Summary
holding that encryption software in source code form is functional rather than expressive and therefore not protected speech
Summary of this case from Universal City Studios, Inc. v. ReimerdesOpinion
No. 1:96-CV-1723.
July 2, 1998.
Kevin F. O'Neill, Cleveland-Marshall College Of Law, Cleveland, OH, Gino J. Scarselli, Richmond Heights, Raymond V. Vasvari, Law Offices Of Raymond V. Vasvari, Cleveland, OH, for Plaintiff.
Anthony J. Coppolino, Department of Justice, Washington, DC, for Defendants.
OPINION AND ORDER
In October and November 1997, Plaintiff Peter Junger ("Junger") and Defendants United States Secretary of Commerce, et al. ("the government") filed cross-motions for summary judgment in this First Amendment case [Doc. 58, 62]. In his motion for judgment, Plaintiff Junger seeks injunctive and declaratory relief from the government's enforcement of export controls on encryption software. In support of his motion for injunctive relief, Junger claims the Export Administration Regulations ("Export Regulations"), 15 C.F.R. pt. 730 et seq., violate rights protected by the First Amendment.
The standards upon which the court evaluates the motions for summary judgment do not change simply because the parties present cross-motions. Taft Broadcasting Co. v. U.S., 929 F.2d 240, 247 (6th Cir. 1991).
The government denies that the Export Regulations implicate First Amendment rights. The government says its licensing requirement seeks only to restrict the distribution of encryption software itself, not ideas on encryption. Stated otherwise, the government says it seeks to control only the engine for encrypting data. The government says it controls the distribution of sophisticated encryption software for valid national security purposes.
For the reasons that follow, the Court denies Plaintiff Junger's motion for summary judgment, and grants the government's motion for summary judgment.
I. Background A. Description of claims made
Plaintiff Junger claims the Export Regulations violate rights protected by the First Amendment. In Count One of his five-count complaint, Plaintiff Junger says licensing requirements for exporting encryption software work a prior restraint, violating the First Amendment's free speech clause. In Count Two, Junger argues that the Export Regulations are unconstitutionally overbroad and vague. In Count Three, he argues that the Export Regulations engage in unconstitutional content discrimination by subjecting certain types of encryption software to more stringent export regulations than other items. In Count Four, Junger claims that the Export Regulations restrict his ability to exchange software, by that infringing his First Amendment rights to academic freedom and freedom of association. In Count Five, Junger alleges that executive regulation of encryption software under the International Emergency Economic Powers Act, 50 U.S.C. § 1701 et seq., is a violation of the separation of powers doctrine.
In addressing these claims, the Court decides whether encryption source code is sufficiently expressive to merit heightened First Amendment protection. The Court then examines whether the Export Regulations are a prior restraint on speech subject to greater First Amendment scrutiny. If the regulatory scheme does not warrant increased scrutiny, the Court decides if the scheme survives intermediate scrutiny.
The Court finds that the Export Regulations are constitutional because encryption source code is inherently functional, because the Export Regulations are not directed at source code's expressive elements, and because the Export Regulations do not reach academic discussions of software, or software in print form. For these reasons, the Court grants the government's motion for summary judgment and denies Junger's motion for summary judgment.
B. Cryptography
Once almost the exclusive province of military and governmental bodies, cryptography is now increasingly available to businesses and private individuals wishing to keep their communications confidential. See Bernstein v. United States Dep't of State, 974 F. Supp. 1288, 1292 (N.D.Cal. 1997) ( "Bernstein III"). To keep their communications confidential, users encrypt and decrypt communications, records and other data. Through encryption, users seek to prevent the unauthorized interception, viewing, tampering, and forging of such data. Without encryption, information sent by a computer is unsecured. Without encryption those other than the intended recipient may view sensitive information.
"Encryption" is the process by which the original, "human-readable" text of a message or document (also known as "plaintext") is transformed into a text (known as "ciphertext") that the sender and recipient intend third parties not to understand. "Decryption" is the reverse process of transforming the ciphertext message or document into the original plaintext.
Encryption has been used for decades although the methods of encryption have changed. Until the end of World War II, mechanical devices commonly did encryption, such as Nazi Germany's Enigma machines. Today, computers and electronic devices have largely replaced mechanical encryption. In using electronic devices, encryption can be done with dedicated hardware (such as a telephone scrambler's electronic circuitry) or with computer software. Encryption software carries out a cryptographic "algorithm," which is a set of instructions that directs computer hardware to encrypt plaintext into an encoded ciphertext. Mathematical functions or equations usually make up the instructions.
Like all software, encryption programs can take two general forms: object code and source code. Source code is a series of instructions to a computer in programming languages such as BASIC, PERL, or FORTRAN. Object code is the same set of instructions translated into binary digits (1's and 0's). Thus, source code and object code are essentially interchangeable. While source code is not directly executable by a computer, the computer can easily convert it into executable object code with "compiler" or "interpreter" software.
Software in source code, a "high level language," is unintelligible to most, but it can be understood by computer scientists, mathematicians, programmers and others with knowledge of the particular language in which the program is written.
C. Regulatory background
On November 15, 1996, President Clinton issued Executive Order 13026. With that order, he transferred jurisdiction over export controls on nonmilitary encryption products and related technology from the State Department to the Commerce Department. The order specified that encryption products formerly designated as defense articles on the United States Munitions List after that would be subjected to Commerce Department regulations (the "Export Regulations"). In his order, the President found that "the export of encryption software, like the export of other encryption products described in this section, must be controlled because of such software's functional capacity, rather than because of any possible informational value of such software. . . ." Exec. Order No. 13026, 1996 WL 666563. The Export Regulations remain in effect.The Export Regulations control the "export" of certain software. The Export Regulations define "export" of controlled encryption source code and object code software as "downloading, or causing the downloading of, such software to locations . . . outside the United States . . . unless the person making the software available takes precautions adequate to prevent unauthorized transfer of such code outside the United States." 15 C.F.R. § 734.2(b)(9).
