[sorry for the delay, things are busy here, and apologies too for the length of this thing...] Misunderstanding, piled on misunderstanding, piled on disagreement. I'll try to focus on the big points, and let the small stuff slide. Let the record show that Prof. Junger and I still agree on lots of stuff that's outside this debate. I wasn't trying to attack him before, and I'm not trying to start a flamewar now. Main point for the busy: Claims that the US government could apply the ITAR to 2 foreigners abroad and get a US court to buy it are, IMHO, unfounded. On Thu, 9 Nov 1995, Peter D. Junger wrote: [...]

seem to have two different areas of disagreement: (i) whether the ITAR's provisions relating to cryptographic software apply to foreign persons who disclose (or transmit) cryptographic software to another foreign person without the United States

[....the Itar is unconstitutional....] Yes.

Now Mr. Froomkin says:

In short, in this particular case the ACEA, and by extention the ITAR, doesn't "say what it says" it "says what it must mean".

(And I dare him to make that assertion in the faculty lounge at Miami when some of the more critical and analytically inclined members of the Miami law faculty are present.) I would take this as an admission

I would say it anywhere. Some days I would even claim to be one of those people..,

that the ACEA and the ITAR does say what it says (even if it must mean something else) were it not for the fact that--and this was my ``ultra vires'' point--that the ACEA doesn't say it.

(In discussing the quoted passage I am assuming that ``extention'' must mean ``extension'' and that it is not used as the opposite of ``intention'', if only because I don't know what the latter would be. But on the other hand the only dictionaries I have to hand are the COD and the on-line version of Webster's Collegiate.)

The AECA doesn't contain any definition of ``export'' whatsoever; the whole issue that we are discussing turns on the interpretation of what the ITAR says when it defines ``export'' as including:

Disclosing (including oral or visual disclosure) or transferring technical data to a foreign person, whether in the United States or abroad ....

Now Mr. Froomkin seems to be contending that this language must be interpreted as it would be interpreted by some sort of neo-Platonic court (probably sitting in Rawl's original position by designation), which he calls ``any court''. The contention is:

Nope. Never said it, didn't mean it. I mean a good ol' garden variety US federal court.

any court construing the ACEA would inevitably read the prohibition on "exporting" to a foreign person as not applying where the nation lacks jurisdiction.

Now it was my argument--which Mr. Froomkin helpfully calls an ``ultra vires'' argument--that any court reading the ACEA would notice (i)

Here's a misunderstanding (for which I'm happy to take full responsibility). What I meant by the "ultra vires" point is this: There are lots of ways in which an agency action can be struck down by the courts. Two of them are: 1) The agency interpreted the statute correctly, but the statute was unconstitutional -- beyond Congress's powers under the constitution. 2) The agency interpreted the statute Incorrectly, and tried to do something beyond the powers delegated to it by congress (the nice thing about this is that one doesn't even reach the issue of whether Congress could, in theory, have delegated the power in question).

that there is no language in that act defining ``export'' and (ii) that ``export'' does not mean disclosing, or even transferring, information (which is what cryptographic software is) and (iii) that, in consequence, the Office of Defense Trade Controls exceeded its congressionally granted authority, and therefore its constitutional authority, when it came up with the perverse provision that is at issue here. But that is the subject of my other, as yet unwritten, message.

That's what I meant by my ultra vires assertion. Type (2) above. So we agree in a sense as to what this problem is -- but I call this a case of an agency misconstruing the statute, not a "separation of powers" problem. Let's assume, for the argument, that I'm wrong and that the agency read the statute reasonably (note under Chevron it doesn't have to read it "right" just reasonably). Does the agency read the statute to apply to two foreigners talking on the beach at Calais? No it does not. Did Congress intend the statute to be applied to the two foreigners? No evidence that it did. Would or should a court read the statute to apply to two foreigners etc. in the absence of a clear direction from Congress to that effect? No. Why not? Two main reasons. One is the one you identify:

Now I take it that Mr. Froomkin's contention turns on the claim that Congress lacks jurisdiction under international law to pass a statute--or authorize a regulation--that makes it a crime for a foreign person to transmit something to another person when both of them are outside the United States. So as to avoid the other

