CINDY A. COHN, ESQ.; SBN 145997 McGLASHAN & SARRAIL Professional Corporation 177 Bovet Road, Sixth Floor San Mateo, CA 94402 Tel: (415) 341-2585 Fax: (415) 341-1395 LEE TIEN, ESQ.; SBN 148216 1452 Curtis Street ROBERT CORN-REVERE, ESQ. Berkeley, CA 94702 JULIA F. KOGAN, ESQ. Tel: (510) 525-0817 JEREMY B. MILLER, ESQ. Hogan & Hartson L.L.P. M. EDWARD ROSS, ESQ.; SBN 173048 555 Thirteenth Street, NW STEEFEL, LEVITT & WEISS Washington, DC 20004 A Professional Corporation Tel: (202) 637-5600 One Embarcadero Center, 30th Floor San Francisco, CA 94111 Tel: (415) 788-0900 JAMES WHEATON; SBN 115230 ELIZABETH PRITZKER; SBN 146267 FIRST AMENDMENT PROJECT 1736 Franklin, 8th Floor Oakland, CA 94612 Tel: (510) 208-7744 Attorneys for Plaintiff Daniel J. Bernstein IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF CALIFORNIA DANIEL J. BERNSTEIN ) ) C 95-00582 MHP Plaintiff, ) ) PLAINTIFF'S FIRST ) SUPPLEMENTAL COMPLAINT v. ) ) ) UNITED STATES DEPARTMENT OF ) STATE et al., ) ) ) Defendants. ) ) ) Plaintiff Daniel J. Bernstein files this First Supplemental Complaint and alleges: 1. On February 21, 1995, Plaintiff filed his Complaint in this action alleging that the Arms Export Control Act ("AECA") and its implementing regulations, the International Traffic in Arms Regulations ("ITAR"), are unconstitutional on their face and as applied to him by defendants. A copy of the Complaint is attached as Exhibit A and incorporated by reference as though set forth fully herein. 2. After the original complaint was filed, the President of the United States, on November 15, 1996 issued Executive Order 13,026 ("EO 13026") and a Presidential Memorandum, 61 Fed.Reg. 58767 (1996), as well as a letter to the Speaker of the House of Representatives and the President of the Senate concerning export controls on cryptography. Copies of each are attached as Exhibit B to this Supplemental Complaint and incorporated by reference as though fully set forth herein. 3. By these actions, the President "transfer[red] certain encryption products from the United States Munitions List administered by the Department of State to the Commerce Control List administered by the Department of Commerce." Presidential Letter, Exhibit B. 4. Under EO 13026, "export controls of encryption products that are or would be, on this date, designated as defense articles in Category XIII of the [U.S.] Munitions List and regulated ... pursuant to the [AECA]" shall now be regulated by the Department of Commerce under the Export Administration Regulations ("EAR"), 15 C.F.R. Parts 730 et seq., originally promulgated under the Export Administration Act ("EAA"), 50 U.S.C. App. sec. 2401 et seq. 5. On December 30, 1996, the Commerce Department issued regulations pursuant to EO 13026 effective immediately, establishing encryption item ("EI") controls ECCN 5A002, 5D002 and 5E002 for commodities, software and technology transferred from the U. S. Munitions List by EO 13026 to Commerce export licensing. 61 Fed.Reg. 68572 (1996) ("EI regulations"). A copy of the EI regulations is attached as Exhibit C. 6. Plaintiff seeks declaratory and injunctive relief as to this new regulatory scheme ("EAA/IEEPA Scheme") and to any substantially similar regulatory scheme by defendants on the grounds that it is unconstitutional on its face and as applied to him. STATUTORY AND REGULATORY CONTEXT 7. The EAA expired on August 20, 1994. 8. The President has continued the EAR to the extent permitted by law under authority of the International Emergency Economic Powers Act ("IEEPA"), 50 U.S.C. sec. 1701 et seq. Executive Order 12,924 (1994) ("EO 12924"), 59 Fed.Reg. 43437; Notice of Aug. 15, 1995, 60 Fed.Reg. 42767 (Aug. 17, 1995); Notice of Aug. 14, 1996, 61 Fed.Reg. 42527 (Aug. 14, 1996). 9. If and when Congress reauthorizes the EAA, statutory authority for the EI regulations will be the EAA; however, the President stated when he issued EO 13026 that if ``adequate controls'' were not placed on encryption products, he would transfer jurisdiction back to the ITAR: Upon enactment of any legislation reauthorizing the administration of export controls, the Secretary of Defense, the Secretary of State, and the Attorney General shall reexamine whether adequate controls on encryption products can be maintained under the provisions of the new statute and advise the Secretary of Commerce of their conclusions as well as any recommendations for action. If adequate controls on encryption products cannot be maintained under a new statute, then such products shall, where consistent with law, be designated or redesignated as defense articles under 22 U.S.C. 2778(a)(1), to be placed on the United States Munitions List and controlled pursuant to the terms of the [AECA] and the [ITAR]. Any disputes regarding the decision to designate or redesignate shall be resolved by the President. Exhibit B, para. 8. KEY STATUTORY PROVISIONS OF THE IEEPA 10. The IEEPA does not give the President the authority to regulate or prohibit the exportation of any information or informational materials, except for those "otherwise controlled for export" under 50 U.S.C. App. sec. 2404 and 2405 (to the extent such controls promote nonproliferation or antiterrorism policy). 