Venable's NII Reporter
VOL. 3, No. 1 Jan. 7,1996
Venable's NII Reporter is an electronic publication of the Information Law Group covering the significant legal and public policy issues encountered on the Information Superhighway. This publication highlights topical issues affecting information providers and users of cyberspace. Readers are encouraged to use the feedback form, or E-mail, to suggest additional topics, provide additional news items, or respond to comments in the publication.
Export Control Litigation
We have previously reported in Volumes1 and 2 on the administrative decisions of the Department of State concerning export of the bookApplied Cryptography and a diskette containing the source code for several cryptographic algorithms published in the book.Venable is serving as counsel to Phil Karn, the individual who unsuccessfully sought permission to export the diskette, having already received permission to export the book. The entire set of trial court pleadings, together with copies of the prior administrative appeals, is available from Mr. Karn's Website.
On September 20, 1996, we filed our opening brief.
On November 6, 1996, the Department of Justice filed its Brief for the Appellees.
On November 27, 1996, we filed our Reply Brief.
On January 3, 1997, the Department of Justice filed a Supplemental Brief containing the Government's view of the effect of the recent change in jurisdiction from the Department of State to the Department of Commerce. A copy follows:
[ORAL ARGUMENT SCHEDULED FOR JANUARY 10, 1997]
NO. 96-5121
_________________________________________________________________
________________________________________________________________
IN THE UNITED STATES COURT OF APPEALS
FOR THE DISTRICT OF COLUMBIA CIRCUIT
____________________
PHILIP R. KARN, Jr.,
Plaintiff-Appellant,
v.
DEPARTMENT OF STATE and THOMAS E. McNAMARA,
Defendants-Appellees.
____________________
ON APPEAL FROM THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
____________________
SUPPLEMENTAL BRIEF FOR THE APPELLEES
____________________
_________________________________________________________________
The appellees submit this supplemental brief, pursuant to Circuit Rule 28(g), to address relevant regulatory developments that have taken place since the completion of briefing.
STATEMENT
1. On November 15, 1996, President Clinton issued an Executive Order and Presidential memorandum governing the export of encryption products. See Addendum A infra.1The Presidential memorandum ordered the transfer of regulatory authority over the export of most encryption products from the Department of State under the International Traffic in Arms Regulations (ITAR) and the United States Munitions List (USML) to the Department of Commerce under the Export Administration Regulations (EAR). Ibid. The Presidential memorandum provides for the Department of State to retain jurisdiction under the ITAR and the USML over encryption products that are specifically designed for military applications. Ibid.
The decision to transfer regulatory authority from the Department of State to the Department of Commerce does not reflect a change in the President's assessment of the risks associated with the export of encryption products. To the contrary, the Presidential memorandum states that the use of encryption products outside the United States "can jeopardize our foreign policy and national security interests" and "can threaten the safety of U.S. citizens * * * as well as the safety of the citizens of other countries." Addendum A infra. The transfer of regulatory authority is based on the President's conclusion that exports of encryption products can be regulated by the Department of Commerce under the EAR "without compromising U.S. foreign policy objectives and national security interests." Ibid.
The transfer of regulatory jurisdiction applies to hardware, to software, including but not limited to source code software, and to technology. The Presidential memorandum recognizes that encryption source code "can easily and mechanically be transformed into object code," and that the export of encryption source code is subject to regulation "because of the code's functional capacity, rather than because of any 'information' such code might convey * * * ." Addendum A infra. For those reasons, the Presidential memorandum and Executive Order direct the Department of Commerce to regulate encryption source code as an encryption product, rather than as technical data or technology, for export licensing purposes under the EAR. Ibid.
2. On December 30, 1996, the Department of Commerce and the Department of State issued new rules implementing the Executive Order and Presidential memorandum. The Department of Commerce amended the EAR to govern the export of encryption products transferred from the USML. 61 Fed. Reg. 68572-87 (Dec. 30, 1996) (Addendum B infra).2The Department of State issued a corresponding rule amending the USML to exclude the encryption products in question. 61 Fed. Reg. 68633 (Dec. 30, 1996) (Addendum C infra). The new regulations are effective upon publication. See 61 Fed. Reg. 68573, 68633.
