In The United States District Court For the northern district of California daniel J. Bernstein, ) no. c-95-0582-mhp ) Plaintiff, ) ) vs. ) San Francisco, California ) united States Department of ) september 20, 1996 state, Et Al., ) ) Defendants. ) _______________________________) Transcript Of Proceedings before the honorable Marilyn Hall Patel, Judge appearances: for Plaintiff: Mc Glashan & Sarrail By: Cindy A. Cohn, Esq. 177 Bovet Road, Sixth Floor San Mateo, California 94402 Lee Tien, Esq. Attorney At Law 1452 Curtis Street Berkeley, California 94702 Steefel, Levitt & Weiss By: M. Edward Ross, Esq. One Embarcadero Center, 30Th Floor San Francisco, California 94111 First Amendment Project By: James Wheaton, Esq. 1736 Franklin, 8Th Floor Oakland, California 94612 for Defendants: Michael J. Yamaguchi, Esq. United States Attorney By: Anthony J. Coppolino, Esq. Department Of Justice Civil Division, Room 1084 901 E Street, N.W. Washington, D.C. 20530 reported By: Carl R. Pline Official Court Reporter Post Office Box 36052 450 Golden Gate Avenue San Francisco, California 94102 friday, September 20, 1996 12:19 P.M., O'Clock The clerk: Civil action 95-0582, Bernstein versus U.S. Department of State, for plaintiff's application for a partial summary judgment, and defendants' motion for summary judgment. Counsel, your appearances, please. Mr. Coppolino: Good afternoon, your honor. Anthony Coppolino with the Department of Justice representing the defendants. The Court: Good afternoon. Ms. Cohn: Good afternoon, your honor. Cindy Cohn, Mc Glashan & Sarrail, representing the plaintiffs. With me are co-counsel. Mr. Wheaton: James Wheaton with the first amendment project, your honor. Mr. Tien: Lee Tien. Mr. Ross: Ed Ross, Steefel, Levitt & Weiss. The Court: Okay. Good afternoon, counsel. Are you all by yourself? Mr. Coppolino: I am distinctly outnumbered today, your honor. The Court: Okay. I thought the government had batteries of lawyers. Mr. Coppolino: No. We staff leanly. The Court: I understand. And with respect to plaintiffs, who is going to be heard? Ms. Cohn: I am, your honor. The Court: Anybody else? Just you. So you brought all these people along for moral support, or to give them appropriate credit, or... are they resources to answer questions? Ms. Cohn: They may be resources to answer questions, your honor. But I'm hoping that I'll be able to handle everything myself today. The Court: I'm sure. I'm sure. A question which -- which may or may not be critical, but... maybe it's more metaphysical. But is encryption or decryption something that you can define as content based? Ms. Cohn: Are you asking me, your honor? The Court: Either one of you. Ms. Cohn: I'd be happy to respond. The Court: Okay. Ms. Cohn: I -- I think that the function of encryption is content based. Certainly the regulation of encryption is content based. Because, first of all, the government is picking a particular subject matter, and deciding anything about that subject is regulated. It's regulate -- or not anything, perhaps, they're saying now, as they clarified it. But the regulation is based on the subject matter of the material. And I think that's classically content based. I also think it's content based for a second reason, which is that the -- what encryption does is inherently... a content-based issue. It allows -- it allows privacy of speech. and it's the content of the ideas there that allow the first amendment protected activity to -- to happen. The Court: Well, is that a whole new proposition or theory that you're raising? That... novel -- by -- by referring to a theory, I mean a novel one under first amendment law; that by -- by reason of the.... the ability of encryption to... shroud conversation -- I don't mean "shroud" as a pejorative, but shroud some conversation with some aura of privacy that that is some separate basis for a special kind of fifth amendment protection that we don't already have under some other guise? Ms. Cohn: Well, your honor, I think that the -- the case law in the area of -- of protected expression -- I mean, obviously, there's been no case that determined that encryption -- methodology of encryption is first amendment protected -- The Court: No. Had that been the case we would -- Ms. Cohn: It would have been a much shorter case. yes, your honor. But we do think that there are several strains of first amendment law that lead easily to that conclusion and in other contexts. The -- the first is that -- that -- the first is the -- the cases that find that -- that compelled speech is -- that a regulation that compels speech is unconstitutional. And the -- the lead case in that is hurley versus irish-american just a few sessions ago. We think that by regulating in such a way that people are compelled to speak to people who they don't want to speak to -- and that's -- stepping back a minute, that's what encryption does, it's an envelope. And if you don't have the electronic envelope, you send postcards. And when you're sending a postcard, you're speaking to all the people on the way who can see the postcard. When you're sending an envelope, you're speaking to just the person who -- who receives it on the other end. So we think that that line of cases on compelled speech leads easily to the finding that electronic envelopes should be protected. The other line of speeches -- the other line of cases is the anonymous speech cases, Mc intyre versus ohio election commission, where -- because, again, if -- if you're forced to speak on the postcard, then you can't be anonymous in your speech. Putting it in an envelope allows you to be anonymous in your speech. And the third, and I think a very important line of cases, are the freedom of association cases. And the lead case is naacp versus alabama ex rel patterson, where the Court says that compelled disclosure of who you associate with, and who you speak with is a first amendment problem. And, once again, if you're forced to communicate on postcards, then you're forced to disclose who you are communicating with and the substance of what you're communicating. So I think that these line of cases all come to the conclusion that there's a special first amendment problem when what the government is trying to regulate is something that allows privacy of speech. The Court: But getting back -- that's -- that's a theory that you have postulated for carving out a special area for protection; namely, the right to speak confidentially. If -- if there is such a right. One generally thinks of the first amendment, of course, as the right to speak out, and speak your views, and be heard; right? Without fear of -- of abridgement. Ms. Cohn: Well, I -- I think that's true. That's one of the key things of the first amendment. But I think the first amendment is much broader than that. And that's where I -- that's where I think the freedom of association is so very important. Because that's first amendment jurisprudence as well. That part of the ability to speak is creating a bubble around the speech that -- that allows you to plan things, especially political planning. And -- and... speak in a way -- speak freely. And -- and if you take away the right to control who hears your speech, then I think the first amendment is greatly affected. In the same way that the Court held in the naacp case that your ability to associate is greatly affected, if the list of who you associate with can be made freely available. People are going to be chilled in what they say. The Court: But that gets away, though, from the question I was asking you about: Is encryption content based? And does that not in fact perhaps... cut against an argument that encryption is -- encryption is more like an -- the envelope; right? It's not what's -- so it's the envelope; it's not what's in the envelope. It's the form of communicating, not the actual substance of the communication. Ms. Cohn: Well, your honor, that's where cryptography and especially cryptography that's -- that is affected through the use of computer software kind of.... is on both sides of the line I think. Because -- and that's what -- to me one of the things that makes this case so interesting is that -- that... it's a subject of mathematics, cryptography. It's ideas. The regulation of the -- the regulatory scheme requires that the state Department -- that the defendants evaluate the cryptography, the cryptographic source code and ideas that you send in to them. They've got to decide: What can this be used for? how strong is it? Can we break it easily? And those are content-based descriptions. They've got to read it, and evaluate it, and decide whether -- you know, in their discretion whether it's something that they think ought to be -- require a license or not. And that's the whole process of -- the Cj process and the licensing system sets up. So it's inherently content based, when you look at what it is they have to do to make it work. The Court: Is it content based in the context of the statute, and the purpose of the statute? Namely, the statute is -- the statute is not looking for recipes. The statute is not looking for... sort of household items, or... the -- say the plans for or the patent application of an automobile, or some -- some device. It defines by virtue of the kind of things that may -- may be in the National interest that the United States does not want its enemies, or other foreign -- or foreign countries to get their hands on, whether it be in the form of weapons, or... Ms. Cohn: I think -- The Court: .... some form of those, to what -- to encrypt them. Ms. Cohn: I think you're right. When you look at the statute, the statute doesn't mandate content-based determinations by the State Department. I think that the problem of content-based regulation comes in the regulations and the ITAR scheme. And in the way it attempts to carry out the very broad and unfocused mandate that the statute gives them. So to the extent there's a statutory problem, I think the statutory problem is that it doesn't limit their discretion to create regulations that discriminate based on content. But I think that the real problem here is that the regulations, which defendants have created as a result of this very broad, very vague mandate, do discriminate based upon the content. The Court: Do you wish to get into this conversation? Mr. Coppolino: I do, your honor. The Court: Or whatever it is. Is -- is encryption in and of itself, by virtue of putting it in this statute, or in the regs, or decryption, is that by its very definition content based? Mr. Coppolino: Well, we think not, your honor. And this is really the heart of the beginning at least of the first amendment analysis with respect to this -- the controls on this cryptographic software. The regulations provide that certain cryptographic software devices and soft -- certain cryptographic devices and software are controlled if they have the capability, the capability of maintaining secrecy or confidentiality. I think where we fundamentally differ, your honor, is that the functionality of a commodity, how it functions, its technical capabilities, what it can do when it is loaded on to a computer is not a content related concept. And controlling that technical capability; that that is your objective. Your objective is not to control the theory and the idea of the software or the device, but your -- your objective is to control what it can do. And in particular in this case the objective is -- it can -- is to have some controls on the end use and end user, or who is going to get these kinds of