. 68633. The transfer of jurisdiction to the Commerce Department concerned encryption commodities, software and technology (collectively, encryption items (EIs). The Executive Order, however, explicitly leaves open the possibility that encryption controls might some day be returned to the ITAR, "upon enactment of any legislation reauthorizing the administration of export controls." Executive Order No. 13026, ¶ 8. ______________________ 1 In March 1996, the EAR was restructured and some of its sections have been renumbered. The EAR in effect at this time has not yet been published in the Code of Federal Regulations, but can be found in 61 Fed. Reg. 12937-13041 (March 25, 1996). The amendments of December 30, 1996, are found at 61 Fed. Reg 685762-68587 (December 30, 1996). 2 Under the ITAR, software "with the capability of maintaining secrecy or confidentiality of information" referred to "cryptographic software." See 22 C.F.R. § 121.1 (Category XIII(b)(l)). Under the EAR, "encryption" is used in place of "cryptographic." Note, however that the definition of the term "encryption software" under the EAR is narrower than the definition of 'cryptographic software" under the ITAR. Compare 15 C.F.R. Part 772, 61 Fed. Reg. 68585 (definition of "encryption software") with 22 C.F.R. §§ 121.1 (Category XIII(b)(l)) and 121.8(f) (definition of "cryptographic software"). Unlike the definition of "software" in the ITAR, software under the EAR does not include algorithms, flow charts and logic design. - 2 -
II. STATUTORY AND REGULATORY BACKGROUND A. Statutory Authority The EAR was originally promulgated under the Export Administration Act of 1979 (EAA), 50 U.S.C. App. § 2401 et seq. The EAA, however, was not intended to be permanent legislation and lapsed on August 20, 1994. Since then, the President has authorized the continuation of the EAR and the recent amendments by executive orders under the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. §§ 1701-06. See 15 C.F.R. § 730.2, reprinted in 61 Fed. Reg. 12735 (March 25, 1996). The President has relied on his authority under the IEEPA and his inherent foreign affairs powers to transfer control of non-military encryption from the ITAR to the EAR. B. The Structure of the EAR The EAR is structured around the Commerce Control List (CCL). See 15. C.F.R. Part 774, 61 Fed. Reg. 12937-13041. Under the EAR, all commodities, software and information on the CCL are classified according to "Export Control Classification Numbers" (ECCNs). The Commerce Department's Bureau of Export Administration (BXA) is primarily responsible for the administration of the EAR. A license from the BXA is generally required before exporting an item listed on the CCL. The decision to grant or deny a license depends, to an extent, on the item's ECCN. Under the amended EAR, encryption items (EIs) are controlled - 3 -
under ECCNs 5A002, 5D002 and 5E002. Encryption hardware is controlled under ECCN 5A002, while encryption software and encryption technology are controlled ECCN 5D002 and 5E002, respectively. See 61 Fed. Reg. 68586-87. Encryption software under ECCN 5D002 is defined as "[c]omputer programs3 that provide capability of encryption functions or confidentiality of information or information systems. Such software includes source code, object code, applications software, or system software." 15 C.F.R. Part 772, 61 Fed. Reg. 68585. Encryption object code is defined as "[c]omputer programs containing an encryption source code that has been compiled into a form of code that can be directly executed by a computer to perform an encryption function." Id. Encryption source code is defined as " [a] precise set of operating instructions to a computer that, when compiled, allows for the execution of an encryption function on a computer. Id. Although encryption hardware is not at issue in this case, encryption software under ECCN 5D002 is treated in the same manner as encryption hardware for licensing purposes. 15 C.F.R. § 774, 61 Fed. Reg. 68587. The Administrations's justification for treating encryption software in the same manner as hardware is that encryption source code "can easily and mechanically be transformed into object code . . .." Executive Order No. 13026, dated November 15, 1996. In other words, encryption software is controlled for its "functional capacity" rather than any information it may convey. As _____________________ 3 Computer Programs are defined in the general definition section of EAR as "[a] sequence of instructions to carry out a process in, or convertible into, a form executable by an electronic computer." 15 C.F.R. Part 772, 61 Fed. Reg. 12933. - 4 -
a result, encryption software (ECCN 5D002) is treated differently than other software controlled under the EAR. Encryption technology under ECCN 5E002 refers to technology related to encryption equipment under ECCN 5A002 and encryption software under ECCN 5D002. 15 C.F.R. § 774, 61 Fed. Reg. 68587. Technology includes "technical assistance" and "technical data," 15 C.F.R. Part 772, 61 Fed. Reg. 12936, but unlike the ITAR, does not include software. See letter from Department of Commerce to Plaintiff's counsel, January 29, 1997, at 2 n.3. The phrase "subject to the EAR" is specifically defined in Section 772 of the EAR and describes those items over which the BXA has jurisdiction. EAR 15 C.F.R. § 734.2, 61 Fed. Reg. 12746-47. If an item is "not subject to the EAR, " the provisions of the EAR do not apply. Id. Before the December 30, 1996, amendments, publicly available technology and software were not subject to the EAR. 15 C.F.R. §§ 734.3(a) and (b)(3), 61 Fed. Reg. 12747-48. Technology and software were considered "publicly available" if "generally accessible to the interested public in any form," 15 C.F.R. § 734.7, 61 Fed. Reg. 12749 (emphasis added), or disclosed in courses at academic institutions. 15 C.F.R. § 734.9, 61 Fed. Reg. 127450. The amendments removed the public availability exception for encryption software controlled under ECCN 5D002, except in printed form. 15 C.F.R. § 734.3(b)(3), 61 Fed. Reg 68578. In other words, encryption source code is not subject to the EAR when printed in a book, but is subject to the EAR when reproduced in electronic form. The amendments § 734.3 also removed encryption software from the academic exception. See EAR § 734.9, Supp. No. 1 to Part 734, 61 Fed. Reg. 68579. The net effect is that encryption software - 5 -
controlled under ECCN 5D002 is always subject to the EAR. C. Definitions of Export The export of encryption items can occur in various ways, depending the item's ECCN. The export of encryption software (ECCN 5D002) and technology (ECCN 5E002) generally "means an actual shipment or transmission . . .out of the United States, or release . .to a foreign national in the United States." 15 C.F.R. § 734. (b), 61 Fed. Reg. 68578. The export of encryption source code and object code, however, also includes "downloading, or causing the downloading of, such software to locations (including electronic bulletin boards, Intern- et file transfer protocol, and World Wide Web sites) outside the U.S. . . .unless the person making the software available takes precautions adequate to prevent unauthorized transfer . . .outside the United States . . ."4 15 C.F.R. § 734.2 (b)(9)(ii), 61 Fed. Reg. 68578. Thus, posting encryption source code or object code on the internet where it could be downloaded by computers located overseas counts as an export unless foreign access is restricted. D. Licensing Requirements and Procedures A license is required before the export of any encryption software (ECCN 5D002) and technology (ECCN 5E002) subject to the ____________________ 4 This definition of export allows professors and teachers to disclose encryption software to foreign students in the classroom (but not on the internet). See letter from Department of Commerce to Plaintiff's counsel, January 29, 1997. - 6 -
EAR, for all export destinations except Canada. 15 C.F.R 742.15(b), 61 Fed. Reg. 68580. A license is also required for providing technical assistance to a foreign person if the requisite intent is present, i.e., "with the intent to aid a foreign person in the development or manufacture outside the United States of commodities and software that, if of United States origin, would be controlled for "EI" reasons under ECCN 5A002 or 5D002.N 15 C.F.R § 744.9, 61 Fed. Reg. 68584-85. A license is not required, however, if the requisite intent is missing as in the "mere teaching or discussion of information about cryptography, including, for example, in an academic setting . . .even where foreign persons are present."5 Id. Certain items that are available abroad may be exempted from the EAR licensing requirements following a determination by the Secretary of Commerce. See 15 C.F.R. § 768, 61 Fed. Reg. 12915-20. After the December 30, 1996, amendments, however, the foreign availability exception does not apply to encryption items controlled for EI reasons. 15 C.F.R. § 768.1, 61 Fed. Reg. 68585.6 Thus, encryption programs that are widely available overseas are still subject to the EAR, and therefore still require a license if "exported." See Pl's Video Exhibit. License applications for encryption items are reviewed by the ____________________ 5 This section, together with the section defining the export of encryption software, allows academics to teach cryptography and disclose encryption software to foreign students as long as the [omission] 6 The BXA may consider the foreign availability of an encryption item independent of EAR § 768 in its decision to grant or deny a license. EAR § 768.3. - 7 -
BXA and other agencies, including the Department of Justice.7 See 15 C.F.R. § 750.3, 61 Fed. Reg. 12830 and 61 Fed. Reg. 68585. In general, licensing decisions on "EI" items are made on a "case-by- case basis," taking into account national security and foreign policy concerns. 15 C.F.R. § 742.15(b)(4)(ii), 61 Fed. Reg. 68582; see also Letter from Commerce Department to Plaintiff's counsel, January 29, 1997, at 2. Licensing procedures for certain mass market encryption software and "key recovery"8 encryption items, however, are treated less restrictively. See 15 C.F.R. § 742.15(b)(1)-(3), 61 Fed. Reg. 68581-82. A person may seek a classification opinion from the BXA, requesting the proper ECCN number or to inquire whether a given item is subject to the EAR. One may also seek an advisory opinion requesting an interpretation of specific EAR provisions or whether a license would be required.9 See 15 C.F.R. § 750.1, 61 Fed. Reg. 12829. Requests for classification opinions are to be answered within 14 days from their receipt, and requests for advisory opinions within 30 days of receipt. 15 C.F.R. § 750.2, 61 Fed. Reg. 12830. In general, all license applications are to be resolved by _____________________ 7 Persons who export items subject to the EAR, including EI items, must keep and retain substantial records pertaining to the export, including Export control documents, memoranda, notes, correspondence, contracts, invitations to bid, books of account, financial record. See generally § 762. These records must be kept for at least five years from the date of export. Id. 8 "Key recovery" refers to the ability of the government to decrypt encoded messages under proper authority. 9 The request for clarification by plaintiff's counsel would apparently be more like a request for an advisory opinion. See letter from Plaintiff's counsel to Commerce Department, January 2, 1997. - 8 -
Commerce Department, or referred to the President, within 90 days of the date on which the BXA registers the application. 15 C.F.R. § 750.4, 61 Fed. Reg. 12830, 61 Fed. Reg. 68585. Determinations with respect to certain mass market and key recovery encryption software may be made in as little as seven or fourteen days. See 15 C.F.R. § 742.15 (b)(1), 61 Fed. Reg. 68581 . If a license is denied (or if the BXA takes any adverse action), an appeal can be taken to the Under Secretary of Commerce. EAR § 756.1, 61 Fed. Reg. 12851. There is, however, no specified period within which such an appeal must be decided. The regulations state only that the "Under Secretary shall decide an appeal within a reasonable time after receipt of the appeal." 15 C.F.R. § 756.2(c) (1). During the pendency of an appeal, any adverse administrative action taken by the BXA remains in effect, unless the Secretary of Commerce specifically grants a stay.10 15 C.F.R. § 756.2 (c)(2). E. Penalties Violations of the EAR carry severe criminal and criminal penalties. See generally 15 C.F.R. § 764.3, 61 Fed. Reg. 12903. Civil penalties can reach $10,000 for each violation, with a maximum civil penalty of $100,000. Criminal penalties for individuals range from $50,000 and up to five years in prison (for knowing violations) ______________________ l0 The scope of judicial review under the amended EAR is unclear. In his Executive Order of November 15, 1996, the President determined that "the foreign availability of [transferred] encryption products cannot be made subject to public disclosure or judicial review without revealing or implicating classified information that could harm United States national security and foreign policy interests." Executive Order Number 13026 § 1. (See section on prior restraints in this opinion, infra) - 9 -
to at least $250,000 and up to ten years in prison (for willful violations). III. FINDINGS OF FACT A. The Parties and Facts Specific to Professor Junger 1. The individual defendants are members of the executive branch and are sued in their official capacities as officers or employees of the United States acting under color of law. The individual defendants and their respective agencies (also referred to as "the government") are responsible for the administration and review of the EAR provisions at issue. 2. The government has asserted that the inclusion of encryption (cryptographic) software on the United States Munitions List (USML) was "to assure that [encryption software does] not fall into dangerous hands abroad, or otherwise be deployed against the interests of the United States and its allies . . .[and] to protect the United States's ability to gather foreign intelligence on military, national security, and foreign policy matters."11 In the Executive Order transferring control on non-military encryption to the Commerce Department, the President reiterated the Administration's position: "I have determined that the export of encryption products described in this section could harm national security and foreign policy interests even where comparable products _____________________ 11 Declaration of William J. Lowell, Director of Office of Defense Trade Controls (ODTC), ¶ 4. - 10 -
