This is a preliminary draft of my preliminary analysis of the Leahy
bill. In it I am primarily concerned with the affect---if any---of
that bill on the constitutionally protected freedoms of speech and of
the press.
At times in this submission I may seem overly suspicious of some
agencies of the government. That may be a consequence of this being
merely a preliminary draft; it is more likely, however, that it is the
result of years of studying the ITAR and the antics of the agents in
the Office of Defense Trade Controls and the NSA as they relate to the
licensing requirements for cryptographic software.
Permission is granted to post this submission to other mailing lists
and news groups, but only if it is posted in its entirety (except for
headers other than the ``To'', ``From'', and ``Subject'' lines).
-------------------------------------------------
The Leahy Bill known as the Encrypted Communications Privacy Act is
certainly well intentioned and Senator Leahy and the other sponsors
(Senators Burns, Dole, Murray, and Pressler) should be congratulated
for their efforts.
Those whose major goal is to be able to export mass-marketed
cryptography have good reason to support this bill, even though it has
features---and ambiguities---that they may find undesireable, and even
though the bill may not actually make all mass marketed cryptographic
hardware and software freely exportable. (There is even the danger
that it might even be interpreted (for reasons that I will explain
hereafter) as not making any change in the requirements for the export
of cryptographic software, whether mass marketed or not).
On the other hand, those like Daniel Bernstein and myself, who want to
publish information---including algorithms and source code---that is
subject to the licensing requirements of the International Traffic in
Arms Regulations (``ITAR'') that apply to cryptographic devices and
software---at least according to the National Security Agency's
representatives and that agency's puppets in the Office of Defense
Trade Controls---may find the bill more of a hindrance than a help in
their efforts to assert the constitutional right of freedom of speech
and of the press.
My concern is not that the bill will somehow lead to mandatory key
escrow. My concern is that in relaxing the restrictions on the export
of software as a commodity it may actually give support to the efforts
of the censors to keep Daniel Bernstein from publishing his article
about his algorithm for converting a hash function into a
cryptographic program---I hope that is a fair enough description of
his article, an article that the censors have prevented me from ever
seeing---and those censor's efforts to keep me from publishing my
materials---which contain some cryptographic software---for my course
in computers and the law, and to keep foreign students from taking that
course.
The major threat is that, for the first time, there would be
at least colorable Congressional authority for the requirement that
one obtain a license before publishing or otherwise disclosing
information. And software is, after all, nothing but information.
Let me go through the bill and attempt to explain my concerns. (I hope
that the version of the bill that I am using is correct.)
A BILL
To affirm the rights of Americans to use and sell encryption products,
to establish privacy standards for voluntary escrowed encryption
systems, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United
States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the "Encrypted Communications Privacy Act of
1996".
SEC. 2. PURPOSE.
It is the purpose of this Act-
(1) to ensure that Americans are able to have the maximum possible
choice in encryption methods to protect the security, confidentiality,
and privacy of their lawful wire or electronic communications; and
(2) to establish privacy standards for key holders who are voluntarily
entrusted with the means to decrypt such communications, and
procedures by which investigative or law enforcement officers may
obtain assistance in decrypting such communications.
I have no objections to the provisions of this section---except
possibly for the reference to procedures by which officers may obtain
assistance in decrypting communications. But I am not happy that the
purpose does not include protecting the freedoms of speech and of the
press, and particularly the freedom to communicate information about
cryptography.
SEC. 3. FINDINGS.
The Congress finds that-
(1) the digitization of information and the explosion in the growth
of computing and electronic networking offers tremendous potential
benefits to the way Americans live, work, and are entertained, but
also raises new threats to the privacy of American citizens and the
competitiveness of American businesses;
Notice that there is nothing here---at least not directly---about the
freedom to distribute and to obtain access to information and that,
therefore, there is no mention of the constitutional right to speak
and publish information about cryptography.
(2) a secure, private, and trusted national and global information
infrastructure is essential to promote economic growth, protect
citizens' privacy, and meet the needs of American citizens and
businesses.
Once again, there is nothing about the freedom to distribute and
obtain access to information.