devices or this kind of software, and potentially deploy it against the interests of the United States abroad. If I could just step back a moment and -- and say that the basic test for determining whether or not something is subject to strict scrutiny is whether or not it is content related. And the supreme Court has made clear that that is an inquiry which turns on whether the government's purpose in relating the speech at issue is to control its content; is disagreement with this message. So that has to be apparent either from the face of the statute, or the regulations. And examples where this has been found by the Court before, for example -- and we cited a number of cases in our brief -- but where the ordinance specifically targets an idea, or -- or the content of speech. for example, indecent speech is regulated in some statutes. A case I just finished with the -- the internet indecency case, where the congress said: If your speech is offensive depictions of sexuality, it is regulated a certain way. That's describing the content. Another case -- a couple of these cases occurred where ordinances regulating protest marches were governed on -- were -- were based on what people were protesting about. Whether it was about, for example -- for example, there was a statute in washington which prohibited picketing in front of a foreign embassy, where you were complaining about policies of that government. Clearly content oriented. The Court said that's got to be subjected to strict scrutiny. So the Court has to look to see whether the statute and regulations are directed at the substance of ideas. And in this case we submit that it is not. That it is directed at the functioning of a product. Now, Ms. Cohn said something earlier with which we agree to some extent. There are two material facts regarding cryptographic soft -- source code and software that are at issue in the case. One -- and we've stipulated to both of these in the joint statement of facts we filed about a week ago. One of them is that for those people who can understand source code, who can read it, and figure it out, who have that training, that source code and programming language may have informative value. That is sort of one fact out there. And at least for the purposes of this motion we -- we don't disagree with it, because it's not dispositive of the question. The second key material fact is that the source code has a functionality. You can take it, you can compile it. You can -- by -- by pressing a button really -- it's a very trivial step. And then you can use it to execute and encrypt information. And that is really the second key factor. The question for the Court is: Why does the government regulate it, given those two qualities and characteristics? We don't care if the idea implicit in the source code is a brilliant idea, or not a very brilliant idea. We don't care about the theory. We care about what it can do when you load it on to a computer. We care about what it can do specifically overseas, because we have concern that there's -- if there is no control on the export of these types of products, that they will be greatly available overseas. And U.S. technology, which is highly secretive in advance technology, could then be turned around and employed against the government... and potentially hinder a very important National Security mission, which is to collect secrets and intelligence abroad and find out, in some instances, what -- what foreign militaries are doing on the battlefield. Very critical National Security interests. So that -- that's the main point. That functionality -- regulation of functionality is not a content-based concept. A couple of other points. Ms. Cohn referred to the doctrines concerning compelled speech, and anonymous speech, and free association. The -- the problem with those cases, your honor, is that the government is not regulating the use of cryptographic software. We certainly don't regulate the use or distribution of the software in the United States. If people want to use the software in the United States to speak anonymously, they can do that. And -- and to be candid, we don't regulate the use abroad. We don't really have jurisdiction to regulate the use abroad. What we relate is the transmission of the product abroad. And that is why those doctrines, free association and compelled speech -- which arise in much different contexts than the context of exporting a product with technical functionality -- that's why those -- those cases don't apply. So that -- that's my view on the issue of -- on whether or not it is a content-based regulation. We believe it's not. Because it is -- it is really a function-based regulation. The Court: Well... that didn't win you the day in terms of whether it was speech or not. You are arguing that in fact the source code was -- was essentially functional. It told the machine what to do, and that was all; and, therefore, it was not speech. Right? Mr. Coppolino: Well, it didn't -- it didn't win me the day on that, your honor. But, as I indicated in our papers, accepting that proposition for the purposes of the motion, even though we may ultimately disagree with it, is not dispositive of the issue of why the government seeks to regulate the export of this product. And that -- The Court: But is the inquiry of why the government seeks to regulate it the proper question or inquiry to determine if it's speech? Mr. Coppolino: No. I -- I disagree. Every -- every case involving -- The Court: No. I didn't make a statement; I asked you. Mr. Coppolino: I'm sorry. Then I don't disagree. let me try to answer your question. (laughter.) Never disagree. The Court: You're anticipating the opinion already; right? Mr. Coppolino: The -- the point I'm trying to make is that accepting your -- your opinion in the motion to dismiss the source code that has expressive value, that doesn't resolve two questions. One, what is the standard of review? And, two, once the standard of review is -- is established, is -- is the regulation a violation of free speech? And the reason for that is that in every case involving a regulation of speech, whether or not intermediate or strict scrutiny applies, speech is at issue. The fact that speech is at issue is the starting point, but it doesn't tell you what scrutiny applies, and it doesn't tell you that the first amendment is violated. What scrutiny applies turns on the purpose of the regulation. That's very clear from supreme Court law. Is the regulation targeted at content? That is, the inquiry that gets you to whether or not it's intermediate or strict scrutiny. not whether speech is at issue. Speech was -- was at issue in every case in which the supreme Court has applied the intermediate standard of review, because the regulations at issue in those cases all regulated or affected speech in some way. Either the time, the place, the manner, which is intermediate review; or the content, which is strict scrutiny. The question here then is not whether speech is at issue; that doesn't end the inquiry. It's: Why is the government controlling the export of this product? And we submit that the purpose is to control the transmission of a product that has a technical capability that could be used against the interests of the United States. That solves the standard of review. And now we turn to whether or not we satisfy that standard of review under the intermediate standard of review. The Court: But if -- but if the speech is -- the encryption or decryption code is in fact speech, as this Court has ruled, then why is not looking for the purpose for which it's going to be used in fact not content based? Because you're looking at the content of that -- of that source code. You're looking at what is -- you may be looking at what it's going to do, but you're looking at how it's going to perform that task, and whether it's going to perform it in a way that would reveal secrets that the government is concerned about having revealed; correct? Or at least more easily. Mr. Coppolino: Looking to how it performs its task, looking at -- to -- as to what it can do, looking at -- looking to its technical capability when it's loaded on to a computer, appraising its strength -- its strengths and its weaknesses, figuring out it works, is not related to its ideas. It's -- it's simply a matter on which I guess we're just going to disagree. I mean, I -- when you are assessing what something does, and how it functions, and what it can do, and there -- and controlling it for those purposes, it is not an idea related -- it is not a content-related idea. The problem -- The Court: Then all encryption would be the same; right? Every encryption code would be the same. Every decryption code would be the same. Mr. Coppolino: Actually, that's a good point, your honor, because the regulations in fact distinguish between various functions that cryptographic products and software have which are not regulated. We do not regulate products, for example, and software that merely authenticate the transmission of data, whether the data being transmitted is the data that was received. That's called data authentication. Not regulated. that function is not regulated. There's another function which concerns whether or not you've submitted -- whether or not you -- you should properly have access to a system. For example, password control. There is software which governs whether or not the password you submitted on a particular computer is -- is the correct password. And we don't regulate that function. We do not regulate cryptographic products that are limited to use in financial -- in -- limited to use in financially related products. That's also set forth in the regulations. So that shows that whether -- whether or not we regulate the cryptographic software turns on its function, not on its ideas. And that is -- that is a very basic distinction that I think is really at the heart of the case. The Court: Well, is the idea of the source code something that will identify whether or not it is translating financial information, as compared to some other information that the -- the party sending it wishes to keep secret? Mr. Coppolino: No. It's not the idea of the source code; it is how it is used. It is how it is applied. And in -- in the case of those other products I described, you may in fact have a cryptographic algorithm that applied in another way could do nothing more than maintain the secrecy of information. But in that -- in the particular context of those products; data authentication, access control... financial institution products, the cryptographic source code, the software, is used in a particular way. It has a limited function. It is not, therefore, a general purpose data confidentiality product. With Mr. Bernstein's software it was not limited to a particular application. Its purpose was to maintain the secrecy of communications across the board. That's what it was used for. And that's the -- and that is the distinction. Now, I -- Ms. Cohn: Your honor, I -- I apologize. I hate to break in -- The Court: Well, are you finished with -- let him at least finish with that idea. Ms. Cohn: All right. Mr. Coppolino: I -- that's my -- that's my basic point on that; that functionality -- The Court: He was close to finishing -- Ms. Cohn: Yeah, I thought he was. I suspected he was. Your honor, I guess I -- I just have to differ with one factual assertion. Mr. Coppolino has asserted to you just now that the content of -- of a particular piece of cryptographic software is not at all related to