50 U.S.C. sec. 1702(b)(3). KEY STATUTORY PROVISIONS OF THE EAA 11. The EAA authorizes restrictions on the export of any goods or technology subject to the jurisdiction of the United States or exported by any person subject to the jurisdiction of the United States, and includes authority over the transfer of goods or technology within the United States to embassies and affiliates of controlled countries.. 50 U.S.C. App. sec. 2404(a)(1). 12. The term "good" excludes "technical data." 50 U.S.C. App. sec. 2415(3). 13. The term "technology" is defined to mean "the information and know-how ... that can be used to design, produce, manufacture, utilize, or reconstruct goods, including computer software and technical data, but not the goods themselves." 50 U.S.C. App. sec. 2415(4). Thus, "technology," not "good," includes computer software. 14. The term "export" is defined to mean "an actual shipment, transfer, or transmission of goods or technology out of the United States," "a transfer of goods or technology in the United States to an embassy or affiliate of a controlled country," or "a transfer to any person of goods or technology either within the United States or outside of the United States with the knowledge or intent that the goods or technology will be shipped, transferred, or transmitted to an unauthorized recipient." 50 U.S.C. App. sec. 2415(5). 15. EAA precludes judicial review of licensing decisions. 50 U.S.C. App. sec. 2412(a), (e). KEY REGULATORY PROVISIONS 16. Under the EAA/IEEPA Scheme, "commodity" is defined as "[a]ny article, material, or supply except technology and software." 15 C.F.R. sec. 772. This definition is essentially identical to the statutory definition of "good." 50 U.S.C. App. sec. 2415(3). 17. The EAR generally treats "software" as "technology," and defines "technology" as technical data, training and assistance. 15 C.F.R. sec. 772 (encryption items) 18. Despite this normal categorization, the EAA/IEEPA Scheme provides that encryption software "shall not be considered or treated as 'technology', as that term is defined in ... the EAA (50 U.S.C. App. sec. 2415) and in the EAR (61 Fed. Reg. 12714, March 25, 1996)." EO 13026, sec. 1(c). Instead, "for export licensing purposes encryption software is treated ... in the same manner as a commodity included in ECCN 5A002." Despite this, "[L]icense Exemptions for commodities are not applicable." Note to Supp. No. 1, Part 774 (Commodity Control List), ECCN 5D002, 61 Fed. Reg. 68587. 19. "Encryption items" are defined as "all encryption commodities, software, and technology that contain encryption features and are subject to the EAR," other than "encryption items specifically designed, developed, configured, adapted or modified for military applications (including command, control and intelligence applications) which are controlled by the Department of State on the U.S. Munitions List." 15 C.F.R. sec. 772. 20. The term "knowledge" is defined to include "an awareness of a high probability of [a circumstance's] existence or future occurrence." 15 C.F.R. sec. 772. 21. "Export of encryption software" is defined as: "actual shipment, transfer, or transmission out of the United States"; "transfer of such software in the United States to an embassy or affiliate of a controlled country"; or "downloading or causing the downloading, of such software to locations (including electronic bulletin boards and Internet file transfer protocol and World Wide Web sites) outside the U.S., and making such software available for transfer outside the United States, over radio, electromagnetic, photo optical, or photoelectric communications facilities accessible to persons outside the United States, including transfers from electronic bulletin boards and Internet file transfer protocol and World Wide Web sites, or any cryptographic software subject to controls under this regulation unless the person making software available takes precautions as adequate to prevent unauthorized transfer of such code outside the United States." 