December 2003 - cypherpunks-legacy

Re: why compression doesn't perfectly even out entropy
by Peter Monta 17 Dec '03

17 Dec '03

Perry Metzger writes: > > 1. If "cooking" a byte sequence in a manner that reduces its > > maximum entropy by less than 1% allows an attacker to break your > > cryptosystem, then it is crap to begin with. With only a little > > more effort, he could break it anyway. > > I would suggest that you look at differential and linear cryptanalysis > to learn what a tiny little statistical toehold will give you. > > My "ad hominem PSA" stands. I suggest people not trust Mr. Wienke's > pronouncements. He appears to be suffering from significant hubris. No, he's correct; cryptanalytic schemes like those you mention rely on statistical toeholds *in the context of a deterministic cipher algorithm*. For one-time pads that are "cooked" or "screened" (and I agree that it's a silly thing to do), the toehold is much weaker, infinitesimal in fact. For example, suppose we take 1024-bit blocks from a physical RNG (which we'll agree is "good", has entropy close to 1024 bits, whatever that means). There are 2^1024 such blocks. Obtain one and apply the magical test---if the block fails, toss it in the bit bucket. Suppose, conservatively, that half the sequences fail. The cryptanalyst now knows that the plaintext cannot be ( failed_pad xor ciphertext ) for any of the 2^1023 failed_pads. Thus, it must be one of the other 2^1023. This is the *only* toehold he gets. Cheers, Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

4 5

Re: Spaces in passwords
by Steve Gibbons 17 Dec '03

17 Dec '03

# > I have a hard enough time getting lusers to choose non-dictionary # > passwords that they can *remember* - one technique is to teach sub-100 # > i.q. types to use two words, seperated by a #,@, etc., with a number # > tossed in: kill#pig1et, which isn't a dictionary word, but has a chance of # > being remembered without writing it on a sticky note and pasting it to # > the @#%&ing monitor. # It's hard. I'd really rather have longer pass{words,phrases} so that there's # the potential for lots of entropy without requiring line-noise for passwords. One of the ideas that I've been kicking around in the back of my head for a while for stronger, easier to uses user authentication goes something like this: 1) User enters a pass-phrase. 2) System "tokenizes" the pass-phrase. The tokenization would probably include a normalization step: condensing white-space and punctuation, standardizing the casing of words, perhaps even going so far as converting 3133+ speak to something readable. Once normalized, the pass-phrase would be parsed, and tokenized. It would be useful to have a large system-wide dictionary, sorted by how common a given word or group of words is normally used in the most commonly used languages that the system's users speak/write. Any word or group of words found in the dictionary would be converted to a number, representing its position in the dictionary, and the significant bits of that number are concatenated to a running bit string. Words and tokens not found in the dictionary would pass through some other algorithm that I haven't thought too much about, yet. 3A) System examines the tokenized pass-phrase against another (probably _very_ large) dictionary of common phrases for acceptability. (maybe just comparing the hashes of the phrases [smaller dictionary]) System also examines the "length" of the tokenized pass-phrase for acceptability (for pass-phrase changes.) 3B) System hashes the tokenized pass-phrase, and compares it against the previously stored hash (for authentication.) [ Standard crypt(3) stuff ] Ignoring the fact that strong one-time-passwords are orders of magnitude better, what would something like this buy you? 0) "Good" pass-phases should be more difficult to brute-force or inteligently attack than simple (8 or 16 byte) passwords. [ rm /usr/local/bin/crack ] 1) Pass-phrases are generally easier to remember than system-generated passwords. [ no more post-its pasted to screens or hidden under keyboards with passwords written on them. ] 2) Pass-phrases can be a pain to type in correctly, the normalization step should help in this regard. [ happier users ] 3) Enforcement of selecting good pass-phrases is difficult. This scheme addresses _some_ of the issues involved. [ The next generation of 'crack' won't have a foothold - happier security officers. ] This message has been sponsored by off-the-cuff, back-of-the-brain, and poorly-thought-out; comments and suggestions/improvements are welcomed. -- Steve(a)AZTech.Net

1 0

no help for the clueless
by Dave Del Torto 17 Dec '03

17 Dec '03

Sameer, I submit that the "info" command should be implemented with a little ReadMe for clueless "subscrivers"... this is part of the idea, right? dave ................................. cut here ................................. >Date: Fri, 19 Apr 1996 04:38:16 -0700 (PDT) >To: ddt(a)lsd.com >From: Majordomo(a)c2.org >Subject: Majordomo results: info clueless > >-- > >>>>> info clueless >#### No info available for clueless. >>>>> >>>>>

