Phil Karns Export Control Appeal on the Applied Cryptography Diskette
December 5, 1994
(BY HAND DELIVERY)
Mr. Thomas E. McNamara
United States Department of State
Bureau of Politico-Military Affairs
Washington, DC 20520
Dear Mr. McNamara:
We represent Mr. Philip R. Karn, Jr. of San Diego, California. This letter is an
appeal pursuant to 22 C.F.R. 120.4(g) of the International Traffic in Arms Regulations
(the ITAR) of the determination by Deputy Assistant Secretary Martha C. Harris with
regard to Mr. Karns appeal of an adverse determination by the State Departments Office
of Defense Trade Controls (ODTC) in CJ case 081-94.
The issue in this case, simply stated, is whether textual material in digital form on a
floppy disk can legally be classified differently, for export control purposes, from the
identical textual material in printed form in a published book. Under the State
Departments rulings, material on the floppy disk has been held to be a defense article,
while the same material in a published book has been properly held to not be within the
Departments export control jurisdiction.
The specific case arises from inconsistent Commodity Jurisdiction (CJ)
determinations concerning cryptographic source code published in the book Applied
Cryptography. This case presents a significant opportunity for the State Department to
demonstrate genuine commitment to the Administrations efforts to strengthen our
economy in the information age through the Global Information Infrastructure program.
If the decisions of Dr. Harris and the ODTC stand, this case illustrates a fundamental
inability of our government to deal with computerized information in a rational manner.
The Department of States Result in This Case
Is Wrong and Insupportable on the Facts and the Law
The ODTC and Deputy Assistant Secretarys (DAS) decisions in this case are
wrong and insupportable on the facts and applicable law. The decisions are based on
distinctions between printed and computer media that are, quite frankly, specious,
arbitrary and capricious. The DAS explicit rejection of the application of the First
Amendment to computer information is both unprecedented and indefensible. ODTC and
the DAS have exceeded their statutory and regulatory authority in this instance. The
result is that the decisions thus far are not only irrational as a matter of policy, but are, in
our view, vulnerable to judicial invalidation with serious consequences for the entire
export control regime.
We assume that the result set out in the DAS letter was based on various unstated
policy goals of the State Department and other agencies, most significantly the National
Security Agency. Whatever these goals, the indisputable facts should lead a fair-minded
person to the conclusion that the article involved in this appeal -- the Applied
Cryptography Source Code Disk (the Diskette) -- does not belong on the U.S.
Munitions List (USML) and should be transferred to the Commerce Control List
(CCL), just as jurisdiction over the book itself was transferred to the CCL. To conclude
otherwise is to ignore the facts, the electronic age in which we live, and the First
The Information on the Diskette Is Identical to the Information in the Book
ODTC and the DAS classified the Diskette as a defense article under Category
XIII(b)(1) of the USML. The information on the Diskette is the same as the information
printed in a published book (the Book).
The Book is Applied Cryptography by Bruce Schneier; it was published by John
Wiley & Sons, Inc. in 1994 and is now in its 3rd printing. It has ISBN 0-471-59756-2.
The Book is available for sale in bookstores. The retail price of the book is $44.95 a
copy. We understand that approximately 20,000 copies have been sold worldwide. We
are advised that a substantial number of copies have been sold in the Far East.
We bought a copy at Borders Bookstore at Tysons Corner, Virginia. In short,
this is a published book like so many others that you and we have at our homes and
offices. The floppy disk that is the subject of this appeal is an exact duplicate, in digitized
form, of the cryptographic source code that is printed as Part Five (pages 456 to 570) of
The History of the Case
At this juncture, it is useful to review the history of this case. This part of our
appeal will also set forth our disagreement with the basis of the prior determinations on
the matter. Our comments will show that the initial adverse determination and the
affirmation of that decision in response to Mr. Karns appeal were based on an irrational
distinction, constitutionally flawed interpretations of the law and an erroneous view of the
facts. These flaws are pervasive throughout both prior administrative decisions in this
Initially the ODTC considered whether the Book was subject to controls under the
ITAR and in a letter to Mr. Karn, dated March 2, 1994, concluded that it was not. The
letter from the Office stated that the Book was in the public domain. The Book was
accordingly transferred to the CCL. That ruling expressly did not extend to the computer
diskettes offered for sale on the last page of the Book.