The other one is that even if Congress had the jurisdiction, the court would be reluctant to read the statute that way, with the implications for foreign relations, comity, etc etc without clear directions to do so. And if you think the court would just formalistically follow the words of the statute, see eg Church of the Holy Trinity, 143 US 457 and its progeny.

constitutional and ultra vires and so on issues, let us assume that Congress were to amend the ACEA to make it a crime ``to transfer a cryptographic device to a foreign person within the United States or abroad without first obtaining a license or a waiver of jurisdiction from the Office of Defense Trade Controls.''

And now assume that someone, F, who is a foreign person and who has never been in the United States transfers a cryptographic device that was not made in the United States or by a United States company to another foreign person who person who has never been in the United States. And now assume that F does come to the United States on a holiday and that he is arrested and indicted for violating the AECA in that he did transfer a cryptographic device to a foreign person.

The first thing to notice is that the indictment is not defective. The only defense--since it is the only one that we are interested in and we control the hypothetical--is: ``but that was in a foreign country'' and therefore the United States has no jurisdiction under international law (or under something) to treat F's actions as a crime.

So the defense moves to dismiss the indict on those grounds. And the prosecution stipulates that the acts charged occured in a foreign country, that F is a foreign person, etc.

On those facts I would hope that the court would construe the statute as not covering F's actions outside the United States and would dismiss the indictment, but--considering that the statute specifically says it applies both within the United States and ``abroad''--I am not nearly as sanguine as Mr. Froomkin is. But let us assume that the indictment is dismissed.

I cannot imagine that the court would do anything but dismiss on these facts.

And now the hypothetical provision in the ACEA is again amended by congress to make it a crime ``for (i) a United States citizen to transfer a cryptographic device to a foreign person within the United States or abroad or (ii) a foreign person to transfer a cryptographic device to a foreign person within the United States or abroad, without in either case first obtaining a license or a waiver of jurisdiction from the Office of Defense Trade Controls.''

Note that now we are more explicit that in the ACEA.

And now assume that F', who has never been in the United States transfers a cryptographic device to a foreign person and thereafter comes to the United States and is arrested indicted for violating the hypothetical provision of the ACEA. It would seem to me that there is no way that any but the most willfully wrong-headed court (and there are, I admit, such courts) would construe the hypothetical provision as not covering F's actions, since it does so clearly cover those actions. I mean that there is no way that the court can get away with concluding that it does not mean what it says.

So what can F' do now? Well, he could try to raise the claim that the lack of ``jurisdiction''--which is the justification for Mr. Froomkin's ``any court'' construing the ITAR's actual provisions would not apply to F or F'--is a ground for dismissing the indictment.

But how can he raise that point? He can't very well deny that the court has jurisdiction over his person--he's sitting in the court with shackels on--and he can't get away with claiming that the court doesn't have jurisdiction to try him for violating the ACEA.

So it would seem that F's only hope would be to move to dismiss the indictment on the ground that to continue the prosecution would be to deny him due process because the United States lacks jurisdiction under international law.

There are a number of other arguments he could make. E.g. denial of due process for lack of notice. Unconstitutionality of the statute as exceeding the powers of congress as a violation of international law. A weaker argument would be an analogy to the ex post facto clause -- now the government seeks to apply its laws to him after the fact. I do not think that the Neuremburg precedent would be contrary, since the claim of the US there was that some laws of man and nations are always in force everywhere. Restrictions on crypto exports does not fall in that class.

Now I am no expert in this area, but I would be surprised if the courts would recognize this as costitutional defense. As I understand it from talking with somebody here at CWRU who is knowledgeable, the courts of the United States tend to defer in such cases to Congress

A vast and unhelpful oversimplification. what do you mean by "such cases"? Criminal prosecutions of US citizens for messing in foreign policy is one thing; criminal prosecutions of foreigners for acts that have foreseeable effects here is another thing; criminal prosecutions on the facts above is a whole different thing.

and the executive--when they are in agreement, as they would be in our hypothetical--and principles of international law count for little.