(3) the rights of Americans to the privacy and security of their
communications and in conducting their personal and business affairs
should be preserved and protected;
I like this one.
(4) the authority and ability of investigative and law enforcement
officers to access and decipher, in a timely manner and as provided
by law, wire and electronic communications necessary to provide for
public safety and national security should also be preserved;
This is presumably included as a political compromise. Those whose
concerns are primarily with marketing software can probably live with
it. Those who are concerned with privacy and liberty and human
decency should, on the other hand, find this finding terrifying. (Of
course, one can argue that the findings are just window dressing
without any substantive significance; I assure you, however, that they
can be used to interpret the substantive provisions of the statute and
that ultimately the interpretation is more important than the words of
the statute itself.)
(5) individuals will not entrust their sensitive personal, medical,
financial, and other information to computers and computer networks
unless the security and privacy of that information is assured;
I have no problem with this as a finding, though I am not sure that I
want to encourage people to entrust sensitive information to computers
and computer networks, no matter what assurances they may be given.
(6) business will not entrust their proprietary and sensitive
corporate information, including information about products,
processes, customers, finances, and employees, to computers and
computer networks unless the security and privacy of that
information is assured;
No problem.
(7) encryption technology can enhance the privacy, security,
confidentiality, integrity, and authenticity of wire and electronic
communications and stored electronic information;
That is correct.
(8) encryption techniques, technology, programs, and products are
widely available worldwide;
Yep.
(9) Americans should be free lawfully to use whatever particular
encryption techniques, technologies, programs, or products developed
in the marketplace they desire in order to interact electronically
worldwide in a secure, private, and confidential manner;
The clumsiness of the language worries me. That word ``lawfully'' may
just mean that Congress finds that people should be free to do
whatever the law allows, but that there are no restrictions on what
the law may forbid.
More troublesome is the reference to programs ``developed in the
market place''. That might be read as suggesting that there is no
freedom to use products that were not developed in the market place.
(The small number of programs that I have written have all been
developed in my head, and in my head's extension, my computer; none of
them had anything to do with the market place. Are the programs
produced by the Free Software Foundation produced in the market place?)
(10) American companies should be free to compete and to sell
encryption technology, programs, and products;
I have no objection to this finding, but notice that it has nothing to
do with the free speech issues that are my concerns. I want to be
able to give away the programs that I have written, and to give away
encryption technology, programs, and products that are subject to
copylefts or are otherwise available. And I want to be able to
explain to my law students about how encryption programs work and why
they may be ethically required to use them for electronic
communications with their clients (and where to get them).
(11) there is a need to develop a national encryption policy that
advances the development of the national and global information
infrastructure, and preserves Americans' right to privacy and the
Nation's public safety and national security;
I don't really object to this, but I suspect that the best policy
would be no policy. There are powers within the government who would
use the reference to ``the Nation's public safety and national
security'' as a basis for continuing to restrict the export or
publication or other disclosure of any secure cryptographic software
and algorithms.
(12) there is a need to clarify the legal rights and
responsibilities of key holders who are voluntarily entrusted with
the means to decrypt wire or electronic communications;
I am not sure that this would not best be left to private agreements
between the owners of the keys and their holders. (But this is not in
the area of my concern.)
(13) the Congress and the American people have recognized the need
to balance the right to privacy and the protection of the public
safety and national security;
This is most unfortunate. In cases of extreem danger the courts may
allow the agents of the state to ignore the constitutional right of
privacy, but it is not a matter of ``balancing'' equally protected
interests. The agents of the state always claim that they are acting
in order to protect public safety and national security, especially
when they are trying to destroy the safety of the constitution.
(14) the Congress has permitted lawful electronic surveillance by
investigative or law enforcement officers only upon compliance with
stringent statutory standards and procedures; and
I guess I don't object to this, except that I am not sure that it is
true.
(15) there is a need to clarify the standards and procedures by
which investigative or law enforcement officers obtain assistance
from key holders who are voluntarily entrusted with the means to
decrypt wire or electronic communications, including such
communications in electronic storage.
This seems confused; what about encrypted data that is not a communication?
SEC. 4. FREEDOM TO USE ENCRYPTION.
