UPDATE:Sept. 30, 1999: Ninth Circuit grants petition for en banc rehearing. Oral arguments scheduled for 1pm Dec. 16, 1999. As a result, the panel opinion discussed in this note,176 F.3d 1132 (CA 9,1999), has been withdrawn. It is NOT law at this time.
UPDATE: June 21, 1999: government petitions for rehearing and rehearing en banc, thus stay reminas in effect until further notice.
The Ninth Circuit's decision in the Bernstein case is a major victory for the First Amendment in the computer age. It confirms that just because you use specialized tools to speak, like a computer, or a specialized language to communicate, like a programming language, you do not therefore put yourself outside the scope of the First Amendment. These propositions are fundamental to free speech, and to freedom of association, in the computer age. And while it is wonderful that the Court of Appeals ruled as it did, it is a pity that the Justice Department's stonewalling on this issue made such a ruling necessary in the first place.
Today the Ninth Circuit-the court of appeals with jurisdiction over Silicon Valley-holds that cryptographic source code is protected speech. The court held, correctly, that the US Government unconstitutionally prevents the export of cryptographic source code with a system of speech licenses. The court held that preventing cryptographers such as Daniel Bernstein from using the Internet to share their work with colleagues around the world is an unconstitutional prior restraint on speech, one hedged with completely inadequate procedural safeguards.
This decision is especially important because U.S. government representatives openly admit that they have been using the export control laws to retard the domestic use of cryptographic software. This decision, which I hope will be upheld by the Supreme Court, will be the first step towards greatly increased use of cryptography in domestic products, and enhanced personal privacy for all Americans.
Perhaps the most important aspect of this decision is that the appeals court recognizes the critical connection between the regulation of cryptography and our modern lives:
"we note that the government's efforts to regulate and control the spread of knowledge relating to encryption may implicate more than the First Amendment rights of cryptographers. In this increasingly electronic age, we are all required in our everyday lives to rely on modern technology to communicate with one another. This reliance on electronic communication, however, has brought with it a dramatic diminution in our ability to communicate privately."As the court recognized, the regulation of cryptography concerns us all in our everyday existence, at a time when the ability of governments and others to observe our everyday activities is at an all-time high. Only the deployment of consumer cryptography offers the ordinary citizen the technical means to attempt to carve out a zone of privacy in an increasingly monitored world. The citizen's right to protect privacy in this manner implicates not just the First amendment but also the Fourth amendment and the right to speak anonymously..
The court was thus right on target when it noted that the regulation of cryptography "touches on the public interest broadly defined.".
A second important aspect of this decision is that the court recognized the effect of technical change on the first amendment, and rejected suggestions that just because speech has side effects it somehow loses its protected status:
"the government's argument, distilled to its essence, suggests that even one drop of "direct functionality" overwhelms any constitutional protections that expression might otherwise enjoy. This cannot be so. The distinction urged on us by the government would prove too much in this era of rapidly evolving computer capabilities. The fact that computers will soon be able to respond directly to spoken commands, for example, should not confer on the government the unfettered power to impose prior restraints on speech in an effort to control its "functional" aspects. The first Amendment is concerned with expression, and we reject the notion that the admixture of functionality necessarily puts expression beyond the protections of the Constitution."It is important to note, however, that although the court struck down the entire export control regime, in a footnote the opinion makes clear that the court is only holding the rules unconstitutional as they relate to source code. Thus, the logic of this decision does not apply directly to object code (actual ready-to-run programs) because Bernstein only sought to export source code. Furthermore, although this decision is "final," under the federal rules of appellate procedure the "mandate" directing parties to comply with it may not issue for more than 45 days in order to give the government time to consider its options. Thus, even if you live in California, this decision doesn't mean you can ship a compiled 3DES toolkit anywhere in the world tomorrow morning.
If the government appeals, the issue is very likely to go to the Supreme Court for resolution given the government's claim that national security might be affected. It is likely that the government will request and receive a stay order if it chooses to appeal.
Congratulations to Cindy Cohn and the rest of the Bernstein legal team!
More information on Cryptography and the Constitution
More information on government regulation of cryptography
More
information on the link between cryptography, e-cash, and privacy
--
Michael Froomkin
Professor of Law
U.Miami School of Law
froomkin@law.miami.edu