It is certainly true that as Justice Jackson put it, the powers of those branches are greatest when they agree. But the constitution trumps all.

So F' will ``inevitably''--to use Mr. Froomkin's word--be convicted of the crime of delivering a cryptographic device to a foreign person outside of the United States.

I do not agree. See above.

Now lets get back to the ITAR as it is actually written. In an actual criminal action brought against a foreign person who is accused of disclosing cryptographic information to a foreigner outside the United States--not that I think such an action will ever actually be brought--the government can point out to the court the facts that I have just discussed, so the court will be aware that there is no constitutional provision requiring the dismissal the indictment, even if the indictment is contrary to international law. And a real court, as opposed to Mr. Froomkin's ``any court'' might in those circumstances feel free to determine that the ITAR means what it says. (That's just common sense.)

But no. First there is the constitutional arguments. Then there is the idea that we interpret the statute to avoid the constitutional and international problems. Then there is the problem that there are no grounds to think that Congress ever intended to reach foreigners in such cases (and Holy Trinity Church, 143 US 457 (1892) still gets cited (despite its anachronistic view of religion)).

And, were the government ever to bring such a case it, it would argue, and I think that it would convince a lot of real judges, that the criminal action does not violate international law because the United States is protecting its own economic interests by prosecuting foreign persons who disclose cryptographic information to other foreign persons outside the United States. The government's lawyer will argue:

Judge, the United States is in a real bind. It is absolutely necessary for our national security that we forbid the export of cryptographic software. But, on the other hand, as those Cryptopunks keep pointing out, we are distroying our computer industry by enforcing the ITAR against American companies. So the only solution is to apply the ITAR against foreigners as well so that the American computer industry will have a levelled--I mean a level--field to play upon. And the anti-trust cases make it absolutely clear that the United States does have jurisdiction to enforce its laws against foreign criminal who break those laws outside of the United States when their crimes have a negative effect upon the economy of the United States.

I am afraid that most federal district court judges would buy that argument, and I am not even sure that Mr. Froomkin's ``any court'' wouldn't buy it.

I think many district judges, most appellate judges, and almost every supreme court justice would at least reject, if not laugh at, that argument. The trend is away from assertions of jurisdiction over foreigners without minimum contacts, e.g. Asahi (sp?).

And, in any case, if such a criminal case were to be brought, the government would almost certainly be able to allege additional facts to help justify the claim that the US does have jurisdiction over the matter under international law.

I'm sorry, but everything that follows the line above is irrelevant. If there are other grounds to prosecute, the court will use those and avoid the constitutional problem. If the foreigner isn't really foreign, then he's not a foreigner. I'm going to respond in detail anyway because I think that the FUD factor may be coming in to play...

For example, the defendant might be French, and the French government might be cheering the United States government on. If the crime is a crime under both French law and the law of the United States then there is going to be no problem with the United States asserting jurisdiction. (That is, if I understand it correctly, Mr. Froomkin's murder example.)

I don't see what dual criminality has to do with this. Am I supposed to be on notice that if I do an illegal thing here to my neighbor, I'm supposed to be at risk of prosecution in Sri Lanka? Anyway, recall that in the original hypo foreigner A is talking *legally* to foreigner B. Even if they are not, it's not within the competence of the US government to do anything about it. Nor -- I have to say this over and over and over and over -- has the US government ever asserted in any form that it would seek to do anything about this. Just because an over-literal reading of a regulation could lead to that view does not equal an actual assertion of jurisdiction by the government.

Or the defendant may have studied cryptography in the United States, before he returned home and disclosed the information.

Not relevant. Note, by the way, that on these facts the "export" was by the (us person?) who taught the foreigner crypto in the US, not later.

Or the information that he disclosed had previously been unlawfully exported from the United States in violation of the ITAR (PGP, for example).

Not relevant.

Or the foreign person is an employee of a United States company or a foreign company doing business in the United States.

Not a foreigner, or the export is traced to a non-foreigner who then is the one charged with the ITAR violation.