For present purposes, the heart of the EAR is the Commerce Control List (CCL). See 15 C.F.R. Part 774, reprinted at 61 Fed. Reg. 12937-13041 (March 25, 1996). The CCL lists categories of items whose export is regulated under the EAR, using a classification system known as Export Control Classification Numbers (ECCNs). See 15 C.F.R. Part 772, reprinted at 61 Fed. Reg. 12928 (March 25, 1996)(defining ECCN). With certain exceptions, persons must obtain a license from the Bureau of Export Administration (BXA) in order to export items listed on the CCL. See generally 15 C.F.R. Parts 738-44, reprinted at 61 Fed. Reg. 12756-12806 (March 25, 1996). The issuance of export licenses for a particular item depends, in part, on the specific ECCN applicable to the item and pertinent licensing policies. See 15 C.F.R. Part 742, reprinted at 61 Fed. Reg. 12786-94 (March 25, 1996).3
The amendments to the EAR give effect to the Department of Commerce's new regulatory jurisdiction over encryption items by amending relevant ECCNs on the CCL to include such items. Encryption commodities (i.e., hard-ware products) are covered by amended ECCN 5A002, while encryption software is covered by amended ECCN 5D002. See 61 Fed. Reg. 68586-87.
Because encryption items covered by ECCN 5A002 and 5D002 "may be used by persons abroad to harm national security, foreign policy and law enforcement interests," they generally may not be exported without a license. 15 C.F.R. &#sect; 742.15, reprinted at 61 Fed. Reg. 68580-82. As a general matter, applications for licenses to export such items "will be reviewed on a case-by-case basis by BXA, in conjunction with other agencies, to determine whether the export or reexport is consistent with U.S. national security and foreign policy interests." 15 C.F.R. &#sect; 742.15(b), reprinted at 61 Fed. Reg. 68581; see also id. &#sect; 742.15(b)(4)(ii), reprinted at 61 Fed. Reg. 68582. Less restrictive licensing rules and policies apply to certain mass-market encryption software and to "key recovery" encryption items (that is, encryption items designed to allow government officials to decrypt ciphertext under proper legal authority). See id. &#sect; 742.15(b)(1)-(2) and Supplement Nos. 4-6 to 15 C.F.R. Part 742, reprinted at 61 Fed. Reg. 68581, 68582-84; see also 61 Fed. Reg. 68575 (defining key recovery encryption items). In addition, during a two-year period, non-recovery encryption items up to 56-bit key length DES or equivalent strength will be eligible for liberalized export licensing based on satisfactory commitments by the exporter to develop, produce, and/or market key recovery items during that period. See id. &#sect; 742.15(b)(3) and Supplement No. 7 to 15 C.F.R. Part 742, reprinted at 61 Fed. Reg. 68581, 68584.
In certain circumstances, the foreign availability of items on the CCL affects the availability and scope of export licenses. See generally 15 C.F.R. Part 768, reprinted at 61 Fed. Reg. 12915-19 (March 25, 1996). However, in his Executive Order, President Clinton determined that the export of encryption products formerly regulated under the USML "could harm national security and foreign policy interests even where comparable products are or appear to be available from sources outside the United States." Addendum A infra. The President further determined that "facts and questions concerning the foreign availability of such encryption products cannot be made subject to public disclosure or judicial review without revealing or implicating classified information that could harm United States national security and foreign policy interests." Ibid. The President therefore directed that the provisions of the EAR relating to foreign availability shall not apply to encryption items transferred from the USML. Ibid. The amendments to the EAR carry out that directive. See 15 C.F.R. &#sect; 768.1(b), reprinted at 61 Fed. Reg. 68585.
