8 July 1998

Date: Wed, 8 Jul 1998 00:59:20 -0700 (PDT)
From: Greg Broiles <gbroiles@netbox.com>
To: cypherpunks@cyberpass.net, cryptography@c2.net
Subject: Initial summary/analysis: Junger v. Daley


The canonical version of the opinion in Junger v. Daley should be
available sometime on July 8 via Prof. Junger's web site at
<http://samsara.law.cwru.edu/comp_law/jvd/>; John Young has prepared an
unoffical advance version at <http://jya.com/pdj11.htm>, and I have
written the following notes based on a quick review of the decision. My
notes are intended as springboard for discussion, not as legal advice. 

--

Peter Junger, the plaintiff in Junger v. Daley, argues that there are five
reasons why the court should have ruled that the EAR's regulation of the
electronic publication and export of cryptographic software was improper:

1.	The EAR's licensing scheme constitutes an unconstitutional "prior
restraint" on protected speech, and thus violates the First Amendment.

2.	The EARs are overbroad (they overreach into areas which do not
need to be regulated in order to reach the regulations' stated purpose)
and they are vague (people potentially subject to the regulations cannot
readily determine whether or not their conduct is controlled by the
regulations). The overbreadth and vagueness of the regulations make it
possible that they will be enforced in an arbitrary way, in violation of
the First and Fifth Amendments.

3.	The EARs discriminate between different types of software
(encrypting vs. non-encrypting) and between different media (Internet and
disks vs. paper) and between encryption software packages (mass-market and
key recovery products vs. others) in a content-sensitive fashion, which is
a violation of the First and Fifth Amendments.

4.	The EARs violate Prof. Junger's right to teach, and his right to
communicate encryption software to others, in violation of the First
Amendment's right to freedom of association.

5.	The IEEPA (International Emergency Economic Powers Act), under
whose authority President Clinton has extended the applicability of the
Export Administration Act (which expired by its own terms in 1994, and has
been extended every year pursuant to the President's declaration of an
"emergency"), did not give the President nor the Department of Commerce
the power to regulate the noncommercial transfer of information via the
EARs, which implement the EAA.

Judge Gwin rejected all of Prof. Junger's arguments, ruling that the EARs
are constitutional, and that they do not overextend the power granted to
the executive branch in the IEEPA. Consequently, Judge Gwin's decision
ends the lawsuit; according to press reports, Prof. Junger plans to appeal
Judge Gwin's ruling to the Sixth Circuit Court of Appeals. 

The heart of the opinion begins with a discussion of whether or not
cryptographic software is entitled to the protections provided for speech
by the First Amendment. Judge Gwin notes that the other two courts to have
addressed the issue of software as protected speech (_Karn_ and
_Bernstein_) reached opposite results. Gwin notes that some software may
be inherently expressive, if it contains an "exposition of ideas"; other
software is "inherently functional", where "users look to the performance
of tasks with scant concern for the methods employed or the software
language used to control such methods". Gwin goes on to conclude that
encryption software is "especially functional" and "inherently
functional", because he believes it carries out the function of
encryption, rather than describing encryption. As such, he reasons that it
is indistinguishable from dedicated encryption hardware. 

Gwin further finds that "In the overwhelming majority of circumstances,
encryption source code is exported to transfer functions, not to
communicate ideas", and hence the value of the software to end users is
its functionality, not its communicative impact. I'm having trouble
finding evidence to support that conclusion in the exhibits and
declarations made part of the record as available online - but I don't
think I've been successful in locating all of the filings. It would be
interesting to determine whether or not this conclusion is supported by
the record, or whether the judge has taken judicial notice of this "fact". 
(Judicial notice is a practice by which judges may decide that a certain
fact is true without admitting evidence on the subject.) 

Judge Gwin notes that Judge Patel, in _Bernstein_, concluded that source
code was both functional and expressive; and that its expressive character
brought it within the First Amendment's protection. Gwin disagrees,
finding that source code is "purely functional" and "rarely expressive",
emphasizing that it is "all but unintelligible to most people". Because he
concludes that the export of source code is conduct which is only
occasionally expressive, he finds that the First Amendment's protection
for communication is not applicable. This conclusion - that the act of
exporting cryptographic source code is not entitled to First Amendment
protection - informs his rulings on Professor Junger's arguments. 

Judge Gwin addressed the arguments as follows:

1. (Prior restraint) Judge Gwin notes the traditional suspicion with which
courts view prior restraint schemes, but reasons that because the export
of encryption source code is not "commonly associated with expression",
regulation of that activity does not amount to a licensing scheme for an
activity integral to, or commonly associated with, expression; and,
consequently, any impact on expressive activity is collateral and
unintended, and, hence, constitutional. 

