In the Karn case, Richey failed to properly apply the right tests for constitutionality, and ignored the properties of source code which make it a form of speech. In the Bernstein case, Patel did not provide a restrictive enough view of the speech value of program source code, and is excessively enthusiastic about its ability to aid communication, as well as the speech-like features of object code. Nevertheless, both judges follow similar analytical frameworks.
In the following sections, we will review the two cases, at least up to the delivery of the summary judgments, and highlight the positions of the plaintiffs and defendants. We will also summarize the opinions of the judges for both summary judgments, and critique each opinion. Finally, we will discuss how the errors in each opinion reflect our current lack of ability to properly deal with information, including computer programs, as commodity items.
The AECA is implemented by the International Traffic in Arms Regulation (ITAR), which contains the USML. The President had delegated his authority under the AECA to the Secretary of State, who has in turn delegated the authority the Undersecretary for Arms Control and International Security Affairs. The ITAR regulations are administered by the Office of Defense Trade Controls (ODTC).
Under ITAR, there is a procedure for determining if an item is on the USML. This procedure is called the Commodity Jurisdiction (CJ) procedure, and is initiated by written request to the ODTC. There are two specified levels of appeal for the outcome of a CJ procedure: the first level is to appeal to the Deputy Assistant Secretary of State for Export control, and the second level is to appeal to the Assistant Secretary of State for Political-Military Affairs. The result of a CJ procedure about a given item does not indicate whether or not that item is actually exportable or not; there are items on the USML which are licensed for export.
The USML specifically lists cryptographic systems and software that can be used for data confidentiality. Finally, control of certain mass market software items may be transferred from the State Department to the Department of Commerce. [1]
On November 15, 1996, President Clinton transferred control of non-military encryption items from the Department of State to the Department of Commerce. Non-military encryption items that were formerly on the USML were now transferred to the Commerce Control List (CCL). The CCL is part of the Export Administration Regulations (EAR), which implement the Export Administration Act (EAA). Even though the EAA is not a permanent piece of legislation (it expires), the EAR are continued, with the implicit approval of Congress, via a Presidential order. The International Emergency Economic Powers Act (IEEPA) provides the President with the authority to make such an order. [2]
As we will see later, there is some confusion over the Judiciary's ability to review these complicated export controls.
On March 9, 1994, Karn then filed a CJ request for a disk containing the exactly the source code that was listed in the book. This disk was not the same as the more extensive disk set offered by Schneier; indeed, Karn took special care to describe how the disk contained exactly the same text and information as the source code section of the book. Karn claimed that the disk set was identical to the book, except for the media itself (disk versus paper). Karn hope to have the disk and the source code it contained designated as ``mass market software''. On May 11, 1994, Karn's request was denied by the State Department on the grounds that the disk containing source code was on the USML and required a license for exportation. In their reply, the State Department also explicitly denied that the disk representation of the source code was not identical to the book representation.
According to the procedure outlined in the first section, Karn then appealed the CJ decision to the Deputy Assistant for Export Controls, on the following three grounds. First, he repeated the claim that the disk was identical to the book. Second, he claimed that because the disk was readily available over the Internet, it was a public domain item under the ITAR, just as the book was. Finally, he claimed that his dissemination of the disk was protected under his First Amendment rights, because the source code on the disk was protected speech. This appeal was denied on October 7, 1994.
Karn followed the denial of his first appeal with an appeal from his lawyers to the Assistant Secretary of State for Political-Military Affairs on December 5, 1994. This appeal contained the first allegations that the ITAR acted as a form of prior restraint in violation of the First Amendment, and that the distinction between the book and disk was ``specious, arbitrary, and capricious''. This appeal also claimed that previous decisions by the State Department were based upon Constitutionally flawed analyses of the law, and incorrect facts. Finally, the appeal stated that Karn would seek judicial review if the appeal was unsuccessful. This appeal also was denied. The denial noted three facts as determined by the State Department: the software on the disk could be used in a functioning cryptographic system, and was placed on the USML for that reason; the disk, including its software, was specifically not included in the ITAR public domain exemptions; and the decisions of the State Department with regard to the USML were not subject to judicial review.