1 0

Re: Unsubsrive
by MBSFT-0K 17 Dec '03

17 Dec '03

> Unsubsrive me! > > Lorca Kelly MBSFT-0K(a)carraig.ucd.ie

1 0

Here's the judge's decision in the Bernstein case
by John Gilmore 17 Dec '03

17 Dec '03

[Forgive the scannos in the interest of speed. This is also at http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/960415.decision] UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA DANIEL J. BERNSTEIN, | No. C-95-0582 MHP | Plaintiff, | OPINION | vs. | | UNITED STATES DEPARTMENT OF STATE | et al., | Defendants. | ____________________________________| Plaintiff Daniel Bernstein brought this action against the Department of State and the individually named defendants seeking declaratory and injunctive relief from their enforcement of the Arms Export Control Act ("AECA"), 22 U.S.C. € 2778, and the International Traffic in Arms Regulations ("ITAR"), 22 C.F.R. Sections 120-30 (1994), on the grounds that they are unconstitutional on their face and as applied to plaintiff. Now before this court is defendants' motion to dismiss for lack of justiciability.1 Having considered the parties' arguments and submissions, and for the reason set forth below, the court enters the following memorandum and order. BACKGROUND 2 At the time this action was filed, plaintiff was a PhD candidate in mathematics at University of California at Berkeley working in the field of cryptography, an area of applied mathematics that seeks to develop confidentiality in electronic communication. A. Cryptography Encryption basically involves running a readable message known as "plaintext" through a computer program that translates the message according to an equation or algorithm into unreadable "ciphertext." Decryption is the translation back to plaintext when the message is received by someone with an appropriate "key." The message is both encrypted and decrypted by common keys. The uses of cryptography are far-ranging in an electronic age, from protecting personal messages over the Internet and transactions on bank ATMs to ensuring the of military intelligence. As a graduate student, Bernstein developed an encryption algorithm he calls "Snuffle." He describes Snuffle as a zerodelay private-key encryption system. Complaint Exh. A. Bernstein has articulated his mathematical ideas in two ways: in an academic paper in English entitled "The Snuffle Encryption System," and in "source code" written in "C", a high-level computer programming language,3 detailing both the encryption and decryption, which he calls "Snuffle.c" and "Unsnuffle.c", respectively. Once source code is converted into "object code," a binary system consisting of a series of 0s and 1s read by a computer, the computer is capable of encrypting and decrypting data. 4 B. Statutory and Regulatory Background The Arms Export Control Act authorizes the President to control the import and export of defense articles and defense services by designating such items to the United States Munitions List ("USML"). 22 U.S.C. € 2778(a)(1). Once on the USML, and unless otherwise exempted, a defense article or service requires a license before it can be imported or exported. 22 U.S.C. € 2778(b)(2). The International Traffic in Arms Regulations, 22 C.F.R. Sections 120-30, were promulgated by the Secretary of State, who was authorized by executive order to implement the AECA. The ITAR is administered primarily within the Department of State by the Director of the Office of Defense Trade Controls ("ODTC"), Bureau of Politico-Military Affairs. The ITAR allows for a "commodity jurisdiction procedure" by which the ODTC determines if an article or service is covered by the USML when doubt exists about an item. 22 C.F.R. € 120.4(a). Categories of items covered by the USNL are enumerated at section 121.1. Category XIII, Auxiliary Military Equipment, includes "Cryptographic (including key management) systems, equipment, assemblies, modules, integrated circuits, components or software with the capability of maintaining secrecy or confidentiality of information or information systems .... __ _ € 121 XIII(b)(l). A number of applications of cryptography are excluded, such as those used in automated teller machines and certain mass market software products that use encryption. Id. C. Plaintiff's Commodity Jurisdiction Determinations On June 30, 1992 Bernstein submitted a commodity jurisdiction ("CJ") request to the State Department to determine whether three items were controlled by ITAR. Those items were Snuffle.c and Unsnuffle.c (together referred to as Snuffle 5.0), each submitted in C language source files, and his academic paper describing the Snuffle system. Complaint Exh. A. On August 20, 1992 the ODTC informed Bernstein that after consultation with the Departments of Commerce and Defense it had determined that the commodity Snuffle 5.0 was a defense article under Category XIII of the ITAR and subject to licensing by the Department of State prior to export. The ODTC identified the item as a "stand-alone cryptographic algorithm which is not incorporated into a finished software product." Complaint Exh. B. The ODTC further informed plaintiff that a commercial software product incorporating Snuffle 5.0 may not be subject to State Department control and should be submitted as a new commodity jurisdiction request. Plaintiff and ODTC exchanged copious and contentious correspondence regarding the licensing requirements during the spring of 1993. Still unsure if his academic paper had been included in the ODTC CJ determination of August 20, 1992, Bernstein submitted a second CJ request on July 15, 1993, asking for a separate determination for each of five items. According to plaintiff these items were 1) the paper, "The Snuffle Encryption System," 2) Snuffle.c, 3) Unsnuffle.c, 4) a description in English of how to use Snuffle, and 5) instructions in English for programming a computer to use Snuffle.5 On October 5, 1993 the ODTC notified Bernstein that all of the referenced items were defense articles under Category XIII(b)(1). Complaint Exh. E; Defendant Exh. 18. After plaintiff initiated this action, the ODTC wrote to plaintiff to clarify that the CJ determinations pertained only to Snuffle.c and Unsnuffle.c and not to the three items of explanatory information, including the paper. Defendant Exh. 21. Bernstein appealed the first commodity jurisdiction determination on September 22, 1993. That appeal is still pending. Plaintiff seeks to publish and communicate his ideas on cryptography. Because "export" under the ITAR includes "[d]isclosing . . . technical data to a foreign person, whether in the United States or abroad", Bernstein asserts that he is not free to teach the Snuffle algorithm, to disclose it at academic conferences, or to publish it in journals or online discussion groups without a license. LEGAL STANDARD A motion to dismiss will be denied unless it appears that the plaintiff can prove no set of facts which would entitle him or her to relief. Conlev v. Gibson, 355 U.S. 41, 45-46 (1957); Fidelity Financial Corp. v. Federal Home Loan Bank of San Francisco, 792 F.2d 1432, 1435 (9th Cir. 1986), cert. denied, 479 U.S. 1064 (1987). All material allegations in the complaint will be taken as true and construed in the light most favorable to the plaintiff. NL Industries. Inc. v. Kaplan, 792 F.2d 896, 898 (9th Cir. 1986). Although the court is generally confined to consideration of the allegations in the pleadings, when the complaint is accompanied by attached documents, such documents are deemed part of the complaint and may be considered in evaluating the merits of a Rule 12(b)(6) motion. Durning v. First Boston Corp., 815 F.2d 1265, 1267 (9th Cir.), cert. denied sub. nom. Wyomina Community Dev. Auth. v. Durning, 484 U.S. 944 (1987). DISCUSSION Plaintiff makes a number of allegations of unconstitutionality with respect to the AECA and ITAR. Specifically, plaintiff alleges that the act and accompanying regulations, both facially and as applied, are a content-based infringement on speech, act as an unconstitutional prior restraint on speech, are vague and overbroad, and infringe the rights of association and equal protection. Bernstein also alleges that the CJ request and registration processes as well as the licensing procedures are unconstitutional, although he does not state the basis of their unconstitutionality. Finally, plaintiff alleges that the actions of defendants are arbitrary and capricious and constitute an abuse of discretion under the Administrative Procedure Act, 5 U.S.C. Sections 701 et ~g Defendants move to dismiss on the grounds that these issues are nonjusticiable. I. Justiciability The AECA plainly states: The designation by the President (or by an official to whom the President's functions under subsection (a) of this section have been duly delegated), in regulations issued under this section, of items as defense articles or defense services for purposes of this section shall not be subject to judicial review. 