Source: http://cryptome.org/jya/pdj-reply6th.htm
Timestamp: 2019-04-25 17:47:28+00:00

Document:
Note: page numbers omitted from tables and text; 35 pages in original format.
18 U.S.C. 792 et seq.
In his principal brief, Professor Junger argued that, under well-established doctrine, encryption source code is a form of expression entitled to full First Amendment protection; that encryption source code is a form of expression written in formal languages, which allow people to communicate very precise and technical ideas; that the publication of encryption source code is necessary for the continuing advancement of computer science and cryptography and plays an essential role in the exposition of ideas in other disciplines; and that the Internet is fast becoming the preferred way for scientists and scholars to communicate and exchange ideas.
The government has conceded that encryption source code can be used to represent and convey ideas and falls within the ambit of First Amendment protection. (Gov. Br. at 35-36.) The parties therefore agree on the threshold question of whether the First Amendment extends to source code. But this alone does not, as the government points out, end the inquiry as to the constitutionality of the regulations at issue in this case. The remaining question is whether the challenged regulations survive First Amendment scrutiny. Professor Junger contends that they do not.
At the onset, it should be made clear that Professor Junger is not claiming that the government cannot legitimately regulate encryption source code or any other kind of software. For example, the government could prohibit a person from putting a virus on the Internet to intentionally damage computers. (See id. at 43.) Nor is Professor Junger claiming that the government cannot make it unlawful to assist foreign terrorists. The government has at its disposal a myriad of criminal laws, including federal conspiracy (18 U.S.C. § 844) and aiding and abetting laws (18 U.S.C. § 2), as well as the Espionage Act (18 U.S.C. § 792 et seq.), that could prohibit the export of encryption source code or other information intended to foreign terrorists.
The government cannot, however, condition the public dissemination of ideas and information, including ideas and information in the form of source code, on the discretion and advance approval of government officials. The First Amendment draws a sharp distinction between laws that punish speech after it occurs and laws that prevent speech from occurring. See Southeastern Promotions, Ltd. v. Conrad, 420 U.S. 546, 558-59 (1975). Laws that restrain expression in advance of publication and condition publication on the discretion of government officials offend the First Amendment unless they provide, at a minimum, procedural safeguards sufficient to protect against abuses of discretion. See Freedman v. Maryland, 380 U.S. 51 (1965).
The regulations at issue provide no such procedural safeguards and, for that reason alone, violate the First Amendment.
The government contends that it regulates the "export" of encryption source code only for reasons that have nothing to do with expression, but with encryption source code's "capacity to control the operation of computers." (Gov. Br. at 23.) The regulations, the government argues, should be treated as content-neutral, evaluated under intermediate scrutiny and deemed to be constitutional.
Assuming arguendo that the regulations are content-neutral, they nonetheless offend the First Amendment as an unconstitutional prior restraint. Otherwise valid content-neutral regulations on expression can violate the First Amendment if they do not provide sufficient procedural safeguards. See FW/PBS, Inc. v. City of Dallas, 493 U.S. 215, 223 (1990); see also Lakewood v. Plain Dealer Publishing Co., 486 U.S. 750, 764 (1988); Bernstein v. United States Dep't of State ("Bernstein II"), 945 F.Supp. 1279, 1287 (N.D. Calif. 1996) (appeal docketed) ("The danger inherent in prior restraints is largely procedural, in that they bypass the judicial process and locate in a government official the delicate responsibility of passing on the permissibility of speech.").
Before addressing the government's specific arguments, it is important to clarify certain features of the regulations challenged in this appeal.
First, this appeal is limited to those provisions of the EAR that require prepublication review and a license from the government before encryption source code can be made available on the Internet. Thus, this appeal challenges only the definition of "export" as it applies to encryption source code in 15 C.F.R. § 734.2(b)(9)(ii) together with the prepublication review and licensing provisions of the EAR that comprise the licensing scheme over encryption source code.
