From: "Peter D. Junger" <junger@pdj2-ra.F-REMOTE.CWRU.Edu>
Date: Fri, 10 Nov 1995 07:56:00 +0800
To: Cypherpunks <cypherpunks@toad.com>
Subject: Re: Exporting software doesn't mean exporting (was: Re: lp ?)
Message-ID: <m0tDf8g-0004LGC@pdj2-ra.F-REMOTE.CWRU.Edu>
MIME-Version: 1.0
Content-Type: text/plain



In our recent correspondence on this list with the heading ``Re:
Exporting software doesn't mean exporting'', Michael Froomkin and I
seem to have two different areas of disagreement:  (i) whether the
ITAR's provisions relating to cryptographic software apply to foreign
persons who disclose (or transmit) cryptographic software to another
foreign person without the United States and (ii) whether there is a
separation of powers (or ultra vires) argument that can be made
against the application of those provisions to anyone, foreign or
estados-unidian, in the United States or abroad.

In this message I will limit myself to the first area of disagreement
and will try to deal with the second area in a later message.

As I tried to say, somewhat clumsily, before, and may have caused some
confusion in doing so, there are so many reasons why the provisions of
the ITAR relating to cryptographic software are unconstitutional and
so even more reasons why those provisions are unenforceable, that I
find it difficult to discuss whether those unenforceable and
unconstitutional provisions can be enforced against a foreign person
who discloses software to another person outside of the United States.
I am, after all, firmly convinced that those provisions cannot be
enforced against him, because I do not believe that those provisions
can be enforced against anyone.  (Though in some ways a foreign person
outside the United States is more vulnerable than a United States
person or a foreign person within the United States, since the outside
foreign person has (arguably) less constitutional protections.)

When I said

  (But of course the ITAR as applied to cryptographic software--and that
  is all that I am talking about--are so unconstitutional in so many
  different ways that nothing is going to turn on that one issue.)

the one issue that I was referring to was the status of outside
foreign persons and, of course, that is not the issue that ``is now in
front of two district judges.''  (I hope that the issue before the two
federal district judges is the issue of the constitutionality of the
ITAR's provisions relating to cryptographic software, but both cases
raise relatively narrow factual issues and may end up being resolved
(if one dares call such a result a resolution) on the grounds that the
issues are not appealable under the Administrative Procedure Act or
that administrative remedies were not exhausted or even that the the
provisions of the ITAR in question are unconstitutional but that that
determination that is good for that day and that train only.)

Now Mr. Froomkin says:

  In short, in this particular case the ACEA, and by extention the
  ITAR, doesn't "say what it says" it "says what it must mean".

(And I dare him to make that assertion in the faculty lounge at Miami
when some of the more critical and analytically inclined members of
the Miami law faculty are present.)  I would take this as an admission
that the ACEA and the ITAR does say what it says (even if it must mean
something else) were it not for the fact that--and this was my ``ultra
vires'' point--that the ACEA doesn't say it.

(In discussing the quoted passage I am assuming that ``extention''
must mean ``extension'' and that it is not used as the opposite of
``intention'', if only because I don't know what the latter would be.
But on the other hand the only dictionaries I have to hand are the COD
and the on-line version of Webster's Collegiate.)

The AECA doesn't contain any definition of ``export'' whatsoever; the
whole issue that we are discussing turns on the interpretation of what
the ITAR says when it defines ``export'' as including:

  Disclosing (including oral or visual disclosure) or transferring
  technical data to a foreign person, whether in the United States or
  abroad ....

Now Mr. Froomkin seems to be contending that this language must be
interpreted as it would be interpreted by some sort of neo-Platonic
court (probably sitting in Rawl's original position by designation),
which he calls ``any court''.  The contention is:

  any court construing the ACEA would inevitably read the prohibition
  on "exporting" to a foreign person as not applying where the nation
  lacks jurisdiction.  

Now it was my argument--which Mr. Froomkin helpfully calls an ``ultra
vires'' argument--that any court reading the ACEA would notice (i)
that there is no language in that act defining ``export'' and (ii)
that ``export'' does not mean disclosing, or even transferring,
information (which is what cryptographic software is) and (iii) that,
in consequence, the Office of Defense Trade Controls exceeded its
congressionally granted authority, and therefore its constitutional
authority, when it came up with the perverse provision that is at
issue here.  But that is the subject of my other, as yet unwritten,
message.