22 U.S.C. € 2778(h). Defendants conclude that this language, as well as the Constitution, precludes review of commodity jurisdiction determinations by this court. Plaintiff does not dispute this assessment. Defendants characterize this action as an attempt to obtain judicial review of their CJ determinations to place plaintiff's cryptographic items on the USML; as such, they maintain the action is precluded. However, this characterization does not comport with either the complaint itself or plaintiff's repeated assertions that he is not seeking judicial review of defendants' CJ decision, but of the constitutionality of the statute and its regulations. It is well established under the political question doctrine that courts do not have the expertise to examine sensitive political questions reserved for the other branches of government. See Baker v. Carr, 369 U.S. 186 (1962). More to the point, as defendants note, the determination of whether an item should be on the USML "possesses nearly every trait that the Supreme Court has enumerated traditionally renders a question 'political."' United States v. Martinez, 904 F.2d 601, 602 (llth Cir. 1990) (finding the CJ determination nonjusticiable without deciding if the then recent amendment to the AECA precluding judicial review applied to that case). However, a review of a particular CJ decision is a distinctly different question from a constitutional challenge to a statute. In Martinez, the Eleventh Circuit noted that defendants had not alleged a constitutional violation.6 904 F.2d at 603. With respect to constitutional questions, the judicial branch not only possesses the requisite expertise to adjudicate these issues, it is also the best and final interpreter of them. Furthermore, as plaintiff points out, federal courts have consistently addressed constitutional issues in the context of national security concerns. See. e.q., New York Times Co. v. United States, 403 U.S. 713 (1971); Haia v. Aaee, 453 U.S. 280 (1981). Because the issues before this court do not necessitate a factual inquiry into the CJ determination, but a legal one into broader constitutional claims, the question is whether the statutory preclusion of judicial review of CJ decisions also embraces this court's review of the statute's constitutionality. 7 Defendants cite a number of Ninth Circuit cases that reject the reviewability of commodity designations under the analogous Export Administration Act, 50 U.S.C. App. Sections 2401 et seq., administered by the Commerce Department. Because this court is not reviewing the CJ determination itself, those cases miss the mark. Of those cases, however, United States v. Bozarov, 974 F.2d 1037 (9th Cir. 1992), cert. denied, 507 U.S. 917 (1993), is instructive. In Bozarov the defendant was charged with exporting items on the Commerce Control List ("CCL")--which is akin to the USML--without a license in violation of the statute. The items, which were computer disk manufacturing equipment, had been listed on the CCL for national security reasons. Bozarov challenged the constitutionality of the Act's preclusion of judicial review. In upholding the preclusion of review, however, the court noted its decision was "bolstered by the fact that certain limited types of judicial review are available under the EAA despite the Act's seemingly absolute preclusion of review. First, colorable constitutional claims may be reviewed by the courts even when a statute otherwise precludes judicial review." Id. at 1044 (citing Webster v. Doe, 486 U.S. 592, 602-05 (1988)). In fact, in order to reach the question of whether it was constitutional to preclude judicial review, the Ninth Circuit had to first find the issue justiciable. There, even the government conceded that Bozarov's nondelegation challenge amounted to a colorable constitutional claim. 974 F.2d at 1044 n.7. More definitive still is the Supreme Court's decision in Webster_, where it addressed whether employment decisions by the Director of the CIA were subject to judicial review. In Webster, plaintiff Doe was discharged from the CIA after informing the agency that he was a homosexual. He contested his termination partly on constitutional grounds. The Court held that the applicable statute bestowed so much discretion on the CIA Director in terminating employees that judicial review of those decisions was precluded under section 701(a)(2) of the APA. However, the Court made clear that such a holding did not preclude review of constitutional claims, noting that where Congress intends to preclude judicial review of constitutional claims its intent to do so must be clear.... We require this heightened showing in part to avoid the "serious constitutional question" that would arise if a federal statute were construed to deny any judicial forum for a colorable constitutional claim. 486 U.S. at 603 (citations omitted). 8 In the instant case, Congress has clearly precluded review of CJ determinations under the AECA, 22 U.S.C. € 2778(h). But it has just as clearly tailored the preclusion of review to the designation by the President or his delegate "of items as I defense articles or defense services for the purposes of this section." Id. Moreover, the language of section (h) indicates that it pertains only to delegations of the President's "functions under subsection (a) of this section." Those functions do not include constitutional determinations. As this court finds that the AECA does not preclude judicial review of colorable constitutional claims, it must determine if plaintiff's claims are colorable in order to decide the issue of justiciability. II. Colorability of Plaintiff's Constitutional Claims Defendants maintain that plaintiff has raised no colorable constitutional claim because this case does not concern "speech" protected by the First Amendment, and even if it does, the minimal infringement is excusable under O'Brien v. United U.S. 367 (1968). Defendant's further argue that plaintiff has not made a colorable claim that the CJ determinations constitute a prior restraint or that the AECA and ITAR are overbroad or vague.9 Plaintiff responds that the items that were subject to CJ determinations are speech of the most protected kind. A. Analytical Framework To determine if Bernstein states a "colorable constitutional claim," it is helpful to know what standard obtains. Colorability, a concept often employed by courts, is rarely defined. Not surprisingly, discussions of colorability appear to be highly specific to both the claim and context in which they arise. The Ninth Circuit has adopted the proposition that a constitutional claim is not colorable if it is clearly immaterial and made only for the purposes of jurisdiction, or "is wholly