The Export Regulations forbid the transfer of certain encryption software outside the United States. Unless very difficult precautions are taken, posting software on the Internet is an export. See 15 C.F.R. § 734.2(b)(9)(ii)(B). However, it is nearly impossible for most Internet users to carry out or verify the precautions. Because of the difficulty of the precautions, almost any posting of software on the Internet is an export.
At least three exhibits supporting this position were listed in the record.
The Export Regulations set up procedures to obtain approval for exporting items on the Control List. To export any item listed on the Commerce Control List, one must first submit a commodity classification request to the Bureau of Export Administration. See 15 C.F.R. Pts. 740-44. All items on the Commerce Control List are given an Export Control Classification Number, and Bureau of Export Administration regulations specify three categories of controlled Encryption Items.
Export Classification Number 5A002 covers encryption commodities (such as circuitry and hardware products), Export Classification Number 5D002 covers encryption software, and Export Classification Number 5E002 covers encryption technology. See 15 C.F.R. § 774 supp. I. Although the Export Administration Act defines "technology" to include software, 50 U.S.C.App. § 2415(4), Bureau of Export Administration regulations treat encryption software the same as encryption commodities. 15 C.F.R. Part 774, Note following 5D002.
Encryption software is defined as "[c]omputer programs that provide capability of encryption functions or confidentiality of information or information systems. Such software includes source code, object code, applications software, or system software." 15 C.F.R. pt. 772.
For software falling under Export Classification Numbers 5A002, 5D002 and 5E002, the Export Regulations requires licenses for export to all destinations except Canada. See 15 C.F.R. § 742.15(a). As later described, Plaintiff Junger's application involves software classified under Classification Number 5D002. As to this classification number, licensing is required except for encryption source code in a book or other printed material, 15 C.F.R. § 734.3, Notes to Paragraphs (b)(2) and (b)(3). Encryption source code in printed form is not subject to the Export Regulations and, thus, is outside the scope of the licensing requirement.
D. Junger's commodity classification requests
Plaintiff Junger is a law professor. He teaches a course titled "Computers and the Law" at Case Western Reserve University Law School in Cleveland, Ohio. Junger maintains sites on the World Wide Web that include information about courses that he teaches, including a computers and law course. His web sites also set out documents involved with this litigation. Plaintiff Junger uses his web site to describe the process of this litigation through press releases and filed materials. Besides descriptions of this lawsuit, the web site has information from Junger's courses and other topics of interest to him.
See, Peter Junger, Junger v. Daley (visited July 2, 1998)http://samsara.LAW.CWRU.Edu/ comp_law/jvd/; see also, Peter Junger, Peter D. Junger v. William Daley et al. (visited July 2, 1998) [http://jya.com/pdj.htm].
Thus at http://samsara.LAW.CWRU.Edu/ comp_law/jvd/pr_brief.txt, Plaintiff Junger makes a press release describing his motion for summary judgment.
Plaintiff Junger wishes to post to his web site various encryption programs that he has written to show how computers work. Such a posting is an export under the Export Regulations. See 15 C.F.R. § 734.2(b)(9).
On June 12, 1997, Plaintiff Junger submitted three applications to the Commerce Department requesting determination of commodity classifications for encryption software programs and other items. With these applications, Plaintiff Junger sought a Commerce Department determination whether they restricted the materials from export. On July 4, 1997, the Bureau of Export Administration told Junger that Export Classification Number 5D002 covered four of the five software programs he had submitted, and therefore were subject to the Export Regulations. Although it found that four programs were subject to the Export Regulations, the Commerce Department found that the first chapter of Junger's textbook, Computers and the Law, was an allowed unlicenced export. While deciding that the printed book chapter containing encryption code could be exported, the Commerce Department said that export of a software program itself would need a license. After receiving the classification determination, Junger has not applied for a license to export his classified encryption software.
That printed material contained examples of simple encryption programs known as one-time pads.
Upon a separate request by letter dated July 18, 1997, Bureau of Export Administration evaluated the software programs contained in chapter one of Computers and the Law. The Bureau of Export Administration informed Junger by letter on August 7, 1997 that none of the software programs contained in the chapter were encryption software subject to Export Classification Number 5D002. The Bureau of Export Administration advised that no export licensing restriction was required for Junger to export the entire chapter he submitted, in electronic form or otherwise. If, however, the chapter had contained encryption software subject to Export Classification Number 5D002, and if it were exported in electronic form, it would no longer be exempt from the export licensing scheme.
II. Legal standards
In reviewing the parties' motions for summary judgment, the Court first examines the standard for judgment under Fed.R.Civ.P. 56. After a brief review of the standard for summary judgment, the Court examines the First Amendment protection afforded computer software. In deciding what level of protection is afforded and what level of scrutiny should be applied, the Court looks to whether the software is expressive or functional. Then, the Court considers whether the Commerce Department licensing scheme is a prior restraint of speech, whether Plaintiff Junger has standing to claim the Export Regulations are overbroad or vague, and then whether the Export Regulations are content-based discrimination.
