From: Cindy Cohn <Cindy@mcglashan.com>
Date: Tue, 14 Jul 1998 18:07:21 -0700 (PDT)
To: bernstein-announce@toad.com
Subject: No Subject
Message-ID: <199807150056.RAA09720@gw.quake.net>
MIME-Version: 1.0
Content-Type: text/plain


Hi all,

I've now had a chance to review the decision in the Junger case.  I think it
contains many flaws, but will just highlight a few here.  

The most striking thing about the opinion is how much the judge's willfully
ignored the undisputed factual record.   Plaintiffs submitted voluminous
declarations from programmers, computer science professors and others
confirming that they often communicate using source code.  The Declarants
included Professor Abelson of MIT, author of the key introductory textbook
of computer science, as well as Professor Appel from Princeton and several
prominent cryptographers and general computer scientists.  All of them
confirmed the need to read, write and share source code as part of their
work, and as part of the development of science.  They also testified to the
fact that many, many other people communicate using source code, and that
higher level languages are developed to allow humans to write, read and
develop each others ideas.  

The Judge does quote the Supreme Court ruling that speech must be protected
by the First Amendment unless it is  "so far removed from any exposition of
ideas, and from truth,  *science,* morality, and arts in general . . . "
 
Yet despite these clear facts and despite the Supreme Court's clear
inclusion of scientific speech as protected expression,  Judge Gwin states:  

 1.  "encryption source code may *occasionally* be expressive (p.12)
2.   that in the "overwhelming majority of circumstances" encryption source
code is exported to transfer functions, not to communicate ideas."  (p.13)
 3.  "For the broad majority of persons receipting such source code, the
value comes from the function" (p.13-14).
4.   "encryption source code is rarely expressive"  (p. 15).
5.  "source code is conduct that can occasionally have communicative
elements."  (p.16)
6.  "Source code is a set of instructions to a computer that is *commonly*
distributed for the wholly non-expressive purpose of controlling a
computer's operation."  (page 17)
7.   "encryption software is not typically expression"  (page 18)

There are similar statements of fact throughout the decision, none of which
contain citations to anything in the record to support them.  

So where is the evidence to support his conclusions?  The government
submitted no empirical studies of source code "exports"  from which one
could conclude how often source code is "expressive."  Certainly this is not
the kind of thing which can be judicially noticed.  At a minimum, the
declarations create a triable issue of material fact as to how often source
code is used to communicate ideas.  This alone should preclude summary
judgment.  

Also, I know of know authority which holds that the number of people who
communicate in a given language is the basis on which we decide whether that
communication is speech.  Judge Gwin certainly cited none, but his opinion
assumes that this is relevant.  

He also says that "certain software is inherently expressive" (page 13)
without stating what he thinks that kind of software is and how it differs
from encryption software.  The Junger team argued that the "functionality"
of encryption software, allowing privacy of speech, makes the software
subject to the First Amendment on its own, just as the regulations of
printing presses and newspaper racks violate the First Amendment even though
the item itself may not be speech.  The Judge ignored this argument
entirely.      

Once the judge has decided that source code is not *sufficiently*
expressive, he ignores the settled analysis for prior restraints in order to
avoid applying the tests.  The easiest mistake to see is his reliance on the
9th Circuit Roulette decision for his holding that prior restraint review
shouldn't apply.  Roulette was *not* a prior restraint case.  It considered
an ordinance which allowed the police to arrest citizens for sitting on the
sidewalks.  In Roulette, a person didn't have to apply for a license to sit
on the sidewalks, he or she simply did it.  The question of whether the act
was expressive or not would always be reviewed by a Judge, as part of the
criminal process.  In the case of cryptography,in contrast,  one of the key
issues has been the fact that the cryptography regulations do not allow for
a judge to review agency decisions denying or requiring a license.  Thus,
applying Roulette as the standard to judge whether prior restraint analysis
applies is just plain wrong.  

Having dispensed with prior restraint by relying on a non-prior restraint
case, the Court then considers overbreadth.   Again, he ignores the record
entirely.  He claims, again without any citation to the record,  that Junger
has failed to show that "the resulting injury to other academics is the very
same injury that Junger allegedly suffered."  

But Junger included Declarations from people who were *not* academics who
have been injured by the export restrictions.  He included declarations from
Mr. Liebman (concerning some O'Reilly software) and Mr. Behlendorf
(concerning the Apache server) demonstrating that even those whose software
contains no encryption capability whatsoever have been injured by the
encryption regulations.  The record contains plenty of evidence that people
other than Junger, attempting to do different kinds of things than he does,
have suffered different kinds of injury due to the regulations.   Similarly,
Judge Gwin states that the regulations are not vague, ignoring the record
evidence that many, many people do not understand them and have been chilled
as a result.  

Next, Judge Gwin finds content neutrality based upon the argument that
government is controlling the "functionality" of the software rather than
its content.  Acceptance of this phony distinction requires that a person
have no understanding of computer programming.  The content and the
functionality of a computer program are synonymous.  They have to be.  There
is no way to change or limit the functionality without also changing the
content of the source code.  To mandate key recovery is to mandate that
computer programs have different content than they would otherwise; its'
like saying that the government wants to control the "taste" of chocolate
cake rather than the recipe.  Change one, you must change the other.  

Judge Gwin also relies on the fact that the Government allows "export" of
software on paper, thus defining "functionality" as based upon the fact that
source code can be converted into object code which can be run.   But this
analysis also ignores the existence of scanners and typists.  Software on
paper isn't any less "functional" than software in electronic form.   It
simply requires one more, simple, step to make it functional.  In the case
of the single page of source code which is Snuffle, in the Bernstein case,
the difference cannot be more than ten minutes worth of typing or a few
minutes to scan and correct errors prior to compiling.  *This* is the
difference our national security rests upon?

Judge Gwin then applies intermediate scrutiny, quickly finding that the test
is met.  

In the end, Judge Gwin decided, despite the evidence, that source code isn't
often read by anyone and so shouldn't really deserve First Amendment
protection.  The rest of the analysis flows from there, with no regard for
the actual facts in the record.  The result is that we have a new category
of lesser protected expression, speech which is also "functional," without
any clear or understandable definition of the term "functional."  And all
those computer scientists and their settled methods of communicating with
each other apparently don't count when it comes to the First Amendment.

The larger ramifications of this holding, if it becomes law for the rest of
us, are frightening.  Taken to its extreme, this holding could be the
exception that swallows the rule of Reno v. ACLU.  If the fact that
something can "function" means it is not speech, every web page written in
HTML could be held not protected, since at some level each page is a
"functioning" computer program.  Certainly any web page or other electronic
publication which contains a Java applet is a "functioning" program. 

As I noted above, there are other criticisms which can be leveled as well.
These are simply a few that I've found so far.   

Cindy 
 






******************************
Cindy A. Cohn, Cindy@McGlashan.com
McGlashan & Sarrail, P.C.
177 Bovet Road, 6th Floor
San Mateo, CA 94402
(650) 341-2585 (tel)
(650) 341-1395 (fax)