15 C.F.R. sec. 734.2(b)(9). 22. Thus the regulations specify that electronic or Internet publication of encryption software requires a license while publication of the same information in "a printed book or other printed material" is not subject to licensing pursuant to 15 C.F.R. sec. 734(b)(2). 23. The export of "assistance," including training, to foreign persons with respect to these "encryption products," shall be controlled to the same extent that export of such assistance is controlled under the AECA and ITAR. EO 13026, sec. 2(d); 15 C.F.R. sec. 730.5(d); 734.5(c); 736.2(b)(7)(ii); 744.9. 24. Under the EI regulations, licenses are required for export to all destinations except Canada. 15 C.F.R. sec. 742.15. Exceptions are made for certain mass-market and key-recovery or key-escrow products, none of which are relevant to Plaintiff's proposed activities. 15 C.F.R. sec. 742.15 (b). 25. "Encryption products" shall not be subject to provisions permitting the unlicensed export of "foreign-available" items. EO 13026, sec. 1(a); 15 C.F.R. sec. 768.1(b). 26. All publicly available technology or software other than encryption technology software may be exported without a license. 15 C.F.R. sec. 732.2 (b)(1), 744.9. 27. In general, information published on an electronic bulletin board is not subject to the EAR because it is publicly available. 15 C.F.R. Part 734, Supp. No. 1 (Q&A), I(3). 28. However, "the provisions of the EAR applicable to the control of software (e.g., publicly available provisions) are not applicable to encryption software." 15 C.F.R. Part 772, Note to ECCN 5D002 ("Encryption software controlled for EI reasons under this entry remain subject to the EAR even when made publicly available"). 29. Under the EI regulations, "the fundamental research provisions ... do not apply to encryption software in both source code and object code." 15 C.F.R. sec. 734.8 (a). 30. Under the EI regulations, "the educational information provisions ... do not apply to encryption software in both source code and object code." 15 C.F.R. sec. 734.9. PARTIES 31. When plaintiff filed his Complaint, neither the U.S. Department of Justice ("DOJ"), the Central Intelligence Agency ("CIA") nor the U.S. Department of Energy ("DOE") had a formal role in the export licensing process for cryptography. 32. The DOJ is now among the agencies that can review export license applications for encryption software and "is concerned with control relating to encryption items." 15 C.F.R. sec. 750.3(b)(2)(v), 61 Fed. Reg. 68585. 33. CIA, DOE and DOJ are now directly involved in the administration of encryption export controls and are proper defendants in this action. 34. At all times relevant to this action, Plaintiff is informed and believes and upon such information and belief alleges that the Defendant U.S. DEPARTMENT OF JUSTICE was and is an agency of the Government of the United States and was and is delegated to coordinate and concur with Defendant COMMERCE DEPARTMENT in promulgating and administering regulations under the EAA/IEEPA. 35. At all times relevant to this action, Plaintiff is informed and believes and upon such information and belief alleges that the Defendant U.S. DEPARTMENT OF ENERGY was and is an agency of the Government of the United States and was and is delegated to coordinate and concur with Defendant COMMERCE DEPARTMENT in promulgating and administering regulations under the EAA/IEEPA. 36. At all times relevant to this action, Plaintiff is informed and believes and upon such information and belief alleges that the Defendant CENTRAL INTELLIGENCE AGENCY was and is an agency of the Government of the United States and was and is delegated to coordinate and concur with Defendant COMMERCE DEPARTMENT in promulgating and administering regulations under the EAA/IEEPA. GENERAL ALLEGATIONS 37. Plaintiff continues to develop and study cryptographic software. 38. Plaintiff wishes to publish cryptographic software and related technical information to the worldwide cryptographic community, both in printed materials and in electronic form (such as on the Usenet newsgroup sci.crypt). He further wishes to exchange cryptographic software and related technical information with foreign persons interested in cryptography, both inside and outside the United States, and to teach cryptographic software and related technical information to his students, some of whom are likely to be foreign nationals, all as part of plaintiff's research and teaching activities as a member of the academic community. 