A. Summary Judgment
Pursuant to Fed. Rule Civ. Proc. 56, summary judgment will be granted if the evidence presented in the record shows that there is no genuine issue as to any material fact and that the moving party is entitled to judgment as a matter of law. In assessing the merits of the motion, this court shall draw all justifiable inferences from the evidence presented in the record in the light most favorable to the non-moving party. Woythal v. Tex-Tenn Corp., 112 F.3d 243, 245 (6th Cir.), cert. denied, ___ U.S. ___, 118 S.Ct. 414, 139 L.Ed.2d 317 (1997). However, an opponent to a motion for summary judgment may not rest upon the mere allegations or denials of his pleadings, but must set forth through competent and material evidence specific facts showing that there is a genuine issue for trial. "[T]he mere existence of some alleged factual dispute between the parties will not defeat an otherwise properly supported motion for summary judgment; the requirement is that there be no genuine issue of material fact." Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247-48, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986); Miller v. Lorain County Bd. of Elections, 141 F.3d 252, 258-59 (6th Cir. 1998).
Summary judgment is particularly appropriate where, as here, the parties contest only legal issues and there are no issues of material fact to be resolved by a trial. See Oscar W. Larson Co. v. United Capitol Ins. Co., 64 F.3d 1010, 1012 (6th Cir. 1995).
B. First Amendment Scrutiny
The scrutiny the Court will apply to the Export Regulations depends upon whether the export of encryption source code is expressive, and whether the Export Regulations are directed at the content of ideas. Prior restraints on expressive materials bear a heavy presumption against their constitutional validity, and are subject to the strictest judicial scrutiny. See New York Times Co. v. United States, 403 U.S. 713, 714, 91 S.Ct. 2140, 29 L.Ed.2d 822 (1971) ( per curiam).
If a law distinguishes among types of speech based on their content of ideas, the Court reviews it under strict scrutiny. See Turner Broadcasting System, Inc. v. FCC, 512 U.S. 622, 642, 114 S.Ct. 2445, 129 L.Ed.2d 497 (1994). To survive strict scrutiny, the government must employ narrowly tailored means that are necessary to advance a compelling government interest. See id.
If a law does not distinguish among types of speech based upon the content of the speech, the law will not be subject to strict scrutiny. Turner, 512 U.S. at 658, 114 S.Ct. 2445 (laws favoring broadcast programs over cable programs are not subject to strict scrutiny unless the laws reflect government preference for the content of one speaker). As described in Turner: "It would be error to conclude, however, that the First Amendment mandates strict scrutiny for any speech regulation that applies to one medium (or a subset thereof) but not others." Id. at 660, 114 S.Ct. 2445.
If the Export Regulations are not expressive and if the Export Regulations are not aimed at the content of the ideas, then the Court reviews the regulations under an intermediate scrutiny standard. See id. at 662, 114 S.Ct. 2445. Under intermediate scrutiny, a law is constitutional if it furthers a substantial governmental interest, if the interest is unrelated to the suppression of free expression, and if the restriction is no greater than is essential to the furtherance of that interest. See id. ( citing United States v. O'Brien, 391 U.S. 367, 377, 88 S.Ct. 1673, 20 L.Ed.2d 672 (1968)).
III. Does the First Amendment protect export of software?
The most important issue in the instant case is whether the export of encryption software source code is sufficiently expressive to merit First Amendment protection. This is a matter of first impression in the Sixth Circuit. Indeed, the Court is aware of only two other courts in the United States that have addressed this question, and they reached opposite results. This Court finds that although encryption source code may occasionally be expressive, its export is not protected conduct under the First Amendment.
Compare Karn v. United States Dep't of State, 925 F. Supp. 1, 9 n. 19 (D.D.C. 1996) (assuming that computer source code is protected by the First Amendment when joined with commentary, but observing that source code alone is "merely a means of commanding a computer to perform a function") with Bernstein v. United States Dep't of State, 922 F. Supp. 1426, 1436 (N.D.Cal. 1996) ( "Bernstein I") (finding that source code is speech for the purposes of First Amendment analysis). Reargument has been ordered in Karn to consider the constitutional effect of transferring jurisdiction over export controls from the State Department to the Commerce Department. Bernstein has been appealed and is presently pending before the Ninth Circuit.
As the Supreme Court observed in Roth v. United States, 354 U.S. 476, 77 S.Ct. 1304, 1 L.Ed.2d 1498 (1957), the First Amendment was adopted to foster the spread of ideas: "The protection given speech and press was fashioned to assure unfettered interchange of ideas for the bringing about of political and social changes desired by the people." Id. at 484, 77 S.Ct. 1304 (upholding a federal statute that prohibited mailing obscene materials). Conversely, speech that is "so far removed from any exposition of ideas, and from truth, science, morality, and arts in general, in its diffusion of liberal sentiments on the administration of Government" lacks First Amendment protection. Virginia State Bd. of Pharmacy v. Virginia Citizens Consumer Council, Inc., 425 U.S. 748, 762, 96 S.Ct. 1817, 48 L.Ed.2d 346 (1976) (ruling that commercial speech is not wholly without First Amendment protection).
In reviewing governmental regulation of computer software, the Court need examine the software involved. Certain software is inherently expressive. Such expressive software contains an "exposition of ideas," Chaplinsky v. State of New Hampshire, 315 U.S. 568, 572, 62 S.Ct. 766, 86 L.Ed. 1031 (1942). In contrast, other software is inherently functional. With such software, users look to the performance of tasks with scant concern for the methods employed or the software language used to control such methods.
Among computer software programs, encryption software is especially functional rather than expressive. Like much computer software, encryption source code is inherently functional; it is designed to enable a computer to do a designated task. Encryption source code does not merely explain a cryptographic theory or describe how the software functions. More than describing encryption, the software carries out the function of encryption. The software is essential to carry out the function of encryption. In doing this function, the encryption software is indistinguishable from dedicated computer hardware that does encryption.