Finally, on September 21, 1995, Karn and his lawyers filed a civil complaint against the State Department, which was assigned to Judge Richey. This complaint attacked the State Department and the ITAR in three main areas. In the first area, the complaint held that the distinction between the book and disk was arbitrary and capricious, and hence in violation of the Administrative Procedure Act (APA). The second area was First Amendment rights: because the ITAR licensing process constituted prior restraint on the disclosure of ideas and information about cryptography, because the CJ procedure was vague and overbroad, and because the State Department was controlling a disk with the same information as the published book, Karn's First Amendment rights were deemed violated. Finally, in the third area, the complaint alleged that because the distinction between the book and disk was arbitrary, irrational, and capricious, Karn's Fifth amendment right to due process was violated.
The government filed a motion to have Karn's complaint dismissed, or to have summary judgment passed on the complaint. Their motion addressed each of the three areas in Karn's complaint: APA violations, and First and Fifth Amendment rights violations. They reiterated the State Department's position in the response to the second appeal, that the export control decisions of the President, as realized in the USML, were by law specifically precluded from judicial review. They declared that the State Department decisions about the disk were a ``non-justiciable political question''. Thus Judge Richey was not in a position to address the alleged violations of the APA.
Next, the government's motion addressed the First Amendment aspects of Karn's complaint. They claimed that his First Amendment claims were without merit because the regulation of the disk was not based upon the information contained in the disk; the regulation of the disk was based upon its ability to function as part of a cryptographic system. However, the government went on to further bolster their case. They went on to say that even if the source code on the disk did have expressive value, the government's regulation of the disk passed the O'Brien test; this was in response to Karn's prior restraint claims.
The O'Brien test applies when determining if a government restriction of conduct which ``incidentally'' restricts speech is constitutional. The test for a government restriction on speech is a four part test, which as we will see, can be interpreted in different ways; indeed, Judges Patel and Richey had slightly conflicting views on how to apply the test. The four parts are: 1) the restriction is within the constitutional power of the government; 2) the restriction furthers substantial government interests; 3) the government interest is not related to the restriction of free expression; and 4) the incidental restrictions of First Amendment rights are no greater than necessary (this is a narrowing provision) [3].
According to the government, the restriction of the disk met all four prongs of the O'Brien test. As we saw before, the government was empowered to restrict the disk, they obviously have an interest in stopping the spread of encryption and are apparently not specifically attempting to restrict expression, and finally, the government considers the USML a highly appropriate way to control arms and encryption.
The government then addressed Karn's vagueness challenge; they held that because the State Department promptly responded to Karn's CJ request and informed him that the disk was on the USML, that the ITAR and the CJ procedures were clearly not vague.
Finally, the government addressed Karn's allegations that due process was not accorded to him, and thereby his Fifth Amendment rights were violated. First, they discussed how the disk was specifically not included in the ITAR public domain exemptions, hence it was properly subject to export control. This is also similar to the government's response to the APA challenge; Karn presented similar challenges in both areas. Then, the government discussed why it was necessary to regulate the disk, and why it was not arbitrary and capricious to regulate the disk even though the source code on the disk was readily available across the world via the Internet. They provided the usual national security and military reasons. They also provided an interesting analogy: many other countries in the world manufacture, distribute, and sell arms such as tanks, guns, and warplanes; however, this does not make irrational or pointless for the President to order that these military items are restricted for export purposes.
Karn and the government then each filed many supplementary briefs on the issues above, but neither brought up any new issues.
On February 22, 1996, Jude Richey issued an opinion in response to the government's motion; in his opinion he held that Karn's APA claim was non-justiciable, and dismissed Karn's constitutional claims. Judge Richey was not at all receptive to Karn's complaint. In the first paragraph of his opinion, Richey refers to Karn's claims as ``needlessly invoking'' the courts, ``meritless constitutional claims'', and concludes by referring to the subject matter as a ``political question'' for the other two branches of government. These may or may not be true, but the Judge's wording reveals his attitude towards Karn's claims.
