Ian & Stuart's Australian Mac: Not for Sale/Another.not.for.sale (Australia).iso/hold me in your arms/crypto.export.controls/applied-floppy-appeal

Internet Message Format | 1994-09-12 | 12KB

Date: Thu, 9 Jun 1994 12:38:10 -0700
From: Phil Karn <[e-mail]>
Message-Id: <[e-mail]>
Subject: Final draft of CJ appeal, as filed

                        7431 Teasdale Ave
                        San Diego, CA 92122
                        June 7, 1994
                        619-587-8281 (voice)
                        619-587-1825 (fax)
                        [e-mail]


Dr. Martha C. Harris
Deputy Assistant Secretary For Export Controls
United States Department of State
Room 7325A
Washington DC 20522
202-647-1346 (fax)


Subject: Appeal in CJ Case 081-94, "Applied Cryptography Source Code Disk"

Also references: CJ Case 038-94, "Applied Cryptography", a book by
Bruce Schneier


        APPEAL OF COMMODITY CLASSIFICATION


This is an appeal under 22 CFR 120.4(g) of an adverse decision by the
Office of Defense Trade Controls (ODTC) in the above cited case.  It
is also a request for ODTC to justify their decision and to respond to
the points made here.

INTRODUCTION

In its May 11, 1994 reply in CJ Case 081-94, ("the Response") ODTC
classified the subject of this appeal, the "Applied Cryptography
Source Code Disk", ("the Diskette") as a defense article under
category XIII(b)(1) of the United States Munitions List. I hereby
formally appeal this determination on several grounds:

1) The information included on the Diskette is, for all practical
purposes and contrary to ODTC's claim, identical to that printed in
the book "Applied Cryptography" ("the Book"), which ODTC previously
ruled was in the public domain and outside their licensing
jurisdiction;

2) Even if the information on the Diskette had not already appeared in
a publicly available book, by ODTC's own prior interpretation of the
ITAR in CJ Case 038-94 it should nonetheless have qualified for the
very same "public domain" exemption; and

3) The First Amendment protects the freedom of speech and of the press
regardless of the medium of expression (diskette or printed textbook).
Therefore, the dissemination of the publicly available Diskette is not
within the licensing jurisdiction of your office.


DISCUSSION

1. The Diskette Should Qualify For The ITAR Public Domain Exemption
   As A Result of ODTC's Decision in CJ Case 038-94

In its Response, ODTC said:

    The text files on the subject disk are not an exact
    representation of what is found in "Applied Cryptography."
    Each source code listing has been partitioned into its own
    file and has the capability of being easily compiled into
    an executable subroutine.

This appears to be the basic rationale for ODTC's decision in this
matter.  I respectfully submit that the statement presents an
arbitrary and capricious distinction, but no meaningful difference,
between the information which is found in the Book and the
Diskette. That characterization of the Diskette provides no basis in
either law, regulations, or logic for ODTC's decision.

The Diskette is as close to Part Five of the Book as one could make
it.  The typographic layout of the Book makes it absolutely clear,
even to the non-programmer, where each cryptographic subroutine begins
and ends.  The name of each routine appears in bold font before the
routine itself and in the header of each page.  Moreover, the Diskette
uses these same names for its files.

The Response goes on to list the cryptographic routines included in
the Diskette and says that they would not be exportable if they were
incorporated into a product. But this is irrelevant to the present
matter, since all of these routines appear in the Book, which ODTC had
already ruled in CJ Case 038-94 to be outside its licensing
jurisdiction and therefore exportable.  The decision in this case must
be based on a comparison to the Book, which is functionally identical
to the Diskette, not to some hypothetical product.

The only real difference between the Book and the Diskette is the one
stated in my original request: the medium on which the information is
recorded.

Presumably, ODTC's phrase "added value" referred to the easy
machine-readability of the Diskette.  But "machine-readability" is no
longer well defined; it cannot be limited to information stored on
computer disks.  With the widespread availability of optical character
recognition (OCR) equipment and software, even printed information
such as the Book is easily turned into "machine readable" disk files
equivalent to those on the Diskette. Moreover, this only need be done
once.  It is then absolutely trivial to duplicate and disseminate the
resulting files by telephone modem or over the Internet.

And even without OCR capabilities, anyone with typing skills could
easily type in the routines from the Book, again producing machine
readable disk files.

2. The Diskette Should Qualify For The ITAR Public Domain Exemption
   Regardless of the Decision in CJ Case 038-94 Because the Diskette Is
   Itself Already in the Public Domain

The issue of whether or not the Diskette is an exact representation of
the Book is really a red herring. Even if the Diskette contained
source code not in the Book, or even if the Book did not exist at all,
the Diskette itself is in the public domain.

The ITAR at 120.10(5) exempts from the definition of controlled
"technical data" "information in the 'public domain' as defined in
120.11", and 120.11 defines "public domain" as "information which is
published and which is generally accessible or available to the
public" from libraries or through subscription, among other means.  Of
particular interest is the lack of any mention of the allowable media
or medium on which the information must be recorded to qualify for
"public domain" status. This is hardly surprising in that any such
restriction would be at once illogical and offensive to the First
Amendment.

