Slashdot Mirror
US Crypto Export Laws Ruled Unconsitutional
An anonymous reader sent us a story over at news.com
that proclaims some joyous news: The a US appeals court has ruled
Export Laws Unconstitutional.
Excellent.
← Back to Stories (view on slashdot.org)
Look at that list of defendants versus just one mere human. My God, it looks an X-Files'esque who's-who of the illuminati.
From the court's ruling:
DANIEL J. BERNSTEIN,
Plaintiff-Appellee,
v.
UNITED STATES DEPARTMENT OF JUSTICE;
UNITED STATES DEPARTMENT OF COMMERCE;
DEPARTMENT OF STATE;
UNITED STATES DEPARTMENT OF DEFENSE;
UNITED STATES ARMS CONTROL AND DISARMANENT AGENCY;
NATIONAL SECURITY AGENCY;
UNITED STATES DEPARTMENT OF ENERGY;
CENTRAL INTELLIGENCE AGENCY;
MADELINE E. ALBRIGHT, United States Secretary of State;
WILLIAM M. DALEY, United States Secretary of Commerce;
WILLIAM COHEN, United States Secretary of Defense; KENNETH A. MINIHAN, Director, United States National Security Agency;
JOHN B. HOLUM, Director, United States Arms Control and Disarmanent Agency;
WILLIAM G. ROBINSON;
GARY M. ONCALE;
AMBASSADOR MICHAEL NEWLIN;
CHARLES RAY;
MARK KORO;
GREG STARK;
Defendants-Appellants.
Australia has unfortunately been second only to the UK in pushing bad crypto proposals that the US government thought up but was unable to get passed in the USA. Their theory seems to be that once a few more countries subjugate their citizens' privacy, it will be much easier to make the case that we should do the same in the US.
It appears that the Wassenaar Arrangement is largely a paper tiger: it provides cover for those governments that WANT to restrict crypto, such as Australia's, but doesn't actually require freedom-loving governments such as Germany's (I know, it sounds funny!) or Ireland's to impose any controls.
Watch out for the next Wassenaar meeting, in which the nasties will try to impose controls on "intangible" goods (translation: The Internet). Today in all countries but the US, intangibles are not controlled by the export laws.
We in the US who have fought this battle for our own rights can't win it for you too. You will have to organize and convince, or sue, or elect, a government in your own country that will do the right thing with respect to crypto. The longer you wait, the more damage the authoritarians will do.
For today let's do a bit of dancing on the Berlin Wall of crypto. Tomorrow it's back to the barricades to push the bastards back further.
The public reason was that, supposedly, American-developed crypto was the best in the world, and letting it get into the hands of the "enemy" (which changed, depending on when and who you were talking to), was a Bad Thing. Since crypto developed outside the U.S. has gotten to be as good, that explanation has gotten incredibly weak. Many people put it up to inertia that the rules haven't changed. There's probably also an element of "We know what's best for you" from the government, and hiding things from the government is perceived to be bad (by the government, anyway).
I have also heard, with little support, that the gvmnt is worried that strong crypto will be used to enhance the underground economy, making it harder for the gvmnt to track (and presumably tax) money flows.
...phil
...phil
"For a list of the ways which technology has failed to improve our quality of life, press 3."
If the Justice Departement appeals to the Supreme Court things could get interesting. There have been cases in the past where the Court made a ruling that violated the Constititution but was in the interest of national security (Japenese internment during WWII for example). And with the moderate to conservative court that exists today, something along these lines could vary well come about.
The article was lacking in detail so it is diffecult to say if this case would be heard by the Court. If for one reason or another five of the justices did not feel that this was a case that properly layed out the
- Consititutional
issues they could very well ignore it and wait for a better opertunity. This would not mean that they will not eventually take this up but mearly that this case was not a good platform to make a ruling on.Well that is enough speculation, I will just wait for some more information before I create a real oppinion.
Posted by AnnoyingMouseCoward:
You asked for opinions - hears mine.
I agree that their are some aspects to strong crypto availability that are extremly vexing - use by criminals, etc, etc.
The problem with these arguments is that the successful criminals can afford the latest and greatest in computer security while private citizens often can't.
