CFP96 Plenary Session

Before the Court: Can the US Government Criminalize Unauthorized Encryption?

Dissenting opinion

Dissenting Opinion of AXSMITH, Circuit Judge:

"The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding." Olmstead v. United States, 277 US 438 (1928) (dissent, J. Brandeis). Sadly, today American jurisprudence faces the same zeal and misunderstanding as it did during the Prohibition years when Justice Brandeis wrestled with the telephone and privacy. This court is faced with a statute which handles new technologies in a manner frighteningly unaware of the basic principles of privacy guaranteed under the Constitution, as elucidated by the Supreme Court. The majority sanctions the wholesale abridgment of the necessary and supporting right of association that accompanies the First Amendment, the reasonable expectation of privacy in the Fourth Amendment, and the privacy rights in the Ninth Amendment. New technologies do not mandate a new constitution, or an erosion of the one currently in place. The unconstitutional part of this statute cannot be separated from the rest of the statute; and therefore, the entire statute is unconstitutional, and the conviction under the statute should be reversed.

The defendant was convicted by a lower court of a violation of the Cryptography Control Act in that he communicated electronically over a wire using encryption for which the US government did not have a key. The registering of a key in excess of 64 bits with an Authorized Key Escrow Agency is mandated by the Cryptography Control Act. While the defendant was convicted of section 10 (b) of this statute, this dissent will address the statute as a whole since its unconstitutionality is encompassed throughout its provisions.

A. First Amendment - Overbreadth

The statute in question does serve some governmental purpose of facilitating the fighting of crime; but it is achieved by means which sweep unnecessarily broadly and invade First Amendment protected speech. The statute does this by including every person in the United States within its scope, whether a criminal or not. A chilling effect on protected speech results.

The doctrine of overbreadth was relied upon in NAACP v Alabama ex rel. Patterson, 357 U.S. 449 1958), stating "a government purpose to control or prevent activities constitutionally subject to regulation may not be achieved by means which sweep unnecessarily broadly and thereby invade the area of protected freedoms." Using that reasoning, the Supreme Court invalidated an Alabama law that required the NAACP, as an organization applying for a license to operate in Alabama, to submit a list of its members. The NAACP protested, claiming that doing so would subject it members to harassment. The Supreme Court found that the freedom of association of the NAACP members in Alabama would be infringed upon if the state of Alabama could demand a membership list. The right of association is tied to the First Amendment's right to free speech, applied to the state through the Fourteenth Amendment, and the Court found for the NAACP. The general rule in constitutional interpretation is that parties before the court may only assert their own rights. However, the Supreme Court has fashioned an exception to that rule in the area of First Amendment overbreadth, where a party before the court is permitted to claim that a statute is overbroad because it infringes upon the rights of a party not before the court.

The defendant in the case before the court today seeks to invalidate the statute under which he was convicted on First Amendment grounds. Facial invalidation of a statute requires "substantial overbreadth." Broadrick v. Oklahoma, 413 US 601 (1973). If the overbreadth is substantial, then the law cannot be enforced against anyone, including the party before the court, until it is narrowed to reach only unprotected activity. Brockett v. Spokane Arcades, 472 US 491 (1985).

Later cases narrowed the application of the overbreadth doctrine where conduct rather than pure speech was at issue. Here, the constitutional standards for pure speech are appropriate. Pure speech was regulated because the contents of the file encrypted were pure speech and that is the item which resulted in the criminal conviction. The argument that the act of encrypting constituted "conduct" that the statute regulated is invalid because encrypting is not against the statute. It is the failure to file the key with a government agent that is the source of illegality in the The Cryptography Control Act under sections 10 (a) through 10 (d). Therefore, the harsher overbreadth standard for statutes regulating "pure speech" should apply.

In the case before the court today, the stated legitimate government purpose of the statute is fighting crime, but that does not mean any measure which would further that goal is acceptable. Two way televisions in every room in the United States, with each move monitored and recorded, would also do a great deal to prevent crime in America and aid in law enforcement. Unfortunately for those who would seek such a future for the United States, there are constitutional limits to some crime fighting measures. In this case, one of the limits is the First Amendment. While advancing in some manner the legitimate government interest of fighting crime, legal and protected speech is included, making the sweep of the statute too broad for constitutionality.

I have already determined that the First Amendment overbreadth standard for pure speech will apply. However, even using the standard for First Amendment expressive conduct, the statute before the court fails the overbreadth test. In Frisby v. Schultz, the Supreme Court looked at the factors of ample alternative means of communication, content neutrality, and the scope of the statute. The statute, though content neutral, is overbroad in its scope and no other ample alternative means of communication are available (Frisby v. Schultz, 487 US 474 (1988)) on par with electronic communication. A legitimate interest in regulating conduct relating to crime prevention and detection certainly exists. The statute before the court today does, arguably, achieve this end. However, in doing so, its scope incorporates all speech, not merely speech for which purpose the statute was drafted. In terms of whom the statute is applicable to, it fails in that its scope is so large it includes every human being that could be kidnapped and dragged onto United States soil. Additionally, other alternative channels of communication do not exist. Where else could a person post a message that could very conceivably be read by thousands of people worldwide, and where else could ideas be spread so quickly as electronic communications and other similar means yet to be invented? Where else could there be such a diversity of input, or exchange of ideas? Nowhere else.