39. Plaintiff is scheduled to begin teaching a course in the theory and practice of cryptography at the University of Illinois at Chicago on January 13, 1997, and wishes to use and distribute cryptographic software and related technical information in his teaching of this course as well as in future courses that he is likely to teach. 40. Plaintiff, in teaching this course and future courses, and in furtherance of his professional career of academic research and development in cryptography, intends to publish cryptographic software and related technical information in electronic form, to his students and others on a University of Illinois at Chicago ("UIC") World Wide Web ("WWW") site, which under normal scientific practice and general principles of academic freedom, as well as established UIC policy, is not restricted as to the possible audience. 41. As to each of the following counts, Plaintiff alleges the need for injunctive and declaratory relief, damages and the need for a Temporary Restraining Order, a Preliminary Injunction and a Permanent Injunction, as follows: 42. This Court has declared that "the ITAR licensing system as applied to Category XIII(b) acts as an unconstitutional prior restraint in violation of the First Amendment." Dec. 16, 1996 Memorandum and Order at 22-23. 43. The cryptographic speech that plaintiff wishes to teach, exchange with foreign peers, and publish, is now subject to export licensing control under the EAA/IEEPA Scheme. 44. As a direct result of the acts and omissions of Defendants, their agents and employees, acting in their official capacities under color of federal law, Plaintiff, and all other persons wishing to publish, discuss, teach and share cryptographic software, and other information relating to cryptography, have been and are deprived of their federal constitutional rights to speak, to publish, assemble, to receive information, and to engage in academic study, inquiry and publication, guaranteed by the First Amendment to the Constitution of the United States. 45. Unless immediately restrained, the defendants will apply the EAA/IEEPA Scheme to plaintiff or will chill his speech through the possibility of prosecution and will cause him irreparable injury. 46. An actual controversy now exists between Plaintiff and Defendants concerning the constitutional validity of the EAA,/IEEPA Scheme on its face and as applied to him. 47. A judicial declaration is necessary and appropriate at this time under the circumstances in order that Plaintiff may ascertain and enforce his rights and duties and also to prevent injustice and irreparable injury to Plaintiff. 48. Plaintiff has already suffered damages from Defendants' conduct in that he has been unable to advance his professional reputation and career by publishing, exchanging and discussing his work with his professional peers and others. 49. Plaintiff's academic colleagues and peers, as well as the public, are harmed by plaintiff's inability to disseminate his work freely. In particular, foreign persons who wish to engage in scientific exchange on cryptography will suffer harm to their careers and reputation because plaintiff and other U.S. persons are deterred from engaging in activities that might constitute provision of technical assistance to a foreign person in developing cryptographic software outside of the United States. 50. Plaintiff has no adequate remedy in the ordinary course of the law. SUPPLEMENTAL COUNT I (UNCONSTITUTIONAL PRIOR RESTRAINT) 51. Plaintiff realleges and incorporates herein by this reference all of the allegations contained in all of the previous paragraphs as though the same were fully set forth in Court I. 52. Materials containing cryptographic software in electronic form are subject to prepublication licensing. Note to 15 C.F.R. sec. 734.3 (b)(2) and (3). 53. Although the EAA/IEEPA Scheme does not apply to printed encryption source code, Defendants "continue[s] to review whether and to what extent scannable encryption source or object code in printed form should be subject to the EAR and reserves the right to impose export controls on such software." 61 Fed.Reg. 68575. 54. Under the EAA/IEEPA Scheme, there exists a procedure like that under the ITAR Scheme by which plaintiff may determine whether a license is required. An exporter may ask Commerce for a non-binding Advisory Opinion ("AO"). 15 C.F.R. sec. 748.3(a). The AO process normally takes about 30 days. 15 C.F.R. sec. 750.2(b). 55 The EAA precludes judicial review of Defendants' determination that speech is controlled. 