(a) LAWFUL USE OF ENCRYPTION.-It shall be lawful for any person within
any State of the United States, the District of Columbia, the
Commonwealth of Puerto Rico, and any territory or possession of the
United States, and by United States persons in a foreign country to
use any encryption, regardless of encryption algorithm selected,
encryption key length chosen, or implementation technique or medium
used except as provided in this Act and the amendments made by this
Act or in any other law.
This only says it is lawful to use encryption unless there is a law
forbidding it. I hardly find that helpful.
(b) GENERAL CONSTRUCTION.-Nothing in this Act or the amendments made
by this Act shall be construed to-
(1) require the use by any person of any form of encryption;
OK, but shouldn't it also cover requiring any person _not_ to use any
form of encryption?
(2) limit or affect the ability of any person to use encryption
without a key escrow function; or
OK, though the language is rather clumsy.
(3) limit or affect the ability of any person who chooses to use
encryption with a key escrow function not to use a key holder.
SEC. 5. ENCRYPTED WIRE AND ELECTRONIC COMMUNICATIONS.
(a) IN GENERAL.-Part I of title 18, United States Code, is amended by
inserting after chapter 121 the following new chapter:
"CHAPTER 122-ENCRYPTED WIRE AND ELECTRONIC COMMUNICATIONS
"2801. Definitions.
"2802. Prohibited acts by key holders.
"2803. Reporting requirements.
"2804. Unlawful use of encryption to obstruct justice.
"2805. Freedom to sell encryption products.
These provisions are not my major concern at this time, but note that
``encryption'' by definition only applies to wire and electronic
communications. It thus seems that these provisions have nothing to
do with data that is encrypted but that is not a communication.
Do you think that this was what was intended?
"\S 2801. Definitions
"As used in this chapter-
"(1) the terms 'person', 'State', 'wire communication', 'electronic
communication', 'investigative or law enforcement officer', 'judge
of competent jurisdiction', and 'electronic storage' have the same
meanings given such terms in section 2510 of this title;
"(2) the term 'encryption' means the scrambling of wire or
electronic communications using mathematical formulas or algorithms
in order to preserve the confidentiality, integrity or authenticity
and prevent unauthorized recipients from accessing or altering such
communications;
"(3) the term 'key holder' means a person located within the United
States (which may, but is not required to, be a Federal agency) who
is voluntarily entrusted by another independent person with the
means to decrypt that person's wire or electronic communications for
the purpose of subsequent decryption of such communications;
"(4) the term 'decryption key' means the variable information used
in a mathematical formula, code, or algorithm, or any component
thereof, used to decrypt wire or electronic communications that have
been encrypted; and
"(5) the term 'decryption assistance' means providing access, to the
extent possible, to the plain text of encrypted wire or electronic
communications.
"\S 2802. Prohibited acts by key holders
"(a) UNAUTHORIZED RELEASE OF KEY.-Except as provided in subsection
(b), any key holder who releases a decryption key or provides
decryption assistance shall be subject to the criminal penalties
provided in subsection (e) and to civil liability as provided in
subsection (f).
"(b) AUTHORIZED RELEASE OF KEY.-A key holder shall only release a
decryption key in its possession or control or provide decryption
assistance-
"(1) with the lawful consent of the person whose key is being held
or managed by the key holder;
"(2) as may be necessarily incident to the holding or management of
the key by the key holder; or
"(3) to investigative or law enforcement officers authorized by law
to intercept wire or electronic communications under chapter 119, to
obtain access to stored wire and electronic communications and
transactional records under chapter 121, or to conduct electronic
surveillance, as defined in section 101 of the Foreign Intelligence
Surveillance Act of 1978 (50 U.S.C. 1801), upon compliance with
subsection (c) of this section.
Except for subdivision (3) this seems totally unnecessary. Let the
parties agree to any arrangement they want. (And anyone who is
seriously going to use an outside key holder is going to want to have
them bonded, and will look to the bonding company for protection.
(Bonding companies are mean.))