are or appear to be available from sources outside the United States."12 3. Encryption software controlled under ECCN 5D002 is publicly available on the Internet and can be downloaded from foreign sites. 4. All encryption software controlled under ECCN 5D002, other than software excluded in the Note to EAR Part 774, Supp. No. 1, Category 5, 5D002, 61 Fed. Reg. 68587, and source code appearing in printed books and other printed material as stated in the Note to paragraphs (b)(2) and (b)(3) of EAR § 734.3, 61 Fed. Reg. 68578, is subject to licensing under the EAR. Licenses are required for all exports of encryption software controlled under ECCN 5D002, except to Canada. EAR § 742.15(b). 5. The plaintiff, Peter D. Junger, is a citizen of the United States and a full professor of law at the Case Western Reserve University Law School ("CWRU") in Cleveland, Ohio. 6. Professor Junger regularly teaches a course on "Computers and the Law" at CWRU. He offered the course this past semester. The dispute between the parties has its origins in a short, encryption program (a "one-time pad" (OTP)) written by Professor Junger in May 1993. Professor Junger wrote the program to demonstrate facts about computers to students in his computers and law class.13 _____________________ 12 Executive Order No. 13026, § 1, November 15, 1996. 13 See Plaintiff's Second Declaration for a detailed explanation of why he uses the OTP program in his course. - 11 -
7. A one-time pad utilizes a nonrepeating set of random key characters. Each key character is used once to encrypt exactly one character of the original (readable) message.14 In an OTP encryption system, the sender and receiver use the same key to encrypt and decrypt the message. "OTP systems, including those implemented on a computer, by definition, have he capability of maintaining the secrecy of information. Based on the limited information available [about Professor Junger's program - a one time pad, 170 bytes in length], NSA's assessment was that this type of encryption technology . . .subject to the export licensing jurisdiction of the State Department."15 Thus, one-time pads (not designed for military applications) were covered under Category XIII(b)(1) of the United States Munitions List under the ITAR16 and have since been transferred to the licensing jurisdiction of the Commerce Department and controlled as encryption software under ECCN 5D002 of the Commodity Control List. 8. "One-time pads using the XOR function [the function used by Professor Junger's program] are well known, even to undergraduate computer science students."17 _____________________ 14 In Professor Junger's OTP program, the encryption function is performed by the XOR function on "bytes" (a string of a combination of eight 0's and 1's). See Pl.'s Second Decl. ¶ 12. 15 Declaration of William P. Crowell, Deputy Director of the NSA, ¶ 14. 16 Id. 17 Declaration of Paul Leyland, Unix System manager at Oxford University, England. Mr. Leyland has exchanged email with Professor Junger. Professor Junger has alleged, supported by his declarations - 12 -
9. The EAR, as amended, allows the teaching of cryptography, including the disclosure of encryption software to foreign students in the classroom.13 10. Professor Junger has not sent his program and other encryption software to foreign colleagues outside of the United States. 11. He has censored the article in order to place it on his web site. He has posted an article, Understanding Law and Computers, in which he has removed the source code for his encryption program, on his World Wide Web (Web) site. He has also not posted his OTP program or the instructions for creating an executable version of his encryption program on his Web site. 12. Professor Junger has not set up "links" on his Web pages that connect directly to sites, within and without the United States, where the Pretty Good Privacy (PGP) encryption program and other encryption programs can be downloaded. 13. Professor Junger has declared that but for U.S. export regulations he would have engaged in the activities listed above. _____________________ and the declaration of Mr. Leyland, that he was not able to send Mr. Leyland a copy of the program Professor Junger wrote or the program Mr. Leyland himself wrote. Mr. Leyland, therefore, has not seen Professor Junger's program and can only comment on what he knows about it. 18 This is apparent from the language of EAR §§ 734.2(b)(9) (definition of "export") and § 744.9 (technical assistance intent exception), and confirmed by the Department of Commerce in response to a letter from Plaintiff's counsel requesting confirmation. - 13 -
14. None of the encryption software or encryption information that Professor Junger wants to disclose is classified for security reasons by the United States government. All of the encryption software that he wants to disclose other than his encryption program is, or will be, publicly available. B. Computer Software and Academic Expression19 15. Writing a computer program is a process of communicating ideas to other human beings as much as it is a process which may make a machine function. Programmers have, for example, written and published computer source code that has almost no practical use, except the instruction of a human reader. 16. Although computer languages are used as instructions for a computer, they are also used, in a fundamental and essential way, for communication between people. For example, teachers regularly evaluate student programs for their readability (by people). This is analogous to the way that writing teachers evaluate student essays ____________________ 19 The facts in this section and the following two sections are uncontroverted by the government. They are supported by the Plaintiff's declarations, the Plaintiff's video exhibit, and declarations (most previously submitted in Bernstein v. Department of State, 944 F.Supp. 1279, 1996 U.S. LEXIS 18974 (N.D. Cal. 1996)) from, among others, the following individuals: Harold Abelson, Professor of Computer Science at the Massachusetts Institute of Technology; Carl Ellison, a computer scientist involved in the development of the modern Internet; Matt Blaze, a principal research scientists at AT&T Laboratories and an Adjunct Professor of Computer Science at Columbia University; Bruce Schneier, author of APPLIED CRYPTOGRAPHY; Phillip Zimmermann, creator of Pretty Good Privacy (PGP); Paul Ginsparg, staff physicist at Los Alamos National Laboratory and a former professor of physics at Harvard University. - 14 -
on the style and quality of their writing, not just on the meanings of the words they use . 17. The criteria used in evaluating "programming style" are often unrelated to the sequence of operations that would be carried out by a computer executing the program. Two programs might evoke exactly the same process when executed by a computer, and yet be judged very differently because they express the process in different ways. 18. There is no functional difference of any significance between source code listings in the form of printed text and the same listings in the form of a text file on computer-readable media. In neither case can the source code be used, buy itself, to cause a computer to execute an operating program. Source code must always be complied by a computer program before it can be used as a functioning program. 19. Computer programmers share information to expand their knowledge and to advance their field as do scientists in many other disciplines. This intellectual exchange is especially important in the field of cryptography (defined below), where the theories of the discipline are in a nascent stage, and must be subjected to constant and intense criticism if the field is to advance. Researchers in the field of cryptography frequently and naturally express their ideas in computer programming language, and collaborate through communications so written. - 15 -
C. Cryptography 20. Cryptography - or the study of encryption - is the science of scrambling a message (i.e., information) in such a manner that only its intended recipient can interpret it, even if the message were intercepted by an unauthorized person. 21. Encryption is based on two elements: an algorithm and a key. An algorithm in cryptography is a mathematical transformation. It transforms plaintext (the initial message) into ciphertext (the unreadable gibberish), and it transforms ciphertext back into plaintext. The key is specific information necessary to encrypt and decrypt a message. For computer-based encryption a key is a string of ones and zeros (called a "bit string") - usually representing a number in binary form, an ASCII value, or a word or phrase in a natural language such as English - that is used in conjunction with an algorithm. A key's strength varies exponentially with its length: a 56 digit key has 256 possibilities while a 64 digit key of the same type has 264 possibilities. In general, the security of an encryption program is related to its algorithm and the length of the key. 22. An algorithm is considered strong if it cannot be broken with available (current or future) resources. Exactly what constitutes "available resources" is open to interpretation. 23. Modern cryptography is mathematical science. Its practitioners often have doctoral degrees in either mathematics or theoretical - 16 -
computer science. Cryptographers rely on peer review to publish and disseminate algorithms vital to the science of cryptography. All sciences require the constant sharing, evaluating, and criticizing of new ideas, but cryptography has by its very nature an adversarial component. Cryptographic algorithms must be evaluated over the course of years and in public settings by other cryptographers to ensure their validity. 24. Encryption algorithms can be described in English, in flow charts and in computer programming languages. For example, the IDEA algorithm. which is widely known among cryptographers, is described in all three ways in Bruce Schneier's book Applied Cryptography (ed. John Wiley and Sons, 1994). The description in English of the IDEA algorithm and the C programming code describe convey the same information, though one is easier to read, and the other is easier to embed in a computer program. 25. Any competent programmer can translate one form of the IDEA algorithm into the other without any special cryptographic skills. The C programming code for the IDEA algorithm, moreover, is also freely available on the Internet at archive sites in the United Kingdom, Finland, Germany, New Zealand, and Italy where Internet users from all over the world can download the C language source code. 26. Despite the important role that the military played in the development of modern cryptography, especially during the Second World War, cryptography is not the sole purview of the world's - 17 -
military and diplomatic institutions. Encryption has predominant civil applications. By far, most of the cryptography used in the world is not protecting military secrets; it's in applications such as bank cards, pay-TV, road tolls, office building and computer access tokens, lottery terminals, and prepayment electricity meters. On the Internet, cryptography is used to facilitate personal privacy, electronic commerce, and contractual exchanges. 27. Human rights organizations use encryption programs, such as PGP, to protect their people overseas. Amnesty International uses PGP as does the human rights group in the American Association for the Advancement of Science. It has been used to protect witnesses who have reported human rights abuses in the Balkans, Burma, Guatemala, and Tibet. Without the use of encryption, human rights organizations might be substantially limited in their use of the internet and may not be able to communicate freely over the internet. As a result, without encryption, some speech, pure political speech, would not occur over the internet. D. The Internet and Related Media20 28. As the Internet has developed, it has become an important vehicle for technical communication between programmers, engineers, and mathematicians. The internet has become a global forum where all kinds of communication and exchanges of information take place. _____________________ 20 For a comprehensive explanation of the Internet, its function, and its many parts, see ACLU v. Reno, 929 F.Supp. 824 (E.D. Pa. 1996). - 18 -
People, companies, organizations and governments use the internet to publish and exchange scientific, commercial, artistic and political speech. 29. The Internet consists of many means of electronic expression, some more akin to teletype communication, others far more similar to publishing. One portion of the Internet contains what are commonly called "newsgroups," which allow "subscribers" (there is not typically a fee for such access, so the term is loosely used) to follow, debate, or browse through the topic or topics of their choice. 30. Internet newsgroups supplement and in some cases replace print publications such as the Communications of the Association for Computing Machinery (CACM), the premier publication for the development of computers and computer programming, as places where new ideas are announced, criticized, developed and discussed. This publication includes and requires the inclusion of computer code, just as it does in print publications. 31. For computer scientists, physicists, mathematicians, economists, or anyone whose ideas include or involve computer programming, publication of their ideas includes publication of the computer code. 32. One Internet site allowing scientists to communicate and exchange ideas is the Los Alamos E-Print Archives. The E-Print Archives are located at the Internet address, http://xxx.lanl.gov. - 19 -
Allowing researchers [o transfer unedited copies of their research papers, the archives contain research papers from more than ten physical sciences and mathematical disciplines. With over 70,000 electronic transactions per day, the archives are an example of the significance of the electronic means of communication. 33. Another part of the Internet, the World Wide Web (the Web) was created by the scientists at CERN in Switzerland for the purpose, among others, of communicating scientific papers, including computer code, to fellow scientists as rapidly as possible. The Web has become "an increasingly common method of domestic distribution of software, including popular commercial Web Browsers with encryption capabilities."21 34. Internet publication of ideas is in many ways superior to paper publication, in that both the transfer of ideas and feedback and criticism are more immediate and direct. 35. Scientists are increasingly using the Internet to publish new ideas and scientific findings. The Internet allows scientists scattered across the world to share, evaluate, and discuss their ideas more quickly, including those ideas expressed or contained in computer code. The electronic medium fostered by the Internet facilitates a more generalized format for distribution of research results, including raw data and in some cases all necessary tools to repeat theoretical or experimental analysis of it. _____________________ 21 Declaration of William J. Lowell, Director of Office of Defense Trade Controls (ODTC) ¶ 25. - 20 -