insubstantial or frivolous." Hoye v. Sullivan, 985 F.2d 990, 991-92 (9th Cir. 1993) (citing Boettcher v. Secretary of HHS, 759 F.2d 719, 722 (9th Cir. 1985)). On a number of occasions the Ninth Circuit has addressed whether constitutional claims were colorable in the context of national security decisions. These have been largely due process and equal protection challenges to revocations of a security clearance. Dorfmont v. Brown, 913 F.2d 1399 (9th Cir. 1990), cert. denied, 499 U.S. 905 (1991); High Tech Gays v. Defense Ind. Sec. Clearance Off., 895 F.2d 563 (9th Cir.), reh'a denied, en banc, 909 F.2d 375 (1990); Dubbs v. CIA, 866 F.2d 1114 (9th Cir. 1989). In Dorfmont the court held that there was no cognizable liberty or property interest in a security clearance that could give rise to a due process claim and therefore the claim was not colorable. The Dorfmont court noted, however, that it had found equal protection challenges to security clearance denials colorable in Hiah Tech Gays. 913 F.2d at 1403. In fact, in Hiah Tech Gays the court bypassed the issue of colorability altogether and concluded on the merits that homosexuals were not a suspect or quasi-suspect class for purposes of heightened equal protection scrutiny.10 Plaintiffs in High Tech Gays had also brought a First Amendment claim based on freedom of association. The court found that plaintiffs had failed to allege or show a security clearance had been denied solely by reason of their membership in a gay organization and, therefore, there was no case or controversy with respect to that claim. In Dorfmont the court described its disposition of the First Amendment claim in Hiah Tech Gays as failure "to allege sufficient facts to raise a justiciable First Amendment claim." 913 F.2d at 1403 n.2. It is unclear whether the court's discussion of justiciability in Dorfmont applies to lack of colorabilty, and if so, what standard it implies. As Hoye is the most recently and clearly articulated of the Ninth Circuit's attempts to define colorability, its standard will govern the court's analysis in this case. B. Analysis Neither party agrees on exactly which items are at issue in this case, which confounds the analysis of whether subjecting them to a licensing requirement raises a colorable First Amendment claim. Defendants claim that only Snuffle.c and Unsnuffle.c are controlled by the USML and subject to the I licensing requirement. This is based on the 1995 letter the ODTC sent to plaintiff after he had filed suit in which it clarified that the CJ determinations did not include any explanatory information, including the paper. This clarification would have been more appropriate in response to plaintiff's letter of July 15, 1993. Bernstein claims that his paper, "The Snuffle Encryption System," remains on the USML and that he has not been able to publish it without a license. It seems evident from the correspondence between Bernstein and the ODTC that the paper was indeed determined to be on the USML at the latest by October 5, 1993, but that as of June 29, 1995, the ODTC disavowed that decision. It is disquieting that an item defendants now contend could not be subject to regulation was apparently categorized as a defense article and subject to licensing for nearly two years, and was only reclassified after plaintiff initiated this action. Nonetheless, given defendants' reevaluation, the claims pertaining to the paper now appear moot.12 1. Speech The paper, an academic writing explaining plaintiff's scientific work in the field of cryptography, is speech of the most protected kind. See Sweezv v. New Hampshire, 354 U.S. 234, 249-50 (1957) (noting the importance of protecting scholarship and academic inquiry). Nor do defendants contest this. Rather, defendants contend that Snuffle.c and Unsnuffle.c--the source code for the encryption program--are not speech but conduct. Plaintiff argues that computer code inscribed on paper, like any non-English language, is speech protected by the First Amendment .13 Plaintiff further argues that even functional software is treated as protectable expression under copyright law. 14 Defendants urge this court to find the source code for Snuffle unprotected conduct rather than speech. They cite Texas v. Johnson, 491 U.S. 397 (1989), for the proposition that conduct must be "'sufficiently imbued with the elements of communication"' to fall within the protections of the First Amendment. Id. at 404 (quoting Spence v. Washington, 418 U.S. 405, 409 (1974)). In evaluating the communicative aspects of burning a flag in Texas v. Johnson, the Court framed the inquiry as whether the conduct entails an intent to convey a particular message and the likelihood of that message being understood. Id. According to defendants, the source code, as a functioning cryptographic product, is not intended to convey a particular message. It cannot be speech, they say, because its purpose is functional rather than communicative. However, the Court in both Johnson and Spence, the flag desecration case upon which Johnson relies, inquired into the communicative nature of conduct only after concluding that the act at issue was indeed conduct and not speech. Both cases strongly imply that a court need only assess the expressiveness of conduct in the absence of "the spoken or written word." Johnson, 491 U.S. at 404; see Spence, 418 U.S. at 409 ("To be sure, appellant did not choose to articulate his views through printed or spoken words. It is therefore necessary to determine whether his activity was sufficiently imbued with elements of communication to fall within the scope of the First and Fourteenth Amendments ...."). In the instant case, Bernstein's encryption system is written, albeit in computer language rather than in English. Furthermore, there is little about this functional writing to suggest it is more like conduct than speech. A computer program is so unlike flag burning and nude dancing that defendants' reliance on conduct cases is misplaced. It would be convoluted indeed to characterize Snuffle as conduct in order to determine how expressive it is when, at least formally, it appears to be speech. Recently the Ninth Circuit addressed the difference between speech and expressive conduct in assessing the constitutionality of the English-only provision amended to Arizona's constitution. Yniguez v. Arizonans for Official English, 69 F.3d 920, 934-36 (9th Cir. 1995) (en banc), cert. granted, 64 U.S.L.W. 3639 (U.S. Mar. 25, 1996) (No. 95-974). Defendants in Yniguez, like defendants here, sought to characterize one's choice of language as expressive conduct. The court was similarly "unpersuaded by the comparison between speaking languages other than English and burning flags." Id. at 934. The court further concluded that language was speech by definition: Of course, speech in any language consists of the ' expressive conduct' of vibrating one's vocal chords, moving one's mouth and thereby making sounds, or of putting pen to paper, or hand to keyboard. Yet the fact 16 that such 'conduct' is shaped by language--that is, a sophisticated and complex system of understood meanings--is what makes it speech. Language is by definition speech, and the regulation of any language is the regulation of speech. Id. at 934-35. Nor does the particular language one chooses change the nature of language for First Amendment purposes. This court can find no meaningful difference between computer language, particularly high-level languages as defined above, and German or French. All participate in a complex system of understood meanings within specific communities. Even object code, which directly instructs the computer, operates as a "language." When the source code is converted into the object code "language," the object program still contains the text of the source program. The expression of