its function. And -- and that's just -- I think, your honor, it's just factually wrong. That the -- that, you know, if -- The Court: Why? Ms. Cohn: Well, because source code gives instructions to the computer to tell it what to do. And if the instructions to the computer tell it that all it is doing is authentication, those instructions -- the -- the content of those instructions is different than the content of the instructions that are telling it to encrypt the data communications. I mean, it -- it.... The content of the -- of the source code is going to be different depending on what it's doing. And so when they're making a distinction based upon what it's doing, they're making a distinction based upon the content of the source code at issue. And I just -- it's -- it's -- I don't normally like to break in, your honor; but that's just factually the -- that's how source code works. That's what it does. Mr. Coppolino: What she's just described is a function. I guess we're going to have point, counterpoint. Or if you want her to do her whole argument -- The Court: That's fine. That's fine. I couldn't -- Mr. Coppolino: What she's just described -- The Court: -- understand the complete argument. maybe you did. Mr. Coppolino: What she just described was functionality, however. The source code instructs the computer to do a certain thing. And by -- by evaluating what the source code is instructing the computer to do, we don't -- we're not trying to control the dissemination of the theory of the source code. We're trying to control the function of what that computer is going to end up doing, if that source code is loaded into it. That's our concern. There are many different types of cryptographic algorithms. They have different -- different mathematical structures, and different mathematical approaches, but they have the same function: Maintain secrecy. And that's the key. but the theories of the algorithms differ. As you can probably discern from the submissions, there are lots of different cryptographic algorithms, and they maintain secrecy in different theoretical ways. We don't care about the theory; we don't care about the idea Mr. Bernstein has, which was to take a particular type of algorithm and use it to allow for an encrypted interactive conversation. That's his idea. We don't care about his idea; we care about the result of what it can do. And the bottom line of my point to you is that concern with how a product can function is not a concern with its content; it's concerned with the technical capability of something being used against you. The Court: Okay. If -- if the source code directs to select out, just as if I were to tell you: Okay, in reviewing that document, select out the following -- and essentially that's what, as I understand it, the source code is doing in this case is select out -- or it may do that, select out certain -- certain things that they recognize, and other things they don't recognize maybe not -- you know, would not be selected out -- but to select out certain ideas and encrypt those -- or maybe it encrypts everything that -- you know, that it reads. But... assuming that it did the former, that it just instructs to select out certain information and encrypt that, and then going back and decrypting, is not that selection process of concern to the government? Mr. Coppolino: The ultimate result is. The -- the ultimate result is of concern in the export controls; that is, the fact that the product can function to apply to a communication in text or in e-mail, and tell the computer to -- to scramble that communication, to make it gibberish, so that it can't be intercepted and read, as Mr. Schneier explains in his declaration, that's the concern. So -- and that is a functional concern. It is a technical capability that we care about. If the software doesn't do that, if it doesn't take a text of a message, a plain text, and turn it into gibberish in a -- in a manner where it can't be -- it can't then be read, we don't care about it. If it can perform that function, we care. You can perform that function pursuant to different theoretical ideas. there are different ways of writing the software to do it. there are different algorithms, different theories. Don't care about the idea. The ideas are freely published. The algorithms are frequently published for peer review, as both -- declarants in both cases have agreed. algorithms are published. Theories are published. Conferences occur on how these things work. Don't care about that. Care about the actual implementation of the idea on a computer to create a function. Ms. Cohn: Your honor, if I could bring us back to the first amendment for a moment. I think it's important to recognize that what the defendants are asking you to do here is to create a new lesser protected category for speech, based upon what they've called functionality. A term that they haven't really defined very well. But.... And -- and I think that that's very dangerous. There's absolutely no support in the case law anywhere for a lesser protected category of speech, based upon functionality. And they've cited none. But I think it's also important that it's not only -- you don't only look at what the government is intending to do to regulate -- to evaluate whether a regulatory licensing scheme passes first amendment muster. You also have to look at how they're doing what they -- what they're intending to do. And there's no question that there are large problems in the ITAR licensing scheme. The Court: Well, let -- Ms. Cohn: Let's remember what happened here -- The Court: -- let me ask you this. Let me ask you this. Does any of this discussion we just had, does it really matter... if -- if there are problems with the licensing scheme, such that it doesn't pass muster under the prior restraint cases? Mr. Coppolino: The discussion we just had on software most definitely matters. And I -- and I would like to explain why. We have tried to sort out in an orderly fashion the -- what we see are the two main things at issue here. There are really two questions. Can we license the export of software, cryptographic software or source code? That's one issue. And what we were just discussing about the functionality of source code is critical to that issue. The separate issue that they have raised goes to whether or not we license the publication of scientific ideas. and this really goes to a separate part of the regulations entirely, concerning how we control technical data. That part of the claim is a facial challenge to the regulations. But -- but that is separate and apart from -- I think Ms. Cohn would agree -- separate and apart from the issue of software. That -- that is at least one discrete issue within the case that I think the issue of functionality is critical to. Because there's no question that the government told dr. Bernstein that if he wanted to export his source code he has to apply for a license. Therefore, the question before -- one question before the Court is: Does that violate the first amendment? And that goes to: What's the standard of review? why is the government regulating it? And we say there's functionality involved, and so on. That's one big, big issue that's on the table. And I think the Court recognized that in the motion to dismiss. Separate issue. Does the government -- does the government's overall licensing scheme with respect to technical data have first amendment problems on facial grounds, vagueness and overbreadth. Separate issue. The Court: But not -- but apart from both of those you would agree that.... that the licensing scheme here is something that obviously precedes any dissemination of the various articles that are controlled; correct? Mr. Coppolino: I -- I concede that it precedes the dissemination of the -- of the software abroad. That's why I draw this distinction. We do not agree, and they have no evidence to show, that the government regulates or licenses the mere publication of a scientific idea, other than the idea implicit in the source code. If -- if by regulating scientific ideas, Ms. Cohn is arguing that we license the export of source code, we agree. to the extent there is an idea in the source code, we license it. We license it for export from the United States. To the extent she is arguing that we license all other types of publication of ideas other than software, we don't agree, because we don't do it. There's no evidence that we do it, in -- in the context of controlling so-called technical data, which is a completely separate part of the regulations. So, therefore, my answer to the question, your honor, is that the threshold question is not the licensing scheme, per se, because we agree that we license software. When we get to the issue of mere scientific information, we don't license it publication -- or we don't license its discussion in a -- in a classroom. And that's a separate issue which -- which I think is really one that, you know, Ms. Cohn may want to address, but it's different from the software issue. The Court: With respect to the -- the software issue, and to the extent it may apply to the technical data issue, it is a predissemination licensing scheme; right? Mr. Coppolino: If I could only quibble with your term. It is a preexport licensing scheme; we -- The Court: Preexport. Preexport. Mr. Coppolino: -- we do not regulate the domestic distribution of software, period. The Court: No. I understand. I understand. Mr. Coppolino: Okay. Then I agree with you. The Court: Okay. Ms. Cohn: Well, your honor, though -- The Court: So, therefore, we're really talking about... prior restraint, in any event; right? Mr. Coppolino: We are -- but, your honor, I think prior restraint is a legal conclusion and term of art which assumes that we are impermissibly controlling the export of this item. The Court: That's the issue. Mr. Coppolino: Okay. (laughter.) Mr. Coppolino: That's the issue. That's exactly the -- The Court: You have to -- you have to define it in terms of the concept, or the -- in terms of the Constitutional issue. And it's awfully hard to draw attention to the constitutional issue of prior restraint without saying those words; right? Mr. Coppolino: Fine. Fine. License -- The Court: That doesn't mean you've already been indicted and convicted. Okay? In fact, that's not the process here in any event. but -- but that's what we're really talking about. Does it matter whether or not -- you know, this lovely discussion we just had about content, does it matter what the content is if... the government's licensing procedures do not pass Constitutional muster under the prior restraint doctrine? Mr. Coppolino: If I -- if I could just comment first. It has to matter, your honor, because if the control of this product is not a violation of the first amendment, then it is not a -- then it is not an impermissible prior restraint under the first amendment to the Constitution. If you're simply going to say: "the software commodity has informational value; therefore, controlling it before it's exported is an illegal prior restraint, no matter what," then the case is over basically. And I suggest to you that is not -- that cannot be correct. Because if you agree with us that the software has a functional capacity that is of legitimate concern to the government, and that the purpose of controlling it is to control that technical capacity, we do not violate the constitution by controlling it. Part of the difficulty we have with this analysis is it really does call into question whether or not software is essentially