Pages 1 - 43 In The United States District Court For The Northern District Of California before the honorable Marilyn Hall Patel, Judge Daniel J. Bernstein, ) ) No. C 95-0582 Mhp Plaintiff, ) ) Vs. ) ) United States Department ) of State, et al., ) ) Defendants. ) ---------------------------) San Francisco, California Friday, October 20, 1995 Reporter'S Transcript Of Proceedings appearances: For Plaintiff: Mc Glashan & Sarrail 177 Bovet Road, Sixth Floor San Mateo, California 94402 By: Cindy A. Cohn, Esq. Steefel, Levitt & Weiss One Embarcadero Center, 30Th Floor San Francisco, California 94111 By: M. Edward Ross, Esq. Lee Tien, Esq. 1452 Curtis Street Berkeley, California 94702 (Appearances Continued On Next Page:) Reported By: Judith N. Dudeck, Csr Official Reporter, Usdc (appearances continued:) For Defendants: Frank W. Hunger Assistant Attorney General Michael J. Yamaguchi United States Attorney Mary Beth Iutti Assistant United States Attorney 450 Golden Gate Avenue San Francisco, California 94102 By: Anthony J. Coppolino Susan Arnold, Esq. Assistant General Counsel National Security Agency 3 1 Friday, October 20, 1995 11:40 A.M. 2 3 The clerk: Civil action 95-0582, Bernstein versus U.S. 4 Department of the State, et al., for defendants' motion to 5 dismiss. 6 Counsel, your appearances, please. 7 Ms. Cohn: Good morning, your honor. Cindy Cohn of 8 Mc Glashan & sarrail for plaintiff Dan Bernstein. With me is 9 Lee Tien and Ed Ross of Steefel, Levitt & Weiss. 10 The Court: Good morning. 11 Mr. Coppolino: Good morning, your honor. I am Anthony 12 Coppolino with the civil division of the Justice Department. I 13 am joined by Susan Arnold, who is an assistant general counsel 14 at the National Security Agency. 15 The Court: Good morning. 16 The Court: You are not -- are you -- well, maybe you 17 are. Are you suggesting that the language of nonreviewability 18 that is contained at section 2778 -- let's call it subsection 8 19 so we don't have to go through all of that -- precludes 20 judicial review on Constitutional -- for Constitutional 21 grounds? 22 Mr. Coppolino: No, I am not, your honor. 23 If I could just clarify the position on that. 24 The foundation of the analysis, it seems to us, is that 25 judicial review is precluded as to commodity jurisdiction 4 1 determinations with the designation of defense articles. 2 The Court: Right. 3 Mr. Coppolino: By statute. 4 In addition the Court of Appeals in Mandel has also 5 held that those determinations are -- constitute nonjusticiable 6 political questions. 7 The Court: Uh-huh. 8 Mr. Coppolino: In Bazarov the Court of Appeals again 9 suggested an avenue of judicial review, which was as to whether 10 there was a colorable Constitutional claim. 11 The Court: And that's what we get to in this case. 12 Mr. Coppolino: That's what we get to. 13 We are not arguing, for example, that the government 14 has unreviewable discretion to violate someone's first 15 amendment rights. We are arguing that the claim here is not 16 colorable, that there is not a valid Constitutional claim. 17 Therefore, there should be no jurisdiction; that what 18 is at issue here is, in fact, a simple commodity jurisdiction 19 request. 20 So I would say that the Court in Mandel and also the 21 district Court in Helme (phonetic) did consider Constitutional 22 questions. They were due process claims that an individual 23 needed the background information on the designation of a 24 commodity. And the Court held that those were nonjusticiable. 25 But we have focused our attention on the issue of the 5 1 colorability of the claims, the basis of the claims. 2 And we believe, your honor, that under the 3 Bazarov/Webster approach to considering these matters that that 4 is a question which informs the question of jurisdiction. 5 If a plaintiff hasn't stated any kind of a 6 Constitutional violation, if the matter doesn't concern the 7 regulation of speech, the Court should dismiss for lack of 8 subject matter jurisdiction, which is what occurred in the 9 Dorfmont case, for example, which involved a Security clearance 10 determination. 11 The Court: Well, wasn't Dorfmont a due process case 12 also? 13 Mr. Coppolino: It was a due process case, your honor. 14 it was a Constitutional claim. 15 The Court: Right. But sometimes it's much the line 16 between is this really a due process claim or way of asserting 17 it a Constitutional claim to get around the nonjusticiability 18 of a review. They are very much interlinked, as opposed to a 19 first amendment claim where the claim is not couched in due 20 process language, looking like an attempt to get a review, but 21 it's couched in what has been done or what has applied or what 22 this particular provision does is to violate my first amendment 23 rights. And that's a much different kind of inquiry than a due 24 process inquiry, which can get awfully close to looking like 25 review. 6 1 Mr. Coppolino: Well, your honor, I do think that the 2 first amendment claim is interposed in an effort to circumvent 3 the jurisdictional bar. 4 And I think that if the Court undertook the analysis 5 that was undertaken in Webster/Bazarov -- or suggested in 6 Bazarov and as well as in Dorfmont. What we are asking you to 7 do is to scrutinize the basis of the claim so that the Court 8 can evaluate whether or not in fact there was a suppression of 9 speech here or whether or not in fact what the government has 10 undertaken here is to designate a functioning commodity -- in 11 this case encryption software, but it could be any other type 12 of commodity -- as a defense article. 13 If the plaintiff can simply invoke the Constitution and 14 say, "my first amendment rights were violated," and then the 15 Court just assumes jurisdiction and proceeds either under 16 12(b)(6) or 56, then the jurisdictional bar, we believe, would 17 be circumvented. 18 I think that the Webster analysis is intended to raise 19 a threshold there. 20 The Court: Right. And so the question becomes what is 21 a colorable claim. 22 Mr. Coppolino: Well, we think so, your honor. 23 And we, of course, have argued the case under -- we can 24 argue it under (b)(1), under 12(b)(6) or under rule 56, which 25 the Court has discretion to convert to if you wish to consider 7 1 matters outside the pleadings. 2 But we ultimately think it's a question of jurisdiction 3 because of the fact that the Ninth Circuit has made it very 4 clear that there is a nonreviewability under the statute, as 5 well as under the political question doctrine. 6 Therefore, before the Court simply says, as the 7 plaintiffs are suggesting, this is a first amendment claim, 8 first amendment claims are presumptively reviewable, just 9 assume all the facts as we have alleged them and let us go to 10 evidenciary proceedings, we believe that would fly in the face 11 of the analysis that the Court should undertake in light of the 12 fairly well-developed case law in this Circuit on the control 13 for export of certain commodities. 