Judge Richey's decision addressed the three areas discussed in Karn's complaint and the government's motion; for the most part, Judge Richey presented the same arguments as presented in the government's motion. He refused to address Karn's APA claims, on the grounds that the AECA precluded judicial review of USML ``defense article'' designations. He did briefly address Karn's attempt to argue that this preclusion of judicial review only applied the Judge's ability to determine whether or not the President had the power to place items onto the USML, and that judicial review of individual items was not precluded. Judge Richey quite reasonably found this reading of the AECA ``strained and unreasonable'', with reference to previous cases and opinions.
Next, Judge Richey addressed Karn's constitutional challenges, where he largely followed the argument of the government in assessing Karn's First Amendment claims. Because Judge Richey felt that the ITAR regulations were content-neutral and passed the O'Brien test, he specifically assumed that the source code was protected by the First Amendment. However, he did note that he was not ruling whether or not source code actually was subject to First Amendment protection. Essentially, Judge Richey's discussion of the O'Brien test was similar to that put forward by the government, as summarized above; Judge Richey concurred that because the regulations addressed the disk as a functioning device and not speech or expression, the O'Brien test did apply. Karn and his lawyers had tried to promote a theory that the disk was ``pure speech'', and that since the O'Brien test only applied to pure conduct, it did not apply here; Judge Richey, however, responded to this by saying ``The Court disagrees, as the plaintiff's argument places form over substance''. In a murky paragraph, he explained how it was not necessary for him to even decide whether or the contents of the disk were ``speech'' or ``conduct'' in order to properly apply the O'Brien test. Finally, Judge Richey made some interesting points in his discussion about the narrowness prong of the O'Brien test. He stated that Karn had not provided any real argument that the government regulations were excessively broad. Judge Richey also noted that there seemed to be no ``present barrier'' to spreading information about cryptography and cryptography source code, except for machine-readable media such as the disk. He seemed to use this as support for his decision that the regulations were narrowly tailored.
Judge Richey also very briefly dismissed Karn's Fifth Amendment claims, deciding that ``regulating the export of the plaintiff's diskette is rational and accordingly, does not violate the substantive due process rights guaranteed the plaintiff under the Fifth Amendment of the Constitution''. He primarily considered Karn's Fifth Amendment claim as a back-door to the APA claim, attempting to use the same ``arbitrary and capricious'' claim while avoiding the preclusion of judicial review as in the APA claim. According to Judge Richey, and supported by case references, due process ``merely requires a reasonable fit between governmental purpose and the means chosen to advance that purpose''. Judge Richey then essentially reiterated some of the government's claims that it was easier to use the disk to build an encryption system than the book, and dismissed the claim. [4]
Karn's case is currently in appeal.
While Daniel Bernstein was a PhD. candidate, he developed an encryption algorithm that he called ``Snuffle''. He wrote a paper describing the algorithm, and produced two pieces of source code which implemented that algorithm (one, ``Snuffle.c'', encrypted information while the other, ``Unsnuffle.c'', decrypted information). On June 30, 1992, he submitted a CJ request for the paper and the source code; he meant to make the source code available on-line.
Bernstein's CJ request was denied on August 20, 1992; this denial was the start of a heated communication between Bernstein and the State Department about ITAR, arms dealer licensing, and various other aspects of Bernstein's case.
On July 15, 1993, Bernstein submitted a second CJ request, asking for separate classifications on five separate items. These items were: the original paper; Snuffle.c; Unsnuffle.c; a description of how to use snuffle; and a description of how to program a computer to use Snuffle. The reply to this CJ was issued on October 5, 1993; this reply lumped the five separate items together and classified them all as defense articles.
