United States Department of State Assistant Secretary of State for Political-Military Affairs Washington, D.C. 20520 June 13, 1995 Philip R. Karn, Jr. 7431 Teasdale Avenue San Diego, CA 92122 Dear Mr. Karn:
I have now completed consideration of your appeal of the decision of Dr. Martha Harris, the Deputy Assistant Secretary for Export Controls, regarding CJ case 081-94, concerning your "applied cryptography source code disk." Pursuant to section 120.4(g) of the International Traffic in Arms Regulations (ITAR), I hereby reaffirm the determination by Dr. Harris that the disk you submitted, which contains cryptographic software, is designated as a defense article under Category XIII(b)(1) of the United States Munitions List (USML).
ITAR section 120.4, which sets forth the commodity jurisdiction procedure, states that the procedure may be used "if doubt exists as to whether an article or service is covered by the U.S. Munitions List" or "for consideration of a redesignation of an article or service currently covered by the U.S. Munitions List."
Category XIII(b) of the USML covers "Information Security Systems and equipment, cryptographic devices, software, and components specifically designed or modified therefor." The cryptographic devices, components and software covered by this category are, per Category XIII(b)(1), those "with the capability of maintaining secrecy of confidentiality of information or information systems . . . ." Because the disk that is the subject of your appeal contains cryptographic software that is capable of being used to maintain the secrecy or confidentiality of information, we have determined that it is covered by Category XIII(b)(1) of the USML.
You contend in your June 7, 1994 and December 5, 1994 letters that the disk is not subject to the export licensing requirements of the ITAR because the disk qualifies for the ITAR "public domain" exemption (e.g., ITAR sections 120.10(a)(5) and 125.1(a)).
However, the ITAR "public domain" exemption which you and your attorneys contend is applicable to your disk is available only for "information" that otherwise would be "technical data," and cryptographic software does not come within the meaning of technical data as defined by the ITAR. "Technical data" is defined, at ITAR section 120.10(a)(1), as "information, other than software as defined in 120.10(d) [sic (citation should read "120.10(a)(4)")], which is required for the design development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles" (emphasis added). Section 120.10(a)(4) refers to section 121.8(f) for the definition of "software." Section 121.8(f) states that software includes "the system functional design, logic flow, algorithms, application programs, operating systems and support software for design, implementation, test, operation, diagnosis and repair."
Section 121.8(f) also states that "[a] person who intends to export software only should, unless it is specifically enumerated in (P) 121.1 (e.g., XIII(b)), apply for a technical data license pursuant to part 125 of this subchapter." Thus, section 121.8(f) specifically excludes Category XIII(b) cryptographic software from the category of software which can be considered technical data and for which an exporter should apply for a technical data license (unless relevant exemptions apply).
As these provisions indicate, the ITAR makes a basic distinction between technical data and cryptographic software. Technical data is primarily "know-how," that is, information which describes how to produce, operate, repair, test, maintain or modify a functioning defense article. However, cryptographic software is subject to licensing as a defense article not because it contains "information," but because it can function to encrypt communications. Such software can be an integral functioning component of a computer system or device that actually encrypts information.
I have concluded that your disk in fact contains software that is capable of performing cryptographic functions. Rather than merely containing information that, for example, explains the theory of how cryptographic software works, the disk contains actual cryptographic software that may be utilized to encrypt information.
Your own statements support this assessment. In your March 9, 1994 letter to Major Gary Oncale, at that time a licensing officer in the Office of Defense Trade Controls, you wrote that "the software on this diskette is provided for those who wish to incorporate on this diskette is provided for those who wish to incorporate encryption into their applications." In your June 7, 1994 letter to Dr. Harris, you referred to the disk you submitted as "cryptographic software." The disk equips its user to encrypt files for confidentiality and to perform other cryptographic functions. The demonstrations presented by your counsel on February 28, 1995, does not alter this conclusion since the text files on the disk can with little effort be compiled to create executable object code. For all of the foregoing reasons, the disk is cryptographic software under Category XIII(b)(1) of the USML.
Cryptographic software such as yours is included in Category XIII of the USML because failure to control such source code software would jeopardize national security. Inclusion of such software on the USML helps ensure that the Department of State can adequately prevent strong encryption that is capable of performing information confidentiality functions from being disseminated overseas in a manner that would jeopardize U.S. national security interests.
I have also considered your argument that the export of your disk is protected by the First Amendment to the Constitution, and have again concluded that continued control over the export of the cryptographic software on the disk does not implicate the First Amendment since such software is subject to licensing not because it might contain "information," but because it can function to encrypt communications.
The three opinions of the Justice Department's Office of Legal Counsel (OLC) upon which you rely are inapposite, primarily because the disk contains cryptographic software and not mere technical data. The OLC opinions deal with ITAR provisions on technical data. The OLC opinions deal with ITAR provisions on technical data. The disk is subject to licensing because it contains a software product that is capable of performing cryptographic functions, and not mere know-how or other information about the functioning of cryptography. Export of the disk is not, therefore, regulated because of any expressive content it might contain.
Accordingly, I believe that inclusion of cryptographic software within the State Department's licensing jurisdiction under the ITAR reflects the regulation of the conduct of exporting an article that functions to encrypt information, and not the regulation of speech or information. Your disk is controlled because it is a product that can perform cryptographic functions. Control over the export of such products is in furtherance of the security and foreign policy of the United States, and is consistent with the protections of the First Amendment.
I note, in closing, that your statement that you will seek judicial review should you receive what you deem an unsatisfactory response to your appeal. In Section 38 of the Arms Export Control Act (AECA), 22 U.S.C. 2778, Congress has given the President broad authority to control the import and export of defense articles and services. This statutory authority includes the authority to designate items as defense articles and services and to promulgate regulations to control the import and export of such items. The statute also provides that the President's determination as to which items are defense articles warranting control under the AECA is not subject to judicial review. See U.S.C. 2778(h). If you desire, you may request that my determination be reviewed by Dr. Lynn Davis, the Under Secretary for Arms Control and International Security Affairs.
I hope you find this information responsive to your request. Please be assured that I reviewed your appeal with great care.
Sincerely, (signed) Thomas E. McNamara