ideas, commands, objectives and other contents of the source program are merely translated into machine-readable code. 15 Whether source code and object code are functional is immaterial to the analysis at this stage. Contrary to defendants' suggestion, the functionality of a language does not make it any less like speech. The Yniguez court noted that "the choice to use a given language may often simply be based on a pragmatic desire to convey information to someone so that they may understand it." Id. at 935. Thus, even if Snuffle source code, which is easily compiled into object code for the computer to read and easily used for encryption, is essentially functional, that does not remove it from the realm of speech. Instructions, do-it-yourself manuals, recipes, even technical information about hydrogen bomb construction, see United States v. The Progressive. Inc., 467 F. Supp. 990 (W.D. Wisc. 1979), are often purely functional; they are also speech. Music, for example, is speech protected under the First Amendment. See Ward v. Rock Against Racism, 491 U.S. 781, 790 (1989). The music inscribed in code on the roll of a player piano is no less protected for being wholly functional. Like source code converted to object code, it "communicates" to and directs the instrument itself, rather than the musician, to produce the music. That does not mean it is not speech. Like music and mathematical equations, computer language is just that, language, and it communicates information either to a computer or to those who can read it. 16 Defendants argue in their reply that a description of software in English informs the intellect but source code actually allows someone to encrypt data. Defendants appear to insist that the higher the utility value of speech the less like speech it is. An extension of that argument assumes that once language allows one to actually do something, like play music or make lasagne, the language is no longer speech. The logic of this proposition is dubious at best. Its support in First Amendment law is nonexistent. By analogy, copyright law also supports the "expressiveness" of computer programs. Computer software is subject to copyright protection as a "literary work." 17 U.S.C. Sections 101, 102(a)(1); accord Johnson Controls v. Phoenix Control Systems, 886 F.2d 1173, 1175 (9th Cir. 1989). For the purposes of copyright, literary works "are works, other than audiovisual works, expressed in words, numbers, or other verbal or numerical symbols or indicia, regardless of the nature of the material objects, such as books, periodicals, manuscripts, phonorecords, film, tapes, disks, or cards, in which they are embodied." 17 U.S.C. Section 101. A computer program is further defined under the copyright statute as "a set of statements or instructions to be used directly or indirectly in a computer in order to bring about a certain result." Id. (emphasis added). Source code is essentially a set of instructions that is used indirectly in a computer since it must first be translated into object code to achieve the desired result. The statutory language, along with the caselaw of numerous circuits, supports the conclusion that copyright protection extends to both source code and object code. See NLFC. Inc. v. Devcom Mid-America. Inc., 45 F.3d 231, 234-35 (7th Cir.), cert. denied, 115 S.Ct. 2249 (1995) ("Both the source and object codes to computer software are also individually subject to copyright protection.") (citations omitted); Johnson Controls, 886 F.2d at 1175 ("Source code and object code, the literal components of a program, are consistently held protected by a copyright on the program.") (citations omitted); Apple Computer. Inc. v. Franklin Computer Corp., 714 F.2d 1240, 1249 (3d Cir. 1983), cert. dismissed, 464 U.S. 1033 (1984). Copyright protection, designed to protect original expression, 17 U.S.C. Section 102(a), supports the likeness of a computer program to speech as defined by First Amendment law. The expression of an idea, a~ opposed to the idea itself, which is not afforded copyright protection under 17 U.S.C. Section 102(b), connotes the "speaking" of an idea. An encryption program expressed in source code communicates to other programmers and ultimately to the computer itself how to make the encryption algorithm (the idea) functional. Nor, under copyright law, does sheer functionality diminish the expressive quality of a copyrightable work. Apple Computer. Inc., 714 F.2d at 1252 (citing Mazer v. Stein, 347 U.S. 201, 218 (1954)); cf. Lotus Dev. Corp. v. Borland Int'l. Inc., 49 F.3d 807, 815 (lst Cir. 1995), judgment aff'd, 116 S.Ct. 804 (1996) (holding that a text describing how to operate something is subject to copyright protection while the method of operation itself is not). While copyright and First Amendment law are by no means coextensive, and the analogy between the two should not be stretched too far, copyright law does lend support to the conclusion that source code is a means of original expression. For the purposes of First Amendment analysis, this court finds that source code is speech. Having concluded that all the items at issue, including Snuffle.c and Unsnuffle.c are speech, this court must now briefly review the claims defendants contest for colorability. 2. O'Brien Defendants, relying on a characterization of Snuffle as conduct, argue that even if that conduct is expressive, the relatively mild O'Brien test should be employed. United States v. O'Brien, 391 U.S. 367 (1968), establishes the standard for assessing when a governmental regulation of conduct may nonetheless run afoul of the First Amendment's speech protections. Under O'Brien a regulation of conduct that incidentally restricts speech will be valid if 1) it is within the power of the government, 2) it furthers an important or substantial government interest, 3) the government interest is unrelated to the suppression of free expression and 4) the incidental restriction on speech is no greater than is essential to further that interest. Id. at 377. Given that Snuffle source code is speech and not conduct, O'Brien does not appear to provide the appropriate standard under which to evaluate plaintiff's claims.17 However, as the parties have not had an opportunity to brief the issue of what First Amendment standard obtains, the court will apply O'Brien for the limited purpose of determining colorability. Defendants make a strong case that the AECA and ITAR satisfy the first and second prongs of O'Brien--that they are within the government's power and further the important interest of national security. With respect to prongs three and four, however, this court cannot say that plaintiff~s contentions are frivolous. Both the technical data provision of the ITAR, 22 C.F.R. Section 120.10, and Category XIII of the USML, 22 C.F.R. Section 121.1, regulating cryptographic software appear to relate to the "suppression of free expression" and may reach farther than is justifiable. Defendants also argue that the Ninth Circuit's decision in United States v. Edler Industries Inc., 579 F.2d 516 (9th Cir. 1978), precludes a First Amendment attack under O'Brien on the AECA and its accompanying regulations. In Edler the court reviewed a conviction under the predecessor of the AECA for unlicensed exportation of technical data relating to a defense article on the USML. The technical data at issue in Edler related to a technique of tape wrapping with applications for missile components. After finding that "an expansive interpretation of technical data relating to items on the Munitions List could seriously impede scientific research and publishing and international scientific exchange," ~ at 519, the court went on to adopt a narrowing construction to save the statute. 