2. (Overbreadth, vagueness)  The "overbreadth" doctrine allows challengers
to the constitutionality of a statute or regulation to raise defects in
the statute's drafting, even where those defects do not directly affect
the challenger's case, where the law in question "has the potential to
repeatedly chill the exercise of expressive activity by many individuals",
according to Judge Gwin. Gwin reject's Prof. Junger's attempt to raise an
overbreadth argument, ruling that the issues raised in Prof. Junger's
challenge are identical to those which would be raised by other parties
not involved in this action.  Consequently, he does not discuss the merits
of the overbreadth argument. (I've run across case law which suggests that
the overbreadth doctrine is not only applicable in the speech context, but
don't have the cites immediately at hand; if this is of interest to
readers, please let me know and I'll try to dig them up.)

Gwin also ruled summarily that "the Export Regulations are not vague" and
that they "provide adequate notice" to potential violators about what
behavior is and is not within the scope of the regulations, citing the
EAR's mention of "the key length in 'bits' for regulated programs".

3. (Content discrimination) Echoing his earlier analysis, Gwin concludes
that the EARs' different treatment of different types of software and
media is not content based because, citing to President Clinton's
Executive Order 13026, the regulations are based upon the functional
capactity of the controlled item, not its informational content. Gwin
points to the EARs' exclusion of "books, magazines, and other printed
materials" in support of his conclusion that only functional information
about cryptography is controlled, ignoring the EARs' controls on technical
information and assistance related to cryptographic items.

Because he concludes that the EARs are content neutral, Gwin applies an
"intermediate scrutiny" standard to determine whether or not they are
constitutional. He finds that limiting the spread of US-source encryption
to foreign countries is an "important interest" (citing Undersecretary
Reinsch's declaration to the effect that foreign cryptographic prodcuts
are not widely used because of the lack of "an infrastructure to support
key distribution and the interoperability of products"), that the
government's interest in restricting exports is "unrelated" to any
communicative content of the exports, and that the regulations are
"narrowly tailored"  (they are no more speech-restrictive than necessary)
to achieve the government's purpose, pointing to the availability of
low-strength encryption and printed information about cryptography as
indications that the EARs are as minimally restrictive as practically
possible. Since the EARs meet the tests for intermediate scrutiny of
regulations which may incidentally burden speech, they are constitutional. 

4. (Academic/associative freedom) Judge Gwin notes that Junger's briefs
have not addressed this claim (likely due to space constraints imposed by
the Court?), and he treats the argument/claim as waived without further
discussion. 

5. (IEEPA/separation of powers)
Gwin similarly notes the lack of discussion of this issue in the briefs
and some discussion in Junger's reply brief to the effect that this claim
is not appropriate for summary judgement (if he had accepted that
argument, the case would still be pending trial on this claim); he then
goes on to cite a line of cases to the effect that Congress, in failing to
reject or modify the President's extensions and modifications of the EAA,
has acquiesced in those changes and that there has been no violation of
the separation of powers principle.  

In general, I'm disappointed in the judge's failure to dig deeply into the
technical issues; my impression is that he doesn't sufficiently understand
the complicated relationship between source code and object code, and
source code and pseudo code. I think it's a shame that this case didn't
get the careful attention that _ACLU v. Reno_ got, with detailed in-person

testimony from experts familiar with the issues. As far as I can tell,
Judge Gwin reached his conclusions based upon his review of the filings,
and statements made by the attorneys at oral argument. It's very difficult
to convey the nuances of these questions and these arguments in written
declarations, and difficult to explore the legal arguments raised in a
concise brief. I haven't found anything facially implausible or obviously
incorrect in the judge's legal reasoning, but I believe he was too quick
to reach conclusions about the applicable facts in this case; and that his
erroneous factual findings led him to apply valid (but inappropriate)
legal reasoning to the parties' arguments. I'm disappointed that, as in
_Bernstein_, several of the less immediately obvious arguments
(overbreadth, vagueness, IEEPA, freedom of association) didn't receive the
full attention of the parties or of the court.

Unfortunately, it is very difficult to dispute a trial judge's findings of
fact on appeal; appeals are largely centered around arguments about
whether or not the court applied the correct legal reasoning to the body
of facts which were established, not whether or not the court reached the
proper conclusion(s) about the facts based upon the evidence received.
Prof. Junger, in his appeal, will likely find himself bound to accept many
or most of the factual conclusions reached by Judge Gwin, even where those
conclusions appear incorrect to people who work with the EARs and
cryptographic software frequently.

I don't have good research material here at home, but I suspect (hope?) it
may be possible to challenge one of the central factual conclusions
reached by Judge Gwin - that most encryption source code exports occur
because of the functional, not the expressive, character of the software
exported. I'm suspicious that reliable data exists from which the judge or
an affiant could reach such a conclusion; and I'm suspicious that even if
such data exists today, that it's possible to extrapolate from that data
conclusions which would be reliable in the absence of export controls,
since such data would most likely be derived from current legitimate
exports, which are a very tiny subset of the exports which would occur but
for the ITARs and EARs. If the appellate court can be convinced that Judge
Gwin's conclusion on that subject was so unreasonable or so poorly
supported by evidence before him that his finding was an abuse of his
discretion, the court may be willing to adopt another finding on the basis
of the paper record, or to remand the case to Judge Gwin to gather more
evidence. 

I'd be interested to hear other folks' conclusions about the opinion.

--
Greg Broiles
gbroiles@netbox.com