In addition to that, there are circumstances where a private citizen does have perfectly legitamite reasons for useing encryption, such as protecting buisness e-mail correspondances from being snooped by rival corporations.
Down under in Australia, we were recently treated to a leaked report from ASIO ( our equivelent of the FBI ) that flatly stated that there was no point in passing laws to prevent criminals from using encryption technology, since being criminals, they don't obey the law anyway.
In this respect, the only solution to the problem seems to be to level the playing field by making strong encryption available to everyone.
Still, politicians arn't known for their grasp of basic science or technology. The report was essentially ignored ( which is why it was probably leaked to the public ) and the Australian government is still going gung-ho to prove we can be just as stupid as everyone else.
But it's nice to think that there may finally be a light at the end of the tunnel.
Posted by AnnoyingMouseCoward:
Ok, I'll admit that was a handwave. I just wanted people in the USA to know that their government isn't the only one doing stupid things.
As for "..this argument could be used against any law whatsoever..", well yes and no. Laws are essentially a social contract between the members of a society as to what forms of behaviour are and arn't acceptable. When the ruling body passes laws that are ignored by a substantial section of the general population, the result is simply a weakening of this social contract and the undermining of the acceptance of the law by the population as a whole.
As the availablility of strong encryption, while I'm not seriously into cryptography and general purpose algorithms, I suspect that it's probably possible for certain groups ( criminals, terrorists, etc ) to come up with fairly secure encryption simply by using the old 19th centuary "Book Codes". With this kind of scheme, you are going to have a hard time de-crypting any message without knowing the book which is used as the key.So "strong" cryptography is available, it's just not available as a general purpose package with a "point and drool" interface.
As for useing cryto to anonymously publish things like biological warefare procedures, drug manufacturing procedures, etc, etc, this is one of those things that I personally feel is greatly over-rated.
As a point in case, an old friend of mine back in high school ( about 20 years ago ) was culturing all kinds of bugs on agar plates. The knowledge base to do this is available in print in any university library. At the time, he blythely pointed to one dish and mentioned that it contained bubonic plague. He took the trouble at this point to reassure me that while it was easy to cultivate, it was a pain in the neck to find a viable vector ( ie, fleas with rats ) so there was nothing to worry about [ and no, I'm not joking ].
Likewise, as someone who majored in chemistry at university, I know for a fact that you can look up recipies for all kinds of explosives and drugs in the organic chemistry section of any university anywhere in the world. Of course, the media has a certain difficulty in getting anyone to pay attention to a headline like "Juvenile delinquent makes drugs with a book from the library!", so they go for "..with a recipe found on the Internet!". It's just media hype.
Just my $0.02 worth.
Going on an idea for a computer language similar to english, what if someone converted a computer language to english and back again. It could be close enough to english to pass as free speach, but structured enough to be converted back to c or some other computer language. Then, post your "free speach" and the simple translator, instant crypto export. I'm not a lawyer, so I can't say it would be legal, but it would be interesting if someone pulled such a stunt.
Not all patents are in language. In fact, except for software, no patents are in "language." Example: a book. It's certainly in a language. But you can't patent a book. Now, let's try some new chip. Is it in a language? No. The plans for it and the documentation are both in a language, but those can't be patented (copyrighted, yes, patented, no).
Now, here's the interesting thing: you cannot patent source code, anywhere. You can naturally copyright it, in fact you're expected to (even the FSF does it). But it's a representation, a language. So you can't patent it.
What you can, unfortunately, patent is the concept behind the code. To give you an example, let's take LZW compression (most commonly used in GIF's), the patent for which is held by Unisys. Now, Unisys has source code, of course. That isn't patented. However, the patent on the compression means that you are not allowed to write any code using that algorithm, even is your code is completely different from the code Unisys has. In effect, it's patenting an idea (which, if I'm not mistaken, the Constitution forbids, but the government either hasn't seen that or has been lobbied by the industry not to look). Other patented ideas: the use of XOR to move a mouse pointer across the screen, the RSA encryption algorithm, color-matching technology (if you believe Imatec's latest claim, which I don't), and so on. There is no patented code for any of these; in fact the RSA encryption algorithm can be found in any discrete mathematics textbook (it's a popular example exercise). But, no one else can use these, even though they're doing their own work, not stealing that of the patent owners.