37. The precautions required under EAR § 734.(2)(9)(b) to restrict the downloading of encryption source code and object code to foreign sites are not effective. The nature of the software distribution mechanisms on the Internet make it burdensome (or impossible) for many Internet users to comply with the requirements of § 734.2(9)(b). In particular, it is not possible to determine reliably the geographical location from which a request originated. Furthermore, the file transfer protocol ("ftp") provides no mechanism for providing notices and obtaining the acknowledgements required under the EAR. Many internet users, especially those who rely on third party service providers to run their file distribution systems, are limited to the standard versions of the software and therefore cannot comply with these regulations. IV. CONCLUSIONS OF LAW Professor Junger contends that the EAR places a constitutionally impermissible burden on his desire to publish academic and other materials electronically, on the Internet and otherwise. For the reasons stated herein, the court finds merit in this contention. A. Standing and Ripeness A plaintiff's standing to invoke federal court jurisdiction is a threshold issue. Standard involves the interplay both of requirements imposed by Article III of the Constitution and of - 21 -
prudential concerns, such as ripeness and mootness, which might otherwise limit this court's jurisdiction. Valley Forge Christian College v. Americans United for Separation of Church and State, 454 U.S. 464, 471 (1982). The court addresses each of these concerns in turn. 1. Standing Under Article III Article III of the Constitution limits the federal courts to adjudication of actual "cases" and "controversies." The existence of a "case" or "controversy" depends on whether a plaintiff has "such a personal stake in the outcome of the controversy" as to warrant federal court jurisdiction. Warth v. Seldin, 422 U.S. 490, 498-99 (1975) (quoting Baker v. Carr, 369 U.S. 186, 204 (1962)). Therefore, a plaintiff must first allege more than "generalized grievances" shared by all citizens. See, e.q., Schlesinger v. Reservists Committee to Stop the War, 418 U.S. 208 (1974). In order to present a case or controversy under Article III, a plaintiff must allege (i) an "injury in fact" to a legally protected interest that is "concrete and particularized," and "actual or imminent," (ii) "fairly traceable to the defendant's allegedly unlawful conduct" and (iii) "likely to be redressed by the requested relief." Allen v. Wriqht, 468 U.S. 737, 751 (1984). These three requirements lay out the constitutional minimum necessary to establish standing under Article III.22 _____________________ 22 In this action, the second and third requirements, causation and redressibility, are not at issue. To the extent that the plaintiff can satisfy the injury requirement, the other two requirements are met. - 22 -
The existence of Article III injury "often turns on the nature and source of the claim asserted." Seldin, 422 U.S. at 500. When First Amendment interests are at risk, standing requirements are more liberally construed: "In the context of threats to the rights of free expression, courts justifiably lessen standing requirements." Briggs v. Ohio Elections Comm'n, 61 F.3d 487, 492 (6th Cir. 1995) (quoting American Booksellers Ass'n v. Virginia 792 F.2d 1261, 1264 n.4 (4th Cir. 1986). In the context of a challenge to a licensing scheme, it is well-established that a plaintiff has standing to present a facial challenge if he is subject to the law and the law has "a close enough nexus to expression, or to conduct commonly associated with expression, to pose a real and substantial threat of the identified censorship risks." City of Lakewood v. Plain Dealer Publishing Co., 486 U.S. 750, 759 (1988). As the Court in Lakewood observed: Our cases have long held that when a licensing statute allegedly vests unbridled discretion in a government official over whether to permit or deny expressive activity, one who is subject to the law may challenge it facially without the necessity of first applying for, and being denied, a license. Lakewood, 486 U.S. at 755-56. (emphasis added). In Lakewood, the Plain Dealer was allowed to challenge a city ordinance regulating the placement of newsracks on public property without having applied for a license. Id. at 754. Likewise, in Chesapeake B&M v. Harford County, 58 F.3d 1005 (4th Cir. 1995) (en banc), cert. denied, 133 L.Ed. 2d 492 (1995), an adult bookstore, which did not apply for a license, was allowed to raise a facial challenge to a local ordinance licensing adult bookstores. In - 23 -
Distribution Systems of America, Inc. v. Village of Old Westbury, 785 F. Supp. 347 (E.D.N.Y. 1992), a local newspaper was permitted to challenge a permit ordinance even though the newspaper did not apply for a license. Facial challenges to licensing schemes implicating the First Amendment are permitted to avoid the risks associated with censorship and, in particular, self censorship. Lakewood, 486 U.S. at 757. As this Circuit has held, the "prior restraint [itself] constitutes a concrete and particularized actual injury in fact." G & V Lounge v. Michigan Liquor Control Comm'n, 23 F.3d 1071, 1075 (6th Cir. 1995); see also Wilkinson v. Brereton, 876 F. Supp 916, 924 (W.D.Ky. 1995)(citing G & V Lounge, 23 F.3d at 1075). Under Lakewood, then, a person is permitted to challenge a licensing scheme if the law has "a close enough nexus to expression, or to conduct commonly associated with expression . . ..,,23 486 U.S. at 759. This does not mean, however, that a plaintiff automatically establishes Article III standing by simply alleging the existence of a prior restraint. A plaintiff must also demonstrate a real interest in engaging in conduct that is (1) arguably protected by the First Amendment and (2) proscribed by the statute or regulation at issue. See Id. at 755-56. Thus, if a plaintiff demonstrates that a licensing scheme implicates First Amendment interests and that he is _____________________ 23 The principle that a licensing scheme can be facially challenged if the person is subject to the law and law has a close enough nexus to expression is so well established that subsequent courts have not entertained the risk of censorship in considering the plaintiff's standing. In FW/PBS v. Lakewood, 493 U.S. 215 (1990), Justice O'Connor held that the plaintiffs could raise a facial challenge even though the Dallas scheme did not pose the risks of censorship that, for example, the scheme challenged in Freedman v. Maryland, 380 U.S. 51 (1965), had. See 493 U.S. at 227- 28. - 24 -
serious about engaging in expression for which a license is required, he has established injury for Article III purposes. Professor Junger has declared that he wants to engage in conduct which is prohibited without first seeking a license. He has declared that he has refrained from posting encryption software and technology (including his course book and an article containing code) on the Internet, and was refrained from sending encryption software overseas to foreign colleagues. He has also declared that he has no idea how to implement precautions required to limit foreign access to his web site, and, nonetheless, does not want to limit access to persons located outside the United States and Canada. He has declared that he must petition the government, and obtain a license, before engaging in any of the above activities and would engage in these activities but for U.S. export controls. The government argues that (a) a license is not required to engage in all of those activities, and therefore, Professor Junger cannot show "injury in fact;" and (b) without a submission detailing his program and the other encryption software, the government cannot determine the export status of the software that he wants to disclose, and this court, therefore, cannot be certain that an actual dispute exists. Defs.' First Memorandum at 8; Defs.' Second Memorandum at 11. The second argument is better viewed as a ripeness argument and will be addressed in the next section. The government's first argument ignores the fact that Professor Junger is challenging a licensing scheme on First Amendment grounds. The continual existence of a prior restraint on protected expression is, in and of itself, an injury in fact for purposes of Article III wholly distinct from actual prosecution or a threat of prosecution. - 25 -
See G & V Lounge, supra; see also Virginia v. American Booksellers Ass'n Inc., 484 U.S. 383, 393 (1988) ("[T]he alleged danger of this statute is, in large measure, one of self-censorship; a harm that can be realized even without an actual prosecution.") To the extent that the government's argument is directed at Professor Junger's claim that he could not teach foreign students if he disclosed encryption software without first applying for a license under the ITAR, it fails to address the present controversy. The question of whether the ITAR, on its face, required a license to disclose encryption programs to foreign students in classroom is no longer in dispute. Under the EAR, the teaching of foreign students is permitted, even where encryption software is disclosed in class. Even if it were still in dispute, however, Professor Junger could satisfy the standing requirements on his other claims. His claims that he cannot send encryption software outside the United States to foreign colleagues and cannot post the software on his web page without restricting access to foreign sites are independent of his teaching claim. The government has proposed a variant of its first argument -- that Professor Junger has not established an injury in fact for Article III purposes. The government has argued that the professor "chill is purely subjective" because he "faces no credible threat of prosecution for teaching his class and otherwise discussing his ideas." Defs.' Second Memorandum at 5; Defs.' First Memorandum at 9. The chill on expression that the professor alleges is far from merely subjective. Professor Junger has submitted declarations of other individuals who have claimed that encryption export controls - 26 -
have chilled their speech.24 Moreover, to the extent that a "credible threat of prosecution" is required to establish an injury under Article III, it does not require much of a showing. As the First Circuit observed, "[t]his standard - encapsulated in the phrase 'credible threat of prosecution' - is quite forgiving." New Hampshire Right to Life Political Action Committee v. Gardner, 99 F.3d 8, 14 (1st Cir. 1996). The requirement can be satisfied "when fear of criminal prosecution under an allegedly unconstitutional statute is not imaginary or wholly speculative." Babbitt v. United Farm Workers, 442 U.S. 289, 302 (1979) (emphasis added). In Babbitt, the United Farm Workers and others challenged an Arizona law prohibiting "dishonest, untruthful, and deceptive" publicity to persuade consumers not to buy or use farm products. The State argued that the criminal penalty provisions of the law had not, and may never be, applied to unfair labor practices (i.e., labor unions). Nonetheless, the Court held that the plaintiffs had standing: The consumer publicity provision on its face proscribes dishonest, untruthful, and deceptive publicity, and the criminal penalty provision applies in terms "to [any] person . . .who violates any provision" of the Act. Moreover, the State has not disavowed any intention of invoking the criminal penalty provision against unions that commit unfair labor practices. Appellees are thus not without some reason for fearing prosecution for violation of the ban on specified forms of consumer publicity. _____________________ 24 See Decl. of Brian Behlendorf ¶¶ 5-11; Decl. of Daniel J. Bernstein ¶¶ 43-63; Decl. of Matthew Bishop ¶¶ 12-14; First Decl. of Matt Blaze ¶¶ 13-15; Second Decl. of Matt Blaze (Postscript); Decl. of Michael Paul Johnson ¶¶ 22-33; Decl. of Lawrence Miller ¶¶ 14-44; Decl. of Bruce Schneier ¶ 27. - 27 -
Babbitt, 442 U.S. at 302 (quoting language of the act) (emphasis added). In Virginia v. American Booksellers Ass'n, Inc., 484 U.S. 383 (1988), the Supreme Court upheld a challenge to a newly enacted state law which prohibited the display of certain material harmful to juveniles even before the law became effective. The Court held that the plaintiffs had established a credible threat of prosecution, when the law was directed against them and the state had not ruled out enforcement.25 In Solomon v. City of Gainesville, 763 F.2d 1212 (11th Cir. 1985), the Eleventh Circuit upheld standing when a plaintiff who displayed Leonardo da Vinci's "Proportions of the Human Figure" above his restaurant challenged an ordinance banning obscene or indecent signs. The court found standing even though the City ____________________ 25 The statute or regulation, however, does not have to "target" individual plaintiffs to establish a credible threat of prosecution. Although apparently not framed as an objection to standing, the government questioned the legitimacy of many of the plaintiffs' claims in ACLU v. Reno, 929 F. Supp. at 870. The government's argument that some of the plaintiffs' claims were exaggerated did not convince the court that there was no likelihood of prosecution. As Judge Dalzell responded: Here, even though it is perhaps unlikely that the Carnegie Library will ever stand in the dock for putting its card catalogue online, or that the Government will hale the ACLU into court for its online quiz of the seven dirty words, we cannot ignore the fact that the Act could reach these activities. . . . Putting aside hyperbolic application, I also have little doubt that some communities could well consider plaintiffs' speech indecent, and these plaintiffs could-perhaps should-have a legitimate fear of prosecution. Id. at 871. - 28 -
