D. J. Bernstein
Bernstein v. United States

Details of the regulations

A brief introduction to federal laws

Active federal laws are collected into two documents:

USC (or U.S.C. in legal citations), the United States Code. USC was created, and is frequently modified, by Congress. Modifications to USC are called statutes. Statutes are published in a journal called the United States Statutes at Large.
CFR, the Code of Federal Regulations. CFR was created, and is continually modified, by the executive branch of the federal government. CFR is much more detailed than USC. Each modification to CFR is published in a journal called the Federal Register.

The Government Printing Office publishes online versions of USC, CFR (not including ``supplements''), and recent Federal Register notices. The Legal Information Institute at Cornell publishes nicer online versions of USC and CFR (again without supplements).

``Isn't Congress supposed to make all the laws?'' you ask. ``Isn't the executive branch supposed to merely carry out those laws?'' Well, yes, but Congress doesn't have time to work out all the details, so it delegates most of the law-writing effort to the executive branch.

The executive branch is still supposed to be limited by Congress. Anything in CFR inconsistent with USC is invalid. However, Congress sometimes makes broad laws, such as export-control laws or emergency-economic-powers laws, and the executive branch then exploits those laws to make up its own rules.

The International Traffic in Arms Regulations

22 CFR 120 through 22 CFR 130 are popularly known as ITAR, the International Traffic in Arms Regulations. ITAR was written by the executive branch, primarily the Department of State.

ITAR controlled Internet-security software for many years. In December 1996, ITAR was modified to control only ``military'' security software.

The executive branch says that ITAR is authorized by the Arms Export Control Act of 1994, specifically 22 USC 2752, 22 USC 2778, and 22 USC 2797. (Previous statutes along the same lines: the Arms Export Control Act of 1976, the Mutual Security Act of 1954, and the Neutrality Act of 1935.)

The Export Administration Regulations

15 CFR 730 through 15 CFR 774 are popularly known as EAR, the Export Administration Regulations. EAR was written by the executive branch, primarily the Department of Commerce.

EAR has controlled Internet-security software since December 1996, except for the ``military'' software still controlled under ITAR. The executive branch explicitly threatened to put non-``military'' software back onto ITAR if it didn't like what happened with EAR.

The Government Printing Office has a web page dedicated to EAR (including supplements) and another web page dedicated to related Federal Register notices.

I have a snapshot of GPO's EAR pages as of the end of 2001. Definitions: 15 CFR 772. Items on the Commerce Control List, 15 CFR 774 supplement 1: table of contents, category 0, 1, 2, 3, 4, 5.1, 5.2, 6, 7, 8, 9, index. Prohibitions, exceptions, etc.: table of contents, 15 CFR 730, 732, 734, 736, 738, supplement 1, 740, supplement 1, 742, 743, 744, supplement 4, 745, 746, 748, 750, 752, 754, 756, 758, 760, 762, 764, 766, 768, 770, 774, supplement 2, index. Stated authority: summary, documents. Miscellaneous information: hints, forms, rules related to forms, contacts, more contacts, even more contacts.

Same information in PDF format: 15 CFR 772, table of contents, category 0, 1, 2, 3, 4, 5.1, 5.2, 6, 7, 8, 9, index, table of contents, 15 CFR 730, 732, 734, 736, 738, supplement 1, 740, supplement 1, 742, 743, 744, supplement 4, 745, 746, 748, 750, 752, 754, 756, 758, 760, 762, 764, 766, 768, 770, 774, supplement 2, index, summary, documents, hints, forms, rules related to forms, contacts, more contacts, even more contacts.

Here are some of the important changes to EAR:

61 FR 68572, 30 December 1996: Huge changes to start controlling Internet-security software.
63 FR 2452, 15 January 1998: Some improvements. For example, virus-protection software was taken off the Commerce Control List.
65 FR 2492, 14 January 2000: Dramatic new exception, 15 CFR 740.13(e).
65 FR 62600, 19 October 2000: Another helpful improvement, 15 CFR 740.13(e)(2).

Before 1994, the executive branch said that EAR was authorized by the Export Administration Act of 1979. (Previous statutes along the same lines: the Export Administration Act of 1969 and the Export Control Act of 1949.) However, that statute expired in 1994. Starting in 1994, the executive branch said that EAR was authorized by the International Emergency Economic Powers Act of 1977.

The word ``emergency'' in ``International Emergency Economic Powers Act,'' like the word ``arms'' in ``Arms Export Control Act,'' cannot be taken seriously; it means whatever the executive branch says it means. I am told that the United States has been in a declared state of national or international emergency every day since 9 March 1933.