This is my major gripe with the patent system. The software industry has twisted it to a use for which it was never intended.
Your suggestion that the US Administration cares about the well-being of US software companies is dubious. They care about it only in so far as it doesn't interfere with their intelligence-gathering capabilities.
http://www.ce9.uscourts.gov/web/newopinions.ns f/f606ac175e010d64882566eb00658118/febd2452a8a4d79 b8825676900685b71?OpenDocument
What about those people who went out and got ;-)
the RSA-in-3-lines-of-Perl program tattooed on
their arm? (Suddenly, that 'This human is
classified as a munition' tattoo that I wanted to
get across my chest doesn't look so neat.
Doug
Well, here's two old links I had lying around...
Tattoo 1
Tattoo 2 (My favorite)
Doug
This is a wonderful result. Source code is a method of communication - of expression - and thus protected by the 1st ammendment. The compiled binary is a tool, serving simply a funtional purpose. My reading is that the source code can now be exported but binaries can't. If this holds, any company wanting to export strong crypto must do so in source form. And the source form must be readable and understandable by other people, in other words, it can't be obfuscated code. This is not only a big win for cryto and free speech, but also for OSS.
...Linux!
Andrew
--
"You never know when some crazed rodent with cold feet might be running loose in your pants."
-Calvin
The crypto restrictions were always pretty dim, particularly since you could export books which explained the theory of the algorithms, or even, as somebody noted, the source-code itself.
Definately headed for the Supreme's, particularly since there have been conflicting concepts of software as speach. Given that, the court will probably choose to hear the case. They could always let the deicision stand without comment, though. We shall see.
---------
I would really like to see this stick but the article finishes with an appeal. This means that, though its a start it really isn't much to go on.
It seems flimsy though to say that programming is simply a language and therefore violates his right to free speech. It just doesn't seem like much to go on when the government believes that it is a national security issue. I'm still doubtful this means much.
-----------
Resume
Football Sports Contest - Win $500 for having an e
Many people miss the point of crypto export restriction and point to the facts that strong crypto is wide available outside the US, that the restrictions are not consistent, hard to enforce, etc. Irrelevant.
The restrictions are actually working very well.
Anyone who really wants crypto anywhere in the world will get it. Terrorists and drug cartels are using crypto for decades. What the export restrictions are really doing is prevent the creation and widespread adoption of interoperable international standards for ubiquitous encryption. That's what they really want. They want no obstacles to their dragnet-style eavesdropping on everyone - on you.
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
Accordint to This NY times article there are at least two other cases concerning this same question. Let's hope this ruling sticks before both those courts, and is upheld in the (inevitable) appeal to the US supreme court.
Before anyone gets upset about another login-required NY times article, remember login/password=cypherpunks/cypherpunks.
0 1 - just my two bits
This is great news! However, be wary: "Justice" has appealed the decision, and the article was very light on details. That means it may go to the Supreme Court, if I've got my US Judicial System hierarchy right... there's still the danger of this decision being overturned.
"Besides which, maybe exporting strong crypto isn't that great of an idea in the first place. Anybody care to comment?"
I'm not sure that the issue is *solely* one of exporting crypto, per se.
If strong crypto was truly considered to be a national security issue, it would be illegal to publish the source code in a paper book, as well. It is not so much the that encryption is or is not a national security issue, though, but that the laws regarding the export of strong encryption are oxymoronic and effectively unenforcable. Since nothing prevent someone from printing the source code to an encryption routine and then mailing it overseas, there is, essentially, no real restriction at all. If someone really wants to use that routine, having to type it in by hand is only a minor inconvenience.
That bit aside, there are at least two reasons offhand why I consider these export restrictions to be a bad idea.
1. The US does not have any kind of unique position with regards to strong encryption. It is possible (and very easy) to acquire encryption tools at least as strong as any available within the US. If someone wants strong encryption, they will get it somewhere, whether the US likes it or not.
2. As a result of (1), the US is placed in the position of being unable to effectively compete on an international arena where any strong encryption is concerned.
Nunc Tutus Exitus Computarus.