and fundamentally speech in the first place. It may have communicative value, but it is ultimately a product that functions. And so I guess that brings us right back full circle -- The Court: I guess you want to come back full circle. You'll get that chance again -- Mr. Coppolino: Thank you, your honor. The Court: -- in another Court, with more judges. (laughter.) Perhaps even more wisdom. Who knows? But... in any event, I would not -- I would not claim any great wisdom on it. But -- but looking at lakewood, lakewood had nothing to do with what was in those newspaper racks. It wasn't a regulation that said: Only newspapers, you know... involving, you know... allegations against the democratic party, or something like that; or allegations against the United States government; or only newspapers that bear certain types of pictures on them may not be placed in these news racks in various locations around the city. It had to do with all newspaper racks; right? Mr. Coppolino: Actually, I don't think -- I don't think I agree with that, your honor. I'm just flipping through the reference in my brief. Well, the problem in lakewood was that it gave the local authority, the mayor, complete discretion to decide whether or not certain news racks would be able to go on public property. The Court: Uh-huh. Mr. Coppolino: And he could, therefore, decide: I like that newspaper. I like its contents. It can go. I don't like that newspaper; I don't like its contents; it can't go. And that -- that was the problem there. It was an absolute discretion to control a pure speech activity. And it's very distinguishable, in our view, from deciding whether or not a particular product with a technical functionality can be exported from a country, without first knowing where it's going, and what use it's going to be put. The Court: And how it does it. Mr. Coppolino: And how -- we don't care how it does it. We just care that it does it. That's the key; that it does do it. Now, comparing that to a mayor's discretion to decide whether a news corner can have that newspaper, but not that newspaper, I think is a bit of a stretch. It just doesn't fit in terms of the analogy. The Court: In terms of the.... how the decisions are made with respect to the export licensing, how much guidance is there... sufficient to take it out of that context? I mean, obviously, you're wed to the notion that this isn't speech; it's really functional. And, therefore, you know, it's not the same. But if you get over that for a moment.... Mr. Coppolino: Sure. How much guidance is there to guide that decision? The Court: Yes. Yes. I was just trying to decide whether I could describe the look on your face for the record. (laughter.) Mr. Coppolino: I was just thinking of the right answer. And I've got one. (further laughter.) The regulations, as I indicated a few moments ago, describe the types of cryptographic software that are subject to control. If your software doesn't do what the regulations say, it's not covered. And that is what defines it. The regulations are very specific. Data authentication, not controlled. Financial institution software, not controlled. Access control, not controlled. Maintaining data confidentiality and secrecy -- The Court: Yeah. A whole list. Assembly, and so on and so forth. But apart from those limitations, or exceptions, what other guidance is there to -- Mr. Coppolino: Okay. The Court: -- for the adjudicating officer, for want of a better term? Mr. Coppolino: This is an area I think where the court -- if I understand your question correctly, I think you're getting into an area that does involve discretion within the executive branch to decide whether or not a particular end use or end user of a software product is going to be harmful to the National Security. We look at whether we -- the technical capability of the product, we look at where it's going, and what it's going to be used for, and we make a judgment as to whether or not there is potential harm to the National Security. The Court: Uh-huh. Mr. Coppolino: I submit to the Court that that is an exercise of discretion that is reserved to the executive branch, because it does concern potential harms to our foreign policy and National Security. And I -- and I believe that the case law in the Ninth circuit is legion on this point. It makes very clear that the government has the discretion to decide whether, why, and for what reason, a product is controlled for export for National security and foreign policy reasons for -- The Court: I'm not questioning -- Mr. Coppolino: Okay. The Court: -- the particular exercise of discretion in a particular case. The question for first amendment purposes is: Is the whole scope of discretion sufficiently defined and clear that it meets first amendment standards -- Mr. Coppolino: Right. The Court: -- or is that discretion fairly broad, in -- in gross, in macro; not with respect to each particular decision. Mr. Coppolino: I think it's limited. I'll make this comment, and Ms. Cohn can jump in. But I think it's limited for these reasons. One, first, it's software. Not the ideas. Two, it's not all software. It's some types of software. And, third, we regulate its functionality. We look to the end use, end user, and potential harm to National security. Which I concede the last part is an inherently discretionary judgment call. But before you even get there, it's got to be software; it's got to be software which performs a certain function. Otherwise, if you want to talk about an idea, if you want to publish an article, if you want to distribute it in the united States, no problem. There's a lot of limitations on that discretion. Therefore, it is properly narrowly tailored, and -- and satisfies the intermediate standard. I think it satisfies the strict scrutiny standard as well. Ms. Cohn: Well -- The Court: Before you jump in -- he actually gave you invitation this time. Ms. Cohn: Yes. The Court: But... before you do that and accept the invitation, you mentioned something that sounded an awful lot like the technical data aspects of that. Did I misunderstand you? Mr. Coppolino: No. I -- what I was trying to say was that part of what limits the government's discretion with respect to the export of software -- we'll talk about technical data in a moment. But part of what limits our discretion with respect to the software is that in fact we only control software product for export in this context. We don't control general publication of ideas and theories. So the first limiting factor is, first, it's got to be software; second, it's got to be a certain -- a certain kind of software; and -- and then, third, you evaluate potential national Security harm to it, which I concede is a discretionary... judgment. The Court: But with respect to -- and I thought I heard -- what I heard you say -- maybe I misunderstood you, and you were really talking about software -- was that -- that to the extent it involves... scientific exchange of ideas, papers, and so forth -- Mr. Coppolino: Don't regulate it. The Court: -- that they're not regulated unless it's going to be disseminated outside of the United States. Mr. Coppolino: No. No. It's a different -- The Court: Am I wrong? Mr. Coppolino: I think you are, your honor. The Court: Okay. Mr. Coppolino: It's a different point altogether. We distinguish -- perhaps Ms. Cohn may not -- but we distinguish between a commodity that is listed on the United states munitions list, category xiii(b), cryptographic software. The Court: Right. Mr. Coppolino: Okay. Separate from that is something called technical data, which is information, scientific technical information, related to the commodity that is necessary for the manufacture, development, and design of the commodity. It's not the commodity itself; it is information related to it. We control the export of that information in a different manner. And that is -- that is the nub of their second major claim; that we control the publication of scientific ideas. We have set forth in our brief a number of points. namely, that there's an awful lot of information that is expressly exempted from the definition of technical data. So it is not even subject to export controls. And we've laid that out for you I think in our papers. And that greatly limits the discretion of the government to reach out and say: That information can't be exported. We -- we specifically define information that's not even subject to the regulations. For example, information that is published and is already in the public domain at bookstores, news stands, libraries. Information that is exchanged at academic symposia. Academic symposia occurs every year in california on cryptography. Broad, free-wheeling discussions of cryptographic algorithms every year at U. cal., santa barbara, and in other -- in other places. So we don't -- we don't regulate that. We don't regulate the publication of those ideas. We don't regulate the exchange of academic principles in a -- in a university setting, or fundamental research published by universities. Multiple limitations to the discretion of the government in controlling the export of technical data. The Court: But does someone screen that data to determine whether or not it -- it falls within some of the exceptions? Mr. Coppolino: No. We do not, your honor. We do not tell people: Come to the United States -- to come to the united States Department of State so that we can find out whether we'll let you put that in a bookstore, or a news stand, or a library. Come to us to find out whether we'll let you teach it in a class. Director Lowell, the director of the State Department agency in the case -- he submitted a declaration -- made clear we don't regulate the information for export, and we don't regulate the means by which it is published in the United states. The typical case is that a party -- a party comes to the State Department and says: My information is either classified or proprietary, pursuant to a contract; I want to export it to that foreign entity, because they are building a very similar defense article, and they need my technical data. or: I want to go train them how to build it or maintain it. In that context, which is really a -- a conduct context, we license the export of technical data. That was the classic case in Edler. Edler wanted to send -- in the Ninth Circuit case in Edler -- he wanted to send blueprints of missile technology to a french company, and he wanted to go help them figure out how to build it. That's a classic case of how technical data is in fact controlled for export, in our -- in our view. While -- while I'm on the point, I would just like to -- The Court: Well, with respect to that discretion, to the extent that it's going to be exported, there is discretion again within the Department for determining what -- whether it comes within a category of material for which a license is required. Mr. Coppolino: Well, with respect -- Ms. Cohn: That's right, your honor. And it's easy to see that, because they -- The Court: Hold on. Wait -- Ms. Cohn: -- prosecute people who -- who make the wrong choice. Mr. Coppolino: But, your honor, the -- The Court: Yes. Mr. Coppolino: -- I'm probably hogging the mike here. But I'll -- let me just try to answer your question. The discretion -- this is -- the issues with respect to technical data are facial challenge issues: Do the regulations on their face violate the first amendment, precisely because they give the government too much discretion? Viewed as a whole, the regulations limit discretion by