56. Once a person has completed the AO process, he or she must seek a license and advance approval for each recipient of the controlled software or technical assistance. 15 C.F.R. sec. 750.3. 57. Under the EAA/IEEPA Scheme, teaching foreign persons both inside and outside the United States about cryptography "with the intent to aid a foreign person in the development or manufacture outside the U.S. of encryption commodities and software" outside of an academic setting require a license 15 C.F.R. sec. 744.9(a). This provision threatens to restrict Plaintiff and others' ability, among others, to speak at conferences or other public meetings. 58. The EAA/IEEPA Scheme does not contain narrowly drawn, reasonable and definite standards for the administering officials to follow, and gives them unbridled discretion to determine what speech is subject to licensing, and whether licensing should be required. As such, the EAA/IEEPA scheme, both facially and as applied, constitutes an impermissible prior restraint of Plaintiff's right of free speech in violation of the First Amendment to the U.S. Constitution. 59. The EAA/IEEPA Scheme does not provide that the Defendants must either issue a license within a specified brief period of time or to go to court to restrain publication, and such undue delay results in unconstitutional suppression of speech. As such, the EAA/IEEPA scheme, both facially and as applied, constitutes an impermissible prior restraint of Plaintiff's right of free speech in violation of the First Amendment to the U.S. Constitution. 60. The EAA/IEEPA Scheme does not ensure a prompt final judicial decision reviewing any interim and possibly erroneous denial of a license and does not require that the burden of proof in any such judicial action be on the government. As such, the EAA/IEEPA scheme, both facially and as applied, constitutes an impermissible prior restraint of Plaintiff's right of free speech in violation of the First Amendment to the U.S. Constitution. 61. The EAA precludes judicial review of licensing decisions. As such, the EAA/IEEPA Scheme, both facially and as applied, constitutes an unconstitutional prior restraint of Plaintiff's First Amendment right to free speech since it purports to prohibit judicial review on any grounds. WHEREFORE, Plaintiff prays for judgment against Defendants as hereinafter set forth. SUPPLEMENTAL COUNT II (VAGUENESS) 62. Plaintiff realleges and incorporates herein by this reference all of the allegations contained in all of the preceding paragraphs herein as though the same were fully set forth in Court II. 63. The EAA/IEEPA Scheme fails to give adequate notice to a person of ordinary intelligence concerning the speech it proscribes. See e.g. 15 C.F.R. sec. 744.9(a). Accordingly, it is susceptible to arbitrary and discriminatory enforcement, chills First Amendment freedoms, and is vague both on its face and as applied to Plaintiff. WHEREFORE, Plaintiff prays for judgment against Defendants as hereinafter set forth. SUPPLEMENTAL COUNT III (OVERBREADTH) 64. Plaintiff realleges and incorporates herein by this reference all of the allegations contained in all of the preceding paragraphs herein as though the same were fully set forth in Count III. 65. The EAA/IEEPA Scheme is overbroad, both on its face and as applied to plaintiff, in that it is not carefully drawn or authoritatively construed to punish only unprotected speech and is susceptible of application to protected expression. 66. The EAA/IEEPA Scheme is overbroad in that licensing is required for the publication of all materials containing encryption source code in electronic form or media, regardless of whether such source code is publicly available, the result of fundamental research or educational. 67. The EAA/IEEPA Scheme is not narrowly tailored to address the Government's purported interest in protecting national security in that it requires a license for the export of cryptographic items even when they are already available outside the United States. WHEREFORE, Plaintiff prays for judgment against Defendants as hereinafter set forth. SUPPLEMENTAL COUNT IV (CONTENT-BASED DISCRIMINATION) 68. Plaintiff realleges and incorporates herein by this reference all of the allegations contained in all of the previous paragraphs herein as though the same were fully set forth in Count IV. 69. The EAA/IEEPA Scheme discriminates against speech on the subject of cryptography, discriminates against recipients based on whether they are foreign nationals or are located outside the United States, discriminates against technology which is sold for a price exceeding