"(c) REQUIREMENTS FOR RELEASE OF DECRYPTION KEY TO INVESTIGATIVE; OR
LAW ENFORCEMENT OFFICER.-
"(1) CONTENTS OF WIRE AND ELECTRONIC COMMUNICATIONS.-A key holder is
authorized to release a decryption key or provide decryption
assistance to an investigative or law enforcement officer authorized
by law to conduct electronic surveillance under chapter 119, only
if-
"(A) the key holder is given- "(i) a court order signed by a judge
of competent jurisdiction directing such release or assistance; or
"(ii) a certification in writing by a person specified in section
2518(7) or the Attorney General stating that- "(I) no warrant or
court order is required by law;
"(II) all requirements under section 2518(7) have been met; and
"(III) the specified release or assistance is required;
"(B) the order or certification under paragraph (A)-
"(i) specifies the decryption key or decryption assistance which is
being sought; and
"(ii) identifies the termination date of the period for which
release or assistance has been authorized; and"(C) in compliance
with an order or certification under subparagraph (A), the key
holder shall provide only such key release or decryption assistance
as is necessary for access to communications covered by subparagraph
(B). "(2) STORED WIRE AND ELECTRONIC COMMUNICATIONS.-(A) A key
holder is authorized to release a decryption key or provide
decryption assistance to an investigative or law enforcement officer
authorized by law to obtain access to stored wire and electronic
communications and transactional records under chapter 121, only if
the key holder is directed to give such assistance pursuant to the
same lawful process (court warrant, order, subpoena, or
certification) used to obtain access to the stored wire and
electronic communications and transactional records.
"(B) The notification required under section 2703(b) shall, in the
event that encrypted wire or electronic communications were obtained
from electronic storage, include notice of the fact that a key to
such communications was or was not released or decryption assistance
was or was not provided by a key holder.
"(C) In compliance with the lawful process under subparagraph (A),
the key holder shall provide only such key release or decryption
assistance as is necessary for access to the communications covered
by such lawful process.
Note once again that this applies only to _communications_.
"(3) USE OF KEY.-(A) An investigative or law enforcement officer to
whom a key has been released under this subsection may use the key
only in the manner and for the purpose and duration that is
expressly provided for in the court order or other provision of law
authorizing such release and use, not to exceed the duration of the
electronic surveillance for which the key was released.
"(B) On or before completion of the authorized release period, the
investigative or law enforcement officer to whom a key has been
released shall destroy and not retain the released key.
"(C) The inventory required to be served pursuant to section
2518(8)(d) on persons named in the order or the application under
section 2518(7)(b), and such other parties to intercepted
communications as the judge may determine, in the interest of
justice, shall, in the event that encrypted wire or electronic
communications were intercepted, include notice of the fact that
during the period of the order or extensions thereof a key to, or
decryption assistance for, any encrypted wire or electronic
communications of the person or party intercepted was or was not
provided by a key holder.
"(4) NONDISCLOSURE OF RELEASE.-No key holder, officer, employee, or
agent thereof shall disclose the key release or provision of
decryption assistance pursuant to subsection (b), except as may
otherwise be required by legal process and then only after prior
notification to the Attorney General or to the principal prosecuting
attorney of a State or any political subdivision of a State, as may
be appropriate.
"(d) RECORDS OR OTHER INFORMATION HELD BY KEY HOLDERS.-A key holder,
shall not disclose a record or other information (not including the
key) pertaining to any person whose key is being held or managed by
the key holder, except-
"(1) with the lawful consent of the person whose key is being held
or managed by the key holder; or
"(2) to an investigative or law enforcement officer pursuant to a
subpoena authorized under Federal or State law, court order, or
lawful process.
An investigative or law enforcement officer receiving a record or
information under paragraph (2) is not required to provide notice to
the person to whom the record or information pertains. Any disclosure
in violation of this subsection shall render the person committing the
violation liable for the civil damages provided for in subsection (f).
"(e) CRIMINAL PENALTIES.-The punishment for an offense under
subsection (a) of this section is-
"(1) if the offense is committed for a tortious, malicious, or
illegal purpose, or for purposes of direct or indirect commercial
advantage or private commercial gain- "(A) a fine under this title
or imprisonment for not more than 1 year, or both, in the case of a
first offense under this subparagraph; or
"(B) a fine under this title or imprisonment for not more than 2
years, or both, for any second or subsequent offense; and"(2) in any
other case where the offense is committed recklessly or
intentionally, a fine of not more than $5,000 or imprisonment for
not more than 6 months, or both.
