SAN FRANCISCO (04/06/2000) - A U.S. Appeals Court judge ruled this week that encryption source code is constitutionally protected speech and not subject to prior restrictions imposed by the U.S. Export Administration. The U.S. government had limited its distribution until January of this year. The decision could have far-reaching implications for other pending cases concerning the freedom to distribute controversial software.
The court's decision was celebrated in Toronto by attendees of the Tenth Conference on Computers, Freedom and Privacy. "This ruling clearly indicates that we are pushing the Sisyphean rock back up the slippery slope toward human rights and freedom for academic security researchers - which is precisely the right direction," said Dave Del Torto, executive director of the San Francisco-based CryptoRights Foundation. "Anyone interested in the success of electronic commerce should be very pleased at the court's decision."
The ruling, by Chief Judge Boyce Martin Jr. of the 6th Circuit U.S. Court of Appeals in Ohio, reversed an earlier decision against professor Peter D.
Junger. Junger, who teaches at Case Western University School of Law in Cleveland, wanted to post encryption source code on his Web site. In July of 1997, the U.S. Department of Commerce told Junger that a chapter in his textbook, "Computers and the Law," which contained encryption code, could be exported in printed form. But the Commerce Department determined that posting the chapter in electronic form would require an export license.
Junger originally challenged the restrictions on First Amendment grounds.
However, a U.S. District Court ruling found that encryption source code wasn't sufficiently expressive to be protected as free speech by the First Amendment.
In January, the Bureau of Export Administration relaxed the encryption export regulations dramatically (see story), altering the context of the decision in the Junger case. While strict limits on the export of encryption source code have been eased, commercial products that use strong encryption are still subject to review by the Commerce Department.
"Having concluded that the First Amendment protects computer source code, we reverse this case for further consideration of Junger's constitutional claim in light of the amended regulations," wrote Martin. "The fact that a medium of expression has a functional capacity should not preclude constitutional protection."
"It's interesting that this ruling is based on the philosophical idea that speech should not be restricted rather than the reality that restriction of export is ineffective," observed Lance Cottrell, president of San Diego-based Anonymizer.com, a service that provides free anonymous use of the Internet. He said it never took more than 48 hours for restricted encryption software to become available over the Internet on non-U.S. sites.
For years, the U.S. government has argued that strong cryptography could compromise law enforcement and national intelligence operations. Another encryption case, brought by University of Illinois professor Daniel Bernstein, also challenged these assumptions, arguing that the encryption export laws blocked the electronic distribution of his scientific research.
Software developers pointed out that the export legislation put U.S. companies at a competitive disadvantage. "It's the 'full employment for foreign cryptographers' act," said Cottrell. "We all know that foreigners can write very high-quality cryptography, and we all simply outsource to them and import the cryptographic software."
Last May, the 9th Circuit Court of Appeals in California ruled in favor of Bernstein, and the 6th Circuit ruling appears to echo the decision. Robin Gross, staff attorney for the San Francisco-based Electronic Frontier Foundation, said that while the encryption export laws have already been changed, the Junger ruling could have a profound impact on pending cases involving software, called DeCSS, that unlocks the playback technology on digital video discs. DVD cases are still pending in district courts in California, Connecticut and New York.
"The DVD cases are about whether the publishing and distribution of the DeCSS software is speech protected by the First Amendment, and this ruling will have a huge impact on these cases," Gross predicted. "It's also time to look at the new export regulations and ask ourselves if the law is in accordance with the First Amendment test for invalidating free speech."
Phil Zimmermann, creator of PGP encryption software, agreed that the ruling could have implications for intellectual property issues, especially litigation involving software that defeats copy protection schemes. Zimmermann, who fought U.S. government allegations that PGP had been improperly exported, said he felt vindicated by the ruling. "I wish this decision had been handed down when we were the target of investigation," said Zimmermann. "It would have simplified our defense strategy."