INFOTECH AND THE LAW

Conflicting decisions by federal judges in two federal courts have set the stage for a decision on whether federal regulations prohibiting the export of encryption algorithms and software violate the First Amendment's prohibition on prior restraint of free speech.

Under the ITAR, a party wishing to export an item that may fall under the regulations may submit a request for a "commodity jurisdiction" determination. The State Department then determines whether the item will be regulated as a "defense article" under the ITAR or whether the export comes under the less burdensome regulation of the Department of Commerce.

In 1992, Daniel Bernstein developed an encryption system he calls Snuffle. He described the system in an academic paper and in source code written in C. He submitted a commodity jurisdiction request to the State Department. The department claimed that Snuffle was a defense article that could not be exported without a license. Bernstein then submitted another request, asking the State Department to confirm that his paper and the source code were all defense articles. The State Department insisted that they were. Bernstein then filed his lawsuit in the California federal court. He claimed that the ITAR regulation as applied to his paper and source code was a violation of the First Amendment as a prior restraint on free speech. After the suit was filed in 1995, the government backed away from its determination that his academic paper was subject to ITAR regulation, but continued to insist that the source code in C was subject to control.

In the meantime, in Washington, D.C., Phillip Karn submitted a commodity jurisdiction request for a book by Bruce Schneier called "Applied Cryptography." One of the chapters of the book contains source code for various encryption algorithms. The State Department ruled that the book was not subject to the ITAR. Karn then submitted a request for a determination on a diskette that contained the same source code as was listed in Schneier's book. In a somewhat incomprehensible about-face, the State Department ruled that the source code on diskette was regulated under the ITAR, even though it had already ruled that the same code in a book was not. Karn sued, claiming that the regulation was a content-based restraint on free speech in violation of the First Amendment.

The government moved to dismiss both First Amendment cases on the grounds that they do not concern "speech" protected by the First Amendment, but rather conduct, which may be regulated to a greater extent than speech. According to the government, source code cannot be speech because its purpose is functional -- to encrypt data, rather than to communicate a message. In two decisions that probably say more about the predilections of the two judges than about the state of First Amendment law, Karn's case was dismissed, while Bernstein's was allowed to proceed to trial.

In the Bernstein case, the judge quickly disposed of the government's argument that the Snuffle source code was speech, not conduct. First, source code is an expression in language -- albeit one understood by computers as well as by humans. Language, virtually by definition, is speech, and the regulation of any language is the regulation of speech. The nature of the language is irrelevant to the First Amendment. English, French, Swahili and C are all high-level expressions of ideas, commands and objectives. All receive the same protection under the First Amendment. The fact that source code is used to create machine-readable code rather than communicate the ideas and commands directly is likewise irrelevant. Music encoded on a player piano role or a CD is protected under the First Amendment to the same extent as written notation or the performance of the music. Having found that the source code is speech, the Bernstein court ruled that any prior restraint on its distribution is subject to the most critical scrutiny.

The judge in the Karn case reflected a different set of sensibilities about the protection offered by the First Amendment. Where the Bernstein court went to some length to analyze whether the source code was speech or conduct because speech deserves the greatest protection from government interference, the Karn court started from the presumption that distinguishing between speech and conduct for First Amendment purposes "places form over substance."

According to the Karn court, the government is entitled to regulate all speech and forms of expression so long as the regulation is content-neutral, furthers an important government interest and is narrowly tailored to the government's interest. Karn has appealed the dismissal of his case.

Jonathan Cain is a partner in the high-technology practice group of Shaw, Pittman, Potts &amp Trowbridge in McLean, Va. He can be reached via e-mail at Jonathan_Cain@shawpittman.com.