Following this ruling, on March 9, 1994, Mr. Karn submitted a second Commodity
Jurisdiction Request (CJR) for the Diskette, which contained the text of the source
code, and only the source code, which was set out in Part Five of the Book. As Mr. Karn
stated in his submission:
Character by character, the information [in the
Diskette] is exactly the same [as in the Book]. The only
difference is the medium: magnetic impulses on mylar
rather than inked characters on paper.
The Diskette is available from the author of the Book by mail-order for $15. In
this connection, please note that the Diskette that is the subject of this appeal is not the
two-diskette set advertised on the last page of the book. The two diskette set advertised
in the Book contains data and information that is not on the Diskette that is the subject of
this appeal. The Diskette at issue here contains only the identical information that is
contained in Part Five of the Book.
The Initial Response From ODTC
ODTC responded to Mr. Karns second filing on May 12, 1994 (the Response).
The Response stated that Mr. Karns request was referred to the Departments of
Commerce and Defense and the National Security Agency for their review and
recommendations. It went on to indicate that, in the opinion of the ODTC, the Diskette
was subject to the licensing jurisdiction of the Department of State and the ITAR. The
rationale for the conclusion was that the text files on the subject disk were not an exact
representation of the contents of the Book. The Response continued:
Each source code listing has been partitioned into its own
file and has the capability of being easily compiled into an
executable subroutine. The subject disk contains source
code listings [for certain cryptographic algorithms] ... Also,
the subject disk contains source code listings for certain
algorithms that would not be exportable if they were
incorporated into a product.
The Response also indicated that the intended use of the Diskette, as stated in Mr. Karns
communication was to provide code to persons who wished to incorporate encryption
into their applications. The response went on to say that:
There are fourteen (14) separate source code files that
amount to thousands of lines of easily executable code
contained on the subject disk. This is certainly an added
value to any end-user that wishes to incorporate
encryption with a product.
The two foregoing quotations constitute the entire rationale of the Response.
This rationale, at best, begs the central issue in this matter, namely that the
contents of the Diskette are in fact identical to the source code listings set out in the Book
that is available at technical and non-technical book stores or by mail. In so doing, the
Response ignores the First Amendment, as it should be applied to electronic and computer
Moreover, the Response erred on relying on the conclusion that the Diskette
source code could be easily compiled into an executable subroutine. The source code in
fact covers only the encryption algorithms and any executable application could be
produced only by linking the Diskette source code with other source code, such as
input/output routines, to produce an executable program.
To the extent that the Response rested on a presumed added value because the
Diskette contained information that could be read by a computer, while the Book
contained information that could be read by a person, the ODTC relied on an irrelevant
and arbitrary factor. It cannot be that the ITAR allows a book with a normal font to be
transferred to the CCL, but precludes similar treatment of the same book on a microfiche
which has added value to certain users.
Unconstitutional Application of the Statute
Our Constitutional argument begins with the proposition that the First Amendment
applies to -- and protects -- the dissemination of information about cryptography. The
Office of Legal Counsel of the Department of Justice (OLC) made precisely this
determination in an opinion issued on May 11, 1978. J. Harmon, Asst. Atty. Gen.,
Memorandum to Dr. Frank Press, Science Advisor to the President. That opinion established four fundamental First Amendment principles that apply in this case:
1) The First Amendment applies to dissemination of information about
cryptography which is developed without governmental involvement just as
it applies to other categories of speech, in other words, cryptologic
information -- unlike obscenity -- is not a less-protected category of
2) The ITAR licensing scheme as applied to pure information such as the
Book and the Diskette is a system of prior restraint that is tested under
the most stringent of First Amendment standards;
3) The ITAR scheme is inherently vague and overbroad with respect to
information such as that contained in the Book and the Diskette because
there is insufficient clarity in what is and what is not covered, as is well
illustrated by the decisions in this case to grant the requested CJ for the
Book and deny one for the Diskette; and
4) In the absence of a system for prompt judicial review of a denial of a
license, the ITAR scheme is facially unconstitutional.
