14 July 1998
Note: Cindy Cohn is lead counsel for Daniel Bernstein in the Bernstein v. Department of State cryptography suit.
See Junger case files: http://jya.com/pdj.htm
Date: Tue, 14 Jul 1998 17:54:07 -0700 To: bernstein-announce@toad.com From: Cindy Cohn <Cindy@mcglashan.com> Hi all, I've now had a chance to review the decision in the Junger case. I think it contains many flaws, but will just highlight a few here. The most striking thing about the opinion is how much the judge's willfully ignored the undisputed factual record. Plaintiffs submitted voluminous declarations from programmers, computer science professors and others confirming that they often communicate using source code. The Declarants included Professor Abelson of MIT, author of the key introductory textbook of computer science, as well as Professor Appel from Princeton and several prominent cryptographers and general computer scientists. All of them confirmed the need to read, write and share source code as part of their work, and as part of the development of science. They also testified to the fact that many, many other people communicate using source code, and that higher level languages are developed to allow humans to write, read and develop each others ideas. The Judge does quote the Supreme Court ruling that speech must be protected by the First Amendment unless it is "so far removed from any exposition of ideas, and from truth, *science,* morality, and arts in general . . . " Yet despite these clear facts and despite the Supreme Court's clear inclusion of scientific speech as protected expression, Judge Gwin states: 1. "encryption source code may *occasionally* be expressive (p.12) 2. that in the "overwhelming majority of circumstances" encryption source code is exported to transfer functions, not to communicate ideas." (p.13) 3. "For the broad majority of persons receipting such source code, the value comes from the function" (p.13-14). 4. "encryption source code is rarely expressive" (p. 15). 5. "source code is conduct that can occasionally have communicative elements." (p.16) 6. "Source code is a set of instructions to a computer that is *commonly* distributed for the wholly non-expressive purpose of controlling a computer's operation." (page 17) 7. "encryption software is not typically expression" (page 18) There are similar statements of fact throughout the decision, none of which contain citations to anything in the record to support them. So where is the evidence to support his conclusions? The government submitted no empirical studies of source code "exports" from which one could conclude how often source code is "expressive." Certainly this is not the kind of thing which can be judicially noticed. At a minimum, the declarations create a triable issue of material fact as to how often source code is used to communicate ideas. This alone should preclude summary judgment. Also, I know of know authority which holds that the number of people who communicate in a given language is the basis on which we decide whether that communication is speech. Judge Gwin certainly cited none, but his opinion assumes that this is relevant. He also says that "certain software is inherently expressive" (page 13) without stating what he thinks that kind of software is and how it differs from encryption software. The Junger team argued that the "functionality" of encryption software, allowing privacy of speech, makes the software subject to the First Amendment on its own, just as the regulations of printing presses and newspaper racks violate the First Amendment even though the item itself may not be speech. The Judge ignored this argument entirely. Once the judge has decided that source code is not *sufficiently* expressive, he ignores the settled analysis for prior restraints in order to avoid applying the tests. The easiest mistake to see is his reliance on the 9th Circuit Roulette decision for his holding that prior restraint review shouldn't apply. Roulette was *not* a prior restraint case. It considered an ordinance which allowed the police to arrest citizens for sitting on the sidewalks. In Roulette, a person didn't have to apply for a license to sit on the sidewalks, he or she simply did it. The question of whether the act was expressive or not would always be reviewed by a Judge, as part of the criminal process. In the case of cryptography,in contrast, one of the key issues has been the fact that the cryptography regulations do not allow for a judge to review agency decisions denying or requiring a license. Thus, applying Roulette as the standard to judge whether prior restraint analysis applies is just plain wrong. Having dispensed with prior restraint by relying on a non-prior restraint case, the Court then considers overbreadth. Again, he ignores the record entirely. He claims, again without any citation to the record, that Junger has failed to show that "the resulting injury to other academics is the very same injury that Junger allegedly suffered." But Junger included Declarations from people who were *not* academics who have been injured by the export restrictions. He included declarations from Mr. Liebman (concerning some O'Reilly software) and Mr. Behlendorf (concerning the Apache server) demonstrating that even those whose software contains no encryption capability whatsoever have been injured by the encryption regulations. The record contains plenty of evidence that people other than Junger, attempting to do different kinds of things than he does, have suffered different kinds of injury due to the regulations. Similarly, Judge Gwin states that the regulations are not vague, ignoring the record evidence that many, many people do not understand them and have been chilled as a result. Next, Judge Gwin finds content neutrality based upon the argument that government is controlling the "functionality" of the software rather than its content. Acceptance of this phony distinction requires that a person have no understanding of computer programming. The content and the functionality of a computer program are synonymous. They have to be. There is no way to change or limit the functionality without also changing the content of the source code. To mandate key recovery is to mandate that computer programs have different content than they would otherwise; its' like saying that the government wants to control the "taste" of chocolate cake rather than the recipe. Change one, you must change the other. Judge Gwin also relies on the fact that the Government allows "export" of software on paper, thus defining "functionality" as based upon the fact that source code can be converted into object code which can be run. But this analysis also ignores the existence of scanners and typists. Software on paper isn't any less "functional" than software in electronic form. It simply requires one more, simple, step to make it functional. In the case of the single page of source code which is Snuffle, in the Bernstein case, the difference cannot be more than ten minutes worth of typing or a few minutes to scan and correct errors prior to compiling. *This* is the difference our national security rests upon? Judge Gwin then applies intermediate scrutiny, quickly finding that the test is met. In the end, Judge Gwin decided, despite the evidence, that source code isn't often read by anyone and so shouldn't really deserve First Amendment protection. The rest of the analysis flows from there, with no regard for the actual facts in the record. The result is that we have a new category of lesser protected expression, speech which is also "functional," without any clear or understandable definition of the term "functional." And all those computer scientists and their settled methods of communicating with each other apparently don't count when it comes to the First Amendment. The larger ramifications of this holding, if it becomes law for the rest of us, are frightening. Taken to its extreme, this holding could be the exception that swallows the rule of Reno v. ACLU. If the fact that something can "function" means it is not speech, every web page written in HTML could be held not protected, since at some level each page is a "functioning" computer program. Certainly any web page or other electronic publication which contains a Java applet is a "functioning" program. As I noted above, there are other criticisms which can be leveled as well. These are simply a few that I've found so far. Cindy ****************************** Cindy A. Cohn, Cindy@McGlashan.com McGlashan & Sarrail, P.C. 177 Bovet Road, 6th Floor San Mateo, CA 94402 (650) 341-2585 (tel) (650) 341-1395 (fax)