The government claims that the statute only continues the current abilities of the government to monitor conversations. The dissent disagrees. The legislature mentions that methods historically used for law enforcement and national security purposes will no longer be available with the advent of stronger encryption capabilities in private hands. It claims that advances in encryption pose a serious threat to that continued ability. Advances in the technology of communication, including encryption, do pose an obstacle to law enforcement. However, the U.S. constitution was not drafted to aid in law enforcement or to cement the national security powers of particular government agencies. Other methods are at their disposal to investigate crimes and assure the national defense.

Once the government acquires the key to decrypt information, everything encrypted with that key is readable. This is a heavy tool to place in law enforcement's hands. Under this statute, all electronic communications must be readable to the government. Comparisons to current wire tap laws are wrong because the scope of information is broader and will expand. In the future, America's lifeline will be on-line. Business and economics will be vastly impacted by connections to the Internet and various electronic communications yet to be conceived. Business processes will be as tied to electronic communication tomorrow as it is today to the telephone and the credit card. This is a larger category of information than mere phone conversations. The current statute does not merely continue the status quo; it tries to force telephone analogies on a medium of expression where it does not apply. The rule this court is setting down for future technology is a piteous line for freedom of speech. In the marketplace of ideas, the truth will flourish against competition, or so our founding fathers believed. "We are not afraid to follow truth wherever it may lead, nor to tolerate any error so long as reason is left free to combat it," wrote Thomas Jefferson. Where every stored and transmitted communication must be made in a manner that is conveniently decoded, speech critical of the government or its policies will naturally be chilled for fear of reprisal.

The crucial factor is the interplay of speech and thought that formulates the speech. The Supreme Court has recognized the importance of uninhibited, robust, and wide-open debate on public issues, see New York Times v. Sullivan, 376 US 254, 270 (1964), previously in interpreting the First Amendment. Such debate challenges citizens' minds to explore ideas previously unthought. That basis for understanding the rights guaranteed by the constitution has not changed. In order to decide whether the overbreadth doctrine applies to a particular case, we have weighed the likelihood that the statute's very existence will inhibit free expression. City of Los Angeles v. Taxpayers for Vincent, 466 US 789 (1984). This statute chills protected speech and causes those under its broad sweep (i.e., all U.S. citizens and permanent resident aliens) to glance warily over their shoulder before even beginning to type.

Absent evidence that most US citizens and permanent resident aliens are criminals, there is no reasonable or justifiable basis to include all of them within the parameters of this statute. The statute includes protected speech in its overly broad sweep attempt to fight crime.

Construing the statute as narrowly as possible would still apply it to everyone in the United States.

If the unconstitutional part of a statute can be severed from the constitutional part of the statute, a court should partially invalidate the statute Allen v. Louisiana, 103 US 80 (1881). Severing the unconstitutional section from the main body of the statute is not feasible, its unconstitutionality is its essence.

Therefore, the statute as a whole is invalid under the First Amendment overbreadth doctrine and the conviction should be overturned.

B. Second Amendment - Right to Bear Arms

The majority adequately, and appropriately, dismisses the appellant's Second Amendment claim.

C. Fourth Amendment - Reasonable Expectation of Privacy

The appellant claims that his Fourth Amendment rights were violated by his arrest and conviction under the Cryptography Control Act. The dissent agrees.

The Fourth Amendment states "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue but upon probable cause, supported by oath or affirmation, and particularity describing the place to be searched, and the persons or things to be seized." The Supreme Court has interpreted the Fourth Amendment to include a reasonable expectation of privacy in certain areas. Initially, that expectation of privacy extended to physical places only. Olmstead v. United States, 277 US 438 (1928). That changed with the seminal case Katz v. United States, 389 US 343 (1967).

In Katz, a man had made a phone call from a pay phone booth and a bug was placed on the outside of the booth without a warrant on the wire carrying the voice communication. In a reversal of its previous stance on the Fourth Amendment search and seizure rulings, the Court wrote, "The Fourth Amendment protects people, not places, against unreasonable searches and seizures." The Court found that intercepting the call was a search in violation of the defendant's Fourth Amendment rights since no warrant was issued authorizing the search. In that case, the Supreme Court chose not to ignore the vital role that new technology, the public telephone, had come to play in private communication. Bypassing a neutral predetermination of the scope of a search leaves individuals secure from Fourth Amendment violations "only in the discretion of the police." Katz, at 358.

In the case before the court, a reasonable expectation of privacy was present in the information because of the act of encryption. Electronic information is so easily transferable, and there is diminished assurance that there is protection adequate to prevent an unauthorized access to the communication without it. Encryption is a specific action taken to ensure that the communication is not read by those not possessing a key to decrypt. Taking this active measure to prevent non-key holders from reading this information guarantees a reasonable expectation of privacy in that information. This opinion does not mean to imply a reasonable expectation of privacy exists only where electronic information has been encrypted. Fourth Amendment privacy for unencrypted electronic information is not the issue before the court in this case.