14 And I think -- 15 The Court: Well, if we treat it under 12(b)(1), which 16 I don't think is a bad idea -- I think it's a little premature 17 to try to deal with it as a rule 56 motion. If we treat it 18 under 12(b)(1), even you yourself have got to the question 19 of -- got us directly to the question of is this a colorable 20 claim and essentially focused on is this particular item -- 21 whatever you want to call it for the time being -- is this 22 speech, right? 23 Mr. Coppolino: Is the designation of that item a 24 regulation of speech, yes. I think that's essentially the 25 question. 8 1 The Court: And essentially you have to look at whether 2 the item, you know, is speech, then. 3 Mr. Coppolino: I think you have to look at the item. 4 I think you have to look at what was intended by the 5 determination, what is the target of it. 6 And on the point of 12(b)(1), I think the first issue 7 that we would need to address is in fact a factual issue. 8 As I think the Court indicated in your Doe V. Schechter 9 decision, there are two types of jurisdictional challenges. 10 there is a facial challenge and there is a factual challenge. 11 If the plaintiff had simply come in and said, "this 12 case is about the designation of my software as a defense 13 article," then perhaps the jurisdictional challenge would 14 simply be a facial challenge. 15 But I think this case also presents a factual 16 challenge. Because in fact what they seem to be arguing fairly 17 consistently is that the case is not about the designation of 18 encryption software as a defense article on the United States 19 munitions list. 20 Indeed, they say that they -- they concede that that is 21 not a reviewable question; they concede that they are not 22 challenging the wisdom of the president or the secretary of 23 State to do that. 24 What they are saying is that it's about his right to 25 publish ideas, merely to publish ideas on cryptology, to speak 9 1 at an academic conference or in a classroom or on a street 2 corner. 3 And I believe that under rule 12(b)(1) you can consider 4 factual matters outside the pleadings to make the determination 5 of what is going on here. 6 And whether you do that under (b)(1) or (b)(6), we have 7 tried to lay out for you in our submission as to what the case 8 is about. 9 And we start with the administrative correspondence, 10 which is attached to the complaint, which, as you know, you can 11 consider. And in that correspondence the plaintiff makes clear 12 that he is submitting a commodity jurisdiction request for 13 Snuffle 5.0 software. He described it as software which 14 functions to encrypt communications on a computer system with 15 zero delay and gives actually quite a good description of how 16 his software works. 17 And he asked for the opportunity to export that 18 software, along with the instructions on how to make it work. 19 We think that pretty clearly indicates that he wants to 20 export software, and that that was the case -- that's what the 21 administrative action was about, that's what the case is about, 22 that that is the factual foundation of the first amendment 23 analysis. Can we designate crypto software on the usml, which 24 is what I think most people think this case is about. 25 The plaintiffs, however, in their complaint, as well as 10 1 in their response brief, as well as in this morning's recorder 2 article that I read, seem to be focusing on the other items 3 that were a part of the commodity jurisdiction request, the 4 noncode items, the nonsoftware items, which explained what 5 Snuffle is and how you program it on a computer to make it 6 work. 7 Almost their entire argument rests on the notion that 8 the government was seeking to regulate this material as 9 technical data, which is a separate category under the 10 international traffic and arms regulations. 11 As you may recall from the pleadings, your honor, there 12 were two requests. In the second request the plaintiff divided 13 up all six items into -- into separate items. And he received 14 one response to that request, which was the referenced "items" 15 includes source code for data encryption. 16 This was an initial administrative determination. This 17 was not appealed and so there is no clear record on it. 18 And he assumed that the determination covered 19 everything, that it covered software, that it covered technical 20 data. 21 As I say, he did not appeal it, and instead he filed a 22 complaint, the focus of which is really not about software. 23 it's about technical data and whether we regulate technical 24 data in a manner that limits scientific exchange. 25 The Court: Well, can we get a stipulation now as to 11 1 what the -- what the Department considers -- of the various 2 items that he submitted -- what it considers to fall within the 3 proscribed list or the list on which you have to obtain 4 permission. 5 Mr. Coppolino: Yes, your honor. 6 Well, your honor, I have tried to do that. During your 7 meet-and-confer process in this district Court, you are 8 admonished to try to narrow the issues in dispute. 9 When we first received the complaint and it appeared to 10 us as if he was challenging not only the designation of the 11 software but these noncolored items, two of which we consider 12 technical data, we discussed this issue several times in our 13 meet-and-confer process. 14 I suggested that the Department -- since the case was 15 not appealed; it was just an initial determination -- that the 16 Department of State issue a clarification to tell the plaintiff 17 where we stand on all of these matters. 18 And we did do that. We did it on June 29th, which was 19 the day of the case management conference in case the issue 20 came up. 21 And that's in the record, by the way. It's attached to 22 a Lowell declaration that we submitted. And that letter 23 says -- which is -- it's a quasi appeal determination is what 24 it is. That letter says that the focus of the Cj determination 25 was the software; that with respect to the technical data -- 12 1 there was one item that we said was not technical data, and 2 there were a couple of items which we said were, and that the 3 practice of the Department of State is to regulate that in 4 accordance with this Court of Appeals decision in the Edler 5 case, which concerned technical data. 6 And in the Edler case the essential holding is that it 7 is Constitutional for the government under the ITAR to regulate 8 the exportation of technical data in connection with the 9 provision of technical assistance; that is to say, the direct 10 assistance to someone in actually creating or obtaining a 11 munition. 12 In the Edler case the Court of Appeals gave a narrowing 13 construction to the very regulations that are at issue here in 14 order to preserve their constitutionality in the face of a 15 first amendment prior restraint and overbreadth claim, the 16 exact two claims you face here with respect to technical data. 17 And we think that insofar as there is a facial 18 challenge here, the Edler case resolves it. 19 The regulations since 1978 have become even clearer, 20 but essentially it was the same concepts. The ITAR has always 21 regulated the export of technical data. 22 And if you look at the regulations, as the Court of 23 Appeals noted in Edler, they are susceptible to an expansive 24 interpretation that might in fact include discussions, academic 25 discussions, all manner of scientific exchanges. 