Second, the regulations define the "export" of encryption source code to include its publication on the Internet. Section 734.2(b)(9)(ii) of the EAR defines "export" as making encryption source code available on "electronic bulletin boards, Internet file transfer protocol and World Wide Web sites, unless the person making the software available takes precautions adequate to prevent unauthorized transfer of such code outside the United States or Canada." Making source code, or any information, available on a website, for example, is not ordinarily what we think of as an export since the source code remains on the computer within the United States, even though it is accessible outside the United States. Making source code and other information available on web site is, however, what we ordinarily think of as "publication"--the act of disseminating or making information generally available to the public.
Third, the regulations restrict the communication of ideas and information within the United States. The precautions required in § 734.2(b)(9)(ii) to prevent unrestricted foreign access are "nearly impossible" for most persons, including most cryptographers and computer scientists, to implement. See Junger v. Daley, 8 F.Supp.2d 708, 713 (N.D. Ohio 1998). Thus, restrictions on publishing encryption source code on the Internet curtail the First Amendment rights of U.S. citizens to communicate with persons within the United States, and not just with persons beyond our borders.
The regulations are thus an archetypical example of prior restraint and stand in direct contrast to valid time, place or manner restrictions, which regulate when, where and how expression can occur in a particular forum. Unlike valid licensing schemes, the regulations at bar condition the publication of encryption source code on the World Wide Web (and other Internet modalities) on the unbridled discretion of government officials.
Unbridled or excessive official discretion in the context of a permit or licensing scheme is the hallmark of an impermissible prior restraint. It is, moreover, enough to convert an otherwise valid content-neutral regulation into an unconstitutional prior restraint. Thus, "even if the government may constitutionally impose content-neutral prohibitions on a particular manner of speech, it may not condition that speech on obtaining a license or permit from a government official in that officials's boundless discretion." Lakewood., 486 U.S. at 764.
We will address in turn each of the three arguments raised by the government with respect to prior restraint: First, that Professor Junger cannot challenge the regulations as a prior restraint (Gov. Br. at 52-59); second, that Junger has "overstated" the extent to which the regulations grant discretion to licensing officials; and third, that the standard of "direct, immediate and irreparable" harm under New York Times Co. v. United States, 403 U.S. 713 (1971), should not apply herein.
The government argues that Junger cannot challenge the regulations as-applied because he never applied for, and was never denied, a license. The government also contends that a facial challenge is inappropriate because "exporting" encryption source code is not "ordinarily" an expressive activity, and (even if it were) the controls on encryption source code are not "directed narrowly and specifically" at that activity. (Gov. Br. at 55-56.) We address each argument in turn.
The Supreme Court in Lakewood affirmed the longstanding rule that one can raise a First Amendment facial challenge to a licensing scheme that allegedly vests excessive discretion in government officials. Id. at 756.
In the area of freedom of expression, it is well-established that one has standing to challenge a statute on the ground that it delegates overly broad licensing discretion to an administrative office, whether or not his conduct could be proscribed by a properly drawn statute, and whether or not he applied for a license.
Id. at 756 (quoting Freedman v. Maryland, 380 U.S. 51, 56 (1965)).
As noted, what the regulations define as the "export" of encryption source code includes its publication on the Internet. There is no question that the publication of source code, including encryption source code, is essential to the advancement of cryptography and computer science. Articles, papers, journals and textbooks that contain encryption source code are, as the government admits, "commonly published and distributed." (Gov. Br. at 50.) The publication of ideas and information that are essential to the sciences is a core form of First Amendment activity, at least as entitled to protection as lesser forms of expression that have supported facial challenges. See, e.g., FW/PBS, Inc. v. City of Dallas, 493 U.S. 215 (1990) (permitting a facial challenge to an ordinance that licensed sexually-oriented businesses); East Brook Books, Inc. v. City of Memphis, 48 F.3d 220 (6th Cir.), cert denied, 516 U.S. 909 (1995) (same).
1 Even in those instances where encryption source code is "exported" strictly for the purpose of having others compile it into executable code, often much more than "the press of a key-stroke" is involved. The declaration of Philip Karn illustrates this. (R. 20 Karn Decl., Apx. pg. 73-80.) Karn scanned the source code of an encryption program from Bruce Schneier's book Applied Cryptography into a computer, but before he was able to compile the program, he had to correct errors which arose not just from the scanning process, but errors contained in the original printed version. (See id. ¶¶ 4-10, Apx. pg. 74-77.) In order to correct those errors, he had to read and understand the meaning of the source code in question.