The 1978 OLC opinion was not some unique aberration in legal analysis. The
principles of that opinion were re-affirmed by OLC on two subsequent occasions. See T.
Olson, Asst. Atty. Gen., Memorandum for William B. Robinson, Office of Munitions
Controls (July 1, 1981); L. Simms, Dep. Asst. Atty. Gen., Memorandum for Davis R.
Robinson, Legal Adviser, Dept. of State (July 5, 1984). Thus the principles first stated by
OLC in the Carter Administration have remained the views of OLC in both Democratic
and Republican Administrations. To the best of our knowledge, those OLC opinions
remain the latest and most authoritative legal opinions within the Executive Branch on the
applicability of the First Amendment to the dissemination of cryptologic information.
We contend that speech in digital form on a diskette is not legally different from
speech in a printed book. The distinctions drawn by ODTC and the DAS in this case are
analogous to a hypothetical decision by a government agency in the 1940s that the First
Amendment had no application to television because it wasnt speech. Whether the
cryptographic information is communicated orally, in writing in a traditional book, or in
electronic form on a diskette, CD-ROM or electronic bulletin board, it retains its status
under the First Amendment as protected speech.
The Response is a well-nigh classic example of the overbroad application of a
statute (in this instance the Arms Export Control Act) by a government agency. As
Justice Brennan wrote in NAACP v. Button, 317 U.S. (1963) 415, 431
The instant decree may be invalid if it prohibits privileged
exercises of First Amendment rights whether or not the record
discloses that the petitioner has engaged in privileged conduct. For in
appraising a statutes inhibitory effect on such rights, this Court has not
hesitated to take into account possible applications of the statute in
other factual contexts besides that at bar.
Pervasive Availability of the Information on the Diskette
Beyond its failure to appreciate applicable Constitutional doctrine, the Response
ignores a more pragmatic difficulty. As noted, the contents of the Diskette and the Book
are the same, and the Book has sold approximately 20,000 copies worldwide. The
Diskette is available from the author of the Book. ODTC is, therefore, telling Mr. Karn
that he cannot export, without an ITAR license, information that has already achieved
pervasive public availability.
Moreover, we understand that the entire contents of the Diskette are included in a
two disk set of cryptographic source code described on the last page of the Book. As
evidenced by the attached printout of information posted on a WorldWideWeb Internet server,
binary copies of the source code for several of the algorithms published in Part
Five of the Book are publicly available from anonymous file transfer protocol (FTP) sites
outside the United States. In these circumstances, trying to prohibit the dissemination of
the cryptographic algorithms in digital format on the Diskette, given the widespread
availability of that information in text and digital format, reflects the pursuit of an
irrational goal that bears no relationship to the real world.
The ITAR defines the term public domain to mean:
information which is published and which is generally
accessible or available to the public:
(1) Through sales at newsstands and bookstores;
(2) Through subscriptions which are available
without restriction to any individual who desires to
obtain or purchase the published information:
. . . .