"(f) CIVIL DAMAGES.-
"(1) IN GENERAL.-Any person aggrieved by any act of a person in
violation of subsections (a) or (d) may in a civil action recover
from such person appropriate relief.
"(2) RELIEF.-In an action under this subsection, appropriate relief
includes- "(A) such preliminary and other equitable or declaratory
relief as may be appropriate;
"(B) damages under paragraph (3) and punitive damages in appropriate
cases; and
"(C) a reasonable attorney's fee and other litigation costs
reasonably incurred."(3) COMPUTATION OF DAMAGES.-The court may
assess as damages whichever is the greater of-
"(A) the sum of the actual damages suffered by the plaintiff and any
profits made by the violator as a result of the violation; or
"(B) statutory damages in the amount of $5,000."(4) LIMITATION.-A
civil action under this subsection shall not be commenced later than
2 years after the date upon which the plaintiff first knew or should
have known of the violation.
"(g) DEFENSE.-It shall be a complete defense against any civil or
criminal action brought under this chapter that the defendant acted in
good faith reliance upon a court warrant or order, grand jury or trial
subpoena, or statutory authorization.
"\S 2803. Reporting requirements
"(a) IN GENERAL.-In reporting to the Administrative Office of the
United States Courts as required under section 2519(2) of this title,
the Attorney General, an Assistant Attorney General specially
designated by the Attorney General, the principal prosecuting attorney
of a State, or the principal prosecuting attorney of any political sub
division of a State, shall report on the number of orders and
extensions served on key holders to obtain access to decryption keys
or decryption assistance.
"(b) REQUIREMENTS.-The Director of the Administrative Office of the
United States Courts shall include as part of the report transmitted
to the Congress under section 2519(3) of this title, the number of
orders and extensions served on key holders to obtain access to
decryption keys or decryption assistance and the offenses for which
the orders were obtained.
"\S 2804. Unlawful use of encryption to obstruct justice
"Whoever willfully endeavors by means of encryption to obstruct,
impede, or prevent the communication of information in furtherance to
a felony which may be prosecuted in a court of the United States, to
an investigative or law enforcement officer shall-
"(1) in the case of a first conviction, be sentenced to imprisonment
for not more than 5 years, fined under this title, or both; or
"(2) in the case of a second or subsequent conviction, be sentenced
to imprisonment for not more than 10 years, fined under this title,
or both.
This provision is completely incoherent. There is no telling how the
government will interpret it, but at a guess they will use it to make
people reveal their keys: ``if you don't tell us your key, we are
going to charge you with impeding the communication to me of
information about the felony I am investigating.''
"§ 2805. Freedom to sell encryption products
"(a) IN GENERAL.-It shall be lawful for any person within any State of
the United States, the District of Columbia, the Commonwealth of
Puerto Rico, and any territory or possession of the United States, to
sell in interstate commerce any encryption, regardless of encryption
algorithm selected, encryption key length chosen, or implementation
technique or medium used.
This sounds nice, but remember that ``encryption'' is defined as:
``the scrambling of wire or electronic communications using
mathematical formulas or algorithms in order to preserve the
confidentiality, integrity or authenticity and prevent unauthorized
recipients from accessing or altering such communications''. So what
does it mean to sell ``any encryption''?
"(b) CONTROL OF EXPORTS BY SECRETARY OF COMMERCE.-
"(1) GENERAL RULE.-Notwithstanding any other law, subject to
paragraphs (2), (3), and (4), the Secretary of Commerce shall have
exclusive authority to control exports of all computer hardware,
software, and technology for information security (including
encryption), except computer hardware, software, and technology that
is specifically designed or modified for military use, including
command, control, and intelligence applications.
OK, here is where the problems that concern me arise.
This provision sounds quite nice, but it covers up several big
problems.
