AS AN ATTORNEY CENTRAL Department of Justice MAY 78 Re: MEMORANDUM TO DR. FRANK PRESS Constitutionality Under the First Amendment of ITAR Restrictions on Public Cryptography The purpose of this memorandum is to discuss the constitutionality under the First Amendment of restrictions imposed by the International Traffic in Arms Regulation (ITAR), 22 C.F.R. § 121 et seq. (1977), the regulation implementing § 38 of the Arms Export Control Act, 22 U.S.C.A. § 2778 (1977), on dissemination of cryptographic information developed independent of government supervision or support by scientists and mathematicians in the private sector. 1/ Our discussion is confined to the applicability of the regulation to the speech elements of public cryptography, and does not address the validity of the general regulatory controls over exports of arms and related items. We have undertaken our review of the First Amendment issues raised by the ITAR as an outgrowth of our role in implementing Presidential Directive NSC-24.2/ 1/ · The cryptographic research and development of scientists and mathematicians in the private sector is known as "public cryptography." As you know, the serious concern expressed by the academic community over government controls of public cryptography, see, e.g., 197 Science 1345 (Sept. 30, 1977), led the Senate Select Committee on Intelligence to conduct a recently concluded study of certain aspects of the field. 2/ Our research into the First Amendment issues raised by participation in briefings and symposia) and dis- Thus ITAR requires licensing of any communication of cryptographic information, 4/ whether developed by the government or by private researchers, which reaches a foreign national.5 The standards governing license denial are set out in § 123.05. The Department of State may deny, revoke, suspend or amend a license: whenever the Department deems such action to be Upon any adverse decision, the applicant may present additional information and obtain a review of the case by the 4/ The ITAR does exempt from the licensing requirement unclassified technical data available in published form. 22 C.F.R. § 125.11(a). The scope of that exemption is somewhat unclear, although it does appear that the burden of ascertaining the ITAR status of possibly exempt information is on the individual seeking publication. See 22 C.F.R. § 125 n.3. In order to claim the exemption, an "exporter" must comply with certain certification procedures. 22 C.F.R. § 125.22. 5/ For example, in one instance the Office of Munitions Control, the office in the State Department which administers the ITAR, refused to issue licenses to a group of scientists preparing to address a conference on space technology in Madrid. The scientists, who had already arrived in Spain, were refused permission to deliver papers at the symposium on the subject of rocket propulsion and re-entry problem of space vehicles. Note, Arms Control-State Department Regulation of Exports of Technical Data Relating to Munition; Held to Encompass General Knowledge and Experience, 9 N. .U. Int'l Law J. 91, 101 (1976). ITAR Provisions and Statutory Authority Under the ITAR, exports of articles designated on the United States Munitions List as "arms, ammunition, and implements of war" must be licensed by the Department of State. 22 C.F.R. §§ 123, 125. Cryptographic devices are included on the list, 22 C. F. R. § 121.01, Category XIII, as are related classified and unclassified technical data, Category XVII, Category XVIII. It is this control over the export of unclassified technical data which raises the principal constitutional questions under the ITAR.3/ The broad definition of the term technical data in the ITAR includes: Any unclassified information that can be used, or 22 C.F.R. § 125.01. The definition of the term "export" is equally broad. Under $125.03 of the ITAR an export of technical data takes place: 3/ Whenever technical data is inter alia, mailed or Unclassified technical data would generally encompass only privately developed, nongovernmental cryptographic research. It is our understanding that government-sponsored cryptographic research traditionally has been classified. The only unclassified government cryptographic information of which we are aware is the Data Encryption Standard (DES) algorithm. The DES was developed for public use by IBM with National Security Agency assistance and published in the Federal Register by the National Bureau of Standards. Department. § 123.05(c). No further review is provided. Nearly all of the present provisions of the ITAR were originally promulgated under § 414 of the Mutual Security Act of 1954 (former 22 U.S.C. § 1934). That statute gave the President broad authority to identify and control the export of arms, ammunition, and implements of war, including related technical data, in the interest of the security and foreign policy of the United States. Congress recently substituted for that statute a new § 38 of the Arms Export Control Act, 22 U.S.C.A. § 2778 (1977), as amended, 22 U.S.C.A. § 2778 (Supp. 3 1977). This statute substitutes the term "defense articles and defense services" for the term "arms, ammunition, and implements of war."6/ The President delegated his authority under both statutes to the Secretary of State and Secretary of Defense. Exec. Order No. 11,958, 42 Fed. Reg. 4311 (1977), reprinted in 22 U.S.C.A. § 2778 (Supp. 1 1977); Exec. Order No. 10,973, 3 C.F.R. 493 (Supp. 1964). A willful violation of § 38 of the Arms Export Control Act or any regulation thereunder is punishable by a fine up to $100,000, imprisonment up to two years, or both. 22 U.S.C.A. § 2778 (c).1/ 6/ The ITAR has not yet been amended to reflect the statutory change. We understand, however, that the Department of State has nearly completed a draft revision of the ITAR. It is our understanding that the revision is not intended to make any major substantive changes in the ITAR, but rather to update and clarify the regulatory language. Although the focus of this memorandum is on the First Amendment issues raised by the ITAR, we feel that one comment about the breadth of the two statutes is in order. It is by no means clear from the language or legislative history of either statute that Congress intended that the President regulate noncommercial dissemination of information, or considered the problems such regulation would engender. We therefore have some doubt whether ŷ 38 of the Arms Export Control Act provides adequate authorization for the broad controls over public cryptography which the ITAR imposes. The First Amendment Issues The ITAR requirement of a license as a prerequisite to "exports" of cryptographic information clearly raises First Amendment questions of prior restraint. 8/ As far as we have been able to determine, the First Amendment implications of the ITAR have received scant judicial attention. The Ninth Circuit presently has a case under consideration which squarely presents a First Amendment challenge to the ITAR and could serve as a vehicle for the first comprehensive judicial analysis of its constitutionality. In that case, United States v. Edler, No. 76-3370, the defendants, Edler Industries, Inc. and Vernon Edler its president, were charged with exporting without a license technical data and assistance relating to the fabrication of missile components. Although the State Department had denied defendants an export license to provide technical data and assistance to a French aerospace firm, the government alleged that defendants nonetheless delivered data and information to the French during meetings in both France and the United States. Defendants were tried before a jury and found guilty. The trial court, the United States District Court for the Central District of California, did not issue an opinion in the case. On appeal, the defendants contend that the ITAR is both overbroad and establishes an unconstitutional prior restraint. The government's rejoinder to those claims is that the ITAR licensing provisions involve conduct not speech and that any effect upon First Amendment freedoms is merely incidental 8/ In addition, the regulatory provisions present questions of overbreadth and vagueness. "Overbreadth" is a First Amendment doctrine invalidating statutes which encompass, in a substantial number of their applications, both protected and unprotected activity. The "vagueness" concept, on the other hand, originally derives from the due process guarantee, and applies where language of a statute is insufficiently clear to provide notice of the activity prohibited. The same statute or regulation may raise overlapping questions under both doctrines. |