Or even that the disclosure was done by a message transmitted over the Internet that happened to be routed through the United States.

So what? The people are still outside the US.

But the matter is even more simple than that since the government is not going to bring those criminal charges against a foreign person or a United States person or anyone else if they can possibly avoid it. The ITAR's provisions on cryptographic software are used by the government to spread fear, uncertainty, and doubt, and to discourage the spread of strong cryptography. Since an actual criminal case would almost certainly result in at least significant parts of those provisions being held unconstitutional, the government is not going to bring such a case if it can find any other ways of satisfying its goal.

And looked at that way, our foreign person who discloses cryptographic software to one or more other foreign persons abroad is going to be the perfect fall guy. As I have suggested before, the government will simply bar him from getting a visa to enter the United States since violation of United States foreign trade regulations is a ground for denying a visa--at least an immigrants visa. And, despite Mr. Froomkin's claim that our foreign person would have a cause of action if his ``petition'' were denied, he would probably have no recourse whatsoever. Certainly he would have no claim that the United States has no jurisdiction to exclude him for acts done by him outside the United States; the United States has jurisdiction to exclude foreigners for things that the foreigners did outside the United States, like believing in polygamy. And a foreign person outside the United States may not have standing to complain of violations of his freedom of speech outside the United States in an American court.

I invite you to consider the recent decision of the 9th circuit that foreigners in the US have full 1st Am. rights. Of course, the position of the would-be enterant is not the same as the position of even the temporary visitor to our shores, since constitutional rights don't attach to foreigners until they are in the country, but the language of that case is very suggestive.

But let us assume, contra-factually that Mr. Froomkin is right, and that the poor, excluded foreign person would have a good cause of action to force the government to give him a visa. (Though I really am curious as to what that action would be.) That cause of action is going to cost tens of thousands of dollars to pursue, and it will take years before it is resolved in favour of our foreign person, who will be excluded--or sitting in jail with a bunch of Cuban and Chinese refugees--until the case is resolved in his failure.

Yes, litigation is expensive. The foreign person unjustly excluded on this hypo will spend the time at home, writing crypto for profit, and reducing our tax base. Meanwhile academic lawyers such as us will be representing her free of charge. The government is sometimes unjust; even when you win against it you are worse off often than if you hadn't had to fight. That's a wholly different issue from whether you win in court, which is what I thought we were arguing about.

I am sorry to have written such a long message, and to have been so slow in writing it, but I think that part of the problem is that both Mr. Froomkin and I were shooting from the hip, and that is why our disagreement grew.

But perhaps it has all been worthwhile, for I do think that there are a few useful conclusions that can be drawn from this discussion:

(i) We academic lawyers tend to try to settle real world questions as if they were academic questions;

Speak for yourself please. I do not accept this accusation. I assert that my "solution" to the "problem" of whether a court would allow a criminal prosecution of a foreigner, however "evil", for discussing crypto with another foreigner in a foreign locale absent the most explicit and direct instructions from Congress is the correct one: probability near zero. Direct, clear instructions from Congress supported by a legislative history or legislative findings that made it clear that this was a result Congress intended would raise the probability considerably, but I'd still bet on the court striking the statute down as violating due process. The academy is part of the real world. All so-called real world questions are fit subjects for academic study. Much of my work is inspired by concrete problems, or is (I hope) applicable to them. Some of my work is more abstract. They applications are less immediate. I'm proud of that too.

(ii) It is never safe to assume that any court will construe a statute or a regulation as meaning something other than what it says;

It at least as dangerous to believe that a court will formalistically apply text as if statutory construction, especially in the shadow of the constitution, were a mechanistic process.

(iii) One can only construe a legal text in a particular context; even if one thinks that one can figure out how any court would interpret the text in qustion, one still nees to know how the text got before the court; and

This is a fair point. The facts *do* matter. This is why "hard cases make bad law."

(iv) The fact that you can always sue the police for unconstitutional harassment isn't of much help when they reach for the rubber hose.

But the fact that you can do so is part of the reason why rubber hoses are less common than they would otherwise be. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin@law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.