In our recent correspondence on this list with the heading ``Re: Exporting software doesn't mean exporting'', Michael Froomkin and I seem to have two different areas of disagreement: (i) whether the ITAR's provisions relating to cryptographic software apply to foreign persons who disclose (or transmit) cryptographic software to another foreign person without the United States and (ii) whether there is a separation of powers (or ultra vires) argument that can be made against the application of those provisions to anyone, foreign or estados-unidian, in the United States or abroad. In this message I will limit myself to the first area of disagreement and will try to deal with the second area in a later message. As I tried to say, somewhat clumsily, before, and may have caused some confusion in doing so, there are so many reasons why the provisions of the ITAR relating to cryptographic software are unconstitutional and so even more reasons why those provisions are unenforceable, that I find it difficult to discuss whether those unenforceable and unconstitutional provisions can be enforced against a foreign person who discloses software to another person outside of the United States. I am, after all, firmly convinced that those provisions cannot be enforced against him, because I do not believe that those provisions can be enforced against anyone. (Though in some ways a foreign person outside the United States is more vulnerable than a United States person or a foreign person within the United States, since the outside foreign person has (arguably) less constitutional protections.) When I said (But of course the ITAR as applied to cryptographic software--and that is all that I am talking about--are so unconstitutional in so many different ways that nothing is going to turn on that one issue.) the one issue that I was referring to was the status of outside foreign persons and, of course, that is not the issue that ``is now in front of two district judges.'' (I hope that the issue before the two federal district judges is the issue of the constitutionality of the ITAR's provisions relating to cryptographic software, but both cases raise relatively narrow factual issues and may end up being resolved (if one dares call such a result a resolution) on the grounds that the issues are not appealable under the Administrative Procedure Act or that administrative remedies were not exhausted or even that the the provisions of the ITAR in question are unconstitutional but that that determination that is good for that day and that train only.) Now Mr. Froomkin says: In short, in this particular case the ACEA, and by extention the ITAR, doesn't "say what it says" it "says what it must mean". (And I dare him to make that assertion in the faculty lounge at Miami when some of the more critical and analytically inclined members of the Miami law faculty are present.) I would take this as an admission that the ACEA and the ITAR does say what it says (even if it must mean something else) were it not for the fact that--and this was my ``ultra vires'' point--that the ACEA doesn't say it. (In discussing the quoted passage I am assuming that ``extention'' must mean ``extension'' and that it is not used as the opposite of ``intention'', if only because I don't know what the latter would be. But on the other hand the only dictionaries I have to hand are the COD and the on-line version of Webster's Collegiate.) The AECA doesn't contain any definition of ``export'' whatsoever; the whole issue that we are discussing turns on the interpretation of what the ITAR says when it defines ``export'' as including: Disclosing (including oral or visual disclosure) or transferring technical data to a foreign person, whether in the United States or abroad .... Now Mr. Froomkin seems to be contending that this language must be interpreted as it would be interpreted by some sort of neo-Platonic court (probably sitting in Rawl's original position by designation), which he calls ``any court''. The contention is: any court construing the ACEA would inevitably read the prohibition on "exporting" to a foreign person as not applying where the nation lacks jurisdiction. Now it was my argument--which Mr. Froomkin helpfully calls an ``ultra vires'' argument--that any court reading the ACEA would notice (i) that there is no language in that act defining ``export'' and (ii) that ``export'' does not mean disclosing, or even transferring, information (which is what cryptographic software is) and (iii) that, in consequence, the Office of Defense Trade Controls exceeded its congressionally granted authority, and therefore its constitutional authority, when it came up with the perverse provision that is at issue here. But that is the subject of my other, as yet unwritten, message. Now I take it that Mr. Froomkin's contention turns on the claim that Congress lacks jurisdiction under international law to pass a statute--or authorize a regulation--that makes it a crime for a foreign person to transmit something to another person when both of them are outside the United States. So as to avoid the other constitutional and ultra vires and so on issues, let us assume that Congress were to amend the ACEA to make it a crime ``to transfer a cryptographic device to a foreign person within the United States or abroad without first obtaining a license or a waiver of jurisdiction from the Office of Defense Trade Controls.'' And now assume that someone, F, who is a foreign person and who has never been in the United States transfers a cryptographic device that was not made in the United States or by a United States company to another foreign person who person who has never been in the United States. And now assume that F does come to the United States on a holiday and that he is arrested and indicted for violating the AECA in that he did transfer a cryptographic device to a foreign person. The first thing to notice is that the indictment is not defective. The only defense--since it is the only one that we are interested in and we control the hypothetical--is: ``but that was in a foreign country'' and therefore the United States has no jurisdiction under international law (or under something) to treat F's actions as a crime. So the defense moves to dismiss the indict on those grounds. And the prosecution stipulates that the acts charged occured in a foreign country, that F is a foreign person, etc. On those facts I would hope that the court would construe the statute as not covering F's actions outside the United States and would dismiss the indictment, but--considering that the statute specifically says it applies both within the United States and ``abroad''--I am not nearly as sanguine as Mr. Froomkin is. But let us assume that the indictment is dismissed. And now the hypothetical provision in the ACEA is again amended by congress to make it a crime ``for (i) a United States citizen to transfer a cryptographic device to a foreign person within the United States or abroad or (ii) a foreign person to transfer a cryptographic device to a foreign person within the United States or abroad, without in either case first obtaining a license or a waiver of jurisdiction from the Office of Defense Trade Controls.'' And now assume that F', who has never been in the United States transfers a cryptographic device to a foreign person and thereafter comes to the United States and is arrested indicted for violating the hypothetical provision of the ACEA. It would seem to me that there is no way that any but the most willfully wrong-headed court (and there are, I admit, such courts) would construe the hypothetical provision as not covering F's actions, since it does so clearly cover those actions. I mean that there is no