In the meantime, Bernstein had filed an appeal to his first CJ request on September 22, 1993. There was no response to this appeal, and on February 21, 1995, Bernstein filed a complaint against the government. The government in turn filed a motion to have the case dismissed on August 14, 1995, and Judge Patel issued an opinion denying that motion on April 15, 1996. What is especially odd is that Bernstein received a letter issued on June 29, 1995, which ``clarified'' the reply to Bernstein's second CJ request by stating that in fact only the two pieces of source code from that CJ request were defense items. One interpretation of this clarifying letter is that the State Department changed its mind about that request after Bernstein filed his complaint, in fear of legal repercussions.
Bernstein's complaint was much further ranging that Karn's complaint. Lee Tien, one of Bernstein's lawyers, referred to their complaint as a ``kitchen sink'' of issues, while the Karn complaint was ``simple'' and ``concrete'' [5]. Bernstein's complaint had ten separate counts, all except one of which addressed alleged constitutional violations by the ITAR and AECA. The lengthy complaint included claims along the following lines: 1) the CJ process and arms dealer licensing and registration processes are unconstitutional because they are prior restraint; 2) the AECA and ITAR are unconstitutionally vague, for instance with respect to the dissemination of academic information about cryptography; 3) the AECA and ITAR are overbroad and not narrowly enough tailored; 4) Bernstein's First Amendment rights and academic freedoms were violated by the ITAR; and finally, 5) the APA was violated by the State Department's decision in Bernstein's case.
The government replied to Bernstein's motion with a motion to have the case dismissed, just as they had in Karn case. Indeed, the government motion in the Bernstein case contained much of the same sorts of arguments as their motion in the Karn case. The motion addressed each of the counts in Bernstein's complaint: it dismissed the challenges to USML designations as non-justiciable, for the same reasons as we have seen before, and it put forward that none of Bernstein's constitutional claims were colorable (that is, worthy of consideration).
First off, the government proceeded as before by explaining how the AECA regulation of cryptography source code was not related to the source code's communicative value or expression, but rather pertained to the source code's functional capacity. Thus, the USML and ITAR did not regulate speech; they only regulated the export of functional software items. However, exactly as in the Karn case, the government went on to say that even if the regulations affected expressive conduct, they satisfied the O'Brien test, for all of the same reasons discussed in the Karn case. Finally, the government countered Bernstein's claim of prior restraint and overbroadness by stating the ITAR and AECA do not regulate scientific papers or explanatory material [6], and stated that the ITAR and CJ process were not vague because the regulations were surely ``susceptible to common understanding by `a person of ordinary intelligence' ''.
Judge Patel denied the government's motion with a detailed opinion that discussed many issues, and put forth determinations that Judge Richey had declined to even consider when he granted the government's motion in the Karn case. Judge Patel's opinion is laden with sympathy towards Bernstein's' complaint; this is foreshadowed when she writes in her introduction that ``All material allegations in the complaint will be taken as true and construed in the light most favorable to the plaintiff''.
Judge Patel first addressed the issue of whether or not the case was judicable, in much the same manner as Judge Richey. She quickly dispensed with the preclusion of judicial review by the AECA, which was an issue raised by the government. She accurately concurred with Judge Richey by stating that the designation of items on the USML was not up for judicial review, but noted that this was not the issue here and that the real case of the complaint was the constitutionality of the entire AECA and ITAR regime as they applied to the cryptography source code.
Judge Patel is clearly a more of an activist judge than Judge Richey. Where he essentially followed the government's lead in his opinion, and denied any mandate to address several issues, such as the narrowness of the regulations, citing them as ``political matters'', Judge Patel was clearly enthusiastic about addressing the constitutionality of the regulations, stating that ``the judicial branch not only possesses the requisite expertise to adjudicate these [constitutional] issues, it is also the last and final interpreter of them''.