Commission instructed the City Manager "to discontinue any and all prosecutorial action now and in the future" with respect to the sign. Id. at 1213. In New Hampshire Right to Life, supra, the First Circuit held that it would assume a credible threat of prosecution exists "absent compelling contrary evidence" for laws that law "facially restrict expressive activity by the class to which the plaintiff belongs." 99 F.3d at 15. The First Circuit's assumption follows the Sixth Circuit teaching in Planned Parenthood Ass'n of Cincinnati, Inc. v. City of Cincinnati, 822 F.2d 1390 (6th Cir. 1987), in which that court found that Planned Parenthood had standing to challenge a local ordinance regulating hospitals and clinics where abortions were performed. The court found standing, and specifically, "a credible threat of prosecution," from the language of the ordinance: "Planned Parenthood has alleged its intention to engage in conduct that is arguably affected with a constitutional interest, and we believe the statutory language of the Ordinance evinces a credible threat of prosecution . . .." Id. at 1395-96. Likewise, in Zielasko v. State of Ohio, 693 F.Supp. 577 (N.D. Ohio 1988), aff'd, 873 F.2d 957 (1989), this district held that the plaintiff, a former judge over seventy years old, had standing to challenge an Ohio law barring persons over seventy from judicial office. Under Ohio law, a judicial candidate had to sign a declaration of candidacy stating that he was qualified for the position. Filing a false declaration was criminally punishable. Although the court could not find a single case where a person over seventy was prosecuted for signing a declaration of candidacy, any candidate filing a false declaration - 29 -
was subject to risk. Id. at 581. The law itself created the risk. As the Eleventh Circuit has observed, [T]he authentic interest of the plaintiff in engaging in the prohibited conduct can establish standing even though the only threat of enforcement comes from the very existence of the statute. A court can be most certain that a constitutional challenge grows out of a genuine dispute where the allegedly unconstitutional statute interferes with the way the plaintiff would normally conduct his or her affairs. Leverett v. City of Pinellas Park, 775 F.2d 1536, 1539 (11th Cir. 1985)(citations omitted) (emphasis added). On its face, the EAR requires a license before "exporting" encryption items -- including software (ECCN 5D002) and information (ECCN 5E002) -- to all destinations except Canada. EAR § 742.15. The definition of export for encryption source code and object code includes posting the code on the World Wide Web site or making code available for ftp file transfer unless certain precautions are taken. EAR § 734.2(b)(9). The definition of export for encryption technology includes the disclosure of technical data to foreign persons within the United States. EAR § 734.2(b)(1). These prohibitions against speaking or publishing without a license are coupled with severe civil sanctions and criminal penalties. EAR § 764.3. The government has not disavowed enforcement for these violations.26 It would be pressing the truth to believe that the national security and foreign policy concerns of the President would _____________________ 26 In fact, the government admits that illegal exports present a credible threat of prosecution: "Plaintiff may arguably have standing to challenge the licensing requirements for cryptographic software, because an illegal export could be subject to prosecution." Def.'s First Memorandum at 10 n.9. (emphasis added). - 30 -
lead to amendments that the government has no intention of enforcing. Moreover, in First Amendment cases where government prepublication review is required, a "credible threat of prosecution" may be completely nonexistent. In Weaver v. United States Information Agency, 87 F.3d 1429 (D.C.C. 1996), a part-time employee of Voice of America was permitted to challenge a prepublication review procedure that did not authorize any form of punishment. The employee received an oral admonishment, but filed suit beforehand challenging the procedure on First Amendment grounds seeking declaratory and injunctive relief. Professor Junger has already posted an article on computer law that he censored in order to meet the EAR requirements. He has declared that if not for the EAR restrictions, he would have posted the uncensored version on his web site. Apart from the other facts alleged by Professor Junger, and supported by declaration, these facts are sufficient to support a facial challenge. The interests of the parties herein are sufficiently adverse to establish a case or controversy for purposes of Article III. The government's reliance on Laird v Tatum, 408 U.S. 1 (1972), and Greater Cincinnati, supra, is unpersuasive, as is its attempt to distinguish Lakewood. The Plaintiffs in Laird a challenged domestic government surveillance program, not a licensing scheme, and the Supreme Court expressed serious doubts about whether their speech had been chilled or whether they had in any way changed their behavior as a result of the challenged surveillance. In Greater Cincinnati, a homeless man and a non-profit organization challenged an anti-begging ordinance prohibiting - 31 -
reckless or threatening panhandling. The individual plaintiff admitted that he had not violated the ordinance in the past, and that he had no intention of doing so in the future. The organization did not establish that it, or any of its members, or even any third-parties had suffered an actual or threatened injury as a result of the ordinance because the ordinance prohibited only reckless or threatening panhandling, not all panhandling. The government attempts to distinguish Lakewood claiming that the EAR does not license "pure speech activity" and does not vest excessive discretion in an agency official. This distinction fails for two reasons. First, Lakewood made clear that a facial challenge is permitted whenever a licensing scheme has "a close enough nexus to expression, or to conduct commonly associated with expression." 486 U.S. at 759 (emphasis added). The central point the professor claims is that he is prevented from publishing without obtaining a license. If the government considers the placement of newsracks a form of "pure speech activity," then the publication of at least encryption source code, which cannot perform any function until compiled and which is used by programmers, scientists and others conversant in programming languages to communicate ideas, must also be counted as a type of "pure speech activity." Second, Lakewood stands for the proposition that a facial challenge can be brought against a licensing scheme that "allegedly vests unbridled discretion in a government official . . ." Id. at 755 (emphasis added). A determination that a licensing scheme does not vest excessive discretion in government officials is properly viewed as a determination on the merits, not a threshold issue to be addressed in the determination of standing. See FW/PBS, Inc. v. - 32 -
City of Dallas, 493 U.S. 215 (1990) (finding that the plaintiffs had standing before reaching the merits, where a Dallas ordinance was struck down, in part, for not providing a specific and reasonable time period for a decision on the license, a form of excessive discretion). Accordingly, the government's attempt to distinguish Lakewood is unpersuasive. In sum, Professor Junger has satisfied the Article III standing requirements and may bring a facial challenge. The next question is whether there are any prudential considerations that would favor dismissal. 2. Ripeness The ripeness doctrine is primarily concerned with when a matter is fit for review. Erwin Chemerinsky, FEDERAL JURISDICTION § 2.4 (ed. 1989). "Justiciability concerns not only the standing of litigants to assert particular claims, but also the appropriate timing of judicial intervention." Renne v. Geary, 501 U.S. 312,320 (1991). Although characterized as a prudential consideration, ripeness overlaps with the Article III standing requirements. See Reno v. Catholic Social Services, Inc., 509 U.S. 43, 58 n.18 (1993); Kardules v. City of Columbus, 1996 U.S. App. LEXIS 24724 *17-18 (6th Cir. 1996). In Abbott Laboratories v. Gardner, 387 U.S. 136 (1967), the Court indicated that ripeness depends on "the hardship to the parties of withholding court consideration" and "the fitness of the issues for judicial review." Id. at 148-49. Legal questions that require a limited factual record are more likely to be ripe. Thomas - 33 -
v. Union Carbide Agric. Products, Co., 473 U.S. 568 (1985). As noted above, the government has argued that there is an insufficient factual record for this Court to determine if a real dispute between the parties exists because Professor Junger never submitted the details of his encryption program or any other program to the government. This court does not need a determination from the BXA to conclude that Professor Junger's OTP encryption program is an encryption program. This was demonstrated by the instructions he gave his students to create a program capable of encryption functions.27 See 15 C.F.R. Part 772 (definition of encryption software). His program is, therefore, controlled as encryption software under ECCN 5D002. In the letter to plaintiff's counsel from the Department of Commerce, dated January 29, 1997, the Director of Strategic Trade and Foreign Policy Controls confirms what is clear under the regulations: In order to export encryption items subject to EI controls, including software, a license application must be submitted to the Commerce Department, which will grant or deny the application based on a case-by-case determination of "whether the export * * * is consistent with U.S, national security and foreign policy interests, Section 742.15(b) of the EAR . . . . Since Professor Junger's program is subject to EI controls as ECCN 5D002 encryption software, he must submit an application before export. Professor Junger has alleged that he want to put his program and other encryption programs on his web site and make them available by ftp without taking the precautions to avoid the __________________ 27 See Pl.'s Second Decl. ¶ 11. - 34 -
definition of "export" in § 734.2(b)(9). He has also alleged that he wants to send his program overseas, by email, for example, to colleagues associated with Oxford University. These allegations, supported by declaration, are sufficient to challenge the provisions covering the export of encryption software.28 There are sufficient facts in the record to sufficiently describe the activities that Professor Junger wants to engage in. Moreover, the government again ignores the fact that the professor has brought a facial challenge. The facts about a particular case are less relevant when the challenge is facial. This court needs no other facts to decide the issues before it. Having concluded that there is a real controversy between the parties the court will address the merits. ___________________ 28 Again, if there was any doubt about any of Professor Junger's claims, it was his claim under the ITAR that he could not disclose encryption software to foreign students. This claim is not at issue under the EAR. - 35 -
B. First Amendment Issues29 Professor Junger advances two First Amendment arguments against the constitutionality of the export controls. First, he argues that these regulations impose a prior restraint on protected expression, but fail to employ the procedural safeguards required of every licensing scheme. Second, Professor Junger charges that regulations impose a content-based restriction on free expression, unjustified by the necessary showing of imminent harm needed to support such limitations. Either of these flaws would seal the constitutional fate of the restrictions sub judice. Both of these arguments depend upon the conclusion that the Professor seeks to engage in a form of expression protected by the First Amendment. It is that issue to which the court turns next. 1. Protected Expression Because this case arises in the context of a comprehensive scheme regulating the export of commodities from the United States, it is necessary, as a threshold matter, to determine whether the First Amendment applies to Professor Junger's claims at all. a. Free Expression and Foreign Nationals _____________________ 29 Professor Junger has presented claims under the First Amendment, as well as claims suggesting that the export restrictions at issue violate the constitutional doctrine of separation of powers, and are ultra vires. This opinion addresses only his First Amendment claims. - 36 -
The First Amendment secures to persons in the United States the right to communicate and to associate with foreign individuals and organizations, as well as with individuals and organizations within the United States. DKT Memorial Fund Ltd., v. Agency for International Development, 887 F.2d 275, 303 (D.C.Cir. 1989). Regulations which restrict the flow of literature into the United States implicate the First Amendment, Lamont v. Postmaster General, 381 U.S. 301(1965), as do regulations which subject the export of literary or artistic works to government review. Bullfrog Films, Inc. v. Wick, 847 F.2d 502 (9th Cir. 1988). In Bullfrog Films, the Ninth Circuit addressed the constitutionality of export restrictions on domestic documentary films. Under a treaty known as the Beirut Agreement, films exported from the United States could be subject to customs duties and other charges, unless submitted to the United States Information Agency (USIA) for review and certification prior to export. Invalidating aspects of the scheme as content based restrictions on free expression, the Ninth Circuit noted that "'[t]here can be no question that, in the absence of some overriding governmental interest such as national security, the First Amendment protects communications with foreign audiences to the same extent as communications within our borders."' Bullfrog Films, 847 F.2d at 509 n.9. (quoting and affirming 646 F. Supp. 492, 502 (C.D.Cal. 1986). Thus, to the extent that he seeks to engage in expression otherwise protected by the First Amendment, Professor Junger's claim is not diminished by the fact that his intended audience resides beyond the national boundaries of the United States. This question having been addressed, it remains for the court to conclude whether part of the Professor's intended expression deserves the protection of the First - 37 -
Amendment at all. b. Software, Source Code and Free Expression The question of whether encryption source code and object code are a form of expression entitled to First Amendment protection is not one of first impression. It has been addressed by two other federal district courts within the last year, on both occasions in the context of suits challenging the export restrictions imposed on encryption software under the ITAR and at issue in this case. See: Bernstein v. Department of State, 922 F.Supp. 1426 (N.D.Cal. 1996); Karn v. Department of State, 925 F.Supp. 1 (D.D.C. 1996)(appeal pending). Both the court in Bernstein, 922 F.Supp. at 1439, and, with some limitations, the court in Karn, 925 F.Supp. at 10, have recognized that encryption source code is a form of speech.30 While the novelty of this issue demands an independent analysis be conducted by this court, the methodology employed by the Bernstein court, which addressed in detail the question of source code as speech, is instructive. As an initial matter, source code, including encryption source code, is in many instances a simple text, which can be inscribed onto paper in ink like any other text. Bernstein, 922 F. Supp. at 1434. In this form, and in other forms, source code is well accepted as a medium of expression within the scientific community. (Abelson Decl. ¶¶ 8, 15). Budding programmers are often critiqued ____________________ 30 The Karn court limited its assumptions in this regard to source code which included comments embedded into its text. Karn, 925 F.Supp. at 10. - 38 -