Karn's declaration demonstrates that there is no real expressive difference between source code in print and in electronic form, but that there is also no real functional difference between the two. The government itself conceded so much at oral argument in the Bernstein case.
Defendants claim that encryption poses unique and serious threats to national security, yet the printed matter exception belies this rationale . . . Defendants conceded at oral argument that the effect of this dichotomy would be to make it more difficult only for the more inept. . . . Again, the government conceded that in only a slightly greater length of time and with some greater technological skill, the regulation could be defeated.
Bernstein III, 974 F.Supp. at 1306. The additional "technological skill" needed to convert source code in a print rather than electronic format into object code is knowing how to use a scanner -- or how to type.
In the alternative, the government argues that even if encryption source code was ordinarily "exported" for expressive purposes, the EAR is a law of general application, and not directed "narrowly and specifically" at the publication of encryption source code. According to the government, the encryption controls on source code should be read as "part and parcel of [the EAR's] general controls on encryption products," which are only a small part of the vast range of items controlled under the EAR. (Gov. Br. at 55.) Since the EAR and even the EAR's encryption controls do not single out the publication of encryption source code on the Internet, a facial challenge here would be as inappropriate as a facial challenge to "a law requiring commercial building permits" because the law would "encompass the construction of publishing facilities." (Gov. Br. at 57.) The government's argument is without merit.
A facial challenge must be evaluated in light of what the plaintiff is seeking to invalidate. The proper question to ask is what would be the outcome of a successful challenge. This appeal is limited to challenging the EAR's encryption controls on source code and, in particular, the provisions of the EAR that require prepublication review and a license before encryption source code can be "exported" under 15 C.F.R. § 734.2(b)(9)(ii). If this challenge succeeds in establishing this aspect of the EAR as an unconstitutional prior restraint, the controls on encryption hardware (i.e. "devices"), object code and even encryption technology will be unaffected. Professor Junger is not asking this Court to facially invalidate the entire EAR, or the entire set of EAR encryption controls. Rather, Junger is asking this Court to invalidate only those provisions of the EAR that restrict the publication of encryption source code on the Internet.
2 See 63 Fed. Reg. 72162 (to be published in 15 C.F.R. § 742.15(b)(1)(i)); 63 Fed. Reg. 72165 (to be published in Supp. No. 6 to Part 742 (relaxed licensing and reporting requirements for computer programs in object code, but not in the form of source code).
The regulations on encryption source code, unlike laws of general application, are also prone to the risks of censorship identified in Lakewood that justify facial challenges to discretionary licensing schemes. The Court in Lakewood identified two risks of censorship: self-censorship, in which a person refrains from engaging in expressive activity, and impermissible government censorship, in which it may be difficult to prove that the licensor's decisions were based on content. See 486 at 757-59. Both are inherent in the encryption scheme.
The record shows that the challenged regulations have resulted in a number of instances self-censorship. (Junger Br. at 54.) The government nonetheless claims that Junger "has greatly overstated the risk that the licensing regulations will deter persons from engaging in expressive activities for which a license is not required." (Gov. Br. at 62 (emphasis added).) The government presents a novel interpretation of self-censorship. If self-censorship refers just to expressive activity that does not require a license, then a licensing scheme that subjects all publication to the unbridled discretion of a licensor would present no risk of censorship. This is absurd. The risk of self-censorship as a result of the regulations on encryption source code is both real and substantial.
Finally, prudential considerations favor allowing a facial challenge to the regulations at issue. Because a license must be sought each time a person wants to publish encryption source code on the Internet, if prepublication facial challenges were unavailable, one would have to challenge each denial in a separate suit. Moreover, since a license would have to be sought for each publication, the challenged scheme shares a special risk of self-censorship in common with the annual licensing scheme invalidated in Lakewood. See 486 U.S. at 759-60. Licensing schemes that require multiple licenses or periodic renewal create the risk that one will alter or refrain from certain speech in order to secure a favorable determination in the future. See id.