As noted above, the President directed the Department of Commerce to regulate cryptographic source code software as an encryption product, rather than as technical data or technology, because the export of encryption source code is regulated for its functional capacity rather than for any possible informational value. Accordingly, for export licensing purposes, encryption software included in ECCN 5D002 is effectively treated "in the same manner as a[n] [encryption] commodity included in ECCN 5A002." 61 Fed. Reg. 68587. Conversely, the export controls on encryption software are distinct from the EAR controls applicable to other kinds of software. See 15 C.F.R. &#sect; 742.15, reprinted at 61 Fed. Reg. 58580; see also id. Part 772, reprinted at 61 Fed. Reg. 68585 (definition of "commodity"). For example, while publicly available software is generally not subject to the EAR, the public availability exclusion does not apply to encryption software covered by ECCN 5D002. See 15 C.F.R. &#sect;&#sect; 734.3(b)(3), 734.7-734.9, reprinted at 61 Fed. Reg. 68578-79.
The amendments to the EAR expressly distinguish between printed materials containing encryption source code, such as books, and encryption source code in electronic form or media, such as computer diskettes. See 61 Fed. Reg. 68575. Printed material setting forth encryption source code is not subject to the EAR and therefore may be exported without a license. Ibid.; see 15 C.F.R. &#sect; 734.3(b)(2)-(3) and accompanying Note, reprinted at 61 Fed. Reg. 68578. In contrast, encryption source code in electronic form or media is subject to the EAR and remains so even if it is publicly available. Ibid. The preamble to the new EAR amendments states that the government "continues to review whether and to what extent scannable encryption source code or object code in printed form should be subject to the EAR and reserves the right to impose export controls on such software for national security and foreign policy reasons." 61 Fed. Reg. 68575.
SUMMARY OF ARGUMENT
The recent transfer of regulatory authority from the Department of State to the Department of Commerce and the corresponding amendments to the ITAR and the EAR do not appear to eliminate the underlying dispute between Karn and the government in this case. The new export regulations administered by the Department of Commerce have the same basic features that Karn challenged, and the district court sustained, under the now-superseded regulations of the Department of State. For that reason, this appeal continues to present a live controversy that is fit for resolution by this Court. However, the fact that the Department of State no longer has jurisdiction over the Karn diskette and that the challenged provisions of the ITAR have been superseded by the new provisions of the EAR does affect the procedural posture of this appeal in certain respects. Specifically, the appeal must now be directed toward the validity of the EAR and the CCL, rather than toward the ITAR and the USML, and the Department of Commerce must be substituted for the Department of State as defendant.
ARGUMENT
1. "As a general rule, a statutory change will not moot a dispute unless it cures the problems that led to the suit." Central Kentucky Product Credit Ass'n v. United States, 846 F.2d 1460, 1464 (D.C. Cir. 1988); see Northeastern Florida Chapter of Associated General Contractors of America v. City of Jacksonville, 508 U.S. 656, 661-62 & n.3 (1993). In this case, the recent amendments to the ITAR and the EAR have not materially altered the regulatory restrictions that led Karn to bring this suit. To be sure, the amended provisions of the EAR differ significantly from the corresponding provisions of the ITAR in certain respects, such as their treatment of key recovery products. However, none of the major regulatory changes embodied in the EAR amendments has any bearing on the specific subject matter of this case -- the Karn diskette.
In order to export his diskette under the EAR, Karn must submit a license application to the BXA, which would grant or deny the application based on a case-by-case determination of "whether the export * * * is consistent with U.S. national security and foreign policy interests." 15 C.F.R. &#sect; 742.15(b), reprinted at 61 Fed. Reg. 68581; see also id. &#sect; 742.15(b)(4)(ii), reprinted at 61 Fed. Reg. 68582.4The diskette is not eligible for any of the liberalized licensing provisions outlined above.5Karn's need for a license is not affected either by the claimed foreign availability of the source code in electronic form or by domestic availability. See pp. 5-7 supra. And the EAR expressly distinguishes encryption source code in electronic media from source code in printed form, requiring a license (or a license exemption) for the export of the former while excluding the latter from the scope of the EAR altogether. See p. 7 supra.