18 Defendants urge that if Edler allows the government to legitimately restrict the export of technical data relating to a defense article, it can certainly restrict the defense article itself. Such an argument is an extension of Edler this court is unwilling to adopt. The validity of the of the munitions list was simply not at issue in that case. While Edler will be instructive to an analysis of the AECA under the First Amendment, it is sufficiently distinguishable on its facts that it cannot preclude plaintiff's challenge at this stage. While the court makes no judgment on the merits, it finds plaintiff alleges facts sufficient to state a nonfrivolous First Amendment claim and hence that claim is colorable. 3. Prior Restraint Plaintiff alleges that the AECA and ITAR act as an administrative licensing scheme for the publication of scientific papers, algorithms and computer programs related to cryptography, since publishing could release that information to foreign persons and would constitute exportation under the ITAR. 22 C.F.R. Section 120.17 .19 Governmental licensing schemes, such as the AECA and ITAR, come with a heavy presumption against their validity when they act as a prior restraint on speech. See Nebraska Press Assoc. v. Stuart, 427 U.S. 539 (1976); New York Times Co. v. United States, 403 U.S. 713 (1971) (per curiam); Near v. Minnesota, 283 U.S. 697 (1931). Prior restraints have even been struck down in the face of national security concerns. See e.a. New York Times, 403 U.S. at 714 (dissolving retraining order against newspaper publication of Pentagon Papers that included classified information). In New York Times the national security asserted was too vague a justification for prior restraints. Id. at 719 (Black, J., concurring), 725-26 (Brennan, J., concurring). In his concurrence to the per curiam decision, Justice Stewart suggested a stringent test for permissible prior restraints, allowing them only when "disclosure . . . will surely result in direct, immediate, and irreparable damage to our Nation or its people." Id. at 730 (Stewart J., concurring). In response to the prior restraint claim, defendants rely on the argument rejected above, that Snuffle is not speech and does not implicate the First Amendment. Since Snuffle is speech that is potentially subject to the prior restraint of licensing, and under the AECA that restraint is unreviewable, plaintiff's prior restraint claim is colorable. 20 4. Overbreadth Plaintiff alleges that the AECA and ITAR are overbroad with respect to their regulation of items with predominately civil applications, the definition of export, Category XIII of the USNL, and the definition of software. Defendants rely extensively on Edler to argue that any overbreadth challenge is foreclosed to plaintiff because the Ninth Circuit has provided a limiting construction to the technical data provision. They also cite the 1984 revisions to ITAR which they contend are even more solicitous of speech because they provide for certain exemptions from technical data for academic research and information in the "public domain." Defendant Exh. lA. However, plaintiff's overbreadth claim goes beyond the technical data provision and beyond those items classified as technical data. The complaint makes clear that the challenge is significantly broader than the scope of Edler and pertains to the defense articles themselves. Facial overbreadth is concededly "strong medicine" employed as a last resort when a limiting construction cannot be applied to a statute. Broadrick v. Oklahoma, 413 U.S. 601, 613 (1973). Defendants employ Broadrick to propose that when conduct as well as speech is regulated, the overbreadth must be substantial in relation to the statute's legitimate sweep. Id. at 615. However, in a subsequent Supreme Court decision relied upon by defendants, Members of the City Council of Los Angeles v. Taxpayers for Vincent, 466 U.S. 789 (1984), the Court noted that "where the statute unquestionably attaches sanctions to protected conduct, the likelihood that the statute will deter that conduct is ordinarily sufficiently great to justify an overbreadth attack." Id. at 801 n.l9 (citing Erznoznik v. City of Jacksonville, 422 U.S. 205 (1975)). In Taxpayers for Vincent the Court clarified the application of substantial facial overbreadth, saying there must be a "realistic danger that the statute itself will significantly compromise recognized First Amendment protections of parties not before the Court ...." Id. at 801. Merely being able to conceive of "some impermissible applications of a statute" is insufficient. Id. at 800. As this court has noted above, cryptographic source code is speech. Even if the statute aims at conduct as well as speech so as to invoke the "substantial overbreadth" doctrine, the court at this stage of the proceedings need only determine whether the claim is colorable. On the record before it at this time, the court cannot say that plaintiff's claim that enforcement of some provisions of the statute or regulations could significantly compromise the protected speech of third parties is frivolous. 5. Vagueness Plaintiff alleges that a number of terms and provisions within the AECA and ITAR are impermissibly vague in that they fail to give notice of the conduct they regulate and have a chilling effect on speech. These provisions include inter alia the meaning of software capable of maintaining secrecy under Category XIII of the USML, the exemptions for information taught in universities, the definition of public domain, and the "willful" requirement for criminal penalties. For a claim of facial vagueness to survive, the deterrent effect of the statute on protected expression must be "real and substantial" and not easily narrowed by a court. Young v. American Mini Theaters. Inc., 427 U.S. 50, 60 (1976). Defendants again rely heavily on Edler to argue that the Ninth Circuit has already resolved the problems plaintiff challenges. While this may be true of the technical data provision, it leaves unaddressed numerous other areas of concern. Defendants also conclude summarily that both the definition of cryptographic software and the exemptions from this definition are clear to a person of ordinary intelligence. This seems to be a bit of dissimulation, unless it is a confession, since the ODTC itself mistakenly classified Bernstein's academic paper as a defense article under Category XIII. Finally, defendants contest plaintiff's vagueness challenge to the "willful" requirement for criminal penalties, citing the Ninth Circuit's clarification that under the AECA willfulness requires a "voluntary, intentional violation of known legal duty ...." United States v. Lizarraga-Lizarraga, 541 F.2d 826, 828 (1976) (construing the predecessor to the AECA). According to Posters 'N' Things. Ltd. v. United States, _ U.S. _ , 114 S. Ct. 1747, 1754 (1994), such a scienter requirement helps to avoid the problem of vagueness a criminal statute might otherwise allow. With the exception of the claim against the willful standard for criminal violations of the AECA, this court does not find plaintiff's claims of vagueness frivolous. It should be emphasized that with the exception of its conclusions that source code is speech for the purposes of the First Amendment and that this case is justiciable, the court makes no other substantive holdings. CONCLUSION For the reasons set forth above, IT IS HEREBY ORDERED that defendants' motion to dismiss is DENIED. IT IS SO ORDERED. Dated: April 15, 1996 MARILYN HALL PATEL United States District Judge ENDNOTES 1. Defendants pose the justiciability issue as one of subject matter jurisdiction. As those questions are distinct and defendants arguments go to justiciability, this court addresses the motion as one pertaining to justiciability alone. See Baker v. Carr, 369 U.S. 186, 198 (1962). 2. Except where noted, these facts come from undisputed portions of the record. 