In the first place, the delegation to the Secretary of Commerce sounds
like a good idea, because, at the present time the people in the
Commerce department who enforce export controls are very nice and
helpful, and operate reasonably under reasonable regulations, while
the puppets who front for the NSA (or are actually agents of the NSA)
in the Office of Defense Trade Controls are not very nice, are
exceptionally unhelpful, and specialize in unreasonable---and down
right irrational---interpretations of unreasonable regulations. But
if the jurisdiction is handed over to Commerce, I predict that the the
puppet masters will turn their attention to Commerce, and shortly
thereafter---if only because of Presidential pressure---Commerce will
have its own incoherent regulations and its own unpleasent people and
it won't be as easy to export software as one might hope.
Note that the transfer is to Commerce but there is nothing that
expressly specifies what law is to be applied by Commerce. Thus in
theory at least there is nothing to stop Commerce from enforcing the
same old provisions of the ITAR
>From the point of view of one who is concerned with first amendment
rights rather than selling cryptographic software as a commodity, the
really unfortunate part is that this provision authorizes export
contols on ``software''. Now the Leahy bill does not define software,
but there is a definition of lying around in the International Traffic
in Arms Regulations (``ITAR'') that I fear Commerce might adopt---it
may even be the language that the draftsmen of the Leahy bill had in
mind. And this definition of ``software'' includes a great deal of
material that cannot constitutionally be controlled. Here is that
definition from the ITAR \S 121,8(f): ``Software includes but is not
limited to the system functional design, logic flow, algorithms,
application programs, operating systems and support software for
design, implementation, test, operation, diagnosis and repair.''
Note that what is covered here is nothing but information, and that
that information includes algorithms, _i.e._ recipes. If the
government can constitutionally ``control'' the ``export'' of
cryptographic algorithms by requiring a license before one can publish
them or otherwise disclose them to a foreign person, then they can
require a license before one publishes Julia Child's recipe for a
_bombe surprise_ or a recipe for winning a Presidential election
without actually committing any felonies.
Even if that definition is adopted, the fact remains that software is
still nothing but information, and that it is the communication of
information that is protectected by the first amendment to the United
States constitution. (If you aren't convinced that software is
protected by the first amendment, notice that software is
copyrightable as a ``literary work''.) Note that the paradigmatic
violation of the first amendment is a scheme under which the
government requires publishers to obtain a license before publishing.
Part of what I fear is that, were the Leahy bill to be passed in its
present form is that the President, in conformance with that bill,
would simply transfer the licensing and rule making powers with
respect to cryptographic devices and software to the Department of
Commerce, but would still leave them controlled by the ITAR and the
Arms Export Control Act just as they are now, including all of the
cryptic and unconstitional interpretations of ITAR that up to now have
been imposed upon the Office of Defense Trade Controls by the National
Security Agency. There is nothing in the Leahy bill that forbids that
sort of shell game. The trouble is that there is nothing in the bill
that specifies the law under which Commerce is to ``control''
cryptographic devices and software.
The real problem, however, is simply that the Leahy bill appears to
authorize control (including licensing) of cryptographic software and
thus to authorize the imposition of licensing requirements for the
constitutionally protected communication of information. At the
present time, on the other hand, although the Arms Export Control Act
does, quite constitutionally, require licensing of physical devices,
the provisions in the ITAR requiring licenses for the communication of
information are not authorized by any act of congress. (The point is
of practical importance because the courts may be willing to strike
down the ITAR's licensing requirements on software on the grounds that
they are _ultra vires_ simply to avoid having to decide the
constitutional issues.)
Thus the major problem with the Leahy bill, from the point of view of
those concerned with the freedoms of speech and of the press, is that
it conflates hardware, which can be regulated constitutionally, with
software, which is text that cannot be constitutionally regulated, and
certainly cannot be subjected to a licensing scheme. (The agents of
the NSA in the Office of Defense Trade Controls try to confuse this
distinction, claiming that cryptographic software is hardware, not
information that is in the public domain under the provisions of the
ITAR.)
The only satisfactory bill, from the point of view of those of us who
are concerned with freedom of speech and of the press would be a bill
that says that export licensing controls do not apply, and recognizes
that export controls cannot be applied constitutionally, to the
publication or other disclosure or communication of software.