In the overwhelming majority of circumstances, encryption source code is exported to transfer functions, not to communicate ideas. In exporting functioning capability, encryption source code is like other encryption devices. For the broad majority of persons receiving such source code, the value comes from the function the source code does.
The Court now examines the relationship between source code's inherent functionality and First Amendment protection. In Bernstein v. United States Dep't of State, 922 F. Supp. 1426 (N.D.Cal. 1996) ( "Bernstein I"), the district court held that the inherent functionality of software does not vitiate its status as protected speech: instructions, do-it-yourself manuals, and recipes "are often purely functional," but they are also protected as speech because they are written in a language. Bernstein I, 922 F. Supp. at 1435.
That court's ruling rested on its conclusion that anything written in a language necessarily is protected speech: "[l]anguage is by definition speech, and the regulation of any language is the regulation of speech." Id. at 1435 (quoting Yniguez v. Arizonans for Official English, 69 F.3d 920, 935 (9th Cir. 1995), vacated on other grounds, 520 U.S. 43, 117 S.Ct. 1055, 137 L.Ed.2d 170 (1997)). Whether the alleged "speech" is actually expressive is immaterial if it is communicated through language. A court "need only assess the expressiveness of conduct in the absence of 'the spoken or written word.'" Id. at 1434 ( construing Texas v. Johnson, 491 U.S. 397, 404, 109 S.Ct. 2533, 105 L.Ed.2d 342 (1989)).
The Bernstein court's interpretation of Johnson appears misguided. Johnson does not "strongly imply" that the First Amendment extends to anything written in language regardless of its expressiveness. Bernstein I, 922 F. Supp. at 1434. Rather, it simply observes that the First Amendment's "protection does not end at the spoken or written word." Johnson, 491 U.S. at 404, 109 S.Ct. 2533.
The Bernstein court's assertion that "language equals protected speech" is unsound. "Speech" is not protected simply because we write it in a language. Instead, what determines whether the First Amendment protects something is whether it expresses ideas. See Roth v. United States, 354 U.S. at 484; Virginia Citizens Consumer Council, 425 U.S. at 762, 96 S.Ct. 1817.
"Fighting words" are written or spoken in a language. While spoken or written in language, they are excluded from First Amendment protection. See, e.g., Sandul v. Larion, 119 F.3d 1250, 1255 (6th Cir.), cert. dismissed, ___ U.S. ___, 118 S.Ct. 439, 139 L.Ed.2d 377 (1997) (observing that words "which by their very utterance inflict injury or tend to incite an immediate breach of the peace" are not protected because they "are no essential part of any exposition of ideas . . . .") ( quoting Chaplinsky, 315 U.S. at 572, 62 S.Ct. 766). Similarly, commercial advertisements are written in a language, but are afforded a lesser level of protection under the First Amendment. See Central Hudson Gas Elec. Corp. v. Public Serv. Comm'n of New York, 447 U.S. 557, 566, 100 S.Ct. 2343, 65 L.Ed.2d 341 (1980) (acknowledging that the government may ban forms of communication more likely to deceive the public than to inform).
Furthermore, the court in Bernstein I misunderstood the significance of source code's functionality. Source code is "purely functional," 922 F. Supp. at 1435, in a way that the Bernstein Court's examples of instructions, manuals, and recipes are not. Unlike instructions, a manual, or a recipe, source code actually performs the function it describes. While a recipe provides instructions to a cook, source code is a device, like embedded circuitry in a telephone, that actually does the function of encryption.
While finding that encryption source code is rarely expressive, in limited circumstances it may communicate ideas. Although it is all but unintelligible to most people, trained computer programmers can read and write in source code. Moreover, people such as Plaintiff Junger can reveal source code to exchange information and ideas about cryptography.
Therefore, the Court finds that exporting source code is conduct that can occasionally have communicative elements. Nevertheless, merely because conduct is occasionally expressive, does not necessarily extend First Amendment protection to it. As the Supreme Court has observed, "[i]t is possible to find some kernel of expression in almost every activity — for example, walking down the street or meeting one's friends at the shopping mall — but such a kernel is not sufficient to bring the activity within the protection of the First Amendment." City of Dallas v. Stanglin, 490 U.S. 19, 25, 109 S.Ct. 1591, 104 L.Ed.2d 18 (1989).
In City of Dallas, 490 U.S. at 25, 109 S.Ct. 1591, the Court reversed a finding of the Texas Court of Appeals. In that Texas decision, the Court found that a Dallas ordinance restricting attendance at certain dance halls to minors restricted the First Amendment rights of adults and minors. The Court found this activity qualifies neither as a form of "intimate association" nor as a form of "expressive association."
In Spence v. State of Washington, 418 U.S. 405, 94 S.Ct. 2727, 41 L.Ed.2d 842 (1974) ( per curiam), the Supreme Court established guidelines for determining whether occasionally expressive conduct is "sufficiently imbued with the elements of communication to fall within the scope of the First . . . Amendment." Id. at 409-10, 94 S.Ct. 2727. "An intent to convey a particularized message [must be] present, and in the surrounding circumstances the likelihood [must be] great that the message would be understood by those who viewed it." Id. at 411, 94 S.Ct. 2727. For example, in Johnson, an individual desecrated an American flag during the Republican National Convention, and the "overtly political nature of this conduct was both intentional and overwhelmingly apparent." Johnson, 491 U.S. at 406, 109 S.Ct. 2533. Similarly, in Tinker v. Des Moines Independent Community School Dist., 393 U.S. 503, 89 S.Ct. 733, 21 L.Ed.2d 731 (1969), a student's black arm band "conveyed an unmistakable message" about his stance on the Vietnam war, a "contemporaneous issue of intense political concern." Id. at 505-06, 89 S.Ct. 733.