She gave a much more detailed discussion of why she was able to properly entertain Bernstein's complaint, while Judge Richey had just proceeded to apply the O'Brien test. According to case references quoted by Judge Patel, as long as the complaint had colorable constitutional claims, it was open for judicial review despite the explicit preclusion of judicial review by the AECA. She discussed the standard for colorability at some length, and stated (with references) that under the Ninth Circuit, a claim was considered colorable unless it was ``clearly immaterial and made only for the purposes of jurisdiction, or `is wholly insubstantial or frivolous' ''. She reviewed various mixed applications of the colorability standard to cases connected with national security decisions, and decided that since they were unclear and mixed, she would use the criteria stated above. This standard, which seems relatively lax, and Judge Patel's sympathetic attitude as revealed in her introduction, go quite far in explaining how she arrived at an opinion that seems quite opposite to Judge Richey's opinion.
Judge Patel next addressed the issue of protected speech with regard to the source code in great detail. She dismissed any of the issues concerning the restriction of the papers, since the State Department had sent out the ``clarifying letter'' which stated that the papers were not defense articles; she did, however comment on the timing of the letter! Her approach to the source code as as speech is perhaps the area where her opinion differs the most from Judge Richey's opinion. She made the following strong statements:
``at least formally, it appears to be speech'',
``This court can find no meaningful difference between computer language, particularly high-level languages as defined above, and German or French. All participate in a complex system of understood meaning within specific communities. Even object code, which directly instructs the computer, operates as a `language' '', and finally,
``For the purposes of First Amendment analysis, this court finds that source code is speech.''
These statements are a stark contrast to Judge Richey's note denying any position whatsoever on whether or not source code was expression or communication.
Judge Patel disregarded as immaterial the government's arguments that the source code was regulated only on a functional basis, and that the source code was functional. She sensibly stated that the functionality does not limit the possibility of speech or communication. For instance, recipes and instruction manuals are functional, yet are also expression. Another more pertinent example is written details on constructing an atomic bomb; these has been ruled as protected expression.
Finally, Judge Patel concurred with Bernstein's argument that copyright law also lends support to the notion of source code as free speech. Since source code can be protected as original expression under copyright law, it is consistent to consider it as protected speech under the first amendment.
Judge Patel then went on to consider the constitutional claims. She stated that the O'Brien test was ``relatively mild'', and probably did not pertain to this case anyway since the source code was to be considered as speech, not conduct. Judge Richey, however, did not take such a restrictive view on applying the test; he had felt that in order to apply the O'Brien test it was sufficient that the regulations treated the source code as conduct. Judge Patel did not take this position at all; however, oddly enough, she proceeded to apply the O'Brien test anyway because neither Bernstein nor the government had been given the opportunity to present a brief on what First Amendment test should be applied. This seemed highly irregular, and should probably be interpreted as Judge Patel's attempt to protect her decision. If she had not discussed the O'Brien test, she would have been leaving her opinion open for an appeal in that area. However, by applying the O'Brien test, she has more fully covered the legal aspects of the case, limiting areas for appeal of her judgment. This is similar to how Judge Richey protected his judgment, by claiming that the source code may not even be protected speech, but then ruling as if it was protected speech. The two judges each had a particular decision in mind when they wrote their opinions. Since Richey knew that he would be able to apply the O'Brien test and still dismiss the Karn case, he went ahead and applied the test, thereby avoiding the complicated issue of whether or not source code is protested speech. Similarly, Judge Patel was able to apply the O'Brien test and deny the government's motion, thereby not having to actually rule that the source code was not functional. A ruling that had to rely on source code not being functional, in order to ignore the government's continued arguments about how the regulations actually only affected functionality, would be very dubious.
Judge Patel quite quickly stated that ``[the court] finds facts sufficient to state a nonfrivolous First Amendment claim and hence that claim is colorable''. She also stated that all government licensing schemes, including the ITAR and AECA, `'come with heavy presumption to their validity when the as a prior restraint''. This was true, she said, even in the case of national security, where she cited the publication of the Pentagon Papers.
Finally, Judge Patel ruled that Bernstein's overbreadth and vagueness claims were not frivolous and hence colorable. As support for the vagueness claim, she pointed out the confusion surrounding the papers in Bernstein's second CJ request, stating that the government itself seemed confused about its own regulations.