I was reading one of the "related articles" on that story http://www.news.com/ News/Item/0,4,0-23872,00.html?st.ne.ni.rel, and one Judge Gwin says that software is not language like cooking recipes, instructions, and manuals, because the software is "purely functional" and "actually performs the function".
HELLO?! Has he ever seen a floppy disk encrypt anything? No! It takes a COMPUTER to do that!
Software is by definition INSTRUCTIONS for the processor. In fact, the word "instruction" is used throughout computer terminology!
He should be banning the export of computers for being able to encrypt. (Sadly, that's more than just sarcastic: we already do that to a certain extent with supercomputers.)
[wiping away tears of happiness]
If this holds up I will start to believe in God again.
The implications are greatest for those who write free software. The ruling seems to apply only to source code. It's hard to argue that object code, which is understandable only by machines, qualifies as "speech." So companies that sell binaries may not be affected at all. They will still be enjoined from exporting encryption without a license. However, distributing GPL source code without binaries is not only easy, it's common practice. If this ruling stands, it'll be one more thing that puts the "free" in "free software".
I find it interesting that part of the descision was
With the continuing approach of computers that can understand and act sensibly on speach proceeds, this ruling gets closer and closer. I don't think this is here yet (it will, imho, be overturned) I do think that it's inevitable that this will happen. As computers become able to interperate a wider and wider variety of things, the export laws would have to get more and more restrictive, and are more likely to be overturned.
Wouldn't this mean that the "RSA in three lines of perl" tatoos are legally exportable on the same basis that a book full of source code is, but that the "bar code form" of the same thing wouldn't be exportable?
It's interesting to note that the argument on the one hand is that source code is a "machine" (although a virtual one, it is still a machine) and on the other hand source code is intended, by definition, to be primarily human readable, and requires a compile step to be a machine. I wonder where this leaves interpreted languages, where there is no compile?
There is also a note burried in there to the effect that because the web and computers in general have become so powerful, personal privacy has become more scarce now than at any other time in history. And then notes that the widespread availibility of strong encryption would help to negate this effect and the people would regain some of the lost privacy. This is the ultimate point. Computers make it to easy to keep track of people, and we've been denied access to their equal ability to hide people.
Never attribute to malice that which is adequately explained by stupidity.
That's an interesting point. Hmmm....
Last time I checked, you couldn't patent a written or spoken idea. You were afforded copyright protection, but you couldn't actually receive a patent. If software is now categorized along with written or spoken ideas ("language" as the 9th circuit called it), then the existing software patents are probably invalid, and should be revoked by the patent office.
Of course, this ruling would go against many years of established court decisions on software related patent infringement suits. This one little case may not make much of a difference on how courts handle patent cases.
No, they can't. This only rules for sourcode. So, mozilla.org could export things as source but could not distribute binaries to people. Free speech doesn't protect executables. This ruling is just about source code.
Their arguments against the export:
First, it is not at all obvious that the government's view
reflects a proper understanding of source code. As noted ear-
lier, the distinguishing feature of source code is that it is
meant to be read and understood by humans, and that it
cannot be used to control directly the functioning of a com-
puter. While source code, when properly prepared, can be eas-
ily compiled into object code by a user, ignoring the
distinction between source and object code obscures the
important fact that source code is not meant solely for the
computer, but is rather written in a language intended also for
human analysis and understanding.
Second, and more importantly, the government's argu-
ment, distilled to its essence, suggests that even one drop of
"direct functionality" overwhelms any constitutional protec-
tions that expression might otherwise enjoy. This cannot be so.16
The distinction urged on us by the government would prove
too much in this era of rapidly evolving computer capabilities.
The fact that computers will soon be able to respond directly
to spoken commands, for example, should not confer on the
government the unfettered power to impose prior restraints on
speech in an effort to control its "functional " aspects. The
First Amendment is concerned with expression, and we reject
the notion that the admixture of functionality necessarily puts
expression beyond the protections of the Constitution.
One thought related to the post which mentioned the liberality of the current court. My statement about "conservatism" is strictly in relation to issues related to national security, where the court still tends to move cautiously.
I really appreciated the poster who provided the analysis of the opinion, the dissenters, etc, BTW. Good job all!!