Applying this standard, it is evident that exporting encryption source code is not sufficiently communicative. In both Johnson and Tinker, the expressive nature of the conduct was clear. Unlike Tinker, encryption source code does not convey "an unmistakable message." Unlike Johnson, the communicative nature of encryption source code is not "overwhelmingly apparent." Instead, source code is by design functional: it is created and, if allowed, exported to do a specified task, not to communicate ideas. Because the expressive elements of encryption source code are neither "unmistakable" nor "overwhelmingly apparent," its export is not protected conduct under the First Amendment.
IV. Prior Restraint
Plaintiff Junger urges that the Export Regulations are invalid on their face as an unconstitutional prior restraint on the export of encryption source code. Specifically, he alleges that the Export Regulations function as a prior restraint by requiring prepublication review and licensing of inherently expressive encryption software. Junger further argues that the Export Regulations lack adequate procedural safeguards to prevent the licensing officials' abuse of discretion. The Court finds that a facial challenge is inappropriate, and holds that the Export Regulations do not serve as a prior restraint on expressive conduct.
Prior restraints on publication of expressive materials are anathema to American constitutionalism. As the Supreme Court has recognized, "it has been generally, if not universally, considered that it is the chief purpose of the [First Amendment's free press] guaranty to prevent previous restraints upon publication." Near v. State of Minnesota ex rel. Olson, 283 U.S. 697, 713, 51 S.Ct. 625, 75 L.Ed. 1357 (1931). It is for this reason that "[a]ny prior restraint on expression comes to this Court with a 'heavy presumption' against its constitutional validity." Organization for a Better Austin v. Keefe, 402 U.S. 415, 419, 91 S.Ct. 1575, 29 L.Ed.2d 1 (1971) (citations omitted).
In order for a licensing law to be invalidated by a prior restraint facial challenge, it "must have a close enough nexus to expression, or to conduct commonly associated with expression, to pose a real and substantial threat" of censorship. City of Lakewood v. Plain Dealer Publ'g Co., 486 U.S. 750, 759, 108 S.Ct. 2138, 100 L.Ed.2d 771 (1988). The mere fact that regulated conduct possibly can be expressive is not enough to invalidate a law on its face on prior restraint grounds. See Roulette v. City of Seattle, 97 F.3d 300, 303 (9th Cir. 1996) (although sitting on city sidewalks may occasionally be expressive, city ordinance prohibiting sitting is not subject to facial challenge). As described above, the Court has found that exporting encryption software has little expressive nature. A facial attack upon legislation on First Amendment grounds is appropriate only where the challenged statute "is directed narrowly and specifically at expression or conduct commonly associated with expression." See Lakewood, 486 U.S. at 760, 108 S.Ct. 2138.
Exporting encryption source code is not an activity that is "commonly associated with expression." Source code is a set of instructions to a computer that is commonly distributed for the wholly non-expressive purpose of controlling a computer's operation. It may, as the Court has noted, occasionally be exported for expressive reasons. Nevertheless, the prior restraint doctrine is not implicated simply because an activity may on occasion be expressive.
In Roulette, the Ninth Circuit recognized that Seattle's anti-sitting ordinance impaired the unquestionably expressive acts of a registrar of voters, a street musician, the Freedom Socialist Party, and the National Organization for Women. 97 F.3d at 302. Nevertheless, the law was not an unconstitutional prior restraint because neither sitting nor lying on the sidewalk are "integral to, or commonly associated with, expression." Id. at 304.
As in Roulette, exporting encryption software is not integral to expression. Because encryption software is not typically expression, a facial challenge does not succeed. Even if the Export Regulations have impaired the isolated expressive acts of academics like Plaintiff Junger, exporting software is typically non-expressive.
Neither are the Export Regulations "directed narrowly and specifically" at the expressive export of encryption source code. Lakewood, 486 U.S. at 760, 108 S.Ct. 2138. The Export Regulations do not single out encryption software. Instead, all types of devices that have the capacity to encrypt data, whether software or hardware, are subject to licensing. See 15 C.F.R. § 742.15. The Export Regulations are not "directed quite specifically" to "an entire field of scientific research and discourse." Bernstein III, 974 F. Supp. at 1305. Instead, the Export Regulations allow academic discussion and descriptions of software in print media while restricting the export of software that can actually encrypt data.
The Court, therefore, finds that Plaintiff Junger's facial challenge to the Export Regulations' licensing scheme fails. Because the Court finds that the Export Regulations are not narrowly directed at expressive conduct, and therefore not a prior restraint, considering Junger's claim that the Export Regulations lack adequate procedural safeguards is unnecessary. See, e.g., Lakewood, 486 U.S. at 772, 108 S.Ct. 2138.
V. Overbreadth and vagueness
Plaintiff Junger argues that he is entitled to bring a facial challenge to the export regulatory scheme as unconstitutionally overbroad and vague. The Court finds that a facial challenge on overbreadth grounds is inappropriate because Junger fails to show that the Export Regulations injure third parties in a manner different from the way they affect the plaintiff. Also, the Court finds that the Export Regulations are not vague.