3. Source code is the text of a source program and is generally written in a high-level language that is two or more steps removed from machine language which is a low-level language. High-level languages are closer to natural language than lowlevel languages which direct the functioning of the computer. Source code must be translated by way of a translating program into machine language before it can be read by a computer. The object code is the output of that translation. It is possible to write a source program in high-level language without knowing about the actual functions of the computer that carry out the program. Encyclopedia of Computer Science 962, 1263-64 (Anthony Ralston & Edwin D. Reilly eds., 3d ed. 1995) 4. The parties disagree about whether the computer code submitted by plaintiff to the State Department is technically "software." Defendants refer to the computer code as software even though it i8 not in object code on a disk. Plaintiff contests this characterization. In any event, in order to be software, which are instructions to the computer, the instructions must be in a form that can be easily altered as distinguished from firmware or hardware which cannot be readily altered, if it can be altered at all. The court notes that 22 CFR Section 121.8(f) defines "software" for the purposes of the AECA. That definition is descriptive of content, however, and does not define the actual format or physical form of the software. At this stage the court need not resolve this issue since whatever the program's form, the ODTC has subjected it to the licensing requirements. 5. The CJ request of July 15, 1993, refers to the items as W BCJF-2, W BCJF-3, DIBCJF-4, DJBCJF-5, and W BCJF-6 without distinguishing information. Complaint Exh. D. 6. This statement appears to be contradicted by that court's own reference to defendants' overbreadth claim on the preceding page of its opinion. Martinez, 904 F.2d at 601. It is not clear whether the overbreadth argument went to constitutionality or merely to statutory interpretation. 7. Plaintiff argues that this court has power to review his cause of action under a political question analysis. Even if that were so, he fails to consider the effect of a clear statement by Congress precluding judicial review in the context of the AECA. Furthermore, plaintiff dedicates nearly ten pages of his brief in opposition to this motion to arguing that review is proper under the Administrative Procedure Act ("APA"). However, as defendants note, to the extent judicial review is precluded by statute, it is also precluded by the APA. 5 U.S.C. Section 701(a)(1) ("This chapter applies . . . except to the extent that--(l) statutes preclude judicial review ...."). That does not necessarily mean plaintiff's allegation that defendants exceeded their lawful authority under the APA is unreviewable. Plaintiff is correct that U.S. v. Bozarov allows courts to exercise review, in the face of statutory preclusion, of "claims that the Secretary acted in excess of his delegated authority under the EAA." 974 F.2d at 1045. Nonetheless, defendants only argue nonjusticiability based on the First Amendment claim. This court declines to rule on the colorability of every one of plaintiff's claims without briefing on those issues. Currently before the court is simply the issue of the justiciability of plaintiff's First Amendment challenge. 8. The Court did not consider whether Doe presented a colorable constitutional claim because that question was not properly before the Court. 9. Defendants only argue in passing that plaintiff's claim that the CJ determinations were made in excess of statutory authority is not justiciable. 10. The discussion of Hiah Tech Gays in Dorfmont betrays the unusual procedural posture the Ninth Circuit adopted in order to reach the merits: "Without addressing whether the federal courts have jurisdiction to hear these claims, we ruled in favor of defendants on the merits of the equal protection attack." 913 F.2d at 1403 (emphasis added) (citation omitted). 11. Reading "colorable" to mean sufficient to state a claim, or even nonfrivolous, is supported by the Sixth Circuit's decision in Brooks v. Seiter, 7-79 F.2d 1177, 1181 (6th Cir. 1985), in which the court, using a frivolousness standard, held that plaintiff prisoners had alleged a First Amendment violation when they complained that prison officials withheld mail order publications. In the context of that holding, the court said that the state interest in deferring to prison officials did not bar courts from hearing a "colorable constitutional claim." Id. 12. If there is any uncertainty about this, defendants should state their determination without equivocation so that the mootness issue can be completely resolved as soon as possible. 13. Bernstein also contends that encryption software is important not only as speech, but as a tool to protect private speech. Plaintiff argues that cases protecting anonymous speech and prohibiting compelled speech support this novel proposition. However, certainly at this stage, the court need not reach the issue. 14. Plaintiff briefly argues that his encryption program, written in source code on paper, is not functional at all. Given the ease with which one can convert source code into object code, however, this argument is specious. More to the point is plaintiff's contention that source code and functioning software are both fully protected under the First Amendment. 15. The court does not employ the word "translate" as art thereby excluding the applicability of "compile", "interpret" or related terms. 16. Whether such "languages" as assembly language or low-level languages constitute speech, or may sometimes constitute speech, need not be addressed at this time in view of the court's ruling that the source code provides the basis for a colorable claim. 17. Plaintiff cites Justice Department memoranda that question the constitutionality of some of the ITAR provisions as well as the propriety of an O'Brien analysis. Plaintiff Exh. A at 60007, 60090. A 1978 memo from the DOJ Office of Legal Counsel addressing the constitutionality of the ITAR restrictions on public cryptography noted that "even a cursory reading of the technical data provisions reveals that those portions of the ITAR are directed at communication. A more stringent constitutional analysis than the O'Brien test is therefore mandated." Plaintiff Exh. A at 60084 n.16. While Snuffle was classified as a munition rather than as technical data, Category XIII of the USML also directly regulates public cryptography. 18. The court's narrowing construction mandates that the statute and regulations only prohibit the export of technical data "significantly and directly related to specific articles on the Munitions List. n 579 F.2d at 521. 19. Defendants continue to argue that plaintiff was mistaken about the inclusion of the academic paper in the CJ determinations made by the ODTC. As the court has noted, plaintiff had every reason to believe his paper had been determined to be a defense article until defendants' clarifying letter of June 29, 1995. Whether or not the prior restraint that may have been applied to the paper is still relevant or whether this confusion could happen again given the apparent applicability of the public domain exception to work of this kind, 22 C.F.R. Section 120.11(a)(8), is a matter the court declines to address at this time. 20. Defendants are correct that with respect to the two instructional items included in the second CJ determination and which ODTC subsequently identified as technical data, a prior restraint claim seems foreclosed by Edler, 579 F.2d at 521 ("So confined, the statute and regulations are not overbroad. For the same reasons the licensing provisions of the Act are not an unconstitutional prior restraint on speech."). [end]