(4) At libraries open to the public or from which
the public can obtain documents (emphasis added)
The Book is available through sales at bookstores and is certainly available at some
libraries, and, again, the Diskette is available through mail-order from the author of the
ODTC was, therefore, clearly correct in concluding that the Book is within the
ITARs public domain exception. It follows that the Diskette is also within that same
exception since it consists of the same information as is found in the Book. The key
operative part of the definition is the critical term: information. The regulation makes no
distinction as to the format or media in which the information is disseminated, but properly
focuses on whether it is information :
which is published and which is generally accessible as
available to the public
While we recognize that the regulatory definition does not explicitly recognize the public
availability of information through electronic media, we doubt that you would seriously
argue that the only recognized or sanctioned forms of public availability were those used
by printers in 1787 when the Constitution was adopted. More importantly, even if the
State Department were to adhere to such a media-based distinction, we seriously doubt
that a reviewing court would agree with such an arbitrary differentiation.
The basis of the Response quoted above boils down to formatting differences
between the Book and the Diskette. To be sure, a printed book has a different format
than an audio or talking book contained on a disk. One can watch a performance of a
play or read the same material in the plays script. One can watch the performance of an
opera or read the libretto. While there may be a difference in artistic impact, the
information received in each instance is the same.
The implications of the Response are unsettling particularly as the publishing
industry moves from print to multi-media distribution. The novelist Tom Clancy has, in all
likelihood, set out technical data, as the term is defined in the ITAR, in one or more of his
books which focus on military and intelligence activities. Does the State Department
contend that the export of a CD-ROM version of Red Storm Rising or The Hunt For Red
October would require an ITAR license?
In Mr. Karns case, there is no difference in the informative impact between the
Diskette and the Book. Whatever formatting differences are present are irrelevant.
ODTCs distinction in the Response is a make-weight which does not even accomplish the
function of providing a substantive rationale for the decision. Moreover, the Response
ignores the wide-spread availability of optical scanners and computer keyboards, both of
which could easily render the Book every bit as systems-ready and systems-friendly as the
The Appeal to The DAS
Mr. Karn filed an appeal (the Appeal) from the Response on June 7, 1994. The
Appeal made a number of arguments, which are helpful in a review of this matter. The
Appeal noted that the information on the Diskette and in the Book were the same; that the
information in the Diskette qualified for the ITARs public domain exception; and that the
First Amendment protected expression regardless of the medium of expression. In
addition to the written appeal, we met on June 30, 1994 with Dr. Harris, her staff and a
representative of another federal agency to explain our arguments and to visually
demonstrate that the information on the Diskette is identical to that in Part Five of the
Dr. Harris provided a response to the Appeal (the Second Response) on October
7, 1994. The Second Response did not squarely address Mr. Karns clearly presented
arguments or the discussion we had with Dr. Harris in our June meeting. It simply
concluded that the Diskette was a defense article, notwithstanding the fact that the
information on the Diskette is the same as the information in the Book. Quite frankly this
result is untenable. No logical rationale based on the ITAR is provided for the Second
Response, which, with respect, is a paradigm of an arbitrary and capricious
The Second Response failed to give any meaningful attention to the First
Amendment, passing that issue off with the terse comment that continued control over
the export [of the Diskette] is consistent with the protections of the First Amendment.
This is simply not so. Rather, the DAS position is jarringly at odds with the First
Amendment. To brush this issue aside with a conclusory statement totally lacking in legal
analysis reflects a surprising insensitivity to the importance of the Constitutional rights that
are involved in this case.
Constitutional Difficulties With the ODTC/DAS Position
This document is not a legal brief. However some comments are in order on the
Constitutional position of ODTC and the DAS in this matter. Simply put, the position is
indefensible. A sampler of the most glaring Constitutional infirmities in the position
We noted earlier in this paper that OLC relied in part on the overbreadth issue.
DAS position in this matter would also not withstand scrutiny under the overbreadth
doctrines cousin, the void for vagueness doctrine. The cryptographic exception, which
is so often cited by ODTC with respect to this sort of issue is an example of a regulation
that would not withstand scrutiny under the doctrine.