Another problem is that the Leahy bill expressly does not apply to
``computer hardware, software, and technology that is _specifically
designed or modified for military use_, including command, control,
and intelligence applications''.
This may sound harmless, but the emphasized language is almost exactly
the language that is used in the ITAR to define what can be included
on the United States Munition List in the ITAR. The major
prerequisite for the designation of an article or service on the
United States Munitions List, according to ITAR \S 120.3, is that it
is: ``specifically designed, developed, configured, adapted, or
modified for a military application''.
This strongly suggests that, if the Leahy bill were adopted, the NSA
and the Office of Defense Trade Controls would simply take the
position that cryptographic devices and software still are
specifically designed for military use and thus remain on the
Munitions List and under the control of the Office of Defense Trade
Controls in the State Department. This would seem to inconsistent
with the intent of the Leah bill, but that is hardly going to bother
the rather spooky people in the Office of Defense Trade Controls since
the law expressly provides that the courts may not review the
designation of an item on the United States Munitions List. (Even
before that provision forbidding judicial review was adopted, one
federal district court held that the defendant in a criminal
case---whose alleged crime was exporting cable or satellite TV
descrambler boxes---could not challenge the inclusion of descramblers
on the Munitions List, because their inclusion was an unreviewable
``political'' determination.)
Thus I predict that the passage of the Leahy amendment would have no
affect whatsoever on the licensing requirements that are presently
applied by the Office of Defense Trade Controls to cryptographic
devices and software. The people who enforce those requirements are
not now governed by law or logic; the Leahy bill is not likely to
change that, not when it contains such a gaping loophole.
But let us look at the particular provisions of the Leahy bill that
will supposedly ease the burden on both cryptographic hardware and
software:
"(2) ITEMS NOT REQUIRING LICENSES.-No validated license may be
required, except pursuant to the Trading With The Enemy Act or the
International Emergency Economic Powers Act (but only to the extent
that the authority of such Act is not exercised to extend controls
imposed under this Act), for the export or reexport of-
``Validated license'' is a term that is not used in the Arms Export
Control Act and the ITAR, so to the extent that that act and those
regulations remain applicable to cryptographic devices and
software---and, as has been pointed out, nothing in the Leahy bill
purports to change that---, this provision will have no affect
whatsoever.
On the other hand, the term ``validated license'' is used in the
regulations of the Bureau of Export Administration of the Department
of Commerce. Thus 15 Code of Federal Regulations \S 770.2 defines
``Validated license'' as: ``A document issued by or under the
authority of the Bureau of Export Administration, authorizing
export.'' So perhaps this provision of the Leahy bill does give some
protection, but only if the powers of the Commerce Department to
regulate software are deligated to Commerce's Bureau of Export
Administration and even then only if this definition is not amended.
It would, moreover, have been preferable if the bill had provided that
cryptographic hardware and software are entitled to a ``general
license'', which is defined in 15 CFR \S 770.2 as follows: ``A license
established by the U.S. Department of Commerce for which no
application is required and for which no document is granted or
issued. It is available for use by all persons, except those listed in
and prohibited by the provisions of Supplement No. 1 to part 788, and
permits export within the provisions thereof as prescribed in the
Export Administration Regulations. These general licenses are not
applicable to exports under the licensing jurisdiction of agencies
other than the Department of Commerce.'' (But note the last
provision.)
"(A) any software, including software with encryption
capabilities, that is-
"(i) generally available, as is, and designed for installation by
the purchaser; or
"(ii) in the public domain or publicly available because it is
generally accessible to the interested public in any form; or
"(B) any computing device solely because it incorporates or employs in
any form software (including software with encryption capabilities)
exempted from any requirement for a validated license under
subparagraph (A).
This provision at first glance looks pretty good, but it arguably
offers no protection to people like Daniel Bernstein and myself who
want to publish new (even if, as is ture in my case, also trivial)
software with encryption capabilities. The ITAR also has a public
domain exemption, but the censors in the Office of Defense Trade
Controls take the position that one would violate the ITAR by the act
of putting matter in the public domain or making it generally
available. (The Office of Defense Trade Controls also takes the
position that cryptographic software is not information that can fall
within the public domain exception in the ITAR.)
