Reflections on the Bernstein ruling

(Please keep in mind that I'm not a lawyer yet, and that my comments are
intended only as the reflections of an amateur and are intended as
discussion fodder, not legal advice.)

Folks seem to be very excited about Judge Patel's ruling in the Bernstein
case - and with good reason. It was, for example, a first-page
above-the-fold item in both of the Bay Area's legal newspapers today.
Unfortunately, most of the media reports have done a poor job of
interpreting the ruling, and it's easy to draw bad conclusions from erratic
news reports about the case. The decision is available online
<http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/961206.decision>
thanks to the folks at EFF. I thought list members might appreciate a
summary of the decision and its potential effects.

1. What the ruling said

In brief, Judge Patel ruled that Category XIII(b) (the category which
refers to cryptographic equipment/software) is unconstitutional because it
functions as a prior restraint upon speech without providing important
procedural safeguards which are required when a prior restraint scheme is
put into place. She ruled that the "technical data" provision of the ITAR
is also unconstitutional when it refers to technical data about Category
XIII(b) items because of the lack of procedural safeguards.

Mopping up other points raised by the suit, Judge Patel ruled that the term
"defense article" as defined in 22 CFR 120.6 should be read to elide the
phrase "or technical data"; and that when interpreted that way, the terms
"defense article", "defense service", and "technical data" are not
unconstitutionally vague. She also ruled that the term "export" is not
unconstitutionally vague, and writes (in 'dicta', which is legalese for
"offhand comment", e.g., without precedential value but interesting as a
hint re what's going on in the judge's mind) that placing software on an
"Internet site" which can be accessed from a foreign country is an export
for ITAR purposes.

She also ruled that the "fundamental research in science and engineering"
(120.11(8)) and "general scientific, mathematical, or engineering
principles" (120.10(5)) exceptions to the definition of "technical data"
are void because they are too vague. As far as I can tell, they are thus no
longer available to potential ITAR defendants.

2. What the ruling didn't say

Judge Patel declined to address the merits of two of Bernstein's arguments:
that cryptographic software is independently worthy of First Amendment
protection as a tool which enables confidential speech and privacy, and
that the ITAR scheme violates the Administrative Procedure Act.

She also refused to grant Bernstein a preliminary injunction which would
have prohibited the US Government from prosecuting him for teaching his
class this spring, because her ruling means that his proposed activities
are not (for now) illegal.

The opinion also narrowly fails to say whether or not Category XIII(b) is
content-based or content-neutral; but reaches its conclusion by pointing
out that such a determination isn't necessary, because even if XIII(b) is
content-neutral, it is still unconstitutional. (* My reading of the opinion
diverges from the EFF's, as reported in their 12/17 press release, on this
point. I think my interpretation is correct. YMMV.)

3. What the ruling means

Some messages that I've seen have suggested that her ruling means that the
ITAR does not apply to crypto of any kind; or that crypto can now be
exported in, variously, the Ninth Circuit, or Northern California, or
Berkeley. Strictly speaking, Judge Patel's ruling is not binding precedent
in any court. The doctrine of "stare decisis", which says that courts
should not disturb existing precedent, suggests that other district courts
in the Northern District of California will follow Judge Patel's ruling, at
least until the Ninth Circuit addresses the issue (in this case or a
different one). But "stare decisis" is a policy statement, not law; and, as
the decision in _Karn v. Dept of State_ makes clear (by ruling that the
First Amendment does not prevent applying Category XIII(b) to source code),
district courts around the country are free to disagree with each other and
issue contradictory or incompatible opinions. (I'm interested in any
analysis which would suggest that her ruling is binding on the ND CA courts
for reasons other than stare decisis; I'm not aware of other grounds, but I
don't know everything, either. Comments?)

Further, Judge Patel's ruling yesterday is dependent upon her earlier
ruling which held that source code is speech for First Amendment purposes.
That ruling has not yet been reviewed at the appellate level, and is not
uncontroversial nor universally accepted. If another court disagrees with
that ruling, Judge Patel's otherwise convincing reasoning in this case
(which says that the lack of procedural safeguards for this prior-restraint
scheme is unconstitutional) is irrelevant - because without speech, the
First Amendment (and its hostility to prior restraint) isn't applicable.
It's also significant because her earlier ruling said that source code is
speech - and her reasoning for reaching that result does not apply to
object code or executables. 

It's also unclear that Judge Patel's ruling is enough to make export of
crypto source legal by people/organizations located even in the Northern
District of CA. Venue is proper, in an ITAR case, in any jurisdiction which
the defense articles have moved through. (18 USC 3237(a); _US v. Durrani_
659 F.Supp 1177, 1182 (D. Conn, 1987); an easy analogy is to the _US v.
Thomas_ "Amateur Action" case, where Tennessee venue was proper for
prosecution of California defendants who sent porn into Tennessee.) So it's
at least arguable that the feds could simply bring an ITAR prosecution in
another district, if exported crypto flowed through that district. (But I
don't think they can do so against Dan Bernstein because of "res judicata",
a doctrine which says that once two parties have fully litigated an issue,
they cannot come back to the same court - or a different one - and ask to
relitigate the same issue.) 

