Encryption Source Code and the First Amendment

The First Amendment does not cover all speech acts. It instead extends constitutional protection to media for the communication of ideas, which are forms of social interaction that realize First Amendment values. The constitutional question, therefore, is whether particular uses of encryption source code are embedded within such media. It is insufficient to distinguish, as do current federal regulations, the publication of encryption source code in electronic form from its publication in written form. Instead it is necessary to focus on the social contexts within which encryption source code is used, whether in electronic or written form. From a constitutional perspective, it is one thing to use source code to convey ideas to an audience, and it is quite another to use source code to run a computer. The article suggests how each of these situations might be constitutionally analyzed. Source code is a high level computer language typically used by programmers to compose computer software.1 Federal regulations prohibit the unlicensed export of computer software, including source code, designed 2 to encrypt messages. To post encryption source code to the Internet is in most circumstances to "export" it under the terms of the regulations.3 Federal regulations do not seek to prohibit the unlicensed export of "a printed book or other printed material setting forth encryption source code," but © 2000 Robert Post. t Alexander F. and May T. Morrison Professor of Law, Boalt Hall School of Law, University of California, Berkeley. 1. See Bernstein v. United States Dep't of Justice, 176 F.3d 1132, 1140 (9th Cir. 1999), withdrawn pending en banc reh'g, 192 F.3d 1308 (9th Cir. 1999), appeal dismissied without prejudice and remanded, No. 97-16686 (9th Cir. April 11, 2000) [hereinafter Bernstein IV]. 2. See Bernstein v. United States Dep't of State, 974 F. Supp. 1288, 1294-96 (N.D. Cal. 1997) [hereinafter Bernstein 1]. To encrypt a message is to make it incomprehensible to someone who does not have the encryption code. Encryption code applies to messages that are sent in digital form. See ANDREW L. SHAPIRO, THE CONTROL REVOLUTION 73 (1999) ("Encryption tools... are the locks and keys of the digital age."). 3. See Junger v. Daley, 8 F. Supp. 2d 708, 713 (N.D. Ohio 1998), rev'd and remanded, No. 98-4045, 2000 U.S. App. LEXIS 6161 (6th Cir. April 4, 2000) ("Almost any posting of software on the Internet is an export."). BERKELEY TECHNOLOGY LAW JOURNAL they do extend to "encryption source code in electronic form or media (e.g., computer diskette or CD ROM).' 4 Daniel J. Bernstein, a professor of mathematics, statistics, and computer science, composed an encryption program called Snuffle in source code.5 He wished to "present his work on Snuffle within the academic and scientific communities. ' 6 Bernstein brought suit challenging the federal regulations as a prior restraint on his ability to speak. The Bernstein case raises the fascinating and controversial question of whether computer programs written in source code can be a form of expression for purposes of the First Amendment. Lee Tien's rich and complex article substantially contributes to our understanding of this question. 7 Tien's distinction between "coverage" and "protection," for example, is exactly right.8 To conclude that the First Amendment "covers" conduct, like the export of encryption source code, is to assert that the constitutionality of the conduct's regulation must be determined by reference to First Amendment doctrine and analysis. To conclude that the conduct is "protected" by the First Amendment, on the other hand, is to assert that the regulation of the conduct is unconstitutional. The question of First Amendment coverage goes to the threshold issue of the kind of analysis that should be brought to bear in evaluating the constitutionality of state regulations; the question of First Amendment protection goes to the ultimate judgments that we ought to reach in a particular case. The threshold question posed by the Bernstein case is whether federal regulation of encryption source code is to be assessed under the doctrines of the First Amendment. This is a question of coverage, and it shall be my focus in this brief comment. Bernstein answered this question in the affirmative, holding that the constitutionality of the federal regulations was to be determined by First Amendment principles. A closel ' analogous case, however, has seemingly reached the contrary conclusion. 4. 15 C.F.R. § 734.3 (1999), note to paras. (B)(2) and (B)(3). 5. See Bernstein IV, 176 F.3d at 1135-36. 6. Id. at 1136. 7. Lee Tien, Publishing Software as a Speech Act, 15 BERKELEY TECH. L.J. 629 (2000). 8. See Tien, supra note 7, at n.10. Tien draws this distinction from Frederick Schauer, Categories and the First Amendment: A Play in Three Acts, 34 VAND. L. REv.