providing express and specific exemptions to the type of information that is controlled as technical data. That is very clear. There's a number of exceptions. And this process of amending the regulations has gone on over the past -- over the past decade. And we have tried to address these very concerns, where academics were coming in and saying: Do your regulations mean I can't teach my class? Because there was a lot of concern about that in the early 80's. My own Department, in the Justice Department, wrote three O.l.c. decisions, office of legal counsel, because we shared those concerns. We looked at those regulations and said: Wow, these could be read pretty broadly. And they were amended several times in order to specifically address those concerns. Now, whether they have or not in a particular case may be left where it applies -- as an applied challenge. But on their face the regulations draw lines to limit discretion. The Court: Now, was it those -- under those regulations that Mr. Bernstein's initial papers before this action was filed were subject to review and.... and the Agency orders? Mr. Coppolino: It's -- the current regulations -- the regulations have been in place -- the current regulations were in place at the time of Bernstein's Cj request, your honor. The Court: But, nonetheless, the government made -- decided I guess after the filing of the lawsuit, they must have made a mistake with regard to exercising its discretion before the lawsuit was filed. Mr. Coppolino: I'm afraid I -- I just can't agree with that, your honor. I think that the -- The Court: Well, what happened then? Mr. Coppolino: The record reflects -- The Court: How come it changed its mind? Mr. Coppolino: The record of the original administrative determinations reflect that our focus was on snuffle source code. The first Cj determination -- mr. Bernstein submitted a letter, and said: Commodity jurisdiction for Snuffle 5.0 software. And the first response: Cj determination for Snuffle 5.0 software. Software determination. The second one, which is really the problematic one, he submitted a commingled Cj, if you will. He had his paper, item two; he had his software, items three and four; and he had instructions on how to encrypt, items five and six. We -- we looked at that, and we said: These items contain cryptographic source code for data encryption. That's what the statement said. And we -- we pointed out that -- I would point out to the Court that we typically receive explanations of what the product is and how it's to be used so we can figure it out. So my point to you, your honor, the long and short of it is, we did not intend to regulate his ideas or his paper. Why would we regulate Bernstein's very brief description of Snuffle, while there are articles and articles, and conferences and conferences on all kinds of cryptographic theories and algorithms? We wouldn't do it. We didn't do it. We regulated his source code. Ms. Cohn: Well, your honor -- The Court: Ms. Cohn. Ms. Cohn: Your honor, I wish the world was, once again, as Mr. Coppolino posits it here; but it's clear that when -- first of all, a very minor point on the facts. The letter that professor Bernstein got back says: it appears that you have presented us with a stand-alone strategic algorithm, and so a license is required. The -- the very words of what they told him was based upon the algorithm. Not based upon the source code. That's what they said. And they said it again, and then he sent them five separate ones. I just -- I think that -- I think that it's -- I'm glad that we finally got back to exactly what happened in this case here, because it -- it... directly refutes all of mr. Coppolino's grand assertions about what they regulate and what they don't regulate. They clearly didn't understand the distinction between protected expression and nonprotected expression in their determinations for -- for professor Bernstein. I think it's all protected expression. I mean, the government wants to divide up source code in one category, and technical data in another category, and then the noncode stuff that's defined as software as yet another category. And our basic position here, your honor, is that it's all speech, and you can't draw lines in between it when you're regulating. The Court: Well, but for the purposes of the statute and regulations they do define or treat differently items in category, what is it, xiii(b) -- Ms. Cohn: That's right. The Court: -- and what is defined as technical data. Ms. Cohn: Right. But I -- but I just think that it -- for purposes of first amendment analysis, it's all speech. And so the -- the tests that have to be applied shouldn't be different based upon some allegations of functionality, some -- some wild new category of lesser protected or nonprotected speech we want to create. It's all -- the source code is speech, the technical data is speech, the algorithm is speech. And it's -- all three of these things are regulated by the -- on the face of the ITAR scheme. The second point I want to make is about -- mr. Coppolino corrected you, and said that: Well, instead of "dissemination," he wanted you to use the term "export". I -- I think that it's important for us to all remember how the ITAR defines export. Because it's much broader than -- than most people think of when they think of what export is. Export of technical data is disclosing, orally or visually, or transferring technical data, to any foreign person, whether abroad or in the U.S. So the definition of export for technical data includes domestic communication if a foreign person is in the room. It includes domestic publication if a foreign person can -- if the information can be disclosed to a foreign person. And we know how many foreign persons there are in the U.S. We certainly know how many there will probably be in a class that's taught by professor Bernstein, high-level mathematics, at a major public university. So it -- it's not just export; it's reaching domestic activities. The definition of -- The Court: Does -- does he save himself if he just asks all of the noncitizens to get up and leave the room during that part of the lecture? Ms. Cohn: Well, I think you've got a fourteenth amendment problem, your honor. We don't discriminate based upon citizenship in this country for who can take a class. And he shouldn't have to do that. I mean, that's part of the first -- you know, the four freedoms that were outlined in the bakke case. Who can teach, what can be taught, who may learn, and what can you -- I forget the fourth one. but who may learn is one of those things. It's part of what's protected under the freedom of academic expression in the united States. But if I may continue, because it's important. because domestic activity and publication is -- is triggered by -- by all three parts of the definition of export. So I've talked about technical data. Let's talk about defense articles. Sending or taking a defense article outside of the united States in any manner, except by mere travel outside the U.S. by somebody who knows that -- you -- you can take your own head out of the country, evidently, under the ITAR. That's c.f.r. 120.17(a)(1). Now, again, if you step back and you look at what does publication in the United States mean, well, if you have a book that's published by M.I.t. press, that's -- I have one here -- it gets distributed internationally. That's how publication works. So if you're publishing a book -- in fact, here's one called: P.g.p. source code internals by philip zimmerman (displaying book), it's going to get international distribution, and you are sending or taking a defense article outside the United States. That's how export reaches out into first amendment territory. It includes publication. The third area is defense services. And this is where we get into the problems of teaching more directly, because it's: Performing a defense service on behalf or for the benefit of a foreign person whether in the U.S. or abroad. So, again, if professor Bernstein is teaching someone how to use his software, he is performing a defense service under the very language of the regulations. That's clear. The facial challenge stands; that export reaches out into first amendment activity. And so we can use the term export if we want to, but let's be very clear about what it means. It reaches out several ways into clear first amendment activity. And when it does that, you've got to meet all of the constitutional tests in order to regulate like this. And that includes prior restraint, it includes subsequent punishment. The -- there are two -- two tests here; the government keeps trying to moosh them together. There's the prior restraint test, and then there's the strict scrutiny under the subsequent punishment provision. There's vagueness, there's overbreadth. And then there's the question, based upon the A.p.a. claim, the ultra vires idea in our complaint, which is: Did congress intend for export to be defined such that it reached out into this kind of clear first amendment activity? And I think it's important to remember that -- that although they claim they're just regulating export, they're regulating much more on the very words of their statute. The Court: Let me ask you the question I -- I started out with in this last discussion; and, that is... in order to do the prior restraint analysis... and particularly if this -- the regulatory scheme does not measure up to that prior restraint -- the prior restraint requirements set forth in lakewood, and subsequent cases, does it matter whether we know, or whether we decide, rather, whether encryption is really content -- specific content based? Ms. Cohn: It -- it does not, your honor. There's nothing -- The Court: Is the analysis any different, in other words? Ms. Cohn: No, your honor, it is not. There's no -- there's not a case cited by defendants, there's not a case anywhere, that says whether something is a prior restraint or not turns upon whether it's content based. Content based is relevant for the discussion of the subsequent punishment provisions, and whether strict scrutiny applies or -- for those provisions. But it is not relevant for purposes of prior restraint analysis, either the Freedman or the Pentagon papers analysis. The Court: Well, you -- you heard what Mr. Coppolino had to say with respect to... the first inquiry under the prior restraint analysis. What is -- is this definite enough, are the definitions, or the process that's described in the -- in the statute and the regulations sufficient to... ensure that the discretion that is being exercised is well-guided discretion that will meet prior restraint requirements? Ms. Cohn: No, your honor. And it's not even close. Let's start with the easy one. The Court: Why not? Why not? Ms. Cohn: Well, first... very briefly, let's start with the easy ones, Freedman versus maryland. There's simply -- the procedure protections that are required under that -- that case and its progeny simply don't exist in the ITAR. I don't think that they can -- can credibly argue that they do. Now, as far as the other big piece of -- of prior restraint analysis, the question of discretion, the -- the test is -- is -- is set out in many cases. The one I like to cite is niemotko versus maryland. Is -- is the discretion limited by certain narrowly drawn reasonable and definite standards for officials to follow? Well, I think we can look all the way across the itar, and we can see that the standards aren't definite. they're not reasonable, and they're certainly not