14 July 1998

Note: Cindy Cohn is lead counsel for Daniel Bernstein in the Bernstein v. Department of State cryptography suit.

See Junger case files: http://jya.com/pdj.htm

    Date: Tue, 14 Jul 1998 17:54:07 -0700
    To: bernstein-announce@toad.com
    From: Cindy Cohn <Cindy@mcglashan.com>

    Hi all,

    I've now had a chance to review the decision in the Junger case.  I think it
    contains many flaws, but will just highlight a few here.

    The most striking thing about the opinion is how much the judge's willfully
    ignored the undisputed factual record.   Plaintiffs submitted voluminous
    declarations from programmers, computer science professors and others
    confirming that they often communicate using source code.  The Declarants
    included Professor Abelson of MIT, author of the key introductory textbook
    of computer science, as well as Professor Appel from Princeton and several
    prominent cryptographers and general computer scientists.  All of them
    confirmed the need to read, write and share source code as part of their
    work, and as part of the development of science.  They also testified to the
    fact that many, many other people communicate using source code, and that
    higher level languages are developed to allow humans to write, read and
    develop each others ideas.

    The Judge does quote the Supreme Court ruling that speech must be protected
    by the First Amendment unless it is  "so far removed from any exposition of
    ideas, and from truth,  *science,* morality, and arts in general . . . "
    Yet despite these clear facts and despite the Supreme Court's clear
    inclusion of scientific speech as protected expression,  Judge Gwin states:

    1.  "encryption source code may *occasionally* be expressive (p.12)

    2.   that in the "overwhelming majority of circumstances" encryption source
    code is exported to transfer functions, not to communicate ideas."  (p.13)

    3.  "For the broad majority of persons receipting such source code, the
    value comes from the function" (p.13-14).

    4.   "encryption source code is rarely expressive"  (p. 15).

    5.  "source code is conduct that can occasionally have communicative
    elements."  (p.16)

    6.  "Source code is a set of instructions to a computer that is *commonly*
    distributed for the wholly non-expressive purpose of controlling a
    computer's operation."  (page 17)

    7.   "encryption software is not typically expression"  (page 18)

    There are similar statements of fact throughout the decision, none of which
    contain citations to anything in the record to support them.

    So where is the evidence to support his conclusions?  The government
    submitted no empirical studies of source code "exports"  from which one
    could conclude how often source code is "expressive."  Certainly this is not
    the kind of thing which can be judicially noticed.  At a minimum, the
    declarations create a triable issue of material fact as to how often source
    code is used to communicate ideas.  This alone should preclude summary
    judgment.

    Also, I know of know authority which holds that the number of people who
    communicate in a given language is the basis on which we decide whether that
    communication is speech.  Judge Gwin certainly cited none, but his opinion
    assumes that this is relevant.

    He also says that "certain software is inherently expressive" (page 13)
    without stating what he thinks that kind of software is and how it differs
    from encryption software.  The Junger team argued that the "functionality"
    of encryption software, allowing privacy of speech, makes the software
    subject to the First Amendment on its own, just as the regulations of
    printing presses and newspaper racks violate the First Amendment even though
    the item itself may not be speech.  The Judge ignored this argument
    entirely.

    Once the judge has decided that source code is not *sufficiently*
    expressive, he ignores the settled analysis for prior restraints in order to
    avoid applying the tests.  The easiest mistake to see is his reliance on the
    9th Circuit Roulette decision for his holding that prior restraint review
    shouldn't apply.  Roulette was *not* a prior restraint case.  It considered
    an ordinance which allowed the police to arrest citizens for sitting on the
    sidewalks.  In Roulette, a person didn't have to apply for a license to sit
    on the sidewalks, he or she simply did it.  The question of whether the act
    was expressive or not would always be reviewed by a Judge, as part of the
    criminal process.  In the case of cryptography,in contrast,  one of the key
    issues has been the fact that the cryptography regulations do not allow for
    a judge to review agency decisions denying or requiring a license.  Thus,
    applying Roulette as the standard to judge whether prior restraint analysis
    applies is just plain wrong.

    Having dispensed with prior restraint by relying on a non-prior restraint
    case, the Court then considers overbreadth.   Again, he ignores the record
    entirely.  He claims, again without any citation to the record,  that Junger
    has failed to show that "the resulting injury to other academics is the very
    same injury that Junger allegedly suffered."

    But Junger included Declarations from people who were *not* academics who
    have been injured by the export restrictions.  He included declarations from
    Mr. Liebman (concerning some O'Reilly software) and Mr. Behlendorf
    (concerning the Apache server) demonstrating that even those whose software
    contains no encryption capability whatsoever have been injured by the
    encryption regulations.  The record contains plenty of evidence that people
    other than Junger, attempting to do different kinds of things than he does,
    have suffered different kinds of injury due to the regulations.   Similarly,
    Judge Gwin states that the regulations are not vague, ignoring the record
    evidence that many, many people do not understand them and have been chilled
    as a result.

    Next, Judge Gwin finds content neutrality based upon the argument that
    government is controlling the "functionality" of the software rather than
    its content.  Acceptance of this phony distinction requires that a person
    have no understanding of computer programming.  The content and the
    functionality of a computer program are synonymous.  They have to be.  There
    is no way to change or limit the functionality without also changing the
    content of the source code.  To mandate key recovery is to mandate that
    computer programs have different content than they would otherwise; its'
    like saying that the government wants to control the "taste" of chocolate
    cake rather than the recipe.  Change one, you must change the other.

    Judge Gwin also relies on the fact that the Government allows "export" of
    software on paper, thus defining "functionality" as based upon the fact that
    source code can be converted into object code which can be run.   But this
    analysis also ignores the existence of scanners and typists.  Software on
    paper isn't any less "functional" than software in electronic form.   It
    simply requires one more, simple, step to make it functional.  In the case
    of the single page of source code which is Snuffle, in the Bernstein case,
    the difference cannot be more than ten minutes worth of typing or a few
    minutes to scan and correct errors prior to compiling.  *This* is the
    difference our national security rests upon?

    Judge Gwin then applies intermediate scrutiny, quickly finding that the test
    is met.

    In the end, Judge Gwin decided, despite the evidence, that source code isn't
    often read by anyone and so shouldn't really deserve First Amendment
    protection.  The rest of the analysis flows from there, with no regard for
    the actual facts in the record.  The result is that we have a new category
    of lesser protected expression, speech which is also "functional," without
    any clear or understandable definition of the term "functional."  And all
    those computer scientists and their settled methods of communicating with
    each other apparently don't count when it comes to the First Amendment.

    The larger ramifications of this holding, if it becomes law for the rest of
    us, are frightening.  Taken to its extreme, this holding could be the
    exception that swallows the rule of Reno v. ACLU.  If the fact that
    something can "function" means it is not speech, every web page written in
    HTML could be held not protected, since at some level each page is a
    "functioning" computer program.  Certainly any web page or other electronic
    publication which contains a Java applet is a "functioning" program.

    As I noted above, there are other criticisms which can be leveled as well.
    These are simply a few that I've found so far.

    Cindy

    ******************************
    Cindy A. Cohn, Cindy@McGlashan.com
    McGlashan & Sarrail, P.C.
    177 Bovet Road, 6th Floor
    San Mateo, CA 94402
    (650) 341-2585 (tel)
    (650) 341-1395 (fax)