Now I take it that Mr. Froomkin's contention turns on the claim that
Congress lacks jurisdiction under international law to pass a
statute--or authorize a regulation--that makes it a crime for a
foreign person to transmit something to another person when both of
them are outside the United States.  So as to avoid the other
constitutional and ultra vires and so on issues, let us assume that
Congress were to amend the ACEA to make it a crime ``to transfer a
cryptographic device to a foreign person within the United States or
abroad without first obtaining a license or a waiver of jurisdiction
from the Office of Defense Trade Controls.''

And now assume that someone, F, who is a foreign person and who has
never been in the United States transfers a cryptographic device that
was not made in the United States or by a United States company to
another foreign person who person who has never been in the United
States.  And now assume that F does come to the United States on a
holiday and that he is arrested and indicted for violating the AECA in
that he did transfer a cryptographic device to a foreign person.

The first thing to notice is that the indictment is not defective.
The only defense--since it is the only one that we are interested in
and we control the hypothetical--is: ``but that was in a foreign
country'' and therefore the United States has no jurisdiction under
international law (or under something) to treat F's actions as a
crime.

So the defense moves to dismiss the indict on those grounds.  And the
prosecution stipulates that the acts charged occured in a foreign
country, that F is a foreign person, etc.

On those facts I would hope that the court would construe the statute
as not covering F's actions outside the United States and would dismiss
the indictment, but--considering that the statute specifically says it
applies both within the United States and ``abroad''--I am not nearly
as sanguine as Mr. Froomkin is.  But let us assume that the indictment
is dismissed.

And now the hypothetical provision in the ACEA is again amended by
congress to make it a crime ``for (i) a United States citizen to
transfer a cryptographic device to a foreign person within the United
States or abroad or (ii) a foreign person to transfer a cryptographic
device to a foreign person within the United States or abroad, without
in either case first obtaining a license or a waiver of jurisdiction
from the Office of Defense Trade Controls.''


And now assume that F', who has never been in the United States
transfers a cryptographic device to a foreign person and thereafter
comes to the United States and is arrested indicted for violating the
hypothetical provision of the ACEA.  It would seem to me that there is
no way that any but the most willfully wrong-headed court (and there
are, I admit, such courts) would construe the hypothetical provision
as not covering F's actions, since it does so clearly cover those
actions.  I mean that there is no way that the court can get away with
concluding that it does not mean what it says.

So what can F' do now?  Well, he could try to raise the claim that the
lack of ``jurisdiction''--which is the justification for Mr. Froomkin's
``any court'' construing the ITAR's actual provisions would not apply
to F or F'--is a ground for dismissing the indictment.

But how can he raise that point?  He can't very well deny that the
court has jurisdiction over his person--he's sitting in the court with
shackels on--and he can't get away with claiming that the court
doesn't have jurisdiction to try him for violating the ACEA.

So it would seem that F's only hope would be to move to dismiss the
indictment on the ground that to continue the prosecution would be to
deny him due process because the United States lacks jurisdiction
under international law.

Now I am no expert in this area, but I would be surprised if the
courts would recognize this as costitutional defense.  As I understand
it from talking with somebody here at CWRU who is knowledgeable, the
courts of the United States tend to defer in such cases to Congress
and the executive--when they are in agreement, as they would be in our
hypothetical--and principles of international law count for little.

So F' will ``inevitably''--to use Mr. Froomkin's word--be convicted of
the crime of delivering a cryptographic device to a foreign person
outside of the United States.

Now lets get back to the ITAR as it is actually written.  In an actual
criminal action brought against a foreign person who is accused of
disclosing cryptographic information to a foreigner outside the United
States--not that I think such an action will ever actually be
brought--the government can point out to the court the facts that I
have just discussed, so the court will be aware that there is no
constitutional provision requiring the dismissal the indictment, even
if the indictment is contrary to international law.  And a real court,
as opposed to Mr. Froomkin's ``any court'' might in those
circumstances feel free to determine that the ITAR means what it says.
(That's just common sense.)