narrowly drawn. The Court: Can you decide that from just looking at -- at the regulations, or does one have to look at how they have in fact been applied? And I'm not talking about an as applied challenge, or looking at, you know, whether the decision in a particular case was exercised properly or not. But, namely, looking at it more for consistency over a number of cases. Or can you -- or can we decide it just based upon the regs and the statute itself? Ms. Cohn: I think that a facial challenge is based just upon the regs -- The Court: Yes. That's true. Ms. Cohn: -- and the statute itself. The Court: And you think it can be done that way in this case. Ms. Cohn: I think that you -- you could do it that way in this case, but I also think there's a wealth of evidence that they're exercising that discretion in a way -- exactly what happened to our client here. I mean, he's been told that he can't post his source -- he can't publish his source code on the internet without a license. So -- and there's no -- there's -- you know, they've had the discretion to say that. We've had to bring massive constitutional litigation to get that question over... looked. They had broad discretion. And you can see the discretion several ways in what happened to our client. First of all, they took the definition of software.... they took the definition of, you know, information -- let me back up. The definition of technical data normally includes software. But the defendants exercised their discretion to decide that all software is technical data, except cryptographic software. That's not. That's -- that's over here on the defense article side. They just shifted it over, just like the (I). And, suddenly, although all other software is information, technical data -- cryptographic software is not. They just -- The Court: Well, is there any other kind of software that... is not embraced in technical data? Ms. Cohn: I'm not aware of any. Mr. Coppolino, you might know the breadth of the itar. I mean, there are many things on -- on the -- on the itar. It's a very long list. Mr. Coppolino: And I -- I was just going to say I believe that what the regulations provide is that software is presumptively treated as technical data. Except for a specific exception listed in section 121.8(f) of the regulations, which says that: If you want to export software, apply for a technical data license, unless it's specifically enumerated on the United States munitions list, which includes, example, category xiii(b), cryptographic software. Now, your honor, I haven't read every -- The Court: Are there any other.... Mr. Coppolino: I believe that there are, your honor. and I would have to read the regulations. But I -- I believe that there are. But it would -- it would really be apparent on the face of the regulations themselves. And I've obviously just focused on -- Ms. Cohn: Your honor -- Mr. Coppolino: -- on this case. Ms. Cohn: -- I'm not aware of any. But I think neither Mr. Coppolino nor I would consider ourselves conversant in the breadth of the very long list in ITAR. The Court: Well, and that may not be a good use of our time anyway. Let -- let me get over to the technical data issue for a moment. And that's where we get into Edler; right? Ms. Cohn: That's right, your honor. The Court: Let -- let me ask you this. Is Edler enough? Do I have -- do we have any plans for Edler? That's a Ninth Circuit decision. You would agree that I'm bound by that; right? Ms. Cohn: I think you're bound by the -- the Edler decision, your honor. But I think that there are several ways in which you can find that the... Edler decision, first of all, doesn't apply as to the source code. And we all agree that that's -- the defendants have categorized that as a defense article. So the narrowing of the definitions of technical data doesn't have anything to do with the source code. It also doesn't have anything to do with the category of noncode items that are defined as software under 121.8(f). It's important to remember that the definition of software in the ITAR -- that's another area of wide discretion, in that it's not only source code, it's algorithms, design flows, logic flows, all sorts of other things are defined as software by defendants. So to the extent we're talking about the technical data provisions, we're not talking about the regulation of algorithms, we're not talking about the regulation of source codes. So Edler just doesn't apply to -- to narrow that at all. The Court: "Edler" or "eedler," how do you pronounce it? Ms. Cohn: I'm sorry, your honor? The Court: What I really want to know is: Is it still good law under Freedman and -- Mr. Coppolino: Well, it is most definitely still good law under Freedman, your honor. And here -- here's why. Freedman -- first of all, I don't even think Freedman applies in this case. Freedman was a case in which the supreme court said that before you can show what might be illegal speech, obscene speech -- no protection at all -- you've got to have a prescreening program to determine whether or not it in fact is illegal. And the Ninth Circuit applied Edler in spokane arcades in precisely that manner. The real -- the other -- the other licensing cases that the plaintiffs cite; niemotko, and lovell versus the city of griffin, and staub versus baxley, and shuttlesworth, these were regulations of pure speech activities; whether or not people could pray with the bible in the park, whether or not people could meet for union activities in their homes, whether or not a civil rights march could occur in alabama. In all of these cases the local government said: You can't do that, unless we tell you you can do that. Completely -- the -- the analogy is simply not there. those cases are inapposite, clearly. Now, what -- what was Edler about? Edler -- talk about an apposite case -- Edler was about these very regulations, technical data provisions of the international traffic and arms regulations, a version that existed in 1978. And we've given you all the versions through the years. And the Court of Appeals looked at those regulations and said: Boy, these could be construed expansively to cover all kinds of scientific exchange. These are very broad. In 1978 the regulation suggested that any discussion of technical information, including at a symposia, was an export. There also was a little mischievous footnote which said that: If you want to publish something, you better come and ask us first. That was the 1978 version. The government -- the Court of Appeals said: Well, this -- let's construe these regulations in a Constitutional manner -- which -- which is of course the Court's obligation -- to look at the face of the regulations and determine whether or not a narrow construction is possible. And the Court in Edler recognized what the purpose of the regulations was. It was to control the dissemination of technology directly related to a defense article, in order to control the conduct of somebody assisting a foreign entity in building one of these munitions on the munitions list. In other words, we control the export of the munition. But we also control the conduct of people who are going to help others build the munition. Edler said: That's Constitutional, no prior restraint, no overbreadth. What's happened since Edler? In 1984 -- The Court: But wouldn't they, in order to do that, have to build in a scienter requirement? Otherwise -- Mr. Coppolino: Yes, there was a scienter requirement. That's most definitely right, your honor. There was a -- if you intend in your export of technical data to assist a foreign entity in developing a munition, the government can -- can regulate that, and it's not -- it's not a speech problem. Now, we have said -- I would just like to finish this thought on Edler, if I may. We have said -- first of all, in 1984, the Department of State, after years of concern about these regulations, including from the Justice Department -- we were on their case for four years, saying: You've got to amend your regulations -- issued a federal register notice in 1984. First thing it said? We've going to follow Edler now on technical data. And then it went on to amend the regulations, took out that footnote about prior approval of publication, put in a public domain exception, put in an exception for commonly taught academic activities. And through the years it has added to that list. What the Court has to do, I think, on the issue of technical data, is that it has to do what the Court of Appeals did in Edler, only it has to do it for the current version of the regulations, and assess -- on their face now -- whether or not discretion to control first amendment activities has been limited in a reasonable manner. And on their face, I submit to the Court, that the -- the very specific exceptions that are in there -- in there indicate that in fact that discretion has been eliminated -- has been limited. Let me make one point about the issue of algorithms, because it's a point that the plaintiffs raise quite often. The definition of software includes, among other things, algorithms. Plaintiff's own declarant explains why this is the case. To get from an actual algorithm to a functioning software product is not that difficult a step. You have programming language, and then you've got source code, and then you compile it, and then you have object code. There is an algorithm in every cryptographic source code. And there's an algorithm in object code -- at least it's reflected in the object code. That's why algorithm is included in the definition of the software. Do we regulate algorithms, per se? Articles that -- that describe algorithms, or even the algorithm itself? The answer is: No. Doctor -- deputy director crowell of N.s.a., and one of plaintiff's declarants -- I'm not quite sure I remember which one; I think it was Mr. Schneier -- both pointed out that in the area of cryptography algorithms are published all the time, so that people can test them. You don't have a good cryptographic algorithm unless it's gone through peer review, and people can determine whether or not it's effective. We don't regulate that process. We've given you articles which have algorithms; we've given you articles which -- which test algorithms. So algorithms, per se, aren't regulated. It's the implementation of the algorithm which is regulated. But I digressed from your answer (sic) in Edler. edler definitely applies. And the regulations are much more solicitous of speech than they were in 1978. The Court: Well, let me ask you this. The -- the amended regulations that you're referring to do they comport with -- would they pass muster under the -- under the Department of Justice's earlier memos? You referred to two, or are there three opinions? Mr. Coppolino: There were three. The Court: There are three of them. Okay. Would -- would the amended regulations -- do they pass muster under those guidelines? Mr. Coppolino: Well, O.l.c. hasn't written an opinion since `84. But our -- our position here -- and, by the way, you know, those opinions are interesting analyses, but ultimately it's your decision. But the answer is: Yes. The Court: I understand that. But you would like me to buy the Department of justice's opinions; right? Mr. Coppolino: I -- and I'm in the Department of justice, and I talk with O.l.c. every day. And -- The Court: But -- Ms. Cohn: And they told you they didn't mean it? The Court: -- I'm -- I'm curious as to, you know, the fault they found, and the admonitions -- Mr. Coppolino: Absolutely. The Court: -- they gave, et