by their instructors on matters of style and quality, matters which can be evaluated quite independently of whether or not a given program is able to "get the job done" on a purely functional level. (Abelson Decl. ¶ 16). A fundamental use of source code, within the community of computer programmers, is to communicate ideas between and among people.31 Programmers have published source code which, in some cases, has little or no function other than the edification of human readers. (Ellison Decl. q 8). In technical papers, source code is often published alongside English language text and mathematical expression. (Ellison Decl. ¶¶ 14, 24). Within the community of computer scientists, economists and other scholars whose academic work includes or involves computer codes, publication of their thoughts and ideas for scholarly review often includes the publication of the programming language code itself. (Ginsparg Decl. ¶ 9). AS noted by the court in Bernstein, software, whether source code or object code, and in whatever medium it is reproduced, is protected by the copyright laws of the United States as a literary work. Bernstein, 922 F. Supp. at 1436. (citing 17 U.S.C. §§ 101, 102(a)(1)). The values protected by the law of copyright and those protected by the First Amendment are deeply linked. "It should not be forgotten that the Framers intended copyright itself to be the engine of free expression. By establishing a marketable right to the use of one's expression, copyright supplies the economic incentive to create and disseminate ideas." Harper & Row Publishers, Inc. v. ____________________ 31 As indeed, the source code found in Finding of Fact Number supra, has permitted the court to communicate to the reader something about the nature of computer programming and academic discourse. - 39 -
Nation, 471 U.S. 539, 558 (1985). Notions of free and creative expression are central to the determination that a work enjoys the protection of copyright to begin with. The fact that software enjoys copyright protection as a literary work should be recalled in light of the established doctrine which holds that copyright law does not protect ideas but only their creative expression. Princeton University Press v. Michigan Document Services, Inc., 74 F.3d 1512, 1518 (6th Cir. 1996). The government has argued that the essence of software is not its communicative aspect but its ability to perform a function. This justification for regulating encryption software is found both in the government's briefs and in the President's findings of fact in support of Executive Order Number 13026. Executive Order 13026, Section l(c), 61 Fed. Reg. 58768 (November 15, 1996). Whether a particular form of expression is regulated for its communicative content is highly relevant in deciding the First Amendment standard of review to apply to a given regulation (a topic addressed later in this opinion), See, e.g., Texas v. Johnson, 491 U.S. 397 (1989), That notwithstanding, the perceived communicative value of a given expression has little to do with the threshold question of whether that expression is "speech" in the first place. Our First Amendment jurisprudence has excluded from constitutional protection certain narrow categories of expression thought to be without any redeeming social value. Chaplinsky v. New Hampshire, 315 U.S. 568 (1940. Even those narrow subclasses of expression which are generally considered to be outside the realm of First Amendment protection - obscenity, Miller v. California, 413 - 40 -
U.S. 15 (1973), fighting words, Chaplinsky, supra, and to a lesser extent, defamation, Gertz v. Robert Welch. Inc., 418 U.S. 323 (1974) - have never been considered something other than speech. R.A.V. v. St. Paul, 505 U.S. 377, 395 (1992)(even forms of expression which can be proscribed on the basis of content are categories of speech, and "not entirely invisible to the Constitution" when then basis for regulation is impermissible). If expression devoid of social content is nonetheless speech for purposes of the First Amendment, it seems highly improbable that software - which several highly knowledgeable and well respected Declarants have noted is a common medium of expression among computer scientists - should be considered something other than speech. This does not mean that the government cannot regulate this sort of expression, only that it must do so consonant with the mandates of the First Amendment. The manner of expression which is regulated in this case is also relevant to the question of whether, and to what extent, the First Amendment is implicated by the EAR. As noted above, source code and object code are subject to prepublication review only if they are to be made available in an electronic medium. EAR 734.2(b)(9)(i)-(ii). Significantly, the regulations prohibit the unlicensed posting of such information to electronic bulletin boards, Internet file transfer protocol ("ftp") sites, and sites on the World Wide Web.32 EAR § 734.2(b)(9)(ii). That the EAR restricts _____________________ 32 An ftp site uses the inter-linked computer networks which together form the Internet to allow a user to find, see lists of, and copy files stored on a remote computer for just such a purpose. Electronic bulletin boards ("BBSs") allow members to contribute to, and draw from, a collection of files maintained on a single computer, or a single computer network, accessed by telephone. - 41 -
what may be made available on these various portions of the Internet without first applying for a licence in itself implicates First Amendment concerns. The ability to disseminate information so broadly, the widespread use of the Internet by scholars and scientists (see findings of fact 20 through 23 above), and the fact that more than forty million people access and exchange information over the Internet, ACLU v. Reno, 929 F.Supp. at 831, means that many of the transfers in EAR § 734.2(b)(9)(ii) implicate the First Amendment in the way the physical export of a howitzer or an air superiority fighter would not. Making information available in a global distribution system in which millions participate as authors, correspondents, viewers and commentators is participating in "a never-ending worldwide conversation . . . [involving] . . . the most participatory form of mass speech yet developed." ACLU v. Reno, 929 F.Supp. at 883. Because the Internet shares many salient characteristics of the traditional public forum, making information available there is at least as much a form of publication as it is an act of export. This does not mean that the government cannot regulate expression there, but only that it must do so. _____________________ These BBSs may or may not be connected to the Internet. On a larger scale, distributed message databases, such as USENET, gather and distribute messages and files to and from interested "subscribers" around the world, via the Internet. These "newsgroups" allow computer users with topic specific interests to read, write, discuss and reply to messages which any of them are free to submit on any of over fifteen thousand different topics of common interest. Finally, the World Wide Web allows computer users to publish "web sites" or "web pages," which, due to a set of basic communications protocols, allow users around the world to share information, often in a highly graphical format, despite variations in computer hardware. See ACLU v. Reno, 929 F.Supp. at 836-38. - 42 -
2. Prior Restraint Prior restraints were recognized as the least tolerable restrictions on freedom of speech and the press well before the First Amendment. See City of Paducah v. Investment Entertainment, Inc., 791 F.2d 463, 465-67 (6th Cir.1986 ). Milton in his AREOPAGITICA and Blackstone in his COMMENTARIES railed against the licenses required by English Crown officials and the court of star chamber after the introduction of the printing press in the Seventeenth Century. 33 City of Paducah, 791 F . 2d at 465-67 . This suspicion of licenses on publication found its way into the First Amendment, which was originally understood to protect primarily against prior restraints. "In determining the extent of the [First Amendment], it has been generally, if not universally, considered that it is the chief purpose of the guaranty to prevent previous restraints upon publication," Near v. Minnesota, 283 U.S. 697, 713 (1931). Prior restraints come in two forms: injunctions and licensing schemes. In both forms, the effect is the same, and equally serious: the prohibition of speech or publication without prior approval. ___________________ 33 The art of printing, soon after it's introduction, was looked upon (as well in England as in other countries ) as merely a matter of state, and subject to the coercion of the crown. It was therefore regulated with us by the King's proclamations, prohibitions, charters of privilege and of license, and finally by the decrees of the court of star-chamber; which limited the number of printers, and of presses which each should employ, and prohibited new publications unless previously approved by proper licensors. . . . Id. at 466 n. 14 (quoting 4 W. Blackstone, Commentaries *151-52). - 43 -
Bernstein v. Dept. of State, 945 F.Supp. 1279, 1996 U.S. Dist. LEXIS 18974 at *17 (N.D. Cal. 1996). The elements of a prior restraint created by a licensing scheme were laid out in Cantwell v. Connecticut, 310 U.S. 296, 305 (1940), where the Court struck down a solicitation statute requiring the approval of the secretary of public welfare: It will be noted, however, that the Act requires an application to the secretary of the public welfare council of the State; that he is empowered to determine whether the cause is a religious one, and that the issue of a certificate depends upon his affirmative action. If he finds that the cause is not that of religion, to solicit for it becomes a crime. He is not to issue a certificate as a matter of course. His decision to issue or refuse it involves appraisal of facts, the exercise of judgment, and the formation of an opinion. Cantwell, 310 U.S. at 554. See also: Southeastern Promotions, Ltd. v. Conrad, 420 U.S. 546 (1975). These elements are met whenever the right to speak or publish is conditioned on the discretion of an administrative official. Although content-neutral time, place and manner restrictions may be valid, see Clark v. Community for Creative Non-Violence, 468 U.S. 288, 293 (1984), the government cannot impose preconditions on speech or publication that are left to an official's discretion. See Lakewood, 486 U.S. at 764. The EAR bears every element of a prior restraint. The definition of "export" includes publishing encryption software on the Internet and disclosing to foreign persons within the United States.34 EAR § 734.2. A license from the BXA is required under the _____________________ 34 Publishing source code and object code on World Wide Web sites, or making it available by ftp, is not considered an export if certain precautions are taken. See EAR 734.2(b)(9). However, the - 44 -
EAR before the electronic publication of any encryption software (and all encryption technology subject to the EAR) that results in an export to a destination other than Canada.35 Other than certain mass market and key recovery items, see § 742.15(b)(1)-(3), a decision to grant or deny a license for encryption software and technology is within the complete discretion of the BXA and other agencies and is determined on a "case by case" basis.36 EAR § 742.15(b). This unlimited discretion on electronic publication protected by the First Amendment itself constitutes an invalid prior restraint. Shuttlesworth v. Birmingham, 394 U.S. 147 (1969). It must be kept in mind when addressing prior restraints that the question is not whether a license would be granted or denied in ____________________ precautions under this section require either a system that checks and verifies the addresses of all computers accessing the site in question, or some other precaution specifically approved in writing by the BXA. The former is impracticable for most persons, and in most cases ineffective. (Second Blaze Decl. ¶¶ 28-29, Pl.'s Second Decl. ¶ 15). The latter is, of course, simply another form of discretion exercised by the BXA. 35 For example, other than encryption software controlled under ECCN 5D002, software that would otherwise be subject to the EAR is exempt if it is publicly available. § 734.3(b)(3). The only exemption from the EAR that applies to encryption software, and only to source code, is the exemption for source code in printed books or other printed material. EAR § 734.3, Note to (b)(2) and (b)(3). 36 In response to a letter of clarification from plaintiff's counsel, the Commerce Department stated In order to export encryption items subject to EI controls, including software, a license application must be submitted to the Commerce Department, which will grant or deny the application based on a case-by-case determination of "whether the export . . . is consistent with U.S. national security and foreign policy interests." 15 C.F.R. 742.15(b), 61 Fed. Reg. at 68581 . . . Letter from Commerce Dept. to Pl.'s counsel, January, 29, 1997, at 1. The letter further states that certain mass market encryption software may be released from EI controls. Id. at 3 n.3. The provisions for mass market encryption software do not apply to Professor Junger. - 45 -
any particular case under a particular set of circumstances. For First Amendment purposes, the question is whether a license is required as a precondition of speech or publication. It is this precondition that the First Amendment will not tolerate. The presumption of prior restraints is heavier-and the degree of protection broader-than that against limits on expression imposed by criminal penalties. Behind the distinction is a theory deeply etched in our law: a free society prefers to punish the few who abuse rights of speech after they break the law than to throttle them and all others beforehand. Southeastern Promotions, 420 U.S. at 558-59. Because the EAR requires that an individual secure a government license before publication, it comes to this Court "bearing a heavy presumption against its constitutional validity." New York Times Co. v. United States, 403 U.S. 713, 714 (1971)(per curium)(quoting Bantam Books. Inc. v. Sullivan, 372 U.S. 58, 70 (1963)(citations omitted)). Although prior restraints are not per se invalid, Near, 283 U.S. at 716, the burden is on the government to conclusively establish that the restraint falls within a narrow class of cases. Id. at 726 (Brennan, J., concurring). The government has not shown that the export of all encryption software and technology subject to the EAR will cause substantial harm to national security and foreign policy interest. Moreover, the government would be hard pressed to assert such irreparable harm from the export of Professor Junger's program or programs that are already widely available on the Internet The EAR licensing scheme fails for a second, independent reason: It lacks the minimal procedural safeguards required under Freedman v. Maryland, 380 U.S. 51, 58-60 (1965). Any licensing - 46 -
