D. Black comments on Bernstein / ITAR decision

December 29, 1996
© 1996 David Black <dlb@osf.org>

I read the decision in detail, and while I'm not a lawyer I do seem to have a
reasonable tolerance for/understanding of legalese.  IMHO,

> ||| Judge rules ITAR unconstitutional in Bernstein case |||
>  
> On Monday 12/15, Judge Marilyn Hall Patel declared the ITAR unconstitu-
> tional in the closely watched Bernstein case (see TBTF for 1996-04-21 [1]).

Well, what she actually did is declared the application of the ITAR to the
regulation of the export of cryptographic software and algorithms to be
unconstitutional.  The ITAR is a broad set of regulations that control
everything that could be useful to an enemy in wartime (bombs, tanks,
guns, etc.); the entire set of these is the US Munitions List, and it
is the inclusion of cryptographic software and algorithms that brings
them under ITAR.  Needless to say, there are a lot of other things on
the USML that are not affected by the ruling.
 
> For a number of reasons the Bernstein decision may have limited impact
> beyond the symbolic:

I agree with your conclusion, but not all your reasons.
 
>  o The ruling [5] is narrowly worded. To my eye it seems only to apply
>   to Bernstein, the single plaintiff in this case.

In general, court rulings on constitutional issues are narrowly worded;
expecially at the district court level, there is a strong bias to doing
the minimum possible to fix whatever is determined to be broken.  Within
that scope the ruling is quite broad -- any use of the current ITAR to
restrict "export" (which includes publishing or posting to the Internet
in such a way that a non-US citizen could access) of crypto algorithms
or software is prohibited as a clear violation of the first ammendment.
The stuff at the end about Bernstein is there because Bernstein specifically
asked for a preliminary injunction to allow him to teach a crypto course
during the spring term.  The decision's rationale for not issuing the
injunction is telling -- it basically says that Bernstein need not fear
prosecution because the rules have been found to be unconstitutional,
and hence there is no need for a remedy specific to Bernstein.
 
>   The case involves
>   computer source code and its  nature as "speech"; the ruling says                               
>   nothing about executable programs.

Ah, you're looking in the wrong place.  The issue of whether computer
code is "speech" was decided much earlier this year by the same judge
in a ruling denying the government's motion for dismissal (it's in the
archives on EFF's web site).  My reading of that ruling is that it
does not distinguish between source and object code.  OTOH, the government
has not had the opportunity to argue that object code deserves less
"scrutiny" than a crypto algorithm in an academic paper.  The government
has basically conceded that the latter is "speech" that is entitled to
the highest degree of first ammendment protection ("strict scrutiny" in
legalese).

> o The scope within which the ruling applies is far from clear. It may
>   only set precedent in Judge Patel's Northern California district.

For now, that's all it does ... however any lawyer can cite this line
of argument in another district, and the circumstances of courts coming
to different conclusions on the same constitutional issue tends to
be appealable to a higher court to settle the issue.
 
> o The judge has said that she will automatically refer the case to a
>   higher court for appeal;the government may ask for a stay. And one
>   observer noted that Judge Patel has a record of being overturned on
>   appeal.

The government will have a hard time getting an indefinite stay.  The
reason is that the decision classified the ITAR regulation of
cryptography as an unconstitutional "prior restraint" on speech.
Court actions that constitute "prior restraint" have a habit of
being overturned by higher courts with stinging public rebukes to
the original court/judge.  No judge wants to bring this upon his/herself.
The most the government could reasonably expect is a temporary stay
until the new regulations (next bullet) come into effect.
 
> o Finally, the ITAR regulations themselves, which Judge Patel ruled to
>   be in violation of the free-speech provision of the Constitution, will
>   be replaced on January 1 with a new set of regulations administered by
>   the Commerce Department. No one knows whether the new rules will moot
>   the ruling or will themselves be rendered unconstitutional by it.

Unless the Commerce Department is completely asleep at the switch, the new
regulations will almost certainly moot the ruling.  The ruling says that for
something like ITAR for crypto software to be constitutional, three things
must be true:
	(1) There must be a strict time limit on the decision making process.
	(2) There must be a right of appeal to a court.
	(3) The government must bear the burden of proof in the court.
It's a good bet that the new Commerce regulations will provide these procedural
guarantees, at least for crypto algorithms and software.