cetera. Mr. Coppolino: Here's the fault -- The Court: Do they do -- do the amended regulations meet their objections, and take care of those objections, or -- Mr. Coppolino: I believe -- Ms. Cohn: Your honor, if I may -- The Court: Hold on. Hold on. Mr. Coppolino: Yes. The answer is: Yes. The principal problem that O.l.c. identified over the years was: Your regulations just say: We regulate the export of technical data, and that includes disclosure in the United states. And O.l.c. said: What does that mean? Does that mean in a classroom? Does that mean if you publish an article? does that mean in a symposia? This is too broad. So what did the State Department do? It amends its regulations, and it says: The definition of technical data, 120.10(a)(5), does not include information concerning general scientific or mathematical ideas commonly taught in schools. intended to address an O.l.c. concern. It does not include general system descriptions. intended to address O.l.c.'s concerns. Then it made the public domain provision totally separate. Again, intended to address O.l.c.'s concerns. And it added to those exceptions; symposia, discussion, fundamental research, and the like. And I would say to the Court that these -- these -- the amendments that were made from 1984 I think to about 1993 all were trying to address these concerns. In response to a facial challenge, I think the Court would have to conclude that the State Department has made efforts to tighten up the meaning of these regulations, and to exclude fundamental first amendment activities, such as publication in new stands, bookstores, and libraries, symposia... academic teaching, and the like. So I believe that the answer to your question is these go a long way, if not entirely, to passing muster under o.l.c.'s analysis. I can't predict to you that we're going to get a weird as applied case, which is problematic. But on their face they clearly do. And there's no evidence -- and I want to stress this point -- no evidence that the government regulates scientific publication in the United States. No evidence that we regulate symposia. We don't give people licenses to go to U. cal., santa barbara, every year for the crypto conferences. No evidence we have to license teaching. There are people teaching crypto all over the country. You saw the textbooks that we put in the record. We don't license that stuff. So people, obviously, are not being chilled. And they're not -- they don't find the regulations vague, because there's a very vibrant exchange in this area that occurs every day. The Court: Ms. Cohn. Ms. Cohn: Well, your honor, first of all, I -- I would suggest that Mr. Coppolino reread what the O.l.c. said. Because O.l.c. was presented with a pre -- a draft of the amended regulations with these changes in it, and said: they don't do it. You've still got problems. Indeed, even after the Edler case. And the State department came out and said: Oh, well, now that Edler has been decided, we follow Edler. There's a -- a memo, and it's attached -- I believe it's exhibit c to Mr. Tien's declaration, from a woman named kathryn fuller in the O.l.c.'s office, saying: It still doesn't pass first amendment muster. So I think that the -- the term -- the very words of the O.l.c. memos contradict what Mr. Coppolino is saying here today. Secondly, the fact that there is speech doesn't mean that there's no first amendment problem. He's turning -- mr. Coppolino is turning the first amendment analysis on its head. It's as though he said: Look at the library; there's all these books here. There can't possibly be a problem with just this one little book that we don't want to put in there. Well, that's not the way you look in a first amendment analysis. The government doesn't -- doesn't dispute that they control the publication -- the electronic publication of source code. They do. They -- they require a license for it. So that, in and of itself, shows that they're reaching first amendment speech. As far as technical data is concerned, let's look at what they've told people who have asked them. We presented several declarations. First and foremost, our client, who was told he couldn't publish any of his items, regardless of the fact that some of them were technical data. They've now said some of them are technical data. Second, let's look at what happened when Mr. Junger (phonetic) asked. He was told: You need a license. Let's look at what Mr. Schneier -- let's look at whatever -- whenever somebody asks the Justice Department, the answer is very clear: You need to register as an arms exporter, and you need a license. Mr. Coppolino: Might I address that, your honor -- Ms. Cohn: Now, the fact that there are people who don't ask, who go ahead and publish, and who aren't summarily sent to jail... The Court: Summarily? Ms. Cohn: Well... (laughter.) Ms. Cohn: .... who are not prosecuted, doesn't mean that there's not a Constitutional problem in this scheme. We have to look at the chilling effect. And we have presented with you -- you with several declarations of people who say that they've been chilled by this scheme. Mr. Coppolino: Your honor -- Ms. Cohn: You don't look at the discussion that's going on; you look at what's been chilled, for purposes of the first amendment. And we've presented you with evidence, lots of it, of the chilling effect here. Mr. Coppolino: I would like to address that point. that is very important. The Court: Yes. Briefly. Mr. Coppolino: Briefly, your honor. The Court: We have to move on. It's 1:30. Mr. Coppolino: Every declarant that submitted a -- that submitted a declaration here, every one of those cases concerned source code or software. Some of them were commercial products, not just an academic who wants to put his source code on the internet. some of them were commercial products, including a web browser. every one of them was software. So their evidence of the -- of the regulation of academic speech was controls on software. We have been consistent on that. Mr. Johnson had a software product which was licensed through the commerce Department. Mr. Behlendorf, a software product, a web browser. Mr. Demberger, source code, on the internet. Mr. Schneier talked about the diskette which was at issue in the Karn case, which we won, by the way. The Karn case was a diskette of source code, and Judge Richey in D.C. said: No first amendment problem; no -- no -- The Court: I know. Judge Richey and I talked about that. (laughter.). Mr. Coppolino: Ex parte evidence. Professor Junger has filed a case in cleveland which i'm handling. And professor Junger never even gave us his software. We don't know what professor Junger's software is. he never gave it to us. He talked to us on the phone, and he filed a lawsuit three years later. But it appears it's software. All of the cases were software, your honor. There is no evidence that we license the publication of scientific ideas. If we had, a Court would have heard about it by now. I -- there's -- there are plenty more examples of what I submitted to the Court that -- that show that there's vibrant exchange of publication of ideas. I think Ms. Cohn has basically conceded with the evidence she has submitted that the case is about software. So you can forget about the technical data facial issues, and decide whether the export licensing of technical software violates the first amendment. Ms. Cohn: Well, your honor -- The Court: I don't know that I can forget about them, but -- Ms. Cohn: -- I don't -- let me make my own concessions. The Court: -- if we don't get to the vagueness issues and overbreadth, we can forget about those, I mean, at least as far as oral argument is concerned. And is there any need to get to those, or anything you want to add with regard to the vagueness or overbreadth issues? Ms. Cohn: Well, just a -- a couple of points, your honor. I think that our vagueness analysis is important for -- for taking a look at the breadth of discretion here. And that flows through all of the questions that go to -- that go in. And I think it's important that -- that -- to take a look at the three or four examples that we pulled out of the regulations, where things are vague. And I think the most important ones to look at are the definition of export, which is much broader than what most people think about export. Most people don't think that talking to a person who is not a U.S. citizen in the United States is export. The government thinks it does. And I think it doesn't put people on notice. Secondly -- The Court: Well, but the question is not what most people think it is, but is it sufficiently defined in the statute or the regulations; correct? Ms. Cohn: But I don't think it gives adequate notice to people. And I think there's a second part of -- of the vagueness analysis that defendants didn't really address in their papers that's important for us to remember, which is -- which is again the question of discretion. I mean, vagueness has two pieces. The first is fair notice. And the second is minimal guidelines for law enforcement, coming out of the Kolender case, and some of those other cases. And I think that -- that there are not minimal guidelines; that exhibit a is what happened to defendant; I mean, they -- to -- to plaintiff. They didn't know what was covered by their regulations and what wasn't, evidently. And it wasn't until we sued, and they got the very smart Mr. Coppolino involved that they realized evidently that they made a mistake. The Court: And now they've all been fully trained by mr. Coppolino, and they know the right answer; correct? Ms. Cohn: But, your honor, it has to be clear in the regulations. They have to be bound by them, especially when they've got a conclusion of judicial review. It means that you have to mount this kind of huge Constitutional problem when they overstep their discretion. It's exactly the kind of problem that prior restraint analysis is supposed to -- is applied to. You shouldn't have to ask. You shouldn't have to sue in order to speak. That's -- that's the whole -- that's the big difference between a prior restraint problem, and a subsequent punishment problem. And here they are restraining prior to publication, and then people are going to have to sue and raise constitutional claims in very narrow areas when they overstep their discretion. I think that the Cj process admits vagueness. The Cj process applies when doubt exists as to whether something is covered or not, or how it's covered. And -- and by -- by creating this process, I think they've admitted that there's a problem. That people -- there is doubt that exists, and that they -- that people don't know what the regulations mean. I think the other important question for vagueness is the exemptions. Because Mr. Coppolino has made such a point of talking about how they are so -- they so clearly protect speech. And let's look at what the words of the reg -- of the exemptions say. They say that they -- they protect general principles, fundamental research, that are commonly taught at academic institutions. I think that when you're faced with a choice of speaking, and if you're wrong, you go to jail, or -- or have civil penalties against you; or not speaking -- The Court: But you might have a very good defense. Ms. Cohn: Well, perhaps. But you shouldn't have to have a defense. That's what prior restraint is about. The -- the -- you know, what is general principle? well, general principle ends up being what the government thinks it is. Because they're the ones who decide whether to prosecute you or