scheme that implicates the First Amendment must provide at least (1) definite and reasonable time constraints within which the licensor must decide whether to issue or deny a license and (2) expeditious judicial review if the license is denied. FW/PBS, Inc. v. City of Dallas, 493 U.S. at 215, 227-29. If the licensing scheme vests excessive discretion in the licensor, it poses a danger of censorship and is presumptively invalid. In that case, (3) the government has the additional burden of going to court and proving its case.37 Id. The EAR controls on encryption software (and technology) pose the same procedural problems as the ITAR controls on Category XIII(b) cryptographic software, which were found unconstitutional in Bernstein, 944 F. Supp. 1279, 1996 U.S. Dist. LEXIS 18974 *32. The EAR, like the ITAR, does not place even "minimal limits on the discretion of the licensor and nothing to alleviate the danger of arbitrary or discriminatory licensing decisions." Licensing decisions on encryption software and technology, other than certain mass market and key recovery items, are made on a case by case basis. EAR § 742.15(b). License decisions, for other than mass market and key recovery items, are required to be made within 90 ___________________ 37 Justice O'Connor's opinion in FW/PBS reflected the judgment of the Court, but was joined in its entirety, including in the passage quoted herein, by only Justices Stevens and Kennedy. In a concurring opinion, Justice Brennan, joined by Justices Marshall and Blackmun, believed that the Court's holding did not give sufficient emphasis to the third of three procedural safeguards required of prior restraints in Freedman. The concurring justices found no reason not to impose Freedman's third requirement: that the government to initiate judicial review of any license denial and bear the burden of proof with respect to its action in any subsequent proceeding. FW/PBS, 493 U.S. at 239-40 (Brennan, J., concurring in the judgment). - 47 -
days from the time it is registered unless the application is referred to the President. EAR § 750.4(a)(1). If an application is referred to the President, there are no time limits on his decision. If a license is denied, an appeal can be taken to the Under Secretary of Commerce, but no specific time limit is given for a decision on the appeal. EAR § 756.2(c)(1). The 90 day time period, which may be extended by referral to the President, and the lack of any specified time period in which an appeal must be decided, fail the first two Freedman requirements. The 90 day period and unlimited appeal period are not reasonable time limitations that provide for prompt judicial review. See Teitel Film Corp. v. Cusack, 390 U.S. 139, 141-42 (1968) (per curium) (holding that 50-57 day period for obtaining decision in film censorship context not a sufficiently "specified brief period"). Moreover, because licensing decisions are made on a case by case basis, the discretion of the administrative officials is unlimited. This unlimited discretion creates too real a risk of censorship, and therefore, the third Freedman requirement must be satisfied: the government bears the burden of going to court and justifying the denial. Accord, Bernstein, 944 F.Supp. 1279, 1996 U.S. Dist. LEXIS *31 (licensing scheme under the ITAR requires all three Freedman safeguards). This court, like the court in Bernstein, is mindful of the difficulties of reviewing licensing decisions involving potential national security and foreign policy concerns. Notwithstanding the difficulties, judicial review is necessary to avoid an impermissible prior restraint. - 48 -
3. The Questions of Content Neutrality. Expressive Conduct and Intermediate Scrutiny Even if this court were to conclude that the export regulations at bar did not impose a prior restraint on free expression, serious First Amendment questions would remain. Professor Junger has challenged the restrictions at bar as content based limits on expression. The question of whether the export provisions in this case discriminate against certain forms of expression based on their content requires an analysis distinct from that of prior restraint. See, e.q., Eastbrook Books, supra, 48 F.3d at 224-26 (reviewing licensing scheme both as a prior restraint and for charges of content-based discrimination). Content-based regulations on free expression are presumptively invalid, R.A.V. v. St. Paul, 505 U.S. 377, 381 (1992) and subject to strict constitutional scrutiny. Consolidated Edison Co. v. Public Service Comm'n of New York, 447 U.S. 530, 536 (1980). Content neutral regulations, by contrast, are ordinarily subject to intermediate scrutiny. Clark v. Community for Creative Non- Violence, 468 U.S. 288, 293 (1984). The government argues that the regulations at bar should be subject to intermediate scrutiny, either (1) as content-neutral, time place and manner restrictions on expression, or (2) because the regulations restrict what the government has characterized as expressive conduct. The Supreme Court has formulated two closely related First Amendment doctrines, both of which call for intermediate scrutiny. East Brook Books, 48 F.3d at 226 n.5. The first is applicable to - 49 -
content-neutral time, place and manner restrictions on expression in public fora. Perry Education Assn. v. Perry Local Educators' Assn. 460 U.S. 37, 45-46 (1983). The second, first fully formulated in United States v. O'Brien, 391 U.S. 367 (1968), has been most often applied in cases dealing with expressive conduct. The Supreme Court has indicated that, in practice, there is little distinction between the two standards. Clark, 468 U.S. at 298 (O'Brien analysis "little, if any, different from the standard applied to time, place, or manner restrictions" applied in other contexts). It is also clear that, in some circumstances, the government may regulate the same expression based on either a time, place, and manner analysis, or as a form of expressive conduct. International Society for Krishna Consciousness v. Lee, 505 U.S. 672, 685 (Kennedy, J., concurring in the judgment). The government has justified the regulations at bar both as content-neutral time place and manner restrictions and as restrictions on expressive conduct. Because either one of these characterizations would support the application of intermediate scrutiny, the court reviews each in turn. A. Time. Place and Manner Analysis Time place and manner restrictions have been imposed and upheld in a variety of circumstances. "[T]he essence of time, place, or manner regulation lies in the recognition that various methods of speech, regardless of their content, may frustrate legitimate governmental goals. No matter what its message, a roving sound truck that blares at 2 a.m. disturbs neighborhood tranquility." - 50 -
Consolidated Edison Company of New York. Inc. v. Public Service Commission of New York, 447 U.S. 530, 536 (1980). The heart of a time, place and manner restriction is its content neutrality. The Supreme Court has "emphasized that time, place, and manner regulations must be 'applicable to all speech irrespective of content.'" Consolidated Edison, 447 U.S. at 536 (quoting: Erznoznik v. City of Jacksonville, 422 U.S. 205, 209 (1975)). In a public forum, the government may impose reasonable restrictions on the time, place, or manner of protected speech, provided the restrictions "are justified without reference to the content of the regulated speech, that they are narrowly tailored to serve a significant governmental interest, and that they leave open ample alternative channels for communication of the information." Ward v. Rock Against Racism, 491 U.S. 781, 790 (1989). i. The Significance of the Government's Regulatory Motive The first question, then, is whether the export restrictions at bar are justified without reference to the content of the speech at issue in this case. The government has argued that the export restrictions on encryption source code and object code in both the ITAR and the EAR are content neutral, in that each was intended not to suppress a particular message, but to limit the availability of encryption technology abroad. (Crowell Decl. ¶ 5; Lowell Decl. ¶ 4). While the government's justification for a given regulation is the "principal inquiry" in determining whether that regulation is content neutral, Ward, 491 U.S. at 791, the regulatory motives of - 51 -
the government are by no means dispositive. The Supreme Court has expressly rejected the argument that "discriminatory . . . treatment is suspect under the First Amendment only when the legislature intends to suppress certain ideas." City of Cincinnati v. Discovery Network. Inc., 507 U.S. 410, 429 (1993)(quoting: Simon and Schuster v. New York State Crime Victims Board, 502 U.S. 105 (1991)). Thus, while an inquiry into legislative or regulatory intent is important, "illicit . . . intent is not the sine qua non of a violation of the First Amendment." Minneapolis Star & Tribune Co. v. Minnesota Comm'r of Revenue, 460 U.S. 575, 592 (1983). It is not necessary to find that the government was motivated by hostility to any given message in order to find the regulations at bar to be content-based. Turner Broadcasting System. Inc. v. Federal Communications Commission, 512 U.S. 622; 114 S. Ct. 2445; 129 L.Ed. 2d 497, 520 (1994). Furthermore, the "mere assertion of a content-neutral purpose" cannot save a law "which, on its face, discriminates based on content." Id. ii. Facial Content Discrimination Professor Junger contends that the export restrictions of the EAR facially discriminate between software relevant to encryption on the one hand, and all other software on the other. A review of the regulations themselves supports his contention. The Supreme Court has consistently taught that speech on a given topic cannot be singled out by the state for special treatment consistent with the First Amendment. Simon and Schuster v. New York State Crime Victims Board, 502 U.S. 105 (l991)(invalidating New - 52 -
York's "Son of Sam" law, which recouped for crime victims the profits from books authored by criminals). "Above all else, the First Amendment means that government has no power to restrict expression because of its message, its ideas, its subject matter, or its content." Arkansas Writers Project v. Raglan, 481 U.S. 221, 229 (1987)(invalidating a tax on periodicals that exempted, inter alia, religious, trade and sports publications). Under our jurisprudence, the government must refrain not only from suppressing a particular message, but also from restricting the discussion of an entire topic: "[t]he First Amendment's hostility to content-based regulation extends not only to restrictions on particular viewpoints, but also to prohibition of public discussion of an entire topic." Consolidated Edison, 447 U.S. at 537 (citing: Police Dept. Of Chicago v. Mosley, 408 U.S. 92 (1972); Cox v. Louisiana, 379 U.S. 536, 580-581(1965) (opinion of Black, J.)). The regulations at issue in this case do not meet this burden. The note to EAR Section 734.9 provides that: A printed book or other printed material setting forth encryption source code is not itself subject to the EAR (see Sec.734.3(b)(2)). However, notwithstanding Sec. 734.3(b)(2), encryption source code in electronic form or media (e.g., computer diskette or CD ROM) remains subject to the EAR (see Sec. 734.3(b)(3)). Materials and activities which are "subject to the EAR" fall within, and are subject to the active regulatory jurisdiction of the BXA. EAR § 772. The EAR defines encryption software to include "[c]omputer programs that provide capability of encryption functions or confidentiality of information or information systems. Such software includes source code, object code, applications software, - 53 -
or systems software." EAR § 772.38 Encryption software is assigned an Export Classification Control Number (ECCN), in this case ECCN5D002, and thus cannot be lawfully exported from the United States without a licence from the BXA. EAR § 774. As noted earlier, the unlicensed export of any item on the Commerce Control List, including encryption software, can result in substantial penalties. EAR § 764.3. It is important to note that neither all software, nor all information regarding encryption, requires an export licence. Exempted from EAR control is all "publicly available technology and software" except that which relates to encryption and is categorized under ECCN5D002. EAR § 734.3(b)(3). Source code and object code related to encryption is not subject to the EAR, so long as it is published in a book or in some other printed form. Only when publicly available source code or object code, which relates to encryption, is published in an electronic form or medium, does the EAR require a licence for export. EAR § 734.3(b)(3) and Note. The term "export" is also precisely (and variously) defined by the EAR, and includes, as the regulations themselves admit "[c]ertain actions that you might not regard as an 'export' in other contexts . . . ." EAR § 730.5(c), 61 Fed. Reg. 12735 (March 25, 1996). With respect to encryption source code and object code, export includes: _____________________ 38 Encryption object code is in turn defined as "[c]omputer programs containing an encryption source code that has been compiled into a form of code that can be directly executed by a computer to perform an encryption function." Encryption source code is defined as "[a] precise set of operating instructions to a computer that, when compiled, allows for the execution on an encryption function on a computer." EAR § 772. - 54 -