Note that though no validated license can be required for such
software and related hardware under the Leahy bill, there is nothing
that says that such software and hardware is entitled to a general
license. One may thus find oneself in the situation---that happened
for example to Daniel Bernstein under the ITAR---that one has written
software that cannot be exported without a license, but for which no
possible license is available.
"(3) SOFTWARE WITH ENCRYPTION CAPABILITIES.-The
Secretary of Commerce shall authorize the export or reexport of
software with encryption capabilities for nonmilitary end-uses in
any country to which exports of software of similar capability are
permitted for use by financial institutions not controlled in fact
by United States persons, unless there is substantial evidence that
such software will be-
"(A) diverted to a military end-use or an end-use supporting
international terrorism;
"(B) modified for military or terrorist end-use; or
"(C) reexported without requisite United States authorization.
Here we see what appears to be authority for the Secretary of Commerce
to regulate the export of software, a provision that probably violates
the first amendment of the United States constitution, unless the
definition of ``export or rexport of software'' is limited in a manner
that would make the regulation quite ineffective. The Leahy bill,
however, makes no effort to define what is an ``export'' of software.
One thus has reason to fear that the Secretary of Commerce will simply
adopt the definitions which have been used to restrain the publication
or other disclosure of cryptographic software under the ITAR.
"(4) HARDWARE WITH ENCRYPTION CAPABILITIES.-The Secretary shall
authorize the export or reexport of computer hardware with encryption
capabilities if the Secretary determines that a product offering
comparable security is commercially available from a foreign
supplier without effective restrictions outside the United States.
This applies only to hardware, and so is not subject to attack on
first amendment grounds. I am willing to bet, however, that if this
provision is passed, the National Security Agency would be delegated
the job of determing whether products of comparable security are
available outside the United States and that very few products would
be found by the NSA to be comparable (and that it would take years to
get a determination of any sort).
"(5) DEFINITIONS.-As used in this subsection-
"(A) the term 'generally available' means, in the case of
software (including software with encryption capabilities),
software that is widely offered for sale, license, or transfer
including, but not limited to, over-the-counter retail sales,
mail order transactions, phone order transactions, electronic
distribution, or sale on approval;
Notice that this gives no protection to those who do not widely offer
their software for sale, license, or transfer---persons like Daniel
Bernstein and almost all academic cryptographers, for example. Those
who are interested in mass marketing cryptographic software may be
happy with this provision, but it is no consolation to those of us who
are not mass marketers. (Note that mass marketed software may be
entitled to less constitutional protection, as commercial speech, than
is the software that academics like Dan Bernstein or myself may desire
to publish as part of our research or educational activities.)
"(B) the term 'as is' means, in the case of software (including
software with encryption capabilities), a software program that is
not designed, developed, or tailored by the software company for
specific purchasers, except that such purchasers may supply certain
installation parameters needed by the software program to function
properly with the purchaser's system and may customize the software
program by choosing among options contained in the software program;
"(C) the term 'is designed for installation by the purchaser' means,
in the case of software (including software with encryption
capabilities)-
"(i) the software company intends for the purchaser
(including any licensee or transferee), who may not be the actual
program user, to install the software program on a computing device
and has supplied the necessary instructions to do so, except that
the company may also provide telephone help-line services for
software installation, electronic transmission, or basic operations;
and
"(ii) that the software program is designed for installation by the
purchaser without further substantial support by the supplier;
Note that those of us who are not a ``software company'' that sells
software to a ``purchaser'' are apparently excluded from the benefits
of this definition.
"(D) the term 'computing device' means a device which
incorporates one or more microprocessor-based central processing
units that can accept, store, process, or provide output of data; and
"(E) the term 'computer hardware', when used in conjunction with
information security, includes, but is not limited to, computer
systems, equipment, application-specific assemblies, modules, and
integrated circuits.".
I do not have any comments on the remaining portions of the bill, and
so I have deleted them from this already too lengthy submission.
I look forward to your reactions and corrections.
--
Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH
Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu
