Re: Exporting software doesn't mean exporting (was: Re: lp ?)

[Michael Froomkin <froomkin@law.miami.edu>]

[sorry for the delay, things are busy here, and apologies too for the 
length of this thing...]

Misunderstanding, piled on misunderstanding, piled on disagreement.
I'll try to focus on the big points, and let the small stuff slide.
Let the record show that Prof. Junger and I still agree on lots of stuff 
that's outside this debate.  I wasn't trying to attack him before, and 
I'm not trying to start a flamewar now.

Main point for the busy:  Claims that the US government could apply the 
ITAR to 2 foreigners abroad and get a US court to buy it are, IMHO, 
unfounded.

On Thu, 9 Nov 1995, Peter D. Junger wrote:
[...]
> seem to have two different areas of disagreement:  (i) whether the
> ITAR's provisions relating to cryptographic software apply to foreign
> persons who disclose (or transmit) cryptographic software to another
> foreign person without the United States

[....the Itar is unconstitutional....]
Yes.
> 
> Now Mr. Froomkin says:
> 
>   In short, in this particular case the ACEA, and by extention the
>   ITAR, doesn't "say what it says" it "says what it must mean".
> 
> (And I dare him to make that assertion in the faculty lounge at Miami
> when some of the more critical and analytically inclined members of
> the Miami law faculty are present.)  I would take this as an admission

I would say it anywhere.  Some days I would even claim to be one of those 
people..,

> that the ACEA and the ITAR does say what it says (even if it must mean
> something else) were it not for the fact that--and this was my ``ultra
> vires'' point--that the ACEA doesn't say it.
> 
> (In discussing the quoted passage I am assuming that ``extention''
> must mean ``extension'' and that it is not used as the opposite of
> ``intention'', if only because I don't know what the latter would be.
> But on the other hand the only dictionaries I have to hand are the COD
> and the on-line version of Webster's Collegiate.)
> 
> The AECA doesn't contain any definition of ``export'' whatsoever; the
> whole issue that we are discussing turns on the interpretation of what
> the ITAR says when it defines ``export'' as including:
> 
>   Disclosing (including oral or visual disclosure) or transferring
>   technical data to a foreign person, whether in the United States or
>   abroad ....
> 
> Now Mr. Froomkin seems to be contending that this language must be
> interpreted as it would be interpreted by some sort of neo-Platonic
> court (probably sitting in Rawl's original position by designation),
> which he calls ``any court''.  The contention is:

Nope.  Never said it, didn't mean it.  I mean a good ol' garden variety 
US federal court.

>   any court construing the ACEA would inevitably read the prohibition
>   on "exporting" to a foreign person as not applying where the nation
>   lacks jurisdiction.  
> 
> Now it was my argument--which Mr. Froomkin helpfully calls an ``ultra
> vires'' argument--that any court reading the ACEA would notice (i)

Here's a misunderstanding (for which I'm happy to take full 
responsibility).  What I meant by the "ultra vires" point is this:
There are lots of ways in which an agency action can be struck down by 
the courts.  Two of them are:

1) The agency interpreted the statute correctly, but the statute was 
unconstitutional -- beyond Congress's powers under the constitution.

2) The agency interpreted the statute Incorrectly, and tried to do 
something beyond the powers delegated to it by congress (the nice thing 
about this is that one doesn't even reach the issue of whether Congress 
could, in theory, have delegated the power in question).

> that there is no language in that act defining ``export'' and (ii)
> that ``export'' does not mean disclosing, or even transferring,
> information (which is what cryptographic software is) and (iii) that,
> in consequence, the Office of Defense Trade Controls exceeded its
> congressionally granted authority, and therefore its constitutional
> authority, when it came up with the perverse provision that is at
> issue here.  But that is the subject of my other, as yet unwritten,
> message.