Overbreadth challenges are an exception to the usual requirement that a plaintiff "must assert his own legal rights and interests." Warth v. Seldin, 422 U.S. 490, 499, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975). An overbreadth challenge allows a plaintiff to attack laws alleged to be unconstitutional under any circumstances, not merely as applied to the plaintiff's own circumstances. See New York State Club Ass'n, Inc. v. City of New York, 487 U.S. 1, 14, 108 S.Ct. 2225, 101 L.Ed.2d 1 (1988). Overbreadth challenges are "strong medicine" that should be used "sparingly and only as a last resort." Id. ( quoting Broadrick v. Oklahoma, 413 U.S. 601, 613, 93 S.Ct. 2908, 37 L.Ed.2d 830 (1973)).
The overbreadth rule arises from the purpose of the doctrine. The overbreadth doctrine allows a challenge to laws having the potential to repeatedly chill the exercise of expressive activity by many individuals. To make the overbreadth challenge, there must be a realistic danger that the statute will significantly compromise recognized First Amendment protections of parties not before the Court. Members of City Council of City of Los Angeles v. Taxpayers for Vincent, 466 U.S. 789, 800, 104 S.Ct. 2118, 80 L.Ed.2d 772 (1984). Under Vincent, to prevail on a facial overbreadth challenge, the plaintiff must show that the challenged law is "substantially overbroad." Id. at 801, 104 S.Ct. 2118. To establish substantial overbreadth, a plaintiff must show that the law will have a significant and different impact on third parties' free speech interests than it has on his own. See id. A challenge on overbreadth grounds requires a showing that the governmental action impair third parties' free speech rights in a manner different from the law's effect on the plaintiff. The overbreadth doctrine does not apply where the law affects the plaintiff and third parties in the same manner. See id. at 802-803, 104 S.Ct. 2118 (observing that "appellees' attack on the ordinance is basically a challenge to the ordinance as applied to their activities").
Junger does not show any difference between his professed injuries and those of parties not before the Court. The heart of his overbreadth argument is that the Export Regulations control the distribution of encryption software among fellow academics, and that such distribution does not pose a threat to United States security interests. But the resulting injury to other academics is the very same injury that Junger allegedly suffers. Because the Export Regulations potentially injure other academics in the same manner as Junger, their injury cannot be the basis of an overbreadth challenge.
Plaintiff Junger's overbreadth challenge fails because he does not show that the Export Regulations injure parties not before the Court in a manner different from the way they affect Junger. Even if Junger could bring the overbreadth challenge, he does not show the Export Regulations significantly compromise recognized First Amendment protections through a challenged law that is "substantially overbroad."
Junger also alleges that the Export Regulations' controls are vague because they do not give fair notice of what items are subject to the licensing requirement. The Court finds that the Export Regulations are not vague. The Export Regulations provide adequate notice. The regulations are quite detailed in describing which encryption software programs are subject to export licensing, and those that are not. Indeed, the Export Regulations even contain a description of the key length in "bits" for regulated programs. See 15 C.F.R. § 742.15(b)(3)(i)-(ii).
VI. Content discrimination A. Appropriate level of scrutiny
Plaintiff Junger urges this Court to review the Export Regulations under a strict scrutiny standard. He argues that strict scrutiny is appropriate because where the government seeks to "suppress, disadvantage, or impose differential burdens on speech because of its content," such regulations must be subject to the most searching judicial review. Turner Broadcasting System, Inc., 512 U.S. at 642, 114 S.Ct. 2445. While laws working a disadvantage on speech because of its content are subject to penetrating review, the Court finds the subject regulations are content neutral. Because the regulations are content neutral, they are subject to intermediate scrutiny.
In deciding whether a law discriminates based on content, the government's purpose in adopting the challenged restriction is "the controlling consideration." Ward v. Rock Against Racism, 491 U.S. 781, 791, 109 S.Ct. 2746, 105 L.Ed.2d 661 (1989). The test is whether the government adopted the restriction "because of disagreement with the message [the speech] conveys." Id. Generally, laws that distinguish favored speech from unfavored speech because of the views expressed are content based. By contrast, laws that benefit or burden speech without reference to the expressed views are usually deemed content neutral. See Turner, 512 U.S. at 643, 114 S.Ct. 2445. See also Boos v. Barry, 485 U.S. 312, 318-19, 108 S.Ct. 1157, 99 L.Ed.2d 333 (1988) (plurality opinion) (invalidating ordinance because whether people are permitted to picket in front of a foreign embassy depends "entirely upon whether their picket signs are critical of the foreign government or not"); Taxpayers for Vincent, 466 U.S. at 804, 104 S.Ct. 2118 (upholding ordinance prohibiting the posting of signs on public property because it "is neutral — indeed it is silent — concerning any speaker's point of view").
Junger first alleges that the Export Regulations discriminate because of content because they treat other types of software more favorably than encryption software. Plaintiff Junger is correct that the government subjects encryption software to heightened licensing regulations that do not apply to other types of software. Under the Export Administration Act, all types of software are regulated as "technology." 50 U.S.C.App. § 2415(4). However, encryption software is categorized under the stricter "commodity" standard. 15 C.F.R. Part 774, note following 5D002.
The Export Regulations are not content based, however, because the regulations burden encryption software without reference to any views it may express. As the President has made clear, encryption software is regulated because it has the technical capacity to encrypt data and by that jeopardize American security interests, not because of its expressive content. Exec. Order No. 13026, 1996 WL 666563. The regulatory distinction between encryption software and other types of software does not turn on the content of ideas. Instead, it turns on the ability of encryption software to actually do the function of encrypting data.