13 1 This was a controversy that raged in the late 1970's 2 and early 1980's, your honor. There was a great concern in the 3 academic community that the ITAR would be used to regulate 4 academic symposia. There was a congressional hearing on this; 5 there were some law review articles. There were Olc opinions, 6 as you saw, which plaintiff submitted -- three opinions from 7 the Department of Justice, office of legal counsel -- all on 8 this very question, to what extent is it constitutionally 9 permissible to regulate technical data. 10 The Department of Justice's view was pretty much the 11 view of the Court of Appeals in Edler, that that regulation 12 must be undertaken in connection with the actual provision of 13 technical assistance, that is, a conduct which is to help 14 someone create the defense article. 15 And in 1984, a few months after the last Olc decision, 16 the State Department said in the federal register that that's 17 what its policy would be, that its practice would be to follow 18 the Edler case. 19 The ITAR was amended to clarify that the technical data 20 does not include information in the public domain, which, as 21 you can see from the definition, includes through distribution 22 at conferences, meetings and seminars. 23 It also does not include fundamental research in 24 science and engineering at accredited institutions of higher 25 learning. That provision was added in 1991. 14 1 So there was an attempt to clarify the ITAR to make 2 clear that the objective is not to regulate first amendment 3 activities. And, again, we are talking about technical data. 4 So we made this point to Mr. Bernstein in his -- in the 5 June 29 clarification because, again, he hadn't appealed the 6 determination. 7 And they don't seem to want to take at least a partial 8 yes for an answer. They seem to want to adhere to their theory 9 and relitigate the Edler case that the ITAR can be construed to 10 regulate academic discussions, scientific exchanges, which you 11 might -- we might even concede that's true, but we have a 12 limiting construction by the Court of Appeals for the Ninth 13 Circuit which we have stated that we follow. And he can't 14 simply come in and say, "I don't believe that. I don't believe 15 you do that." He has to make some sort of showing that in fact 16 the State Department is regulating symposia. 17 Now, we submitted with our reply some journal articles, 18 which indicate to the Court that -- I think we tried to 19 demonstrate to the Court that this reflects that there is not a 20 regulation or a system of prior restraint on the exchange of 21 theories and ideas regarding cryptographic algorithms. You can 22 present the algorithm. You can discuss the theory. 23 Indeed, two of the things we submitted were materials 24 from symposia which were held here in California, at which a 25 very renowned scholar at one of the symposia got up and had an 15 1 explanation of how one of his encryption algorithms worked. 2 and, indeed, NSA officials attend some of these symposia. So 3 we don't have a prepublication review requirement on academic 4 exchanges at symposia. We don't have a prepublication review 5 requirement on journals. 6 The Court: Okay. I understand that. 7 But I guess my question about that, as it applies to 8 this case, is, for example, one of the items he sent in was the 9 paper that pursuant to this more recent, I guess, explanation 10 of the earlier letter says that that's not subject to the 11 regulation. But do you have a basis for a reasonable belief 12 based upon the government's earlier response that indeed that 13 paper was on the list as well? 14 Mr. Coppolino: No. 15 The Court: And subject to licensing. 16 Mr. Coppolino: As I say, your honor, that is his 17 contention, but we don't believe that there is a genuine 18 dispute as to that, and we think you can evaluate that at this 19 stage on 12(b)(1). 20 As I indicated, if you look at the submission, we don't 21 believe that this reasonably describes an academic paper. It 22 is actual source code. It is the software itself described in 23 computer language source code. In addition, he explains how to 24 program it on a computer. 25 And he labeled the request a request to export -- for a 16 1 commodity jurisdiction request to export Snuffle software. 2 Now, he described that as a paper, but it was construed 3 by the government, as we indicated in our submission, to be a 4 commodity jurisdiction request for software. 5 NSA and the State Department have set forth for the 6 Court that our focus was whether or not this encryption 7 software, Snuffle 5.0, fell within category 13(b) of the United 8 States munitions list. We do not consider the nonsoftware 9 items as a paper or technical data. And we subsequently 10 advised Mr. Bernstein on June 29th at to how the technical data 11 is to be regulated. 12 Now, if he wants to make some showing that we don't 13 follow the Edler case with respect to technical data, he is 14 free to do that. But they haven't made that showing. 15 They have suggested in their submissions that they have 16 evidence that the speech of other people has been regulated 17 under the ITAR. But, of course, they had an obligation under 18 the initial disclosure process to disclose to us whatever their 19 evidence is. And I think what they are referring to are other 20 pending commodity jurisdiction cases which involve the export 21 of encryption software. 22 Indeed, one of them is a case which is now pending in 23 district Court in D.C. that I am handling before Judge Ritchie. 24 it's another case involving cryptographic source codes on a 25 diskette. 17 1 So I think that's what they are referring to when they 2 say that the speech of others has been regulated. 3 But, otherwise, I don't know because they haven't 4 provided it to me; they haven't provided it to you. 5 Our point, your honor, is -- the bottom line is this 6 case is about the designation of encryption software on the 7 United States munitions list and that that software functions 8 to encrypt information on a computer. 9 And if I could just briefly address that issue, if the 10 Court would permit me, the first amendment analysis there. 11 We think that the O'Brien analysis applies. And the 12 O'Brien analysis is a four-part analysis, which is O'Brien and 13 cases like it, turner, ward V. rock against racism, ccnv, they 14 all concern cases where the regulation is not directed at 15 speech but appears to be content neutral on its face and might 16 incidentally affect speech. 17 And here you have the designation under category 13(b) 18 of encryption software which functions to maintain secrecy. 