The ITAR is so murky in this area so that it may well have a chilling effect that will
deter persons from engaging in Constitutionally protected speech. Moreover, inasmuch as
the cryptographic exception is the basis or part of the basis of ODTCs position in this
area, it infringes on Mr. Karns right to equal protection of the law and is, therefore, in
violation of the First and Fifth Amendment to the Constitution. More specifically, the
result of the Second Response is that Mr. Karns speech about a particular subject, i.e.,
cryptography is not given the same protection as other speech in which he engages.
At the very least, Mr. Karns desired activity, i.e. the export of the partial contents
of a published book is symbolic speech, a clearly expressive act with a high communicative
content. Such speech has been recognized by the Supreme Court for decades. See
Stromberg v. Carlson, 283 US 359 (1931).
We also note that comment in the Second Response that OTC has made a
determination that the source code on the disk . . . is of such a strategic value as to
warrant continued State Department listing. National security interests do not
automatically supersede the First Amendment. In a recent opinion, Judge Green wrote
that it is recognized that the government has an interest in protecting the National
Security, and, at times, that security interest may be grave. However, the issue in this
instant case is not whether the government has such an interest but whether that interest is
so all-encompassing that it requires ... [a denial of] virtually every fundamental feature of
due process. See Rafedie v. Immigration and Naturalization Service, 795 F. Supp 13,
19 (D.D.C. 1992). In The City of Houston v. Hill, Justice Brennan wrote that speech is
often provocative and challenging ... [but it] is nevertheless protected against censorship
or punishment, unless shown likely to produce a clear and present danger of a serious
substantive of evil that rises far above public and convenience, annoyance or unrest. 482
U.S. 451, 461, (1987). The Supreme Court also addressed this issue in the Pentagon Papers case:
Thus, only governmental allegation and proof that
publication must inevitably, directly and immediately cause
the occurrence of an event kindred to the safety of a
transport already at sea can support even the issuance of an
interim restraining order. New York Times v. United
States, 403 U.S. 713, 726-272 (Stewart, J. concurring).
The crux of the ODTC/DAS position appears to be that the information on one
medium--the Book -- may be exported while the identical information on another -- mylar
-- may not. This is no position at all. It is particularly ironic that representatives of an
Administration, which is publicly so supportive of the coming Information Super
Highway, could take a policy position that is so at odds with its implementation and
In considering our Constitutional arguments, it is important to recognize that the
applicability of First Amendment protections to communications of cryptography
information is not merely an argument crafted by Mr. Karns counsel, but is the legal
position already taken the OLC. Opinions of that office, within the Executive Branch,
have the authority of binding rulings. If there are any unpublished OLC opinions which
support the DAS position, we are not aware of them. Accordingly we submit that the
DAS conclusion is not only wrong, it is inconsistent with standing Executive Branch legal
For the reasons stated, the Diskette should be held to not be a defense article, not
covered by the Munitions List and not subject to any controls under the ITAR.
If you believe a meeting might assist in a rapid resolution of this appeal, please let
us know. Based on our prior personal experience as attorneys in the Executive Branch,
our understandings of the role of the National Security Agency in these matters, and the
disposition of Mr. Karns prior appeals, we are -- quite frankly -- pessimistic about the
outcome of this appeal. We are taking this step only because our request that the State
Department agree to waive any arguments based on failure to exhaust administrative
remedies prior to our seeking judicial relief was rejected. We are here before you on
appeal primarily because we may be required to appeal to you before going to court. We
hope that our pessimism proves unfounded, but the decisions in this case to date do not
justify any expectation that a favorable decision is, as a practical matter, available within
the Executive Branch.
Kenneth C. Bass, III
Thomas J. Cooper
Disclaimer: The materials on this Website have been prepared for informational purposes only and are not legal advice. You should not act on the basis of these materials. They are not a substitute for obtaining legal advice from your own lawyer. Browsing this Website or contacting us through it does not create an attorney-client relationship. If you contact us through this Website, please do not send us any confidential information.