not. And also, of course, under chevron they're going to have the discretion to interpret what general principles are to the extent that they -- they -- that they're reasonable. So it creates a giant chilling effect. You know, what's commonly taught? What's fundamental research? What's general principles? And by claiming that they don't claim to make that decision for people, I mean, they're just being disingenuous. of course, they do. They decide who is going to go to jail because they guessed wrong. And so I think that they -- what -- what happens here, even if they don't exercise... their authority -- their discretion to prosecute people, is that they -- they create a chilling effect. And that's a -- a big first amendment problem. The Court: One -- one of the questions I have -- and i think probably it's better addressed to Mr. Coppolino, since it's quote his "statute"; right, or regulation -- is the regulation that defines a defense article, which I understood to be a term of art, and distinct from technical data, as meaning any item or technical data designated in. Ms. Cohn: That's right. The Court: You know, I -- I find that confusing. Mr. Coppolino: Right. But, your honor, you cited -- The Court: I know that my being confused is not a test, but.... Mr. Coppolino: But you've cited one sentence in the entire regulation. And I -- The Court: Right. Right. Mr. Coppolino: -- and I would ask the Court to, I think, assess the regulations as a whole. But these provisions -- The Court: But how do you deal with that definition, though? Mr. Coppolino: Right. Here's what -- The Court: Is technical data a defense article or not? Mr. Coppolino: No. It's not. And I'll tell you why. The definition of technical data means information which is required for the design, development, production, manufacture, assembly, operation, et cetera, of defense articles. Defense article and technical -- technical data are separate things. One is a commodity in the U.S.m.l.; section 21 lists the commodities, the items. And technical data is the information related thereto. I think viewed as a whole there's no question that there's a clear distinction in the regs between commodities, such -- such as software; and technical data, which is information related to the commodities themselves. Ms. Cohn: Well, your honor, if I might just butt in. i mean, software is technical data in one context, and it's a commodity in another. And, of course, that -- that particular context depends on what the government decides. I mean, that's -- that's vagueness. That's -- that doesn't put people on fair notice. Mr. Coppolino: The regulations specifically say cryptographic software is a defense article. So it's clear. I mean, there's no -- you have fair notice of that. With respect to the -- one point I didn't raise earlier is that with respect to the definition of technical data and the export of that, including disclosure in the United states, before you get to that it has to be technical data. And all of the information that is exempt from the definition of technical data, if disclosed in the United states, is not an export. So you don't get to that issue if it doesn't fall within the category. And the category has multiple... exemptions. Those exemptions are not vague; they are -- they are reasonably construed to be very clear. We don't decide. We don't have a bureau of commonly taught academic principles, it's true. We don't decide what those are. We don't have a book that says what's a commonly taught academic principle. That is in there to provide academics some assurance that what they do in their everyday common occurrence of their classroom is not regulated. We don't license classroom discussion. And that's what that provision, on a facial challenge, is reasonably construed to mean. If some professor wants to come in here and say: "you prosecuted me for teaching my class," then -- then that might be a tough as applied case, and I don't think that's ever going to happen. But the regulation on its face tries to set forth general categories so that people know that what they're doing is not going to run afoul of the -- the export control laws. The Court: But what is -- I mean, how is a reasonable reader to understand what that term means, "general principles," and some of the others that have just been referred to? Are they supposed to -- you say they're supposed to know that just because they're an academic teaching in universities; right? Mr. Coppolino: I think the Court has to -- has to decide whether or not a person of ordinary intelligence would understand what that means. And the term -- the term States: General scientific -- The Court: What section are we looking at? Mr. Coppolino: I'm looking at 120.10(a)(5). The Court: Okay. Got it. Uh-huh. Mr. Coppolino: And it talks about commonly taught -- let's see, I'm sorry. Technical data does not include information concerning general scientific, mathematical, or engineering principles commonly taught in schools, colleges and universities. Now, Ms. -- Ms. Cohn is arguing that we decide what's commonly taught. We don't. The purpose of the -- of the exception, as director lowell pointed out, was to let the academic community know that what occurs in their classrooms is not subject to regulation. The question before the Court is: How do you construe that on a facial challenge? Do you take the most unreasonable position, and say that this means we have -- the government licenses every academic exchange in a classroom? which would come as a shock to most teachers who are out there teaching cryptography, physics, chemistry every day. Or do you construe it to mean it's an exemption from what's covered from export controls? In the absence of evidence that we do anything like this, it's not possible to conclude that this is going to create a chilling effect. A chilling effect on the first amendment can't merely be subjective; it has to be a real concrete indication that there's in fact threatened prosecution and threatened injury here. And there is not. And -- and that's why I think that the Court can readily construe -- construe this and other -- and other exemptions to pass muster. Some of the other exemptions are quite specific -- The Court: We talking now about facial challenge. we're not talking about as applied challenges; right? Mr. Coppolino: That's right. The Court: And the question, you know, in that context is... you know, whether -- whether the terms as used are vague; correct? And whether one -- Mr. Coppolino: Yes. The Court: -- you know, of ordinary and reasonable intelligence would -- would be able to understand what that means; is that correct? Mr. Coppolino: I think that's the standard, your honor. I -- I think in this rather unique context, I wouldn't -- I think that we're talking about an area of -- of policy that a lot of people don't have any knowledge of. But for the people who are certainly in this area these terms should be understood. Now, let me make this point. Their own declarants describe the differences between the various software; confidentiality, authentication, financial. They -- they describe those terms, and they also describe the define -- why algorithm is in the definition of software. The Court: But if -- if these persons are wrong in their definition, it's -- the government's definition is going to control at least with respect to any -- any licensing; right? Mr. Coppolino: The -- the government has tried to set forth exemptions on what is not controlled. We're not describing what is controlled. We are describing what is not controlled, what you are free to do. And these are, you know -- The Court: But it it's not your general principle, and even though it may be theirs, then it's controlled; right? Mr. Coppolino: In the -- no, your honor. In the supreme Court case of grayned versus city of rockford it talks about this subject. It says: Language is unavoidably inexact. You can't describe with meticulous specificity every single circumstances which may or may not be covered. What the Court looks to in that context is whether the regulation has -- has been drawn with reasonable flexibility. Whether there has been some attempt to draw lines to protect first amendment activities. On their face these regulations do that. If -- if you pose a very difficult hypothetical, I think that has to wait for the as applied case. But, facially, they have gone a great length to -- to try to resolve these potential first amendment concerns that have been raised -- that were raised many years ago, and were -- and they've tried to address over the -- over the past decade. I have one other point -- if she wants to respond to that. But there's one other point on overbreadth that I really feel I need to raise. The Court: Yes. The reporter: I think I've had it. The Court: You need about five? The reporter: At least. The Court: Okay. We're not going to go much longer. How much longer -- how long will it take you? Mr. Coppolino: I have -- have a comment that will take about two -- two to three minutes. The only point I wanted to make on overbreadth, your honor, is that it's -- it is a standing doctrine. And a party under overbreadth can raise the interests of third parties not before the Court that are different from his own. Bernstein is here raising the interests of academics, who want to publish scientific ideas, including posting source code on the internet. The reason this is critical is that overbreadth is -- asks the Court to invalidate the statute in all applications, all conceivable applications. The statute is void. We have a plainly legitimate sweep here; we apply technical data controls to all the munitions. And if you were to strike down the technical data controls as to all munitions, there's simply no evidence in the record suggesting that technical data controls cannot be applied properly to the many, many munitions that we do apply it to properly. Similarly, with cryptographic software. Mr. Bernstein is an academic who says he wants to post the source code for academic reasons. But there are many commercial software manufacturers who are selling their software, very powerful software. I don't think overbreadth applies here. He's claiming his interests are being violated. That's my point on overbreadth. Oh, the other last thing I'll say is -- The Court: No. That's it. Mr. Coppolino: Well, they -- they're going to go for a P.I. -- I don't know if the Court is aware of that -- on his teaching, and we're back here in a couple of weeks. And... I have a lot of concerns about that, but I don't know if you want to -- The Court: No. No. Not today. Mr. Coppolino: Okay. The Court: Okay. Finished? You are finished; right? Ms. Cohn: Evidently. The Court: You are. Okay. Thank you. Ms. Cohn: Thank you. The Court: You're back here in two weeks? This is not on the record. (off-the-record discussion.) (whereupon these proceedings concluded at 1:45 P.m.) carl R. pline official reporter U.S. district Court Certificate Of Reporter I, carl R. pline, official reporter for the United states district Court, northern district of California, 450 golden Gate avenue, San Francisco, California 94102, do hereby certify that the foregoing transcript, pages numbered 1 through 79, constitutes a true, full and correct transcript of my shorthand notes taken as such official reporter of the proceedings hereinbefore entitled, and reduced to typewriting to the best of my ability. ______(signed)_______________ Carl R. Pline, Csr Official Court Reporter carl R. pline official reporter U.S. district Court