This Diskette is obviously within the "public domain".  Anyone may
obtain it by mail order from the author for a nominal charge to cover
duplication and mailing.  (The restriction to US and Canadian
addresses exists only because of uncertainty about US export
regulations.) Furthermore, much of the source code contained on the
disk is in the public domain, in the even broader sense of the
original authors having granted blanket copying and use permission, or
relinquished copyright altogether.

The software on this Diskette is also readily available to the public
from many "anonymous FTP" repositories on the Internet, several of
which are outside the United States and Canada. These repositories
clearly qualify as "libraries open to the public" under 120.11(4).
Indeed, it seems that the subject software is even more strongly
"public domain" (in the ITAR sense) in machine readable form than in
book form, precisely because the machine readable form is so much more
readily obtainable.

3. The First Amendment Protects Absolutely the Freedom of Speech
   and the Press, Regardless of the Medium of Expression

The export of publicly available cryptographic information, including
software, is protected by the First Amendment to the Constitution.

The US Supreme Court has written that "[t]he liberty of the press is
not confined to newspapers and periodicals.  It necessarily embraces
pamphlets and leaflets.... The press in its historic connotation
comprehends every sort of publication which affords a vehicle of
information and opinion" (Lovell v. City of Griffin, 1938).  Freedom
of the press, says the Court, includes "the right of the lonely
pamphleteer who uses carbon paper or a mimeograph as much as of the
large metropolitan publisher who utilizes the latest photocomposition
methods" (Branzburg v. Hayes, 1972).

The computer network, the bulletin board system (BBS) and even
"sneakernet" (the manual exchange of diskettes) are clearly the modern
successors to the mimeograph machine. Users of these systems have just
as much First Amendment protection, including the right to export
their works, as John Wiley & Sons, publishers of "Applied
Cryptography".

There is opinion that the power to control exports is a Presidential
national security and foreign policy function that deserves wide
deference by the courts.  But the national security power, "like every
other governmental power, must be exercised in subordination to the
applicable provisions of the Constitution" (US v Curtiss-Wright Corp,
1936).  In Baker v Carr (1962), the Supreme Court said "[I]t is error
to suppose that every case or controversy which touches foreign
relations lies beyond judicial cognizance".

In Bullfrog Films, Inc. vs Wick (1988) the Federal Court of
Appeals for the 9th Circuit said "We ... reject ... the suggestion
that the First Amendment's protection is lessened when the expression
is directed abroad. The cases cited by the government do not support
its contention that otherwise protected free speech interests may be
routinely subordinated to foreign policy concerns".

And in New York Times Co v US, 1970, popularly known as the "Pentagon
Papers" case, the Supreme Court said, "[A]ny system of prior
restraints of expressions comes to this Court bearing a heavy
presumption against its constitutional validity" and the government
"thus carries a heavy burden of showing justification for the
imposition of such a restraint".

It thus seems impossible to argue that export controls on information,
including software, widely available in the United States, and even
already available in published form outside the US (such as the
Diskette) are necessary to prevent a "substantial likelihood of
serious damage to national security or foreign policy" (Haig v Agee,
1981).  Ordinary common sense says that ODTC's ruling in CJ Case
081-94 is arbitrary, capricious and wholly indefensible.

Indeed, in the most celebrated prior restraint case (United States vs
The Progressive, 1979), the government gave up all further attempts to
control the dissemination of the information in question (design
principles for thermonuclear weapons) once the Department of Justice
became aware that the information it sought to ban had been published
in the United States. Trying to ban further dissemination of that
publication would have been both unconstitutional and futile, as are
current attempts to control the export of public domain cryptographic
software.

Even an Assistant Attorney General of the Department of Justice has
expressed the opinion that export controls on publicly available
cryptographic information are unconstitutional:

"It is our view that the existing provisions of the ITAR are
unconstitutional insofar as they establish a prior restraint on
disclosure of cryptographic ideas and information developed by
scientists and mathematicians in the private sector". (Memorandum from
J. Harmon, Department of Justice, to F. Press, Science Advisor to the
President dated May 11, 1978, reprinted in "The Government's
Classification of Private Ideas: Hearings Before a Subcommittee of the
House Committee on Government Operations", 96th Congress, 2nd Session,
1980.)

This opinion is entitled to special weight because Mr. Harmon was, at
that time, in charge of the Office of Legal Counsel, the office which
is responsible for preparing all the official opinions of the Attorney
General.

CONCLUSION

I seek a favorable ruling that would recognize the "public domain"
exemption for publicly available cryptographic software, such as the
subject diskette, regardless of the medium on which it is recorded.

I hope this will be possible through administrative appeal.  Should it
become necessary, however, I am fully determined to seek judicial
relief.


                    Sincerely,



                    Philip R. Karn, Jr