That the Export Regulations are not directed at the content of ideas is further suggested because the Export Regulations do not attempt to restrict the free flow of public information and ideas about cryptography. Publicly available information that can be used to design or operate encryption products is not subject to the Export Regulations and may be freely exported. 15 C.F.R. § 734.3(b)(3). More important, the Export Regulations exclude books, magazines, and other printed materials, by that imposing no controls on the export of publications on cryptography. 15 C.F.R. § 734.3(b)(2).
The plaintiff also argues that the Export Regulations are content based because they discriminate based upon media: export of encryption software in print form is not subject to the Export Regulations' licensing requirement, whereas software exported electronically is subject to licensing. The plaintiff argues that Reno v. ACLU, ___ U.S. ___, 117 S.Ct. 2329, 138 L.Ed.2d 874 (1997), forecloses any distinction between Internet and print publications. There, the Supreme Court held that "our cases provide no basis for qualifying the level of First Amendment scrutiny that should be applied to [the Internet]." Id. at 2344.
Plaintiff's argument is misguided for two reasons. First, as discussed above, the media distinction is not content-based discrimination because it is not directed at the content of ideas. Second, Reno is distinguishable.
In Reno, parties challenged the constitutionality of the Communications Decency Act. That act limited the transmittal of indecent (but not obscene) information on the Internet. In finding the Communications Decency Act unconstitutional, the Court found "any person with a phone line can become a town crier with a voice that resonates further than it could from any soapbox." Id. at 2344.
Reno is distinguishable from the instant case. In Reno, the court found the government could not restrict the transmission of indecent (but not obscene) communication. In so finding, the Court held the Decency Act was "a content-based blanket restriction on [indecent] speech." Id. at 2343. But obscenity does not have the functional ability that encryption software does. In other words, the function of a given lascivious photograph is the same whether on a computer screen or in a magazine. Software, by contrast, is functionally different in electronic form than when in print. When in print, encryption source code is simply a description of instructions. When in electronic form, encryption source code is a functional device that directs a computer to perform specified tasks. Unlike Reno, the regulated item is fundamentally and functionally different when in electronic form than when in print form.
Finally, Junger contends that the Export Regulations discriminate based on content by excepting certain mass market and key-recovery software from export regulations. See 15 C.F.R. § 742.15(b)(1)-(2). This argument does not persuade. The government distinguishes among software based upon its functional ability. These distinctions are not directed at the content of ideas. 40-bit mass market and key-recovery software pose a lesser threat to American security interests than more complex types of encryption software. Plaintiff's argument only proves that the government tailors the licensing requirements to the risks presented, with less restrictive requirements for exports that pose lesser risks.
Encryption software is more effective the longer the "key" length is. A message encrypted with 40-bit key length can be broken by "brute force" computer attack on the encryption in 3.6 to 5.5 hours. The time needed for 56-bit encryption, by contrast, ranges from 27 to 41 years, and 64-bit encryption from 7,000 to 11,000 years. See Testimony of William P. Crowell, National Security Agency, at 10-11 (Tab 14 to McNamara Declaration) and Testimony of Deputy Assistant Attorney General Robert S. Litt at 7 (Tab 26 to the Declaration of Anthony J. Coppolino).
Roughly speaking, data encrypted with strong encryption (128-bit) is 309, 485, 009, 821, 345, 068, 724, 781, 056 times harder to break than data encrypted with 40-bit software. See Netscape Download Product Info. (Last visited June 18, 1998) http://www.netscape.com/download/client_options.html# enhanced(.
B. Application of intermediate scrutiny standard
Because the Export Regulations are content neutral, the Court must evaluate the licensing scheme under intermediate scrutiny. Turner, 512 U.S. at 662, 114 S.Ct. 2445. A content neutral government regulation passes constitutional muster if "'it furthers an important or substantial governmental interest; if the governmental interest is unrelated to the suppression of free expression; and if the incidental restriction of alleged First Amendment freedoms is no greater than is essential to the furtherance of that interest.'" Id. ( quoting United States v. O'Brien, 391 U.S. 367, 377, 88 S.Ct. 1673, 20 L.Ed.2d 672 (1968)).
The "important interest" prong is satisfied because the government is properly concerned with controlling the export of encryption software to potentially hostile countries or individuals to protect national security. The use of encryption products by foreign intelligence targets can have "a debilitating effect" on the National Security Agency's "ability to collect and report . . . critical foreign intelligence." Without the Export Regulations' licensing requirements, domestic producers of encryption software could export their products, without restriction, to any person abroad for any reason, no matter a particular encryption product's strength and its usefulness to hostile interests abroad.
See McNamara Decl. ¶ 5.
The government's important interest in controlling the spread of encryption software is not diminished even if certain forms of encryption software are already available abroad. Whatever the present foreign availability of encryption software, the government has a substantial interest to limit future distribution. The government also has an interest in ensuring that the most complex and effective encryption programs, such as 128-bit key length software, are not widely released abroad.
The evidence before the Court suggests that plaintiff's claims of widespread foreign availability of encryption are overstated. See Testimony of Undersecretary Reinsch at 3-4 (Tab 4 to Reinsch Declaration). In fact, foreign encryption products are not widely used in the absence of an infrastructure to support key distribution and the interoperability of products. See Testimony of Deputy Assistant Attorney General Litt at 15 (Tab 26 to Coppolino Declaration).
The Export Regulations, furthermore, are "unrelated to the suppression of free expression." O'Brien, 391 U.S. at 377. Plaintiff Junger argues that the Export Regulations are related to the suppression of expression because they limit the publication of software. This argument is off the mark. A regulation is not "related" to the suppression of free expression simply because it may have the effect of suppressing expression. Such an interpretation of the O'Brien test would render it a nullity, for any law that had the incidental effect of burdening expression would violate the First Amendment. Instead, a law violates the "unrelated" prong if it is "directed at the communicative nature of conduct." Johnson, 491 U.S. at 406, 109 S.Ct. 2533. In other words, the government cannot prohibit particular conduct to reach its expressive elements. Id.