That's what I meant by my ultra vires assertion.  Type (2) above.  So we 
agree in a sense as to what this problem is -- but I call this a case of 
an agency misconstruing the statute, not a "separation of powers" problem.

Let's assume, for the argument, that I'm wrong and that the agency read 
the statute reasonably (note under Chevron it doesn't have to read it 
"right" just reasonably).  

Does the agency read the statute to apply to two foreigners talking on 
the beach at Calais?  No it does not.   

Did Congress intend the statute to be applied to the two foreigners?  No
evidence that it did. 

Would or should a court read the statute to apply to two foreigners etc.
in the absence of a clear direction from Congress to that effect? No. 

Why not?  Two main reasons.  One is the one you identify:
> Now I take it that Mr. Froomkin's contention turns on the claim that
> Congress lacks jurisdiction under international law to pass a
> statute--or authorize a regulation--that makes it a crime for a
> foreign person to transmit something to another person when both of
> them are outside the United States.  So as to avoid the other

The other one is that even if Congress had the jurisdiction, the court 
would be reluctant to read the statute that way, with the implications 
for foreign relations, comity, etc etc without clear directions to do 
so.  And if you think the court would just formalistically follow the 
words of the statute, see eg Church of the Holy Trinity, 143 US 457 and 
its progeny.

> constitutional and ultra vires and so on issues, let us assume that
> Congress were to amend the ACEA to make it a crime ``to transfer a
> cryptographic device to a foreign person within the United States or
> abroad without first obtaining a license or a waiver of jurisdiction
> from the Office of Defense Trade Controls.''
> 
> And now assume that someone, F, who is a foreign person and who has
> never been in the United States transfers a cryptographic device that
> was not made in the United States or by a United States company to
> another foreign person who person who has never been in the United
> States.  And now assume that F does come to the United States on a
> holiday and that he is arrested and indicted for violating the AECA in
> that he did transfer a cryptographic device to a foreign person.
> 
> The first thing to notice is that the indictment is not defective.
> The only defense--since it is the only one that we are interested in
> and we control the hypothetical--is: ``but that was in a foreign
> country'' and therefore the United States has no jurisdiction under
> international law (or under something) to treat F's actions as a
> crime.
> 
> So the defense moves to dismiss the indict on those grounds.  And the
> prosecution stipulates that the acts charged occured in a foreign
> country, that F is a foreign person, etc.
> 
> On those facts I would hope that the court would construe the statute
> as not covering F's actions outside the United States and would dismiss
> the indictment, but--considering that the statute specifically says it
> applies both within the United States and ``abroad''--I am not nearly
> as sanguine as Mr. Froomkin is.  But let us assume that the indictment
> is dismissed.

I cannot imagine that the court would do anything but dismiss on these 
facts. 

> 
> And now the hypothetical provision in the ACEA is again amended by
> congress to make it a crime ``for (i) a United States citizen to
> transfer a cryptographic device to a foreign person within the United
> States or abroad or (ii) a foreign person to transfer a cryptographic
> device to a foreign person within the United States or abroad, without
> in either case first obtaining a license or a waiver of jurisdiction
> from the Office of Defense Trade Controls.''

Note that now we are more explicit that in the ACEA.
> 
> And now assume that F', who has never been in the United States
> transfers a cryptographic device to a foreign person and thereafter
> comes to the United States and is arrested indicted for violating the
> hypothetical provision of the ACEA.  It would seem to me that there is
> no way that any but the most willfully wrong-headed court (and there
> are, I admit, such courts) would construe the hypothetical provision
> as not covering F's actions, since it does so clearly cover those
> actions.  I mean that there is no way that the court can get away with
> concluding that it does not mean what it says.
> 
> So what can F' do now?  Well, he could try to raise the claim that the
> lack of ``jurisdiction''--which is the justification for Mr. Froomkin's
> ``any court'' construing the ITAR's actual provisions would not apply
> to F or F'--is a ground for dismissing the indictment.
> 
> But how can he raise that point?  He can't very well deny that the
> court has jurisdiction over his person--he's sitting in the court with
> shackels on--and he can't get away with claiming that the court
> doesn't have jurisdiction to try him for violating the ACEA.
> 
> So it would seem that F's only hope would be to move to dismiss the
> indictment on the ground that to continue the prosecution would be to
> deny him due process because the United States lacks jurisdiction
> under international law.