19 And the question is if we control that under the ITAR, 20 is that a violation of the first amendment. And our position, 21 as we have stated, is that encryption software can be utilized 22 on a computer to encrypt information. It is a functioning 23 commodity. 24 The plaintiff's argument is that software is also 25 speech. It is information. He says there is no rational 18 1 distinction between describing the software in English and 2 describing it in source code, which is computer language. 3 But we think there is a very rational distinction. The 4 English explanation of Snuffle would inform the intellect the 5 source code can be utilized on the computer to actually 6 encrypt. He also compares his software to a recipe. 7 Well, if I may, your honor, if I may suggest, if you 8 put a recipe on a computer, you don't get chocolate cake. But 9 if you put a source code on a computer, you get the function to 10 encrypt. And that's the basic difference. It's not simply 11 informational. It is a fundamentally -- it's fundamentally a 12 product that can function to encrypt. 13 And that's the basis of category 13(b) of the ITAR. 14 We believe that while Mr. Bernstein's intention might 15 have been to send the software out to demonstrate its 16 intellectual theory and to show the world that this is my 17 invention, this is how it works, and isn't this interesting, 18 the purpose of regulating the export of encryption software is 19 not to target the specific idea that the software reflects but 20 its function to encrypt information. 21 And this would apply, your honor, as to whether it's 22 any other kind of munition. Someone might wish to export, for 23 example, electronic equipment in order to demonstrate its 24 scientific capabilities and values and not to allow someone to 25 use it. But we would regulate that. 19 1 Someone might want to export a gun to make a political 2 statement in support of a particular cause. But we would 3 regulate that. It is a munition. 4 So there is a difference between the communication 5 aspect -- 6 The Court: There is quite a bit a difference between 7 the items you just talked about and software also. 8 Mr. Coppolino: But not really in principle, your 9 honor, because they do function. 10 The Court: Because what you are suggesting is that 11 software -- or in this case we are talking about the object 12 code? 13 Mr. Coppolino: We are talking about source code in 14 this instance. 15 The Court: We are talking about source code. Okay. 16 Is that correct? Do you agree? Is that what we are 17 talking about, source code? 18 Ms. Cohn: Source code. 19 The Court: Okay. 20 That source code in and of itself does not constitute 21 speech, period. Is that correct? Or is it source code in the 22 context of the facts of this case? 23 Mr. Coppolino: No. We are saying that the definition 24 of software in category 13(b) includes encryption source codes. 25 because an encryption source code is an encryption algorithm in 20 1 computer programming language. That is, you add the computer 2 programming language to enable the computer to read it and to 3 utilize it. 4 The next step is to compile it into object code. But 5 most would agree that's a fairly trivial step. There are 6 commercial programs to compile it, but the key is the source 7 code. 8 And that's the target of our regulation is the source 9 code. And, as I say, the source code can be utilized to 10 function if you compile it, and you have turned your computer 11 into a device that can now encrypt communications. And that is 12 the key. 13 There is no valid distinction between source code and 14 object code because the step to get from one to the other is 15 rather trivial. 16 The Court: Okay. Assuming that, though, the source 17 code operates the same way, whatever the particular program may 18 be -- this happens to be an encryption code or decryption, I 19 guess, program, correct? 20 But the source code doesn't operate -- doesn't have a 21 different function when you take it to some other use that 22 software is routinely put to. 23 Mr. Coppolino: Well, your honor, I think -- 24 The Court: Right? 25 Mr. Coppolino: No. I don't think I -- if I understand 21 1 your question, this Snuffle is source code -- 2 The Court: Yes. 3 Mr. Coppolino: -- that functions to encrypt. 4 You can take a powerful source code, the most powerful 5 source code there is, and you can utilize it in a particular 6 product or software to do something which does not maintain 7 data confidentiality, which does not maintain secrecy. 8 But this source code is simply out there. It is 9 not -- for instance, if the source code were applied in a 10 particular manner which it did not maintain the confidentiality 11 of a communication, then it might not be subject to category 12 13(b). 13 But, as it stands, it can be utilized to maintain 14 secrecy, and you have to look at the product. 15 The Court: But you are confining yourself to just the 16 regulation. And let's look beyond that. Because we know that 17 all software is not used just for this purpose, right? That 18 it's used for a lot of different things. And source codes 19 perform the same function, whether it's, you know, vis-a-vis 20 the -- how it's going to be used or how the computer is going 21 to function and essentially instructing the computer as to what 22 to do. 23 Mr. Coppolino: Right. 24 The Court: In the same way whether it's doing this 25 function or whether it's telling it to read an encyclopedia, 22 1 right? 2 Mr. Coppolino: Your honor, I agree that source code 3 has to be applied to a particular application, whether it's 4 word processing or e-mail or some other application. 5 But the essential function of the source code in this 6 case and the source code that's covered by the regulations is 7 to maintain data confidentiality. 8 The Court: I understand that. 9 But in the context of speech and what is speech, you 10 have to evaluate not just what this is but what the function of 11 the source code is and then determine whether or not it is 12 speech. Because if it's speech in one context, why isn't it 13 speech in this context? 14 Mr. Coppolino: The problem with that, your honor, is 15 that that's not the case before you. 16 If you had a case involving software which had the 17 Bernstein source code in it, which did not function to maintain 18 data confidentiality or secrecy -- for example, in the 19 regulations there is something called data authentication, 20 which is an encryption process which just allows you to verify 21 whether the data you sent was received at the other end. It's 22 not a secrecy function. 23 If the final source code product before you was just 24 that, then it wouldn't be covered by category 13(b). I don't 25 think it would be a speech issue. 