The Export Regulations are "unrelated to the suppression of free expression," O'Brien, 391 U.S. at 377, 88 S.Ct. 1673, for the same reasons that they are content neutral. The Export Regulations are not designed to limit the free exchange of ideas about cryptography. Instead, the government regulates encryption software because it does the function of actually encrypting data.
Besides meeting the "important interest" and "unrelated" prongs, the Export Regulations also satisfy the "narrow tailoring" requirement. The narrow tailoring prong does not require that the government employ the least speech-restrictive means to achieve its purposes. Instead, narrow tailoring requires that the law not "burden substantially more speech than is necessary to further the government's legitimate interests." Ward, 491 U.S. at 799, 109 S.Ct. 2746. Accordingly, the requirement is satisfied if the government's interests "would be achieved less effectively absent the regulation." Id.
The government's interest in controlling the spread of encryption software and gathering foreign intelligence surely would be "achieved less effectively" absent the export controls. Encryption software posted on the Internet or on computer diskette can be converted from source code into workable object code with a single keystroke. Elimination of export controls would permit the unrestricted export of encryption software to any person, organization, or country, without regard to the strength of the software, the identity of the recipients, or the uses to which it might be put.
The export controls at issue do not "burden substantially more speech than is necessary to further the government's legitimate interests," Ward, 491 U.S. at 799, 109 S.Ct. 2746, for the same reason they are not overbroad. Export controls are targeted at precisely the activity that threatens the government's legitimate interests. First, the Export Regulations do not prohibit exporting encryption products altogether, but only those inconsistent with American national security and foreign policy interests. See 15 C.F.R. § 742.15(b). The licensing requirements are tailored to the risks presented, with less restrictive requirements for exports that pose lesser risks, such as 40-bit mass market and key-recovery software. See 15 C.F.R. § 742.15(b)(1)-(2). Finally, the Export Regulations do not reach print publications. Thus, they "leave open ample alternative channels of communication," Ward, 491 U.S. at 802, 109 S.Ct. 2746, for the exchange of information and ideas regarding cryptography.
Because the content neutral export regulations at issue enable the government to collect vital foreign intelligence, are not directed at a source code's ideas, and do not burden more speech than necessary, they satisfy intermediate scrutiny.
VII. Academic freedom and freedom of association
Plaintiff Junger alleges that the Export Regulations violate his First Amendment rights of academic freedom and freedom of association by restricting his ability to teach, publish, and distribute encryption software. Neither Junger nor the defendants address this issue in the briefs submitted to the Court. The Court therefore considers that Junger has waived the academic freedom and freedom of association claims.
VIII. International Emergency Economic Powers Act and the separation of powers
Plaintiff Junger claims that executive regulation of encryption exports under the International Emergency Economic Powers Act is an impermissibly broad delegation of authority and, therefore, a violation of the separation of powers. Specifically, he alleges that the President does not have the statutory authority under the International Emergency Economic Powers Act to extend regulatory control to encryption software. Instead, encryption software is exempt from regulation under the International Emergency Economic Powers Act because it is "informational material." The plaintiff has failed to address the merits of this claim in his briefs, and only argues that summary judgment is inappropriate because there are material facts still in dispute.
Junger claims that resolution of this issue depends upon whether the licensing scheme has the effect of controlling the dissemination of "informational material" both in the United States and abroad. The Court disagrees. Whether there is statutory authority to regulate encryption software is a legal question that can be determined by reference to the statute's text. Junger's claim that there are material facts still in dispute is a curious one, given that he has himself moved for summary judgment.
The Court lacks jurisdiction to review Junger's claim that the President exceeded his authority under the International Emergency Economic Powers Act when he directed that encryption products be controlled for export. "[L]ongstanding authority holds that such review is not available when the statute in question commits the decision to the discretion of the President." Dalton v. Specter, 511 U.S. 462, 474, 114 S.Ct. 1719, 128 L.Ed.2d 497 (1994).
The President clearly has statutory authority under the International Emergency Economic Powers Act to extend export controls in general. See United States v. Spawr Optical Research, Inc., 685 F.2d 1076, 1079-1082 (9th Cir. 1982), cert. denied, 461 U.S. 905, 103 S.Ct. 1875, 76 L.Ed.2d 807 (1983). Congress has recognized and approved of this practice, see id. at 1081, and courts have consistently held that the President's decision to invoke the International Emergency Economic Powers Act to regulate international trade is unreviewable. See Regan v. Wald, 468 U.S. 222, 242, 104 S.Ct. 3026, 82 L.Ed.2d 171 (1984); Beacon Prods. Corp. v. Reagan, 633 F. Supp. 1191, 1194-95 (D.Mass. 1986), aff'd, 814 F.2d 1 (1st Cir. 1987); Spawr Optical, 685 F.2d at 1080. "[W]here there is no contrary indication of legislative intent and where, as here, there is a history of congressional acquiescence in conduct of the sort engaged in by the President," the President has the greatest discretion to act. Dames Moore v. Regan, 453 U.S. 654, 678-79, 101 S.Ct. 2972, 69 L.Ed.2d 918 (1981).
IX. Conclusion
For these reasons, plaintiff's motion for summary judgment is denied, and defendants' motion for summary judgment is granted.
IT IS SO ORDERED.