In short, the basic features of the ITAR to which Karn originally objected have been carried forward in the amendments to the EAR. For that reason, the case does not appear to be moot. See Northeast Florida, 508 U.S. at 662 n.3 (repeal of old ordinance and enactment of new one does not moot case where "the new ordinance is sufficiently similar to the repealed ordinance that it is permissible to say that the challenged conduct continues"). And because the new provisions of the EAR are (for present purposes) functionally the same as those of the ITAR, this case remains in a suitable posture for this Court to address Karn's legal objections to the restrictions on the export of his diskette, objections that involve a facial challenge to the obligation to apply for an export license
2. While the underlying controversy between Karn and the government regarding the export of his diskette remains essentially unchanged, the regulatory changes do affect the posture of this appeal in several respects. Karn filed suit against the Department of State for a declaratory judgment regarding the Department's administration of the ITAR in connection with Karn's diskette. See J.A. 13-14 (complaint). With exceptions that are not applicable here, the Department of State no longer has jurisdiction over the export of cryptographic products, and the provisions of the ITAR and the USML that were placed in issue by Karn have been superseded by the EAR and the CCL. As a result, the relief sought by Karn has been overtaken by events. Because the repealed provisions of the ITAR and the USML have "no further effect" on Karn (Central Kentucky, 846 F.2d at 1465), there is no basis for this Court to pass on the validity of those provisions.6
This does not mean, however, that there is nothing for this Court to decide. As explained above, the new provisions of the EAR take up (for present purposes) where the ITAR left off, and a live dispute between the parties persists in the context of the new regulations. The point is simply that the parties and the Court must direct their attention to the current regulations that now govern the export of Karn's diskette, not the now-superseded regulations that originally governed the export but no longer do so. See Legal Assistance for Vietnamese Asylum Seekers v. Department of State, 45 F.3d 469, 472 (D.C. Cir. 1995), opinion denying panel rehearing, 74 F.3d 1308, vacated on other grounds, 117 S. Ct. 378 (1996). The proper issue before the Court is no longer the validity of the ITAR's former restrictions on the export of cryptographic source code, but rather the validity of the corresponding restrictions in the EAR that are now in effect.
The President's transfer of regulatory authority to the Department of Commerce has one further consequence: it requires substitution of the Department of Commerce as defendant in this case. In ALPA v. CAB, 750 F.2d 81 (D.C. Cir. 1984), this Court was presented with a similar transfer of regulatory authority pendente lite from the Civil Aeronautics Board to the Department of Transportation. The Court held that, as of the effective date of the transfer, the Department of Transportation was to be substituted automatically as defendant, pursuant to Rule 25(d) of the Federal Rules of Civil Procedure. See 750 F.2d at 87 & n.37. In light of ALPA, the Department of Commerce must be substituted as defendant under the analogous provisions of Rule 43(c) of the Federal Rules of Appellate Procedure.
3. A final procedural point should be brought to the Court's attention. In the proceedings below, the district court declined to entertain Karn's non-constitutional APA claim because it was expressly precluded by Section 38(h) of the Arms Export Control Act (AECA), 22 U.S.C. &#sect; 2778(h). See Brief for Appellees at 14-18. At present, there is no comparable statutory provision explicitly precluding judicial review of claims relating to the EAR and the CCL. As noted above (see p. 3 n.2 supra), the authority of the Department of Commerce to enforce the EAR and the CCL currently derives primarily from the International Emergency Economic Powers Act, 50 U.S.C. &#sect;&#sect; 1701 et seq. (IEEPA), and the IEEPA does not contain an explicit prohibition on judicial review of regulations issued pursuant to its provisions. The mere absence of a statutory bar to review does not mean, however, that Karn may now go forward with his non-constitutional APA challenge. The decision to place encryption products, including cryptographic source code, on the CCL is beyond the reach of judicial review even in the absence of an explicit statutory bar. That decision, and related decisions regarding the scope of the restrictions on the export of encryption items, reflect delicate considerations of national security and foreign policy that courts are not competent to second-guess under the APA. See United States v. Mandel, 914 F.2d 1215, 1220-23 (9th Cir. 1990) ("[T]he Secretary[] [of Commerce's] decision to place an item on the [CCL] is a political question not subject to [judicial] review to determine whether he had a basis in fact" for doing so); see also United States v. Martinez, 904 F.2d 601 (11th Cir. 1990) (holding that political question doctrine renders propriety of placing item on USML non-justiciable).7As a result, the transfer of regulatory authority to the Department of Commerce has not changed the non-reviewability of Karn's APA claim.