23 1 The point is, though -- the question you raise, I 2 believe, goes to the final function of the software. And 3 that -- and it depends what kind of software the source code is 4 applied to. But this source code was Justice being -- he wants 5 to export it as a source code to show how it works. And that 6 source code can maintain data confidentiality. It's not 7 packaged with anything that would not maintain data 8 confidentiality, according to the analysis at the NSA. And 9 that is the key. 10 In other words, the speech issue that you raise is not 11 before us because the source code standing by itself can be 12 utilized to maintain data confidentiality, and that is the 13 final determination with respect to the ITAR. 14 If he submitted a software program that did not do 15 that, that did not maintain the secrecy of communications, even 16 though it utilized the Snuffle source code, it would probably 17 be a different case. But he didn't do that. And that's why 18 it's covered by category 13(b). 19 And I would also say, your honor, that that is -- you 20 know, that is a technical issue. It's a technical evaluation 21 that the government has the discretion to make in terms of 22 whether or not there is a basis for including something on 23 category 13(b) or not. 24 The Court: Well, yes. But it's not up to the 25 government to determine what is speech. 24 1 Mr. Coppolino: No. And we are certainly not saying 2 that. We just don't think that a functioning commodity that 3 can maintain the secrecy of a communication is speech. And 4 that is really the essential point. 5 And all I would say is that -- 6 The Court: Well, let me hear from plaintiff's counsel 7 on this. 8 Mr. Coppolino: Thank you, your honor. 9 The Court: And find out exactly what it is, you know, 10 that -- are we talking about the right target of this action? 11 Ms. Cohn: I'm sorry? 12 The Court: Namely, the software and the source code? 13 Ms. Cohn: Well, your honor, certainly the software and 14 the source code is the -- a key target of this action. 15 But our position has been with regard to the noncode 16 items that standing in Dan Bernstein's shoes at the time that 17 he made these submissions to the Justice Department -- excuse 18 me -- to the State Department, it was, to be kind, unclear at 19 best whether he could publish the noncode items. 20 And we think that that's a serious issue. Because if 21 the government can do that and be unclear and leave people like 22 Dr. Bernstein not knowing what he can publish and what he can't 23 publish, they have created a chilling effect. 24 And for them to then turn around after they have been 25 sued and say, oh, we didn't really mean a couple of these 25 1 items; you just misunderstood us, is not appropriate when what 2 they are chilling is first amendment expression. 3 I don't think that Mr. Coppolino would disagree with me 4 that the paper that was submitted is protected speech. 5 And I think a clear reading of what Dan asked the 6 government and what the government said back left him pretty 7 clearly understanding that he could not publish even his paper. 8 and I think the government has to do better than that when it's 9 speech at stake. 10 The Court: Assuming that the government concedes -- 11 and I guess they do -- that those items that have now been 12 removed from those that were submitted are not subject to the 13 regulation, and assuming -- I assume as to the paper they 14 certainly would agree that that is speech -- and assuming that 15 the other items they also agree are speech, he is now no longer 16 restrained, what is the remedy? 17 Ms. Cohn: I think that the regulations still need to 18 be changed on their face, your honor. There is nothing right 19 now in the way that the regulations are set up or the way that 20 they are administered that binds the State Department or any of 21 the agencies to do the same thing with the next person who 22 submits a paper. 23 In the Edler case we got a narrowing judicial 24 construction of technical data, but we don't have anything 25 binding them to prevent them from continuing this chilling 26 1 effect in the future and then just waiting until they are sued 2 and then issuing clarifications. 3 I think that that's part of our facial challenge here 4 is that this regulation is not set up to protect speech. And 5 we saw that exactly happen in Dr. Bernstein's case. 6 So even with such a stipulation, I think the issue of 7 whether their regulations properly protect speech is -- needs 8 to continue because we need to get either some sort of judicial 9 construction, or they need to rewrite their regulations so it's 10 more clear. 11 It's important to remember, I think, when you are 12 thinking about this what their definition of "software" 13 includes. 14 Now, he is talking today that he is only concerned 15 about software that can function to encrypt. 16 But, as we noted in our papers, their definition of 17 "software" in the regulation includes algorithms, includes many 18 things that are not software which can function to encrypt. 19 Now, he can come up here today and tell you that that's 20 not what they are planning to restrict and to show you 21 documents where they didn't restrict it. But all that seems to 22 me to prove is that they have got absolute discretion. There 23 is nothing binding them to this interpretation right now. 24 And I submit that for future people who are interested 25 in publishing their algorithms, unless we have something 27 1 binding from this Court, there is going to be nothing to stop 2 them next time from once again saying what they said to Dr. 3 Bernstein, which is this contains a strategic algorithm. You 4 can't publish it. 5 The Court: And what about the software itself? Is 6 that really the focus of the attack? 7 Ms. Cohn: I think that that's certainly the only thing 8 that they are defending against seriously. 9 But I think one final point that is important to 10 remember is that they did not say that he could publish the 11 other noncode items. They said that they are technical data. 12 technical data is still controlled and brings up a whole nother 13 kettle of fish of problems with the regulations. So I think 14 it's important to remember that they didn't say he could 15 publish the noncodes items. They didn't go that far. 16 But, you're right, the meat of what we are arguing 17 about today is the software. 18 The Court: Do we look at, first of all, software sort 19 of in gross, so to speak -- in other words, what is software, 20 what does it do, what is its function -- to determine whether 21 it's speech, or do we look just at the regulation in the 22 software that's involved here and what it does? 23 And, finally -- you know, it's compound, complex all 24 the things you are not supposed to do -- number three, does it 25 make any difference, if there is a difference, between those 28 1 two? 2 Ms. Cohn: I think it does make a difference, your 3 honor. I think there is a difference. 4 I think I need to answer these in reverse order, but I 5 will do my best. 6 The Court: That's fine. Take them in any order you 7 want. I deserve what I get by asking that question. 