5 September 1997
Source: Hardcopy from Peter Junger

Tab E

Gino J. Scarselli, Esq.
664 Allison Drive
Richmond Hts., Ohio 44143
gscarsel@mail.multiverse.com
Tel/Fax 216 291-8601

July 18, 1997

VIA FAX AND EXPRESS MAIL

Anthony J. Coppolino, Esq.
Department of Justice
Civil Division, Room 1084
901 E Street, N.W.
Washington, DC 20530

re: Commerce Department response to Applications Nos. Z082060, Z082061, and Z082062.

Dear Mr. Coppolino:

As we have discussed, I am sending you this letter to forward to the Commerce Department. We are seeking clarification of some of the responses that Commerce made to our applications dated June 12, 1997.

I understand that you will first get some indication from Commerce as to how long we will have to wait for a response. I would appreciate it if you would let me know as soon as possible. We expect Commerce to reply within a reasonably short time since the Department has already reviewed our submissions. We would prefer a response from Commerce before we file the supplemental complaint, but we may file without one depending on how long it will take Commerce to respond.

Although we have more questions than the ones we ask below (like "Why was Twiddle classified as EAR99?"), we have tried to keep the list short and limit our questions to what we think is most important. Having said that, our questions are as follows:

1. In response to Application No. Z082061, the Department describes item 2 as "Portions of Chapter One to Computers and the Law, written by Professor Peter Junger in electronic form or media..." This is not an entirely accurate description of our request. We requested a classification of the entire chapter, which includes the source code and machine code representations of Twiddle and the source code in ANSII [sic] C of Paul Leyland's one-time pad (See Figure 1.4 in Chapter One). The response states that Twiddle is classified as EAR99 and that the "non-software part of the chapter" is not subject to the EAR if it "does not meet the definition of 'technology' under the EAR (e.g. discussion of export policy and the Junger lawsuit), or if it is 'publicly available' within the meaning of section 734.3 of the EAR..."

This response first ignores to mention Paul Leyland's program and second "classifies" the item. Chapter One, as both EAR99 and as "not subject to the EAR." On the first point, the failure to mention Paul Leyland's program may have been an oversight so we ask that Commerce address it in its response. On the second point, if the same item is subject to the EAR and not subject to the EAR, how is its export status determined?

Professor Junger used the chapter that was submitted in his class last fall. He is revising the chapter for his class this coming fall. If this fall's version of the chapter contains the RSA algorithm

in Perl, which was classified as ECCN 5D002 (Application No. Z082060, item 4) will the chapter be classified as ECCN 5D002, EAR99, not subject to the EAR or something else?

2. In Application No. Z082061, we requested a classification of an html page of links to overseas sites where encryption programs can be downloaded. Instead of responding with a classification, Commerce responded with an advisory opinion stating that "Professor Junger's activity is not an export that is subject to the Export Administration Regulations (EAR). See section 734.2(b) of the EAR."

Since Commerce has offered to supply us with an advisory opinion, we ask that the Department clarify the status of posting html pages that link to encryption programs overseas. Specifically, we have three questions: First, is the html page _itself_ classified under the EAR? Second, although the response states that Professor Junger's activity -- posting an html page containing links to overseas sites where encryption programs can be downloaded -- is not an export, can it be construed as providing technical assistance), would the same conclusion follow for anyone else who posts links to overseas encryption sites?

3. In Application No. Z082062, we requested rulings on programs that implement certain encryption algorithms and gave examples of such programs. In response, Commerce stated that it was unable to classify the requests because we would have to submit "a complete technical description of the particular software" rather than a description of programs that implement particular operations or algorithms.

We asked for classifications of programs that implement certain encryption algorithms rather than actual programs because programs can be written in different languages, versions and for different operating systems. For example, if we requested a classification for Wordperfect, we would expect that Wordperfect 5.1, Wordperfect 6.0 and Wordperfect 3.5 (for the Macintosh) would all be given the same classification. Without submitting a complete list of _all_ programs that implement particular encryption algorithms, which we could not do, how can we obtain a classification for programs that implement the same algorithm in different languages and different versions?

Again, please let me know as soon as possible when Commerce can respond. If you have any questions whatsoever, please let me know and I will do my best to answer them.

Sincerely,

[Signature]

Gino J. Scarselli
Attorney for Professor Junger

cc: Raymond Vasvari, Esq.
Kevin Francis O'Neill, Esq.
Peter D. Junger

2

Gino J. Scarselli, Esq.
664 Allison Drive
Richmond Hts., Ohio 44143
gscarsel@mail.multiverse.com
Tel/Fax 216 291-8601

July 24, 1997

VIA FAX AND MAIL

Anthony J. Coppolino, Esq.
Department of Justice
Civil Division, Room 1084
901 E Street, N.W.
Washington, D.C. 20530

re: your letter dated July 21, 1997

Dear Mr. Coppolino:

First, thank you for responding to my letter dated July 18, 1997. In your letter, you stated that the Commerce Department would respond no later than August 18, 1997. This, however, is unacceptable.

In the letter of July 18, we asked your client to clarify some of the responses to our classification requests. None of the questions asked in that letter require a review of new material. Your client has had all the information that it needs to respond since at least June 17, 1997. We believe that Commerce would be able to respond within a short time and expected a response by the end of this week. Although you stated in your letter and in our telephone conversation that Commerce would respond as soon as possible, we are not prepared to wait until August 18 for a response.

We do not want to further delay the litigation. At the same time, we want to be as reasonable as possible. Therefore, we will wait until the end of next week for a response. If we do not receive a response by Friday, August 1, 1997, we will withdraw our questions and prepare to file the supplemental complaint. If, by the end of next week, your client needs an additional day or two, please let me know.

Since our conversation on Tuesday, I have decided not to submit other questions that may delay a response from Commerce. I would, however, like to clarify the last question asked in the July 18 letter. The question had to do with our requests for rulings on programs that implement certain encryption algorithms. Our example of Wordperfect may not have been the best example since it is not an encryption program. Therefore, consider programs that implement the RSA algorithm. Commerce has classified our submission of a program in Perl that implements the RSA algorithms as 5D002 software. Are we justified in believing that a program in C, for

July 24, 1997
Page 2

example, or any other programming language that implements RSA would also be covered as 5D002 software?

If you would like to discuss this matter further, please feel free to contact me.

Sincerely,

[Signature]

Gino J. Scarselli
Attorney for Professor Junger

cc: Raymond Vasvari, Esq.
Kevin Francis O'Neill, Esq.
Peter D. Junger