way that the court can get away with concluding that it does not mean what it says. So what can F' do now? Well, he could try to raise the claim that the lack of ``jurisdiction''--which is the justification for Mr. Froomkin's ``any court'' construing the ITAR's actual provisions would not apply to F or F'--is a ground for dismissing the indictment. But how can he raise that point? He can't very well deny that the court has jurisdiction over his person--he's sitting in the court with shackels on--and he can't get away with claiming that the court doesn't have jurisdiction to try him for violating the ACEA. So it would seem that F's only hope would be to move to dismiss the indictment on the ground that to continue the prosecution would be to deny him due process because the United States lacks jurisdiction under international law. Now I am no expert in this area, but I would be surprised if the courts would recognize this as costitutional defense. As I understand it from talking with somebody here at CWRU who is knowledgeable, the courts of the United States tend to defer in such cases to Congress and the executive--when they are in agreement, as they would be in our hypothetical--and principles of international law count for little. So F' will ``inevitably''--to use Mr. Froomkin's word--be convicted of the crime of delivering a cryptographic device to a foreign person outside of the United States. Now lets get back to the ITAR as it is actually written. In an actual criminal action brought against a foreign person who is accused of disclosing cryptographic information to a foreigner outside the United States--not that I think such an action will ever actually be brought--the government can point out to the court the facts that I have just discussed, so the court will be aware that there is no constitutional provision requiring the dismissal the indictment, even if the indictment is contrary to international law. And a real court, as opposed to Mr. Froomkin's ``any court'' might in those circumstances feel free to determine that the ITAR means what it says. (That's just common sense.) And, were the government ever to bring such a case it, it would argue, and I think that it would convince a lot of real judges, that the criminal action does not violate international law because the United States is protecting its own economic interests by prosecuting foreign persons who disclose cryptographic information to other foreign persons outside the United States. The government's lawyer will argue: Judge, the United States is in a real bind. It is absolutely necessary for our national security that we forbid the export of cryptographic software. But, on the other hand, as those Cryptopunks keep pointing out, we are distroying our computer industry by enforcing the ITAR against American companies. So the only solution is to apply the ITAR against foreigners as well so that the American computer industry will have a levelled--I mean a level--field to play upon. And the anti-trust cases make it absolutely clear that the United States does have jurisdiction to enforce its laws against foreign criminal who break those laws outside of the United States when their crimes have a negative effect upon the economy of the United States. I am afraid that most federal district court judges would buy that argument, and I am not even sure that Mr. Froomkin's ``any court'' wouldn't buy it. And, in any case, if such a criminal case were to be brought, the government would almost certainly be able to allege additional facts to help justify the claim that the US does have jurisdiction over the matter under international law. For example, the defendant might be French, and the French government might be cheering the United States government on. If the crime is a crime under both French law and the law of the United States then there is going to be no problem with the United States asserting jurisdiction. (That is, if I understand it correctly, Mr. Froomkin's murder example.) Or the defendant may have studied cryptography in the United States, before he returned home and disclosed the information. Or the information that he disclosed had previously been unlawfully exported from the United States in violation of the ITAR (PGP, for example). Or the foreign person is an employee of a United States company or a foreign company doing business in the United States. Or even that the disclosure was done by a message transmitted over the Internet that happened to be routed through the United States. But the matter is even more simple than that since the government is not going to bring those criminal charges against a foreign person or a United States person or anyone else if they can possibly avoid it. The ITAR's provisions on cryptographic software are used by the government to spread fear, uncertainty, and doubt, and to discourage the spread of strong cryptography. Since an actual criminal case would almost certainly result in at least significant parts of those provisions being held unconstitutional, the government is not going to bring such a case if it can find any other ways of satisfying its goal. And looked at that way, our foreign person who discloses cryptographic software to one or more other foreign persons abroad is going to be the perfect fall guy. As I have suggested before, the government will simply bar him from getting a visa to enter the United States since violation of United States foreign trade regulations is a ground for denying a visa--at least an immigrants visa. And, despite Mr. Froomkin's claim that our foreign person would have a cause of action if his ``petition'' were denied, he would probably have no recourse whatsoever. Certainly he would have no claim that the United States has no jurisdiction to exclude him for acts done by him outside the United States; the United States has jurisdiction to exclude foreigners for things that the foreigners did outside the United States, like believing in polygamy. And a foreign person outside the United States may not have standing to complain of violations of his freedom of speech outside the United States in an American court. But let us assume, contra-factually that Mr. Froomkin is right, and that the poor, excluded foreign person would have a good cause of action to force the government to give him a visa. (Though I really am curious as to what that action would be.) That cause of action is going to cost tens of thousands of dollars to pursue, and it will take years before it is resolved in favour of our foreign person, who will be excluded--or sitting in jail with a bunch of Cuban and Chinese refugees--until the case is resolved in his failure. I am sorry to have written such a long message, and to have been so slow in writing it, but I think that part of the problem is that both Mr. Froomkin and I were shooting from the hip, and that is why our disagreement grew. But perhaps it has all been worthwhile, for I do think that there are a few useful conclusions that can be drawn from this discussion: (i) We academic lawyers tend to try to settle real world questions as if they were academic questions; (ii) It is never safe to assume that any court will construe a statute or a regulation as meaning something other than what it says; (iii) One can only construe a legal text in a particular context; even if one thinks that one can figure out how any court would interpret the text in qustion, one still nees to know how the text got before the court; and (iv) The fact that you can always sue the police for unconstitutional harassment isn't of much help when they reach for the rubber hose. -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger@pdj2-ra.f-remote.cwru.edu junger@samsara.law.cwru.edu