8 Ms. Cohn: I think it's important to look at in this 9 particular case what encryption software functions to do. 10 because encryption software functions to allow people to have 11 private speech. And I think that that fact alone triggers 12 first amendment analysis here. 13 If the government is trying to regulate control of 14 something that allows people to have private speech, the first 15 amendment has got to come into play. 16 Part of the first amendment is the ability to speak 17 privately with others. Another way of saying that is the 18 ability to control who you speak to and not to have other 19 people listening in on your conversations. And that's what 20 this tool does. 21 So I think on that -- even if you look at what the 22 function of software is, the capability of maintaining secrecy, 23 I think we are in the grounds of the first amendment, and a 24 first amendment analysis is warranted if they want to regulate 25 in this area. 29 1 The second question is that you can't just look at 2 software as a whole. You have to look at what someone is doing 3 with the software, how it happens. 4 Just like -- just like wearing a jacket can be speech 5 sometimes and other times it's Justice wearing a jacket. Using 6 software on some occasions can be speech and other times it may 7 not be. 8 And that's where what Mr. Bernstein was trying to do 9 becomes critical. Because Dr. Bernstein was trying to 10 communicate his software. He was trying to post it to an 11 academic group where people could take a look at it and tell 12 him if it was a good idea or not. We call that a scientific 13 method where I went to school. 14 What he is trying to do is to advance the sciences. 15 and for the government to sit and regulate and decide which 16 sciences can be advanced, can be published in, and which 17 sciences cannot is impermissible under the first amendment, 18 again, unless they can meet the Pentagon paper standards and 19 the other first amendment tests. 20 It's important to remember here that we are not arguing 21 they can't regulate. We are arguing that they have got to meet 22 these stringent first amendment standards to the extent that 23 their regulation expects protected expression. 24 Okay. Let me know if I have answered them all. Let me 25 know if I missed one. 30 1 The Court: No. I think you have. 2 But going from that to the application in -- generally 3 under this regulation -- and maybe I really should be asking 4 the government this, but I will ask you and then you can 5 respond. 6 Do you understand this regulation to mean any kind of 7 software -- I will use the term "software" for now -- that has 8 the ability to do any kind of encryption or decryption even if 9 it's used for commercial purposes as opposed to for National 10 Security or whatever, you know, purposes that the government 11 may be concerned about. And, obviously, it's not National 12 Security. But, in other words, I assume the process is the 13 same. 14 Ms. Cohn: Yes. Your honor, I think the process is the 15 same. I might be a little out of my technical depth. But I 16 believe that encryption is like envelopes. It doesn't 17 really -- what you put in it can vary. The function itself is 18 the same. 19 It is my understanding from reading the ITAR that the 20 regulation requires licensing for software with the capability 21 of maintaining secrecy. 22 What that says to me is whenever the State Department 23 deems that the software is capable of maintaining secrecy, the 24 person who developed it has to get a license. So I think it is 25 generally any software. And there is no distinction that I can 31 1 see in the regulations to say that something that is going for 2 a military application is different from regular software. 3 In fact, with Dr. Bernstein's software, as he said to 4 the State Department -- and I don't think they have 5 challenged -- it's not for a military application. 6 The Court: Ms. Cohn -- I'm sorry. I don't have the 7 papers in front of me. I may not be pronouncing your name 8 correctly. But can one make a distinction? Is the process the 9 same whether it's used for commercial purposes, say, at&t 10 doesn't want mci and sprint and all the rest of them to know 11 what they are doing, and so they have developed software that 12 will accomplish this purpose. That's -- is it essentially the 13 same process that is being used, say, by Dr. Bernstein or that 14 would be used, you know, by the Department of defense or the 15 cia? 16 Mr. Coppolino: Yes, your honor. It's the same 17 analysis. The ITAR refers to or concerns encryption software 18 which maintains secrecy, and there are distinctions which I 19 could get to. 20 But to answer your question about commercial versus 21 noncommercial, the focus of the regulation is on a commodity 22 that's covered by the munitions list. The regulation doesn't 23 exist to regulate just money making. It exists to regulate the 24 distributions of a product even if someone wants to just give 25 it away because the product can function. And that is the key. 32 1 The Court: So any software. 2 Mr. Coppolino: Any software -- 3 The Court: As I say, if at&t developed some software 4 because they wanted to be able to communicate within the 5 entities or with other entities but not have mci and sprint be 6 able to get access to it all and they developed a software, 7 they would have to get a license? 8 Mr. Coppolino: If it's a software that functions to 9 maintain secrecy that they wish to export and it does not fall 10 within the exceptions in the ITAR, they would. 11 The example you provide is interesting because the 12 government does give licenses, for example, to U.S. 13 corporations with subsidiaries abroad that seek to use 14 encryption to protect their communications. 15 And in fact while I am on that point, let me just say 16 that this is not a prohibition on the export of Snuffle or any 17 type of software. It's simply an attempt to control it. 18 If Mr. Bernstein's Cj request indicated he wanted to 19 transmit it electronically to all over the globe, would it 20 be -- and his request was is this on the usml. If he had come 21 with a license request to say, "I want to send it to this 22 specific end user to this specific end use," there is a chance 23 it might have been licensed, and we do license things such as 24 the example that you have just provided. 25 But to get back to your commercial question, if we had 33 1 an exception, for example, for academics or hobbyists, that if 2 you wanted to export encryption software just to sort of show 3 how it works, what would be the principal line? From our 4 standpoint, there would be no principal line to then turn 5 around and say to a commercial provider, "you can't export 6 yours," because in substance it is the same thing. 7 The Court: The point of it was does it function the 8 same. And essentially what you are saying is it functions the 9 same whatever the context, whether it's for military purposes 10 or whether it's for commercial or whatever. 11 Mr. Coppolino: Most definitely. 12 The Court: If it's decryption or encryption software, 13 it's covered, period. 14 Mr. Coppolino: That's right. Your honor, the ITAR 15 covers items which have a military and intelligence capability. 