CONCLUSION
For the foregoing reasons and the reasons set forth in the appellees' principal brief, the Department of Commerce should be substituted as defendant and the judgment of the district court should be affirmed.
Respectfully submitted,
FRANK W. HUNGER Assistant Attorney General
ERIC H. HOLDER, Jr. United States Attorney
DOUGLAS N. LETTER SCOTT R. McINTOSH Attorneys, Appellate Staff Room 3127, Civil Division Department of Justice 950 Pennsylvania Ave. N.W. Washington D.C. 20530
January 3, 1997
1 The Executive Order and Presidential memorandum were issued after the filing of the appellees' brief. Karn notified this Court of the issuance of the Executive Order in his reply brief (p. 12).
2 The EAR is designed primarily, although not exclusively, to implement the Export Administration Act of 1979, 50 U.S.C. App. &#sect;&#sect; 2401 et seq. (EAA). The EAA is not permanent legislation, and when it has lapsed, the President has issued Executive Orders under the International Emergency Economic Powers Act, 50 U.S.C. &#sect;&#sect; 1701-1706 (IEEPA), directing and authorizing the continuation in force of the EAR. See 15 C.F.R. &#sect; 730.2, reprinted in 61 Fed. Reg. 12735 (March 25, 1996). Such Executive Orders are currently in effect. See Executive Order 12924 (Aug. 19, 1994), reprinted in 59 Fed. Reg. 43437 (Aug. 23, 1994); see also 61 Fed. Reg. 68576 (Dec. 30, 1996).
3 Until March 1996, the CCL was codified in 15 C.F.R. Part 799. At that time, the Department of Commerce undertook a general restructuring and reorganization of the EAR. See 61 Fed. Reg. 12714 (March 25, 1996). The restructuring moved the CCL to its present location in 15 C.F.R. Part 774. As of this date, the restructured provisions of the EAR have not been published in the printed edition of the Code of Federal Regulations. The Court is referred to 61 Fed. Reg. 12937-13041 (March 25, 1996) and Addendum B infra for the pertinent provisions of the current version of the CCL.
4 Because the cryptographic software on Karn's diskette was not designed for military applications, its export is not subject to the residual regulatory jurisdiction of the Department of State under the ITAR.
5Because certain of the encryption algorithms on the diskette employ extremely long keys, the diskette does not qualify for liberalized treatment either as mass-market encryption software or as 56-bit non-recovery encryption software. And because the source code on the diskette lacks key recovery features, it is not eligible for export licensing under the EAR's new key recovery provisions.
6Karn did not seek compensatory relief or any other form of "retrospective" relief regarding the ITAR that might survive the repeal of the ITAR's encryption provisions. Standing alone, a bare request for a declaration that past conduct was unlawful does not appear to present a justiciable case or controversy. See FCC v. ITT World Communications, Inc., 466 U.S. 463, 468 n.5 (1984).
7To the extent that Karn's APA claim may call into question decisions by the President himself regarding the regulatory treatment of cryptographic software (see pp. 1-2 supra and Addendum A infra), a further obstacle to judicial review would appear to be presented. See generally Dalton v. Specter, 511 U.S. 462 (1994); Franklin v. Massachusetts, 505 U.S. 788 (1992). But see Chamber of Commerce v. Reich, 74 F.3d 1322, 1326-28 (D.C. Cir. 1996).
For more information on Venable's Information Law Group, contact
KBass@venable.com