And, were the government ever to bring such a case it, it would argue,
and I think that it would convince a lot of real judges, that the
criminal action does not violate international law because the United
States is protecting its own economic interests by prosecuting foreign
persons who disclose cryptographic information to other foreign
persons outside the United States.  The government's lawyer will
argue:

  Judge, the United States is in a real bind.  It is absolutely
  necessary for our national security that we forbid the export of
  cryptographic software.  But, on the other hand, as those
  Cryptopunks keep pointing out, we are distroying our computer
  industry by enforcing the ITAR against American companies.  So the
  only solution is to apply the ITAR against foreigners as well so
  that the American computer industry will have a levelled--I mean a
  level--field to play upon.  And the anti-trust cases make it
  absolutely clear that the United States does have jurisdiction to
  enforce its laws against foreign  criminal who break those laws
  outside of the United States when their crimes have a negative
  effect upon the economy of the United States.

I am afraid that most federal district court judges would buy that
argument, and I am not even sure that Mr. Froomkin's ``any court''
wouldn't buy it. 

And, in any case, if such a criminal case were to be brought, the
government would almost certainly be able to allege additional facts
to help justify the claim that the US does have jurisdiction over the
matter under international law.

For example, the defendant might be French, and the French government
might be cheering the United States government on.  If the crime is a
crime under both French law and the law of the United States then
there is going to be no problem with the United States asserting
jurisdiction.  (That is, if I understand it correctly, Mr. Froomkin's
murder example.)

Or the defendant may have studied cryptography in the United States,
before he returned home and disclosed the information.

Or the information that he disclosed had previously been unlawfully
exported from the United States in violation of the ITAR (PGP, for
example).

Or the foreign person is an employee of a United States company or a
foreign company doing business in the United States.

Or even that the disclosure was done by a message transmitted over the
Internet that happened to be routed through the United States.

But the matter is even more simple than that since the government is
not going to bring those criminal charges against a foreign person or
a United States person or anyone else if they can possibly avoid it.
The ITAR's provisions on cryptographic software are used by the
government to spread fear, uncertainty, and doubt, and to discourage
the spread of strong cryptography.  Since an actual criminal case
would almost certainly result in at least significant parts of those
provisions being held unconstitutional, the government is not going to
bring such a case if it can find any other ways of satisfying its
goal.

And looked at that way, our foreign person who discloses cryptographic
software to one or more other foreign persons abroad is going to be
the perfect fall guy.  As I have suggested before, the government will
simply bar him from getting a visa to enter the United States since
violation of United States foreign trade regulations is a ground for
denying a visa--at least an immigrants visa.  And, despite Mr.
Froomkin's claim that our foreign person would have a cause of action
if his ``petition'' were denied, he would probably have no recourse
whatsoever.  Certainly he would have no claim that the United States
has no jurisdiction to exclude him for acts done by him outside the
United States; the United States has jurisdiction to exclude
foreigners for things that the foreigners did outside the United
States, like believing in polygamy.  And a foreign person outside the
United States may not have standing to complain of violations of his
freedom of speech outside the United States in an American court.

But let us assume, contra-factually that Mr. Froomkin is right, and
that the poor, excluded foreign person would have a good cause of
action to force the government to give him a visa.  (Though I really
am curious as to what that action would be.)  That cause of action is
going to cost tens of thousands of dollars to pursue, and it will take
years before it is resolved in favour of our foreign person, who will
be excluded--or sitting in jail with a bunch of Cuban and Chinese
refugees--until the case is resolved in his failure.

I am sorry to have written such a long message, and to have been so
slow in writing it, but I think that part of the problem is that both
Mr. Froomkin and I were shooting from the hip, and that is why our
disagreement grew.

But perhaps it has all been worthwhile, for I do think that there are
a few useful conclusions that can be drawn from this discussion:

  (i) We academic lawyers tend to try to settle real world questions
  as if they were academic questions;

  (ii) It is never safe to assume that any court will construe a
  statute or a regulation as meaning something other than what it
  says; 

  (iii) One can only construe a legal text in a particular context;
  even if one thinks that one can figure out how any court would
  interpret the text in qustion, one still nees to know how the text
  got before the court; and

  (iv) The fact that you can always sue the police for unconstitutional
  harassment isn't of much help when they reach for the rubber hose.

--
Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH
Internet:  junger@pdj2-ra.f-remote.cwru.edu    junger@samsara.law.cwru.edu