16 Ms. Cohn is right, encryption hides communications. It 17 could be a love letter, or it could be an order from saddam 18 hussein to bomb kuwait. It hides a communication. 19 And we regulate the software depending on its 20 significance and its power -- the most significant and the most 21 powerful is regulated under the usml -- precisely because it 22 can have a military communication -- a military or intelligence 23 significance because it can encrypt. 24 As we have indicated in our papers, the history is 25 replete with showing the importance of code breaking. It saves 34 1 lives. It's critical to military exercises to try to determine 2 what the enemy is doing on the battlefield to try to determine 3 what terrorist organizations are doing. So that is why it has 4 a military and intelligence application. 5 But the ITAR does not cover all encryption software. 6 that is simply not correct. The ITAR under category 13(b) 7 specifically says, "we cover encryption software except as 8 provided herein." And it excludes software, for example, for 9 financial institutions, software which maintains the data 10 authentication function that I described to you, and in 1992 11 the State Department announced an initiative to transfer a 12 whole category of encryption software to the State 13 Department -- I mean, to the commerce Department, commerce 14 control list, depending on its specific criteria, such as 15 whether it's an over-the-counter software, whether it's mass 16 market software. Over-the-counter there is an evaluation of 17 the specific encryption and algorithm in there and so on. 18 And so there is an attempt to limit the scope of the 19 encryption software that is covered by category 13(b). There 20 is an attempt to narrow that focus. 21 And that's critical because -- and, furthermore, on the 22 issue of maintaining secrecy, that seems pretty clear. That's 23 not ambiguous. If the software can maintain secrecy, which 24 means that if you can't read the communication, it's 25 covered. And that shouldn't be ambiguous. 35 1 Now, the issue of the fact that software is defined as 2 an algorithm, that is in the definition of software, your 3 honor. 4 But, as you can see from the materials we submitted, we 5 don't regulate theories about algorithms. We don't regulate 6 algorithms. Indeed -- we regulate the algorithm when it is 7 incorporated into a source code when it is in computer 8 programming language. 9 You can see that from the materials we submitted which 10 are replete with algorithms which lay them out and discuss 11 them. 12 Furthermore, one of the most significant encryption 13 algorithms is called the data encryption standard. That 14 algorithm was published by the United States government. It 15 was actually put out there in a publication which I have with 16 me. So it's not the algorithm. It is source code which 17 incorporates and utilizes the algorithm. That's the key. 18 The Court: I gather, that plaintiff -- one of 19 plaintiff's arguments is that all of that that you have now 20 just said may not be that clear from the regulations; is that 21 correct? 22 Ms. Cohn: Certainly the part about the algorithms is 23 not at all clear from the regulations. And so the agencies 24 aren't bound by it. We don't think that's an appropriate way 25 to deal with issues that reach into protected expression. 36 1 Mr. Coppolino: Your honor? 2 The Court: Are the regulations specific enough to -- 3 and clear enough to exclude algorithms other than how they are 4 incorporated for the purposes of the regulation? 5 Mr. Coppolino: Your honor, it is clearly susceptible 6 to that construction. There is no question about it. Because 7 you can see that we don't regulate algorithms in theory. We 8 regulate them in the source code. Algorithms are freely 9 published and discussed in theory. The Court can take judicial 10 notice of that. And if they can cite one case in which we 11 said, "don't publish that article describing that algorithm 12 because that's software," I would like to see it. 13 The cases concern algorithms which are in source code 14 form, which means that they can be used to turn a computer into 15 an operating device. That's the key. 16 As I indicated, a lot of encryption algorithms, if not 17 all of them, are published so that they can withstand peer 18 reviews to determine whether or not they are strong. There are 19 mathematical formulas. They get tested. We don't regulate the 20 theory, the formula or -- itself. We regulate it when it is in 21 a source code. 22 And with respect to the argument about a chilling 23 effect, your honor, how can there be a chilling effect on the 24 notion that he can't give a speech or teach in a classroom or 25 publish an article when there is a mountain of literature out 37 1 there about cryptology, about cryptographic algorithms, when 2 there are symposia that go on all the time. We have given you 3 just two examples of that. 4 As I say, that is his interpretation of the ITAR. That 5 is an interpretation that was of great concern in the early 6 1980's. It is an interpretation which the Court of Appeals in 7 Edler specifically addressed. And it provided the judicial 8 narrowing construction that's binding here as to whether or not 9 the technical data provisions can be constitutionally construed 10 in the face of a prior restraint, overbreadth or vagueness 11 challenge. That construction has already been made. 12 If you simply want to confirm that, that's acceptable, 13 certainly with respect to technical data, when you are dealing 14 with that part of the case. But that construction exists. 15 The Court: And we need to move on. 16 The real thrust of this complaint has to do with -- 17 although you have raised other issues, vagueness, overbreadth 18 and so forth -- really are the first amendment and the prior 19 restraint in the context of the first amendment, of course. 20 but those are the critical issues, right? 21 Ms. Cohn: Yes, your honor. That's why we focused on 22 them in our brief. 23 The Court: And I don't know. Let me ask you this: In 24 terms of the Court resolving the motion, is it necessary if the 25 Court -- if the Court makes a determination that this for first 38 1 amendment purposes and/or prior restraint does State a 2 colorable claim and that we have to then go to the next step, 3 is there any reason to deal now or in the Court's order with 4 overbreadth and vagueness? 5 Ms. Cohn: Your honor? 6 The Court: Now, obviously, if I say it's not colorable 7 and I dismiss it, then we have to get to the remaining claims 8 as well. 9 Mr. Coppolino: If I may -- 10 Ms. Cohn: No. 11 Mr. Coppolino: I just think that prior restraint and 12 vagueness and overbreadth all go together. Certainly with 13 respect to technical data, they all went together in Edler _____ 14 because it's an issue as to whether or not the regulation is so 15 either vague or overbroad that it can serve as a prior 16 restraint, and I think those all come in together. And with 17 respect to technical data, they all go out together. So that's 18 how I -- I think that those issues kind of hang together. 