In sum, the encryption regulations have a close enough nexus to expressive activity, namely the publication of encryption source code, and present sufficient risks of both self-censorship and content-based censorship to justify a facial challenge.
The government argues that Professor Junger is not entitled to raise an as-applied challenge because he never applied for a license and therefore "cannot, for example, claim that the government has denied him a license in order to suppress the dissemination of particular information about cryptography." (Gov. Br. at 52.) This argument ignores the fact that Junger commenced the licensing process by submitting requests for commodity classifications. (See R. 40 Tab C, Application requests, Apx. pg. 318, 346-48, 367-69, 375-76.) Contrary to the government's characterization of classifications requests as "providing guidance" to "persons who are uncertain about the applicability of the licensing requirements" (Gov. Br. at 62), a person is required to submit specific programs in order for them to be classified.3 Moreover, the government's argument ignores the fact that the existence of the licensing process itself and not simply the denial of a license, chills speech.4 See Interstate Circuit v. Dallas, 390 U.S. 676, 688 (1968) ("attendant evils" of a prior restraint "are not rendered less objectionable because the regulation of expression is one of classification rather than direct suppression" ); see also Bantam Books, Inc. v. Sullivan, 372 U.S. 58, 67-68 (1963) (recognizing a chill on speech by an informal system of censorship). Thus, Professor Junger can challenge on an as-applied basis the requirement that he obtain a license for publishing on-line the programs he submitted that were subsequently classified as ECCN 5D002 (i.e., subject to licensing as encryption items). Cf. G&V Lounge, Inc. v. Michigan Liquor Control Comm'n, 23 f.3d 1071, 1076 (6th Cir. 1994) (chill of First Amendment rights is an "injury in fact" for purposes of Art. III standing).
The government claims that Junger has overstated the degree of discretion given to BXA and other government officials. (Gov. Br. at 59.) Although the regulations appear to include detailed standards restraining the decisions of government officials, classification and licensing decisions, in the final analysis, permit the exercise of a great deal of discretion.
This is but one example of the discretion which the BXA and NSA exercise in classifying encryption software for export control. The government has also classified source code that contains no encryption capability as encryption software. (See Junger Br. at 53.) Thus, either the regulatory definition itself is not sufficiently clear, or government officials rely on other factors neither clear nor discernable when classifying encryption source code.
Licensing decisions are ultimately made on a case-by case basis, and take into account foreign policy and national security interests. Licensing decisions based on foreign policy and national security may not, as the government notes, lend themselves to "mechanical application," but they also no doubt lend themselves to abuse.6 See United States v. Stanley, 483 U.S. 669, 695-96 (1987) (Brennan, J., concurring in part and dissenting in part).
6 Invocation of "foreign policy" and "national security" are ultimately as vague as a regulation adopted "in the best interest of the community," which was invalidated in Southeastern Promotions, 420 U.S. 546.
Particularly in cases where licensing decisions cannot be reached by the mechanical application of a given standard, procedural safeguards are required to protect against abuses of discretion. The challenged regulations have two fundamental flaws: (1) they fail to provide a definite and reasonable time limitation within which licensing decisions must be resolved, and (2) fail to provide for expeditious judicial review of adverse decisions. See 15 C.F.R. § 750.4(a)(1), § 756.2(c)(2). The lack of reasonable and definite time limitations is in itself a form of "unbridled discretion" that supports a facial challenge and is enough to find the regulations unconstitutional. FW/PBS, 493 U.S. at 223-24.
The government argues that this case does not involve a traditional prior restraint that requires a showing of "direct, immediate and irreparable" harm. (Gov. Br. at 63-64.) This case is precisely that, in that it involves regulations that require the approval of government officials before scientific and academic papers can be published on the Internet.
The original purpose of the First Amendment was to guard against licenses imposed on publication. "[I]t has been generally, if not universally, considered that it is the chief purpose of the [First Amendment's] guaranty to prevent previous restraints upon publication." Near v. Minnesota, 283 U.S. 697, 713 (1931). The Court in Near recognized only three narrow exceptions to the general prohibition against prior restraints: cases involving obscenity, immediate incitements to acts of violence, and prohibitions on constitutionally protected publication that can be overridden only by the most compelling security concerns. Id. at 716. The last exception applies not to mere assertions of national security, but in situations comparable to "the publication of the sailing dates of transports or the number and location of troops" during times of war. Id.