Having established that a reasonable expectation of privacy exists for information that has been encrypted, who has the right to assert a reasonable expectation of privacy? Granting limitless extensions of the reasonable expectation of privacy for encrypted information would necessarily lead to illogical results. For example, a hacker could conceivably encrypt the information of a computer she had broken into and then claim a reasonable expectation of privacy in the information. There is no need to sanction such logical extremes. A possessory interest must be present in the medium of storage upon which the encrypted information is stored at the time of encryption before a reasonable expectation of privacy under the Fourth Amendment attaches. "Possessory" is meant in a very loose sense. A user of an Internet provider would have a possessory interest in any encrypted information stored on the provider's machine, and an Internet user that sent an encrypted file over the Internet would retain her reasonable expectation of privacy because of the possessory interest of the medium of storage when the information was encrypted. It includes any computer to which a user has authorized access.

Here, the defendant owned the information and the medium upon which it was stored when encrypted and had a reasonable expectation of privacy. The next question is: does requiring the key to be given to the US government violate the defendant's reasonable expectation of privacy under the Fourth Amendment? Yes.

The Cryptography Control Act permits the Department of Justice and other law enforcement and intelligence agencies to reach back in time to prepare their search from a time prior to the establishment of probable cause. The search begins with the registering of the key. Since the statute reviewed by this court requires that a key be registered for potential future use by the US government at a later date, there is a violation of the defendant's reasonable expectation of privacy because the requirement is in place prior to the establishment of probable cause.

There is also some issue as to the sufficiency of particularity that is required of a warrant. In this type of technology, under the current legislation, there is no requirement to change keys at all. So if a user would obey the statute and register her key and then never change it, any warrant issued to decrypt would include all information that ever was encrypted by that key, which may be broader than what is permissible by warrant. The court is not unaware that a warrant could just as well issue for everything ever written by someone and all paper records they have in their possession. However, in the current statutory scheme, no mechanism is in place that would provide for a warrant requirement for less than everything ever encrypted by a user, should that user decide never to change their key. Also for that reason, the statute before the court today is unconstitutional under the Fourth Amendment. Not every warrant issued under its guise would be assured of the same high standards of particularity, and the push would be to expand the scope of the warrant in the instances where the combination of a long-standing key and the requirements for a warrant intersect.

In addition to the unconstitutionality of the statute for the other reasons outlined in this opinion, the statute is unconstitutional under the Fourth Amendment in the process it establishes to retrieve the encrypted information, and also in that it requires the forfeit of an encryption key prior to the establishment of probable cause.

D. Ninth Amendment - Right to Privacy

The Ninth Amendment states, "The enumeration in the Constitution of certain rights shall not be construed to deny or disparage others retained by the people." The amendment reserves to the people rights not specifically mentioned in the previous amendments and was passed for fear that the listing of rights might lead to the interpretation that the listed rights are the only guaranteed ones. The Cryptography Control Act fails to pass this constitutional hurdle as well.

In ben Shalom v. Secretary of the Army, 489 F.Supp. 964 (1980) the federal court wrote, 'If what the United States Supreme Court itself has termed the right of "personal privacy" means anything, it should safely encompass an individual's right to be free from unwarranted governmental intrusion into matters so fundamentally affecting a person as one's personality, self-image, and indeed, one's very own identity.'

The regulation in ben Shalom and the statute before the court today both chill the freedom of association. Association is part of a process by which the formulation of First Amendment protected speech is made. The Ninth Amendment protects the privacy of one's personality, while the First Amendment protects manifestations of that personality. See ben Shalom, 489 F.964 at 976.

In Olmstead, Griswold, and Wade, the Supreme Court recognized that the Constitution protects fundamental liberties, in addition to those enumerated in the Bill of Rights. In Griswold, the fundamental right was the right of marital privacy, where a couple was arrested for purchasing birth control. In Wade, the Court recognized the decision to have an abortion as one of those rights.

The majority would exclude from this list the right to communicate free of guaranteed governmental oversight. The Cryptography Control Act seeks to reserve a right to the government, that of the ability to be able to eavesdrop on all electronic communications. The Ninth Amendment states the reverse.

For that reason, the Cryptography Control Act is also unconstitutional under the Ninth Amendment.

E. Conclusion

The Cryptography Control Act is constitutionally invalid under the First, Fourth, and Ninth Amendments to the US Constitution. The majority adopts the notion that electronic communications have evolved into nothing more than a variation of speaking on the phone, ignoring reality quite like the Olmstead majority did over sixty years ago. Only a studied attempt could achieve this result.

The depth of electronic communications in its imagery, widespread reach, and sheer communication to a large number of people refute any telephone analogies. The founders of this country wrote the Constitution as a living document to adapt with time and events, not as an encrusted one with outmoded definitions sufficient only to strangle the freedoms once enjoyed. The statute before this court solidifies the erosion of personal freedoms in the name of "security." Too soon there will be no real security in what was once the birthright of every U.S. citizen: freedom.


Back to decision page

Back to CFP Moot Court page

Back to CFP96 home page


Last updated March 9, 1996
cfp96@mit.edu