Due to the above arguments, Judge Patel denied the government's motion. The Bernstein case was decided in favour of Bernstein by Judge Patel. However, the transfer of cryptographic items to the CCL took place shortly after the case was decided, and Bernstein and his lawyers filed another, similar complaint directed at the Commerce Department. The government again filed a similar identical motion to dismiss, which was again denied by Judge Patel for very similar reasons as above. She carried over her decision from the first case to the second case. [7]
``Both parties exaggerate the debate needlessly. Plaintiff does so by aggrandizing the First Amendment, by assuming that once one is dealing with speech that it is immaterial what the consequences of that speech may be. Defendants do so by minimizing speech, by constantly referring to `mere speech'' or ``mere ideas''in their briefs and assuming that the functionality of speech can somehow be divorced from speech itself. This controversy is before this court precisely because there is no clear line between communication and its consequences.'' [8]
Indeed, there is no clear line between communication and its consequences, just as there is no clear line between program source code as expression and as a functional item. And, unfortunately, the ruling of Judge Richey and Judge Patel do not give us much insight on where the line between speech and function may lie for source code. Both preliminary rulings lie on either ends of a wide spectrum or hierarchy of possible attitudes towards source code and programs. Judge Richey essentially ignores the communicative and protected speech aspects of programs, while Judge Patel goes too far by positing those attributes for object code, or binary programs. Thus we are still left with the long-standing problem of how to deal with programs, not only in cryptography export controls, but in intellectual property and other areas of the law.
Judge Patel's decision was proper: the Bernstein case raised legitimate issues about the constitutionality of the cryptography export control regime. Judge Richey failed to adequately address any of these issues in depth, hiding behind the mantra of ``political issues''. He failed to justify his conclusion that the O'Brien test was indeed passed by the regulations; in fact, he sidestepped the narrowness prong of the test, again citing ``political issues''. This was highly unsatisfactory. It is clear from reading program source codes and by speaking with computer science and software engineering practitioners that computer programs are indeed a highly developed form of communication. In fact, in the software engineering fields there is a large amount of effort expended to develop methodologies and practices which make program source codes more expressive, more communicative ideas, and more useful to other people.
Also, we can quite easily generate examples that will cause considerable trouble for Judge Richey's opinion. What about books on CD-ROM media? Surely they are subject to all the same first amendment rights as books on paper media, especially if they are the exact same text as the printed version? Now, consider placing the entire Schneier book onto a CD-ROM -- how would Judge Richey approach that? His opinion gives no hints. It does not seem plausible that he could extend his functionality justification to cover the CD-ROM, especially in light of the recent Supreme Court decision over the Communications Decency Act (CDA), where the court ruled that publications on the Internet deserved at least as much protection as paper publications, if not more. Judge Patel, however, did make note of this decision [9]. Now, what if we make the entire Schneier book available on the Internet for free? It seems that given the CDA decision the online book could not be regulated under the ITAR and AECA.
Here is another example: suppose we wish to export a bundle containing the Schneier book, a computer, a document scanner, character recognition software, and a compiler -- would this qualify as a cryptographic system? Presumable not, since we could freely export each item individually. However, this is dangerously close to providing the same functionality as the disk in the Karn case. The conclusion we can draw from these contrived examples is that Judge Richey's opinion was flawed, because it did not sufficiently address any of the issues that these examples highlight. Indeed, it seems as if his opinion would be at odds with the Supreme Court CDA ruling.