the cost of reproduction and distribution, and discriminates against encryption software in electronic form, each of which constitutes an impermissible regulation of speech based on content in violation of the First Amendment to the U.S. Constitution. WHEREFORE, Plaintiff prays for judgment against Defendants as hereinafter set forth. SUPPLEMENTAL COUNT V (RIGHT TO RECEIVE/FREEDOM OF ASSOCIATION) 70. Plaintiff realleges and incorporates herein by this reference all of the allegations contained in all of the previous paragraphs herein as though the same were fully set forth in Count V. 71. The EAA/IEEPA Scheme's requirement of a license prior to the electronic publication of encryption software or the provision of "technical assistance" to foreign persons, including the provision of encryption software, impermissibly infringes on the First Amendment rights of Plaintiff and others in restricting the development of the science of cryptography. 72. The EAA/IEEPA Scheme infringes on the First Amendment rights of Plaintiff and others to receive the results of the study and inquiry with regard to scientific issues, since the licensing scheme will prevent or chill others from electronically publishing encryption software or providing information about cryptography outside of an "academic" setting. WHEREFORE, Plaintiff prays for judgment against Defendants as hereinafter set forth. SUPPLEMENTAL COUNT VI (ULTRA VIRES) 73. Plaintiff realleges and incorporates herein by this reference all of the allegations contained in all of the previous paragraphs herein as though the same were fully set forth in Count VI. 74. The IEEPA does not permit the President to regulate purely domestic speech. 75. The IEEPA does not permit the President to regular or prohibit, directly or indirectly, exportation of any information or informational materials, and Congress intended by this limitation on the President's power to restrict information that is protected under the First Amendment. 76. The IEEPA does not permit the President to regulate "any postal, telegraphic, or other personal communication which does not involve a transfer of anything of value." 50 U.S.C. sec. 1702(3)(b)(2). 77. Because cryptographic source code and information related to cryptography is speech protected by the First Amendment, and because it extends to noncommercial cryptographic source code, the EAA/IEEPA Scheme exceeds the limits set in the IEEPA, in contrary to law and violates the Administrative Procedure Act. PRAYER WHEREFORE, Plaintiff prays for judgment against Defendants, and each of them, as set forth below: 1. For a Declaration of this Court: a. declaring that the statutes, regulations, policies, practices and conduct complained of herein are, on their face, and therefore unconstitutional and void; b. declaring that the statutes, regulations, policies, practices and conduct complained of herein are in violation of the First and Fifth Amendments to the Constitution of the United States and so are null and void as applied to Plaintiff's desired conduct of publishing the Items and any other scientific paper, algorithm or computer program; 2. For a Temporary Restraining Order, a Preliminary Injunction, and a Permanent Injunction, all enjoining Defendants, and each of them, as well as those persons or entities acting on their behalf, and all persons acting in concert or participating with them, from prosecuting Plaintiff or any others for publishing in electronic form or otherwise, a scientific paper, algorithm or computer program, and specifically, a. preliminarily and permanently enjoining Defendants from doing or causing to be done any of the following acts: 1) further and future enforcement, operation or execution of the statutes, regulations, policies, practices and conduct complained of herein, with respect to scientific papers, algorithms or computer programs through criminal prosecution or in any other way; 2) threatening, detaining, prosecuting, discouraging, or otherwise interfering with Plaintiff and any other person in the exercise of their federal constitutional rights. b. granting expedited docket treatment to bring this case to trial at the earliest possible time. 3. For the recovery of damages in a sum to be proved at trial; 4. For attorneys fees incurred herein; 5. For costs of suit incurred herein; and 6. For such other and further relief as the Court deems just and proper. Dated: January 7, 1997 McGLASHAN & SARRAIL Professional Corporation (signed Cindy A. Cohn) By ______________________________ CINDY A. COHN Attorneys for Plaintiff DANIEL J. BERNSTEIN