19 The Court: Okay. So that's why you focused on it in 20 the context of the first amendment, your argument is in the 21 context of the first amendment, but it's essentially the same 22 thing. 23 Ms. Cohn: Yes. 24 Your honor, it's our position that in order to -- 25 The Court: Do you agree? 39 1 Ms. Cohn: Yes. 2 The Court: Okay. Fine. 3 Ms. Cohn: Surprisingly, I agree with Mr. Coppolino, 4 that part of what -- part of making the regulation pass first 5 amendment mustard, it's Pentagon papers test, the Freedman V. 6 Marilyn test and the compelling interest test that has to do 7 with vagueness and overbreadth in that it has got to be 8 narrowly tailored. So I think that they are part and parcel of 9 the same thing. 10 Mr. Coppolino: That's a legal question. We think that 11 the regulation is not targeted at speech on its face but is 12 targeted at the conduct of exporting a functioning commodity. 13 the O'Brien test applies. And the O'Brien test has four parts, 14 whether it's within the government's Constitutional power, but 15 whether the government has a significant interest, which is 16 unquestioned here because our interest concerns the signals 17 intelligence function; whether it's unrelated to the expression 18 of speech, which we believe it is, and whether or not -- it is 19 not narrowly tailored. It doesn't have to be the least 20 restrictive alternative. The test under O'Brien and ccnv is 21 whether the government's interest would be better served by the 22 regulation or not. 23 I mean, when you look at the cases this has been 24 applied to. In the case of the draft card case, the Court 25 concluded that the government's interest in promoting a 40 1 selective service system would be better served by preventing 2 people from burning their draft card, which is obviously more 3 symbolic than the conduct of exporting software. 4 But if I could just close with two points, your honor. 5 again, I would just ask the Court to take a look at the exhibit 6 that he submitted. It is not a paper. He can characterize it 7 that way, but it is a submission of a request for Snuffle 8 software, it is in source code form, and it explains how to 9 utilize it on a computer. 10 And that was to our standpoint -- from my standpoint 11 that was a request to get a determination on whether or not he 12 could export a particular functioning product. And we don't 13 believe that that implicates speech. 14 Can I make one last point and I will turn it over to 15 ms. Cohn? 16 You mentioned what could come next? Well, you saw 17 their 56(f) affidavit, and it's quite raw as to the kinds of 18 discovery that they would seek, and there are a number of areas 19 that are of great concern, and before I left today, I wanted 20 just to flag for you one of those areas because of its -- 21 The Court: We are not there yet. 22 Mr. Coppolino: Particularly on the government 23 interest, your honor, because it's a highly sensitive, National 24 Security area. 25 The Court: Yes. And I think that if the Court denies 41 1 the motion in part that before any attempt at discovery is done 2 that that discovery should be controlled. 3 Now, I am not suggesting I am going to rule because I 4 am waiting to hear -- usually I come out here with my mind 5 pretty much made up but not totally in this case. 6 Mr. Coppolino: I thank the Court. 7 The Court: So your arguments were helpful. 8 Ms. Cohn: Your honor, there were just a couple of 9 things I would like to address. 10 The first has to do with the application of the O'Brien 11 test. And our position is that the O'Brien test is not 12 applicable here. 13 And the key thing to think through in thinking about 14 whether O'Brien applies is what was our client trying to do. 15 he was trying to communicate -- he was trying to publish 16 software. And what is it they restrict? 17 Well, their definition of "export" is disclosure to a 18 foreign person. And we find it difficult, if not impossible, 19 to preserve the ability to publish when it's -- when you need a 20 license to disclose to a foreign person. 21 And if what they are trying to regulate here is 22 disclosure -- on its face that's what they are trying to 23 regulate; that's what export is -- then O'Brien is not 24 applicable. And in fact the Justice Department's own memos 25 concluded that a stricter test than O'Brien is required. 42 1 that's because what they are trying to control here is 2 communication. 3 The second point I want to make is that Mr. Coppolino 4 has talked a lot about how software can function to encrypt and 5 that he is concerned about that function. 6 But I think that's just another way of saying he is 7 concerned about the effect of publication. He is concerned 8 about what possible harms might happen after publication. 9 And we submit that if that's his concern, then the 10 first amendment set of tests provides the appropriate way to 11 look at what the harms are. And if he can prove a direct, 12 immediate and irreparable harm under the Pentagon papers case, 13 then he can regulate. 14 The Court: Now, what do you mean when you use the term 15 "publication"? What are you defining as "publication"? 16 Ms. Cohn: Well, I think that -- what we are defining 17 is general publication, which means communication to a mass 18 audience in a way that you cannot identify. 19 The Court: In a hard-copy form? 20 Ms. Cohn: A hard-copy form or electronic form. And we 21 gave you in our brief the Cubby V. Compuserve case, which held 22 that it's not appropriate to call electronic publishing 23 something different than regular publishing. And that's our 24 position. He is doing it for the exact same reasons he might 25 publish it on paper, the exact same purpose, and that that's 43 1 protected expression. 2 The Court: Okay. 3 Ms. Cohn: The government agrees with us that Dr. 4 Bernstein cannot publish his computer code without a license. 5 we think that that step alone triggers the first amendment 6 analysis here, regardless with whether you agree with us on the 7 noncode and what the facts purely say. Even on the software 8 alone, there is a first amendment analysis necessary here, 9 given what they are trying to control, especially given the 10 particular function of encryption software, which is to allow 11 privacy of speech. 12 Thank you, your honor. 13 Mr. Coppolino: Thank you, your honor. 14 The Court: Okay. Thank you very much. The matter is 15 deemed submitted. 16 (Proceedings Concluded At 12:33 P.M.) 17 1 Certificate Of Reporter 2 3 4 I, Judith N. Dudeck, The Undersigned Official Court 5 reporter for the United States district Court for the northern 6 district of California, 450 Golden Gate avenue, San Francisco, 7 California, do hereby certify: 8 9 That The Foregoing Transcript, Pages Numbered 1 10 through 43, inclusive, constitutes a full, true and correct 11 transcript of my shorthand notes taken as such official 12 reporter to the proceedings hereinbefore entitled, and reduced 13 to typewriting to the best of my ability. 14 15 16 17 ----------------------------------- 18 Judith N. Dudeck Official Court Reporter, C.S.R. 5591