Judge Patel's opinion has its own problems. Although it was the right ruling to make for the specifics of the Bernstein case, it goes dangerously far by designating object code, or even all computer code, as protected speech. While Judge Richey ignored the speech aspects of computer programs, Judge Patel is perhaps over-enthusiastic about them. There is a continuous spectrum of different forms of computer programs, with binary object codes at the bottom, and high level English descriptions of algorithms and processes at the other end. In between these two ends of the spectrum there are various levels of description, spanning (roughly in order of decreasing ``sophistication'') pseudo-code, visual programming, high level programming languages (like ``C'', Scheme, or Pascal), p-code (or bytecode, the machine independent codes used by the Java virtual machine), assembly code, object code, and microcode. Judge Patel sees every form of computer language in this spectrum as protected speech; Judge Richey would probably only agree that English descriptions, or perhaps pseudo-code descriptions, are protected speech.
However, the line between protected and unprotected forms of programs for First Amendment purposes should lie somewhere in between, somewhere underneath languages like Scheme ``C'' . It is clear from Judge Patel's opinion, and from reading programs, why Scheme programs should be protected speech. It is not so clear why this protection should be extended to binary codes, as she mentions. She briefly states that because binary codes are simply the result of translating higher level programs, they are probably protected, just as speech translated from Dutch to Russian is also translated.
But she is wrong because when computer programs are translated, of the higher level semantics and information contained in the original programs are lost. This is a highly debatable point, and indeed it would be desirable for lower level computer languages to retain all of the program semantics and information contained in higher level languages. But we can gain an intuitive feel for why this maybe right, just by looking at the various forms of languages. Higher level computer languages use English (or French etc.) words, and are written to express abstract or domain specific concepts, like triangles and cars, or sets and stacks. Lower level programs are indeed more like simple instructions to the computer: add these numbers, put this value in that location. There is a definite and significant qualitative difference in the amount of communication and expression provided by high and low level computer languages; that is precisely why higher level computer languages have evolved and continue to evolve.
It is not a problem in itself the Judge Patel indicates that these low level computer programs could be considered protected speech; rather it is the consequences of this opinion that we must be wary of. By her opinion, every form of computer program is protected -- but then this leaves the government powerless to control cryptography, a significant form of weapon or defense article. And despite all the arguments that say cryptography should not be controlled, it is clear that the government has a legitimate interest in controlling it [10]. The question is, as Judge Patel outlined it, how to draw the line between expression and function.
As the world, or at least our part of the world, transforms to an information society, and as software becomes a major component of every device that we use, including basic and advanced military systems, government will need to be able to appropriately control certain forms of software and software systems. Cryptography is one such sort of system. Other types of software that might need to be controlled are computer ``viruses'', or software that can be used to violate privacy. We can even imagine that in the future, with the evolution of the man-machine interface, there could be various forms of software ``drugs'' that may need to be regulated. These scenarios and examples may sound far-fetched, but we are least half way there in that software is ever-present in many devices around us.
So although Judge Patel's decision was, in general, a good decision, it serves as another example of how we do not have the right answers on how to appropriately classify software and computer programs in the law. Endnotes [1] This description of the export control laws is derived from the ``Declaration of William J. Lowell'' in the Karn case. William J. Lowell was the Director of the ODTC at that time.
[2] The information on the transfer of encryption items form the USML to the CCL is taken from Judge Patel's opinion on the Government's request for summary judgment in the Bernstein case.
[3] This description of the O'Brien test is taken from the government's ``Memorandum of Points and Authorities in Support of Defendant's Motion to Dismiss, or in the Alternative, for Summary Judgment'' in the Karn case.
[4] All of the quotes in this section (``Overview of the Karn Case'') are from Judge Richey's opinion of March 22, 1996, unless otherwise attributed.
[5] Mark Voorhees. ``A Tale of Two Crypto Court Cases''. Information Law Online, May 3, 1996.
[6] This was despite the outcome of Bernstein's second CJ request, and the suspicious clarifying letter that followed after he filed his complaint.
[7] All of the quoted attributed to Judge Patel in this section come from her opinion denying the government's motion to dismiss in Bernstein's first complaint.
[8] From Judge Patel's opinion denying the government's motion to dismiss in Bernstein's second complaint.
[9] ibid.
[10] This interest is outlined in the government briefs and motions in these two cases, as well as in numerous other writings.