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
First of all, there is the inevitable appeal to the U.S. Supreme Court which (IHMO and IANAL) has generally been sensitive to national security concerns in such a way that a conservative ruling is more likely than the (again, IMHO) liberal ruling of the appellate court.
Secondarily, following the unsafe assumption that the Supreme Court would uphold the appeals court decision, if Congress could still pass a more specific law as to when crypto software can and cannot be exported , using the previous court judgement to refine the law. If the Free Speech == crypto exports lawsuit is brought up again, it would then need to again go through the whole process of trial and appeals all over again.
...(momentary pause -- I'm putting on my asbestos underwear)...
Besides which, maybe exporting strong crypto isn't that great of an idea in the first place. Anybody care to comment?
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
What's the bet that the US government knew that the export laws could be appealed on constitutional grounds, but went ahead and got all these countries (including my own, Australia) to sign the Wassenar agreement.
:P :)
So... now the US can quite legimately claim that it can't honour the agreement because of the constitutional appeal, giving US software companies an advantage over all the poor countries that were duped into signing over their rights (and most of us don't have those sort of clauses in our own constitution).
Thanks, guys!
While many are celebrating this ruling due to the crypto export implications, I think real victory is for the deeper issue: is source code speech? While the fights not over, I'm very encouraged that the appelate court reaffirmed that source code is expressive and is a form of speech (at least within the narrow context of this case).
The Junger case was similar. It involved a law professor who wanted to post crypto source code for his "Computers and the Law" class. A lower court (going against the ruling of the lower court in this case), sided with the government and dismissed the expressive nature of source code due to its functional aspect. They basically said source code wasn't speech. This was, IMHO, a bad bad ruling. I really find it offensive that the court would assert that a language such as C that I spend a large portion of my time reading and writing (often just for fun), isn't speech. I use computer languages to communicate ideas. That's speech. The judge (Gwinn) in the Junger case just didn't "get it." I've read this ruling, and it's obvious that at least some of the judges (or more likely, their aids) do "get it."
Let's just hope that if this goes to the Supreme Court, they're as enlightened.
Randy Weems
rweems@nospam.hotmail.com
Presidential candidates ought to be out trumpeting this one as a win for business and free speech.
Forgive me if this seems a silly question, but why *do* the US government want to restrict encryption export?
Do they actually believe that it's a threat to national security? I can't believe even the US government could be quite that stupid...
Is there maybe another reason? I don't know what... something to do with trade maybe? It's not like it'd be the first time they've tried to gain unfair trade advantages.
Of course, that's probably not it... but if not, what *is* their motive?
If "source code" is speech and you can't restrict that, what about binaries?
Someone mentioned that netscape would be able to exports their strong crypto version if this was upheld - but it's not distributed as source.
Methinks this is a big gray area.
--
--
Jason Eric Pierce
I started to get the same thing, but in C.
Unfortunately, after the artist got halfway down my back, I passed out.
It's a shame too. He still hasn't done the header files yet.
:)
Save the whales. Feed the hungry. Free the mallocs.
"...software is considered language, and therefore the export limits violated Bernstein's free speech under the First Amendment."
If that interpretation is upheld and accepted as precedent, it could have HUGE implications for people who write software in the U.S.
For example, if your state government passed a law prohibiting the writing of malicious code (i.e. virus, worm, trojan), First Amendment protection could make the law unconstitutional. The act of distributing the virus/worm/trojan could probably be prohibited, though.
IANAL and this post is all conjecture on my part, but I am VERY interested in seeing how this plays out.
Save the whales. Feed the hungry. Free the mallocs.
Restriciting export of crypto is POINTLESS. The laws are left over from the days when the *algorithm itself* was an important secret that needed to be protected. Now days the algorithms are all public (and well known all over the world) and the encryption key is really the important part. Restricting crypto export accomplishes nothing but harm to the American software industry.
I've been through the process of getting export approval for an encryption capable web server. It was a time consuming pain in the butt, and in the end we still lost sales because we couldn't ship the 128 bit version. The whole things was particularly annoying because we had to get a new license every time we released a new version of the software. Our product did the same SSL encryption everyone else did. It is a waste of taxpayer money when the government takes the time to individually license every single version of every single product that uses the same friggen algorithm! I almost wonder if the only reason we still have these pointless laws is because a bunch of useless buraeucrats are just trying to hang on to their pointless regulatory jobs.