7 The government's assertion that its interests sound in national security and foreign policy also support application of the third Near exception. See Nebraska Press Assoc. v. Stewart, 427 U.S. 539, 592 (1976) (Brennan, J., concurring) (stating that "as an initial matter, the purpose for which a prior restraint is sought to be imposed 'must fit within one of the narrowly defined exceptions to the prohibition against prior restraints" (citations omitted)).
Application of the third Near exception is justified only if the government can show that without preapproval a publication will result in "direct, immediate, and irreparable damage to our Nation or its people." New York Times, 403 U.S. at 730 (Stewart, J., joined by White, J., concurring). Under this formidable showing, the government has not and cannot justify its restraint on scientific and academic publication.
The government argues that the New York Times standard only applies if it is seeking to suppress "disfavored information and ideas." (See Gov. Br. at 64.) But the First Amendment's disapprobation of prior restraints extends beyond a prohibition of only those restraints which suppress disfavored expression. See, e.g., Bernard v. Gulf Oil Co., 619 F.2d 459, 476 (5th Cir. 1980) (en banc), aff'd on other grounds, 452 U.S. 89 (1981) (striking down court order prohibiting all solicitations of prospective plaintiffs by plaintiffs seeking class certification and their attorneys); Fernandes v. Sanatani, 663 F.2d 619, 632 (5th Cir. 1981), cert. denied, 458 U.S. 1124 (1982) (striking down section of permit scheme that authorized denials of a permit for prior violations). Thus, the government is bound by New York Times even if its purpose is not to suppress disfavored information.
The government devotes most of its brief to arguing that the challenged regulations are content-neutral and survive intermediate scrutiny. But even if the regulations are found to be content-neutral, they cannot survive intermediate scrutiny in a way sufficient to sustain the judgment below.
Under the standards set forth in United States v. O'Brien, 391 U.S. 367 (1968), "a content neutral regulation will be sustained if 'it furthers an important or substantial governmental interest; if the governmental interest is unrelated to the suppression of free expression; and if the incidental restriction on alleged First Amendment freedoms is no greater than is essential to the furtherance of that interest.'" Turner Broadcasting System, Inc. v. FCC , 512 U.S. at 662 (quoting O'Brien, 391 U.S. at 377). The government has not shown, and cannot show, that the regulations meet all three prongs of the O'Brien test.
In applying the O'Brien test to the facts in this case, this Court must first determine not only if the government has asserted an important or substantial interest, but also whether the regulations "will in fact alleviate the harms in a direct and material way." Turner, 512 U.S. at 664. The government asserts that its interest is to keep encryption out of the hands of "hostile countries, organizations, and individuals who could jeopardize our national security and foreign policy." (Gov. Br. at 45.) The question is not whether this is an important government interest, we assume that it is, but whether the encryption regulations on source code further that interest "in a direct and material way."
The government has introduced evidence that the use of encryption "by foreign intelligence targets 'can have a debilitating effect on NSA's ability to collect and report * * * critical foreign intelligence'" (Id. (quoting R. 63 McNamara Decl. ¶ 5, Apx. pg. 216)), but the government has not shown that the challenged regulations are an effective means of keeping encryption out of the hands of foreign intelligence targets. In contrast, Junger has submitted evidence to the contrary.
Vice Admiral McConnell of the NSA, in response to Senator Murray's question "[w]ith at least 20 million people hooked up to the Internet . . . how do U.S. export controls actually prevent criminals, terrorists, or whoever from obtaining . . . encryption software?" stated that "[e]ncryption software distribution via Internet, bulletin board or modem does not undermine the effectiveness of encryption export controls." ((R. 60 McConnell testimony, Apx. pg. 205.) NSA Deputy Director Adm. William Crowell repeated the same point to Congress, stating that "serious users of security products don't obtain them from the Internet."8 (R. 60 Crowell Decl., Apx. pg. 201.) The testimony of these two high-ranking NSA officials is strong evidence that the regulations restricting the "export" of encryption source code on the Internet do not further the government's stated interest. At the very least, this evidence creates a genuine issue of material fact inconsistent with the district court's grant of summary judgment.