downloading, or causing the downloading of, such software to locations (including electronic bulletin boards, Internet file transfer protocol, and World Wide Web sites) outside the U.S., or making such software available for transfer outside the United States, over wire, cable, radio, electromagnetic, photo-optical, photoelectric or other comparable communications facilities accessible to persons outside the United States . . . unless certain precautions are taken. EAR § 734.2(9)(B)(ii).39 From these provisions, two things are clear. First, the EAR treats encryption source code and object code differently than all other forms of source code and object code, in that, under EAR § 734.3(b)(3), only code dealing with encryption is subject to these licensing requirements. Second, these licensing requirements apply only when encryption source code and object code is published in certain, electronic media . This alone is enough to support a finding that, with respect to encryption, these are content-based regulations. Regulations which restrict only certain topics, and then only when discussed in certain media, implicate concerns beyond the neutral time-place-manner analysis suggested by the government. In Linmark Associates v. Township of Willingboro, 431 U.S. 85 (1977), the Supreme Court invalidated a ban on residential "for sale" signs. _____________________ 39 The precautions that must be taken to avoid making such an electronic transfer an "export" under the EAR require that the transfer be made in a way that, at a minimum, checks and verifies the electronic address of every system requesting or receiving the transfer, to verify that the system is located within the United States. Alternatively, the transferor may take whatever other precautions are approved in writing by the BXA. EAR § 734.2 (b)(9)(ii)(A)-(B). The practicality of these precautions, and their effect on the constitutionality of the EAR's restrictions on publishing encryption source code and object code, are discussed later in this opinion. - 55 -
Significantly, the township had neither banned all lawn signs, nor all communications indicating the fact that a home was on the market. Id. at 92-93. Despite the fact that the topic of sale was prohibited in one medium only, the Supreme Court declined to view the case as a content neutral time, place and manner restriction, and evaluated the ordinance in light of the township's interest in suppressing the content of the signs. Id. at 94. In City of Cincinnati v. Discovery Network, Inc., 507 U.S. 410 (1993), the Court invalidated a Cincinnati ordinance which banned newsracks distributing commercial handbills, while permitting those which contained newspapers. The fact that an inquiry into content was necessary to determine whether a given newsrack was permitted or proscribed doomed the ordinance: "Under the city's newsrack policy, whether any particular newsrack falls within the ban is determined by the content of the publication resting inside that newsrack. Thus, by any commonsense understanding of the term, the ban in this case is 'content-based.'" Id. at 429. The straightforward logic of Discovery Network applies with equal force to this case. Because it distinguishes between regulated and unregulated speech on the Internet and in other electronic media, based upon the subject matter to be discussed, the EAR's restriction on the publication of encryption source code and object code cannot be considered content neutral. iii. Content Neutrality and Regulatory Inquiry In addition to their facial references to content, it is clear that the regulations also require an administrative inquiry into the - 56 -
content of a putative speaker's message in order for the government to determine whether that expression is permissible. EAR § 742.15(a). Licensing schemes which require an inquiry into the content of a speaker' s message are not content neutral . Forsythe County, Georgia v. Nationalist Movement, 505 U.S. 123, 133 (1992); Arkansas Writers' Project Inc. v. Ragland, 481 U.S. 221, 230 (1987); FCC v. League of Women Voters of California, 468 U.S. 364, 383 (1984). Here there can be no question that an inquiry into content is part of the licensing scheme at issue. The regulations themselves provide for a "case-by-case" review of putative communications, to determine "whether the export . . . is consistent with U.S. national security and foreign policy interests." 15 C.F.R. § 742.15(b), 61 Fed. Reg. 68581. Moreover, from the beginning of this litigation, the government has claimed that it cannot reach a regulatory determination with respect to Professor Junger's intended expression without first knowing what he intends to say, a position confirmed in the Commerce Department's January 29, 1997 letter to Professor Junger's attorney. The regulatory scheme at bar seeks to weigh each electronic disclosure of encryption source code or object code against the national security and foreign policy interests of the United States, and grant or deny licences accordingly. Such an assessment necessarily involves an inquiry into the content of every message so regulated. Restrictions which contemplate such an inquiry as an essential part of the licensing process are not necessarily invalid, but neither are they content neutral. - 57 -
iv Content Neutrality and Alternative Channels of Communication Every content neutral time, place and manner restriction must leave open channels of communication which are adequate alternatives to those it forecloses. Ward, 491 U.S. at 790. With respect to cryptographic source code and object code, the government has submitted numerous scholarly articles in printed form dealing with the science of encryption (Exhibits to Defendants' First Memorandum of Points and Authorities). There can be no question that there exists a lively academic discussion in the field. Still, under Ward, this court is bound to consider whether the unregulated traffic in printed literature provides the "ample adequate alternatives" to the electronic exchange of information which the government has chosen to regulate. City of Ladue v. Gilleo, 512 U.S. 43; 129 L. Ed. 2d 36, 48 (1994). "The [Supreme] Court long has recognized that by limiting the availability of particular means of communication, content-neutral restrictions can significantly impair the ability of individuals to communicate their views to others. . . . . [t]o ensure 'the widest possible dissemination of information." Stone, Content-Neutral Restrictions, 54 U.Chi.L.Rev. 46, 57-58 (1987)(quoted in Ladue, 29 L. Ed. 2d at 47, n.13). In Ladue, the Court noted a ban on residential signs foreclosed "an unusually cheap and convenient form of communication" which for many might have "no practical substitute." Ladue, 129 L. Ed. 2d at 48. In Linmark, supra, which addressed a ban on for-sale signs, the Court took stock of the potential alternatives for home-sellers: [the]options to which sellers realistically are relegated - primarily newspaper advertising and listing with real estate agents - involve more - 58 -
cost and less autonomy than "For Sale" signs . . . are less likely to reach persons not deliberately seeking sales information, and . . . may be less effective media for communicating the message that is conveyed by a "For Sale" sign in front of the house to be sold . . . . The alternatives, then, are far from satisfactory. Linmark, 97 S.Ct. at 1618 (internal citations omitted). The alternatives which the EAR provides to those wishing to engage in an academic discussion involving source code and object code are similarly unavailing. Like the humble yard sign, the Internet provides academics and others with an inexpensive means of reaching large numbers of people with interests similar to their own. As noted above (see findings of fact 20 -23), the Internet began as a means to rapidly share academic papers and journals. Its speed, distributive power, and ease of use have made it "the medium of choice" among academics and other researchers who routinely share large amounts of information. (Leyland Decl., ¶¶ 3-4). Especially for those interested in encryption, the Internet has become an important means of announcing, discussing and criticizing new ideas, including ideas expressed in source code and object code. (Blaze Decl., ¶¶ 28-30). It is easy to imagine the advantages of such a forum over print. The same draft article, posted to an Internet newsgroup, to enjoy similar exposure and feedback, would have to be photocopied and mailed to a large list of individuals, some of whom the author might not even know were interested in his work. To benefit from the same level of criticism, the author would have to collect the critiques of every willing correspondent and distribute them to every other, over and over again with each round of revisions. Or he could post the article to an Internet newsgroup, allow interested - 59 -
critics to identify themselves, and then participate, with minimal effort, in an ongoing electronic roundtable. In both Ladue and Linmark, the Court considered cost, widespread distribution and the chance of reaching one's intended audience as factors to be considered in deciding whether there were "ample alternatives" to a medium foreclosed by regulation. On those criteria, print is simply no substitute for the Internet. The regulations at bar do provide for precautions which make the electronic publishing of source code and object code permissible. Those precautions involve the imposition of technical filters to prevent access to encryption information by computer users outside the United States. This notwithstanding, it is technically difficult to install such precautions, which would make it burdensome (or even impossible) for many Internet users to comply with these provisions. (Second Blaze Decl., ¶ 29). Moreover, there is no reliable way to determine the geographic location from which a request for information on the Internet arrives. Furthermore, some data transfer methods, like ftp, have no mechanism for soliciting or obtaining the verifications required by the EAR. These burdens, which may pose insurmountable obstacles to some file transfers, are not "adequate alternatives" to a system that works perfectly well without them. v. Content Neutrality Accordingly, the court finds that the regulations at bar cannot be considered reasonable content-neutral time, place and manner restrictions on free expression, and cannot properly subject them to an intermediate scrutiny on that basis. - 60 -
B. Expressive Conduct While intermediate scrutiny cannot be applied to the EAR based on the government's claim of content neutrality, the government has also suggested that intermediate review is appropriate because encryption source code and object code is regulated for "its function," and that the regulations apply to the "act" of export. A second vision of intermediate scrutiny is associated with United States v. O'Brien, 391 U.S. 367 (1968), under which a regulation on expressive conduct is valid if it (1) regulates a matter that is within the constitutional power of the government to regulate, (2) furthers an important or substantial government interest, (3) is unrelated to the suppression of free expression, and (4) places an incidental burden on free expression no greater than is essential to the furtherance of that interest. Turner Broadcasting, 114 S.Ct. at 2469 (citing: O'Brien, 391 U.S. at 377). Since O'Brien, this form of intermediate scrutiny has been applied in cases involving various forms of expressive conduct: Barnes v. Glenn Theaters, 501 U.S. 560 (l991)(nude dancing); Clark, 468 U.S. 288 (1984)(upholding park service ban on sleeping in Lafayette Park); United States v. Albertini, 472 U.S. 675 (1985)(entering military bases for the purpose of protesting national policy); Los Angeles City Council v. Taxpayers for Vincent, 466 U.S. 789 (1984)(upholding ban on posting signs on public property). The Court has also declined to save, through the application of O'Brien intermediate scrutiny, a number of regulations which - 61 -
facially prohibited some form of expressive conduct, but which operated to bar the underlying message expressed. R.A.V. v. St. Paul, 505 U.S. 377, 395 n.7(1992)(declining to adopt a lesser scrutiny for racially provocative expressive conduct criminalized under state law); United States v. Eichman, 496 U.S. 310, 317 (1990)(finding federal prohibition on flag burning was aimed directly at the message conveyed by the expressive conduct); Texas v. Johnson, 491 U.S. 397 (1989)(invalidating state law prohibiting flag desecration in a manner likely to incite onlookers); Carey v. Brown (1980)(invalidating ban on residential picketing other than in labor disputes as content based); Buckley v. Valeo, 424 U.S. 1 (1976)(invalidating portions of the Federal Election Campaign Act as violating the First Amendment, and declining to characterize campaign contributions as a form of conduct); Spence v. Washington, 418 U.S. 405 (1974;overturning conviction for attaching peace sign to flag displayed in window, and declining to apply O'Brien based on the underlying statute's clear concern for content); Police Dept. of Chicago v. Mosley, 408 U.S. 92 (1972)(invalidating ordinance which gave favorable treatment to labor pickets as content based). Because the court finds that (1) Professor Junger's intended publication is not "expressive conduct," within the meaning of O'Brien and its progeny, (2) that the government's purpose is not "unrelated to the suppression of free expression," and (3) that the regulations at bar do not advance a significant governmental interest. Accordingly, the regulations at bar cannot be subjected merely to intermediate scrutiny on the strength of O'Brien. i. The Conduct Element of Expressive Conduct - 62 -
The subsequent treatment of O'Brien teaches that its analysis is proper only in cases where the government seeks to regulate some form of "nonspeech" conduct in a way which incidently burdens speech. The Supreme Court has "often held that when speech and nonspeech elements 'are combined in the same course of conduct, a sufficiently important governmental interest in regulating the nonspeech element can justify incidental limitations on First Amendment freedoms.'" FW/PBS, 493 U.S. at 244 (White, concurring in part and dissenting in part)(quoting: O'Brien, 391 U.S. at 376)(see also: Texas v. Johnson, 491 U.S. at 402-04 (noting that written texts and the spoken word implicate a First Amendment analysis distinct from expressive conduct); Bernstein, 922 F.Supp. at 1435 (rejecting the government's suggestion that encryption software was a form of expressive conduct when the software "at least formally" appears to be speech). The difficulty with adopting an expressive conduct in this case is the absence of anything that might properly be called expressive conduct. Professor Junger seeks to make available on the Internet, and through other electronic media, including Email, texts which include cryptographic source code and object code. His communication of those texts cannot properly be characterized as conduct, even if the government has chosen to define "then act of export" to include such communications. Johnson, 491 U.S. at 402- 04. The question of whether a given course of conduct is sufficiently "imbued with elements of communication" to merit First Amendment status does not arise unless the speaker has chosen to convey his message other than in spoken or written words. Spence, - 63 -