So while the ruling has considerable historical, cultural, and symbolic
significance, it's dangerous to assume that it means that export
restrictions on crypto are dead.

--
Greg Broiles                | US crypto export control policy in a nutshell:
gbroiles@netbox.com         | 
http://www.io.com/~gbroiles | Export jobs, not crypto.
                            |

Greg Broiles <gbroiles@netbox.com> writes:

>> (Please keep in mind that I'm not a lawyer yet, and that my comments are
>> intended only as the reflections of an amateur and are intended as
>> discussion fodder, not legal advice.)

I'm not one either.

>> It's also unclear that Judge Patel's ruling is enough to make export of
>> crypto source legal by people/organizations located even in the Northern
>> District of CA. Venue is proper, in an ITAR case, in any jurisdiction which
>> the defense articles have moved through. (18 USC 3237(a); _US v. Durrani_
>> 659 F.Supp 1177, 1182 (D. Conn, 1987); an easy analogy is to the _US v.
>> Thomas_ "Amateur Action" case, where Tennessee venue was proper for
>> prosecution of California defendants who sent porn into Tennessee.) So it's
>> at least arguable that the feds could simply bring an ITAR prosecution in
>> another district, if exported crypto flowed through that district. (But I
>> don't think they can do so against Dan Bernstein because of "res judicata",
>> a doctrine which says that once two parties have fully litigated an issue,
>> they cannot come back to the same court - or a different one - and ask to
>> relitigate the same issue.) 

It happens to be the case that the Northern District of California
borders on the Pacific Ocean, and includes (at least) two airports
with direct flights to more crypto-friendly jurisdictions to the west.
I do not know if there are any satellite or oceanic cables similarly
situated, but I wouldn't be surprised.

Of course, the significance of this is between you and your lawyer.

		Marc

a good review by Greg Broiles of the reasons, expressions of 
    "faith and doubt," etc. on the part of Judge Patel, and further 
    confirmation of my statements on the wide open plains of judicial 
    discretion on the federal bench.  Judge Patel is also to be 
    commended for her courage of standing up to the pressure from the 
    DOJ and the White House; I doubt she is high on their popularity 
    chart... <g>

        I think my comment on firing a shot which has breached Fort 
    Clinton and the thanks we owe Bernstein and all the lawyers is 
    about the bottom line --we have hit the target, but we have not 
    killed the beast.  It will take many more decisions, on a case by 
    case basis, to fight the administration, and a few brave souls 
    could be looking at three hots and a cot before it is over.

        have no doubt:  Bubba has no intention of backing down. Free 
    speech, and private communication over open public lines, removes 
    the power of the government to intimidate the populace; and takes 
    away the media's slanted exclusivity.  

    Expect a wave of prosecutions as the DOJ goes for broke.

            --attila

  ==
    Tyranny Insurance by Colt Manufacturing Co.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: Encrypted with 2.6.3i. Requires 2.6 or later.

iQCVAwUBMrzaBr04kQrCC2kFAQG7ogQAuW2xTRiSY1CKixwzMr2O5TkT/P7OpNug
9Jb/mcQhc/b/JivaW6qWDQQiiVz1NZ0ueRWlAX3UJvJ70qv4uRmiOACCXYIkmgno
vtZMDOgmMayICJrrtsve2vCVRna28St8tev8UvAenIIHcwYZILT7RhcgRXsESIsa
gywlHvXYaAc=
=tg0J
-----END PGP SIGNATURE-----

At 10:46 PM -0800 12/21/96, Attila T. Hun wrote:
>        have no doubt:  Bubba has no intention of backing down. Free
>    speech, and private communication over open public lines, removes
>    the power of the government to intimidate the populace; and takes
>    away the media's slanted exclusivity.
>

It takes away a power J. Edger Hoover used very effectively.  That is, the
power to control Washington power brokers by tapping their lines and
gathering dirt.  While there are "institutional reforms" which have
"eliminated these kinds of abuses", without at least a public audit which
shows every use of FBI (etc.) wiretapping equipment, and a paper trail to
back it up, we can not be sure.

(This audit would require a separate escrow agency to keep the wiretap
equipment and check it out to the FBI for use.  It would also require that
the equipment be complex enough that it can't be cobbled together with
pieces from Radio Shack.  Note that these restrictions are less severe than
those Greg Broiles describes for convicted felons during parole.)


-------------------------------------------------------------------------
Bill Frantz       | Client in California, POP3 | Periwinkle -- Consulting
(408)356-8506     | in Pittsburgh, Packets in  | 16345 Englewood Ave.
frantz@netcom.com | Pakistan. - me             | Los Gatos, CA 95032, USA