[S]erious users of security products don't obtain them from the Internet. The president of a prominent Internet security corporation was recently asked in a magazine article on this issue: "Since encryption technology is available as freeware off the Internet, why would anyone pay a company for it? He responded by saying: "Freeware is worth exactly what you pay for it. I'd rather not implement security systems using software for which the source code is available to any 12-year old who thinks being a hacker is fun."
Moreover, the fact that encryption software is widely available outside the United States9 does not support regulations that are intended to keep encryption out of the hands of foreign intelligence targets and, in particular, does not justify regulations that restrict the Internet publication of the exact same source code available overseas.10 See Florida Star v. B.J.F., 491 U.S. 524, 535 (1989) (stating that the "dissemination of information which is already publicly available is relatively unlikely to advance the interests . . . [of] the State. . . ").
The Court has warned that "it may not simply assume that [a regulation] will always advance the asserted state interests sufficiently to justify its abridgment of expressive activity." Turner, 512 U.S. at 664 (quoting Los Angeles v. Preferred Communications, Inc., 476 U.S. 488, 496 (1986)). The government is asking this Court to do exactly that: assume that the government's interests are furthered by the challenged regulations.
The government contends that the regulations are "unrelated to the suppression of free expression" because they target encryption source code's capacity to make computers encrypt data." (Gov. Br. at 48.) The government also contends that the challenged regulations are effective in furthering its stated interest of keeping encryption out of the hands of terrorists and others who might endanger national security.11 This, according to the government, justifies its control over the dissemination of encryption source code on the Internet.
11 As just noted, if the regulations do not further the government's interest, they fail the first prong of the O'Brien test.
Thus, the government finds itself on the horns of a dilemma: either the challenged regulations restricting the dissemination of encryption source code on the Internet are not effective, in which case the government cannot satisfy the first prong of O'Brien, or the regulations, as designed, are effective and result in insecure communications and therefore less speech on the Internet, in which case the regulations fail the second prong of O'Brien.
Assuming for the sake of argument that the government has satisfied the second O'Brien prong, it has not satisfied the third. Under O'Brien's third prong, the government "bears the burden of showing that the remedy it has adopted does not 'burden substantially more speech than is necessary to further the government's legitimate interests.'" Turner, 512 U.S. at 665 (quoting Ward, 491 U.S. at 799). The government has not carried this burden.
There is no question that the regulations at issue burden a substantial amount of protected speech. The "basic thrust" of the challenged regulations "threatens to undermine essential features of scientific freedom and the open exchange of information that are generally acknowledged as critical to innovation in science and technology and are responsible in large part for the preeminence of America's research and development enterprise." (R. 60 AAAS letter, February 7, 1997, at 1, Apx. pg. 187.) Again, given the testimony of the NSA officials cited above, there exists a genuine issue of material fact over whether the regulations burden more speech than necessary to further the government's stated goal.
12 Even if print, for example, was found to be an adequate, alternative medium for purposes of intermediate scrutiny, the availability of alternative media is irrelevant to a prior restraint analysis. The existence of alternative forums or media "does not justify an otherwise impermissible prior restraint." Southeastern Promotions, 420 U.S. at 556.
For reasons given above and given in Appellant's opening brief, this Court should reverse the district court's judgment.
American Civil Liberties Union of Ohio Foundation, Inc.
Undersigned counsel certifies that this brief complies with the type-volume limitations set forth in Rule 32(a)(7)(B) of the Federal Rules of Appellate Procedure. The brief uses a 14-point proportional font and contains _________ words.

References: § 844
 § 2
 § 792
 v. 
 v. 
 v. 
 v. 
 v. 
 § 734
 § 734
 v. 
 v. 
 v. 
 v. 
 v. 
 § 734
 § 742
 v. 
 v. 
 v. 
 v. 
 § 750
 § 756
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.