418 U.S. at 409. For a prohibition on expressive conduct to be subjected to intermediate scrutiny, it must target the conduct, and not the expression, in which a speaker engages. Lee v. International Society for Krishna Consciousness, 505 U.S. 672, 704 (1992)(Kennedy, J., concurring)(pagination irregular in original). Because Professor Junger seeks to express himself in writing, albeit in an electronic forum, there is no severable "conduct" element to his expression which would allow it to be "incidentally" regulated under O'Brien. A closer analysis of the government's regulatory motives, in light of O'Brien and its progeny, reinforces this conclusion. ii. Unrelated to the Suppression of Free Expression The third of the four tests set forth in O'Brien requires a regulation on expressive conduct to be "unrelated to the suppression of free expression" in order to be valid. O'Brien, 391 U.S. at 377. In subsequent cases, the Supreme Court has expanded upon this requirement, to explain that regulations which target the secondary effects of expression are valid, while those which seek to limit the harm done through communication itself are not. Thus, in Johnson, the Court explained that "a law directed at the communicative nature of conduct must, like a law directed at speech itself, be justified by the substantial showing of need that the First Amendment requires," and not by the more relaxed standard found in O'Brien. Johnson, 491 U.S. at 406. Whether a regulation is "unrelated to the suppression of free expression" turns in large part upon the "governmental interest at stake" in the regulation, Id., and the way - 64 -
in which the prohibited conduct implicates that interest. When a regulation seeks to prohibit "conduct" precisely because of its communicative attributes, the restriction violates the First Amendment. Glenn Theatres, 501 U.S. at 577. While it is permissible to regulate the secondary effects of expression, the communicative impact which a given act of expressive has on its audience is never a secondary effect. Boos v. Berry, 485 U.S. 312 (1988). In this light, the export regulations at bar are not concerned with the secondary effects of Professor Junger's expression, so much as their direct impact upon his audience. The governmental interest at stake in this case is easily identified in the text of the EAR: encryption "may be used by persons abroad to harm national security, foreign policy and law enforcement interests." 15 C.F.R. §742.15, 61 Fed. Reg. 68580-82 (Dec. 30, 1996). But it is difficult to see how Professor Junger's electronic publication, on its own, would undermine this goal. Encryption software is not a force unto itself, or an animate being. Unlike even a computer virus, which once released into a computer network can cause havoc on its own, encryption software poses no threat to our national interests unless "persons abroad" are willing to use it to encode messages the concealment of which jeopardize American interests. While the court does not doubt that such persons exist, the fact that the government seeks to restrict Professor Junger's expression to avoid their misconduct sheds considerable light on whether the regulations at bar are "unrelated to the suppression of free expression," or even target "speech and nonspeech elements" which combined in the same course of conduct. FW/PBS, 493 U.S. at 244 (White, concurring in part and dissenting in part). On the most obvious level, the speech - 65 -
element regulated here (Professor Junger's) and the harmful conduct which the government seeks to prevent (the actions of some unspecified "foreign person") are not combined in the same course of conduct at all. They are the distinct acts of different people, linked only by the communication, and the information, which they presumably share in common. The status of expression which creates the risk of harm, by inciting, offending or inviting third parties to dangerous conduct is well settled in the jurisprudence of the First Amendment. Speech which incites lawlessness through the advocacy of violence cannot be proscribed or punished until that speech creates a clear and present danger of imminent lawlessness, which the speaker intends to create. Johnson, 491 U.S. at 409, Brandenburg v. Ohio, 395 U.S. 444, 447 (1969). Likewise, speech which risks provoking a hostile audience response is protected expression, absent a clear and present danger of serious harm. Johnson, 491 U.S. at 409; Street v. New York, 394 U.S. 576, 592 (1969); Terminiello v. Chicago, 337 U.S. 1, 4 (1949). Finally, in cases where speech provides third parties with the information or the inspiration necessary to commit a crime, the First Amendment has been extended to shield speakers from civil and criminal liability where their message provides the information or inspiration for a crime. Rice v. Paladin Enterprises. Inc., 1996 WL 515786 (D.Md.1996), is instructive in this regard.40 In Rice, a self _____________________ 40 See also: DeFillippo v. National Broadcasting Co., 446 A.2d 1036, 1040 (R.I.1982)(applied in wrongful death action of boy who hanged self after seeing hanging stunt on television); Herceg v. Hustler Magazine. Inc., 814 F.2d 1017 (5th Cir.1987), cert denied 485 U.S. 959 (1988)(reversing damage award in case against pornographic magazine which has published article on autoerotic asphyxia, imitation of which allegedly led to adolescent's death); Yakubowicz v. Paramount Pictures Corp., 404 Mass. 624, 536 N.E.2d - 66 -
styled "hit-man" committed three execution style murders, closely patterned on the instructions contained in Hit Man, an manual detailing the finer points of murder for hire. The survivors sued Paladin, Hit Man's publisher, alleging in wrongful death and survival actions. Holding that the First Amendment precluded the imposition of liability against the publisher, the District Court granted summary judgment. In doing so, the court applied the Brandenburg incitement standard, holding that even expression which incites lawlessness may not be punished absent a clear and present danger of lawless conduct, and the intention, on the part of the speaker, to bring it about. What Paladin, the hostile audience cases and the incitement cases share is a common logic: absent extraordinary circumstances, the First Amendment does not permit a speaker to be silenced beforehand, or punished afterward, based on what someone in his audience may do with, or as a result of, the message he conveys. Central to the government's position in this case is that the electronic publication of source code and object code is being regulated is being regulated "because of such software's functional capacity, rather than because of any possible informational value" the software might have. Executive Order 13026, 61 Fed. Reg. 58768-69 (November 15, 1996). But as has been made clear in the evidence submitted (Karn Decl., ¶¶ 13-15) that encryption source code does not run itself. It requires skill and knowledge to take ____________________ 1067 (1989)(wrongful death suit dismissed against publisher, despite fact that perpetrator had recently seen violent film from which he uttered lines as he killed his victim); Zamora v. CBS. Inc., 480 F.Supp.199 (S.D.Fla.1979)(network not liable for violent programming which led teenager to crime); Olivia N. v. N.B.C., Inc., 125 Cal. App.3d 488, 178 Cal.Rptr. 888 (Ct.App.1981)(network not liable to victim of copycat rape derived from televised drama)). - 67 -
such code, in whatever form it is published, compile it, install it on a computer, and use it for whatever purpose, be it good or ill. iii. Encryption as a Tool of Communication Nor is encryption software something which, like contraband, serves only malign purposes. As noted earlier, the bulk of encryption that is use today is employed legitimate, non-military enterprises. (Schneier Decl., ¶ 36). Its features extend from the commercial to the political, and in recent years encryption software distributed over the Internet has helped to identify and protect the victims of repression and human rights abuses throughout the world, by allowing them to communicate in confidence with human rights organizations worldwide. Much of this speech is wholly political, conducted with Americans, and would not take place but for the availability of encryption software . (Banisar Decl., ¶¶ 3-7 ). By virtue of this capacity, encryption technology serves other legitimate, expressive purposes as well. By protecting anonymity in electronic communications, encryption allows the unpopular and the stigmatized to gather information without fear of retribution. The right to gather information anonymously, Lamont, supra, the right to speak anonymously, McIntyre v. Ohio Election Comm'n, 115 S.Ct. 1511, 1524 (1995), and to publish anonymously, Talley v. California, 362 U.S. 60, 64-65 (1960), are all well established. If the Internet is to be regarded as a public forum, as well it should, these rights should obtain there with as much force as in any other medium. The First Amendment protects not only expression, but the tools - 68 -
of expression from improper regulation. Minneapolis Star & Tribune Co. v. Minnesota Comm'r of Revenue, 460 U.S. 575 (1983)(invalidating tax on ink and paper). Given that, and the legitimate uses of encryption as a tool of expression, this court cannot find the regulations at bar to be unrelated to the suppression of free expression. vi. Expressive Conduct and Intermediate Scrutiny The potential legitimate uses of encryption, and the fact that the harmful conduct which the government seeks to avoid in this case is not that of the speaker, but of as yet unidentified members of his potential audience, leads to only one conclusion: the restrictions on the electronic publication of encryption source code and object code are not "unrelated to the suppression of free expression," but directly linked to the communicative effect that Professor Junger may have on his audience. C. Strict Scrutiny The court is unable to conclude that the EAR's restrictions the publication of encryption source code and object code are either content neutral, or aimed at some form of expressive conduct. The regulations themselves, their stated goals, and their necessarily content based inquiry into regulated expression combine to make them nothing less than content-based restrictions on expression. As such, they are presumptively invalid. Simon and Schuster, 502 U.S. at 115. - 69 -
Where the government regulates speech in a public forum based on its content. the Constitution requires the regulations be subjected to the most exacting scrutiny. Denver Area Educ. Telcoms. Consortium, Inc. v. FCC, 116 S. Ct. 2374 (1996). Only when the government can assert a "compelling state interest" and the regulations at issue use "narrowly drawn" to achieve that end, will content based restrictions survive. Ragland, 481 U.S. at 231-232. The regulations here are asserted as necessary to protect the national security and foreign policy interests of the United States. 15 C.F.R. § 742.15, 61 Fed. Reg. 68580-82. As an initial matter, both the term "national security," and the notion of things affecting "foreign relations," are in themselves vague. McGehee v. Casey, 718 F.2d 1137, 1143 (D.C.Cir.1983)(citing: Halperin v. Kissinger, 606 F.2d 1192, 1200 (D.C.Cir.1979), aff'd by an equally divided Court, 452 U.S. 713 (1981); Zweibon v. Mitchell, 516 F.2d 594, 653-54 (D.C.Cir.1975). The government is not "free to foreclose expressive activities in public areas on mere speculation about danger." Bay Area Peace Navy v. United States, 914 F.2d 1224, 1228 (9th Cir.1990). When a restriction is aimed at communication, it will be deemed unconstitutional unless the government shows that the message triggering the regulation presents a "clear and present danger" of harm, or is otherwise unprotected expression. Tribe, Constitutional Law 798 (2d Ed.1987). Thus, even when dealing with issues of national security, the Court has "required a strong showing of imminent danger before permitting First Amendment freedoms to be sacrificed. Osborne v. Ohio, 495 U.S. 103, 141 (1990)(citing: New York Times Co. v. United States, 403 U.S. 713, 726-727 - 70 -
(1971)(Brennan, J., concurring). As early as Near v. Minnesota, 283 U.S. 697 (1931), the Court noted that speech might be restricted in the interests of national security only under exacting circumstances, such as prohibitions the disclosure of "the sailing dates of transports or the number an location of troops during wartime." Near, 283 U.S. at 716. Somewhat more recently, the Court declined to allow the injunction of the New York Times, when the newspaper sought to publish the Pentagon Papers, volumes of classified histories of the Vietnam War which had been secretly obtained by former Pentagon employee Daniel Ellsberg. New York Times, supra, 403 U.S. 713 (1971). The circumstances of New York Times are instructive here: despite the classified nature of the documents at issue in that case, and the fact that the disclosure of those secrets would come in the midst of the long and costly war, the Court refused to prohibit publication. By contrast, the government has shown no enemy, no foreign power, and no specific harm awaiting from Professor Junger's disclosure of encryption source code and object code. At least with respect to information which is publicly available, this court has no choice but to conclude that the regulations at bar are not narrowly tailored to advance any government interest. Indeed, as demonstrated by the Professor's videotape evidence, and several of his declarants, encryption software is readily available abroad and on the Internet for the asking. In seeking to regulate the dissemination of what is freely available, the government is not only shutting the barn door after the cow has left, but after she has calved and calved again. - 71 -
Publicly available encryption software is just that: available, worldwide. It advances no purpose whatever to restrict free expression in the interest of keeping secret that which is widely known. Accordingly, to the extent the EAR prohibits the disclosure, in whatever form, of publicly available encryption software, it violates the First Amendment. . - 72 -
CERTIFICATE OF SERVICE The undersigned hereby certifies that a copy of the foregoing was served on February 10, 1996, upon Anthony J. Coppolino, Department of Justice, Civil Division Room 1084, 901 E Street, N.W., Washington, D.C. 20530 by Express Mail. Respectfully submitted, [Signature] Gino J. Scarselli (0062327) 664 Allison Drive Richmond Hts., OH 44143 Tel. 216-291-8601 Fax 216-291-8601 Attorney for the Plaintiff