1 0

Re: Spaces in passwords
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>>Of course not. In a normal Unix password, adding spaces to the >>password search space increases the search space, so it necessarily >>makes the search harder. > >Depends on the space of ideas that are leading to your passwords. >If the reason you're adding spaces is to separate an n-character word >from the dictionary from a 7-n character word from the dictionary, >this reduces the search space for a cracker considerably. >At least pick random punctuation instead. Huh? I don't follow your reasoning. If you use two random words, the search space for a dictionary attack with an N word dictionary is N^2. That's true whether you include a space or leave it out. If you use "random punctuation" and the punctuation character is unknown, you add perhaps a factor 20, which is so much smaller than N that it isn't worth arguing about. Two-word passphrases are pretty good, and if you feel uncomfortable with an N^2 work factor, use three words to get N^3. That's a much bigger win than talking about random punctuation characters. paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning(a)isd.3com.com or paul_koning(a)3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "Be wary of strong drink. It can make you shoot at tax collectors ! -- and miss!" ! -- Robert A. Heinlein, "The Notebooks of Lazarus Long" ! in "Time Enough for Love"

1 0

Re: plaugue of unsubscribes
by David Loysen 17 Dec '03

17 Dec '03

At 12:01 PM 4/18/96 -0700, you wrote: >On Thu, 18 Apr 1996, Alex Strasheim wrote: > >> I've started sending mail to postmasters when I get one of those "take me >> off your list!" messages. >[snip] > >See John's message about the forged subscribes. It sounds like these >folks may have never used a mailing list and didn't want to. Can't really >blame them for being upset at receiving hundreds of pieces of email that >they didn't ask for. > >What still confuses me is the number of people who asked to be >"unsubscrived." Seems like an odd coincidence that all those folks would >miss the B key. Some had done it severeal times in the same message. I >wonder if they were totally set up -- if they got mail telling them to >"unsubscrive." Some people's idea of fun boggles me... > >Rich > The firewalls list got a bunch of "signoff" requests over the last few days. Same gag I'd wager. The Firewalls list owner said he unsubscribed over 200 people who appeared to have been falsely subscribed. ===================================== dwl(a)hnc.com Zippity do da, zippity ah, my oh my what a wonderful day. Ya right, and here I am without time to finish a cup of coffee.

2 1

Nym Server Questions and Remailer Suggestion
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

1. Do the nym servers lie about the times of being sent? 2. Do they automatically latantize messages? I get an very quick response from a nym server, and a very quick response from the remailer, but a message to the nym identity (which goes through both) takes a long time *. For the purpose of mitigating traffic analysis, has anyone considered creating a "delete-me" redirect, hence I could send a few messages to a nym server that I know won't go anywhere, but I can hide my traffic in that stream. Also, nym servers could ping each other and send delete-me redirects admist all the jumble of the normal redirects. An easy solution is to send incorrectly encrypted messages which are thrown away regardless. _______________________ Regards, I am a creationist; I refuse to believe that I could have evolved from humans. Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

2 1

Enough of this How do I get on coderpunks(Please reply via email only NOT to the list)
by cypherpunks＠count04.mry.scruznet.com 17 Dec '03

17 Dec '03

The noise level has finally gotten to me... can someone tell me how to get on coderpunks private email replies only please I will be unsubscribing from cypherpunks shortly... cheers kelly

1 0

Re: EFF/Bernstein Press Release
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:52 PM 4/18/96 -0500, John Deters wrote: >>On Thu, 18 Apr 1996, Mark Neely wrote: >> >>> Well, that puts legislation making virus authoring a crime >>> into a new (and difficult) position. > >My understanding is that it isn't illegal to author a virus, but it >certainly would be to release it. I think there is a confusion here between source code and object code. I am sure that the lawyers on the list will correct me on this if I am wrong here... The way I read this ruling is that it would have not effect on the laws on releasing viruses in code. (i.e. putting a virus into an executable and letting it go out to infect the world.) What it would permit would be publication of virus source and information about viruses. Publication of information about viruses (including source code) has a useful purpose. How can people write anti-virus programs if they do not know how they work? If publication of techniques is stopped, the anti-virus people have to wait until they find a live copy before writing something to detect and/or remove the offending code. The virus writers are going to do this whether or not they can publish. Letting them brag makes them faster to stop. The "let them brag" principle also works with system hacks. Finding what techniques are used will let you plug holes that you may not know about. It is better to have information than not. On to another [rant]... I have been seening a surprising amount of rant from the forces of Government about keeping information out of "the hands of terrorists". I am wondering how this is going to be brought about. The books are there. They can be ordered from a number of mail order firms. They can also be found in used book stores across the country. The information is alos on the net, on cd-roms and other mediums of storage. How are they going to stuff the tentacles back into the can? Without imposing a very represive police state, they cannot. It would require sifting through all of the available data (books, magazines, libraries, etc.) and removing all "offending" information. Since weapons are so easy to make, they would have to remove knowlege relating to a wide variety of fields. Not possible without alot of cops and alot of guns. The results would not be pretty. The thing I have not determined is whether they understand the outcome of the ideas they are wanting to implement. A good case could be made either way for cluelessness or totalitarian mindsets. I am beginning to think it is a bit of both... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0