Thad
The Bolachek Journals
I wouldn't be surprised to see another appeal, to the US Supreme Court now. This has been too big an issue for the US Government over the years to let it drop without a real fight.
Hmmmm. I thought the only restriction was on the EXPORT of encryption technology. AFAIK, US citizens have been able to use any strength encryption they can lay their hands on. They just aren't allowed to export the technology. So all the US government agencies really want to be able to do is 'snoop' on non-US citizens, who presumably are not protected by that holy-of-holies, the US Constitution.
MrCreosote Meow!Thump!Meow!Thump!Meow!Thump! "You're right! There isn't enough room to swing a cat in here!"
The text of the opinion is now available at the 9th Circuit website.
Agreed this is a remarkable and exciting result. agreed that this is quite likely to go up, given the stakes involved. For now, however, I will withhold further comment until I have had a chance to study the opinion.
It is important to note the narrow scope of the holding, despite all the yummy language:
"We emphasize the narrowness of our First Amendment holding. We do not hold that all software is expressive. Much of it surely is not. Nor need we resolve whether the challenged regulations constitute content-based restrictions, subject to the strictest constitutional scrutiny, or whether they are, instead, content-neutral restrictions meriting less exacting scrutiny. We hold merely that because the prepublication licensing regime challenged here applies directly to scientific expression, vests boundless discretion in government officials, and lacks adequate procedural safeguards, it constitutes an impermissible prior restraint on speech."
Slip Opinion at 4241.
The significance of this limiting language should not be overlooked. While the court did, in dicta (non-precedential commentary) reach out into the nether areas of whether government may try to slow the use of encryption, that was not the limited holding which is the crux (and legally binding effect) of the opinion.
Indeed, there is some risk that the opinion might be understood as a roadmap for drafting revised regulations or legislation that would permit the particular conduct encouraged by Bernstein (scientific inquiry) as a sort of "fair use," but preclude any other uses of encryption, which is among the Government's principal goals. [Replacing the prior restraint licensing, for example, with severe penalties for improper disclosure after the fact, with narrow exceptions for "academic and scientific" expression. Indeed, limiting regulation to use and transmission of object code and non-expressive transmission of source code might go a long way to slamming down much of what the government wants to slam while passing muster, perhaps, even with this court.]
Many roads before this will be over with: possible en banc review before the entire 9th Circuit, possible appeal to the Supreme Court. Possible dumping of the statute for more technically acceptable, yet equally egregious legislation.
But it is nice to see that we are no longer spitting into the wind, legally speaking. Dicta or no dicta, this opinion gives counsel for prospective cypherpunks a lot with which to go to bat. I am also encouraged with the hints that the Fourth Amendment is also implicated by crypto regulation!
By the way, some people commented earlier that the court's "liberal" opinion would be disregarded by the Supreme Court. I think not, at least not by lockstep ideology (although they might reverse). Arguably the most conservative voice on the bench, Justice Antonin Scalia is a powerfully strong First Amendment advocate, almost to the point of being absolutist. Don't forget that this is the same conservative court that twice shut down Flag Burning statutes.
That law considered that encryption as a weapon and so that kind of technology was (is?) not to be exported out of the US. IMHO, it was kind of a stupid thing: if I was a Dictator of some republic full of atomic bombs and needed strong encryption it wasn't the hardest thing to get. Well, if *I* wanted strong encryption, I could download it of the net!
So, the abolition of that law, is more simbolic than practical (for the average citizen the encryption available out of the US was as good as 148 bit!)
Joao
It is yet to be seen whether it gets appealed again (don't they have to show that there was some flaw in the process so far to make a higher appeal?).
However, I wonder how broadly this can be applied. The rulings of the 9'th Circuit court are not binding for other circuits (AKAIK, IANAL) but rather can be used in other circuits as being suggestive only.
Perhaps the FUD'iest thing they could do would be to NOT appeal, but to charge someone else in a different jurisdiction.