There are a number of other arguments he could make.  E.g. denial of due 
process for lack of notice.  Unconstitutionality of the statute as 
exceeding the powers of congress as a violation of international law.  A 
weaker argument would be an analogy to the ex post facto clause -- now 
the government seeks to apply its laws to him after the fact.  I do not 
think that the Neuremburg precedent would be contrary, since the claim of 
the US there was that some laws of man and nations are always in force 
everywhere.  Restrictions on crypto exports does not fall in that class.

> 
> Now I am no expert in this area, but I would be surprised if the
> courts would recognize this as costitutional defense.  As I understand
> it from talking with somebody here at CWRU who is knowledgeable, the
> courts of the United States tend to defer in such cases to Congress

A vast and unhelpful oversimplification.  what do you mean by "such 
cases"?  Criminal prosecutions of US citizens for messing in foreign 
policy is one thing; criminal prosecutions of foreigners for acts that 
have foreseeable effects here is another thing; criminal prosecutions on 
the facts above is a whole different thing.

> and the executive--when they are in agreement, as they would be in our
> hypothetical--and principles of international law count for little.

It is certainly true that as Justice Jackson put it, the powers of those 
branches are greatest when they agree.  But the constitution trumps all.  

> 
> So F' will ``inevitably''--to use Mr. Froomkin's word--be convicted of
> the crime of delivering a cryptographic device to a foreign person
> outside of the United States.

I do not agree.  See above.

> 
> Now lets get back to the ITAR as it is actually written.  In an actual
> criminal action brought against a foreign person who is accused of
> disclosing cryptographic information to a foreigner outside the United
> States--not that I think such an action will ever actually be
> brought--the government can point out to the court the facts that I
> have just discussed, so the court will be aware that there is no
> constitutional provision requiring the dismissal the indictment, even
> if the indictment is contrary to international law.  And a real court,
> as opposed to Mr. Froomkin's ``any court'' might in those
> circumstances feel free to determine that the ITAR means what it says.
> (That's just common sense.)

But no.  First there is the constitutional arguments.  Then there is the 
idea that we interpret the statute to avoid the constitutional and 
international problems.  Then there is the problem that there are no 
grounds to think that Congress ever intended to reach foreigners in such 
cases (and Holy Trinity Church, 143 US 457 (1892) still gets cited 
(despite its anachronistic view of religion)).

> 
> And, were the government ever to bring such a case it, it would argue,
> and I think that it would convince a lot of real judges, that the
> criminal action does not violate international law because the United
> States is protecting its own economic interests by prosecuting foreign
> persons who disclose cryptographic information to other foreign
> persons outside the United States.  The government's lawyer will
> argue:
> 
>   Judge, the United States is in a real bind.  It is absolutely
>   necessary for our national security that we forbid the export of
>   cryptographic software.  But, on the other hand, as those
>   Cryptopunks keep pointing out, we are distroying our computer
>   industry by enforcing the ITAR against American companies.  So the
>   only solution is to apply the ITAR against foreigners as well so
>   that the American computer industry will have a levelled--I mean a
>   level--field to play upon.  And the anti-trust cases make it
>   absolutely clear that the United States does have jurisdiction to
>   enforce its laws against foreign  criminal who break those laws
>   outside of the United States when their crimes have a negative
>   effect upon the economy of the United States.
> 
> I am afraid that most federal district court judges would buy that
> argument, and I am not even sure that Mr. Froomkin's ``any court''
> wouldn't buy it. 
> 
I think many district judges, most appellate judges, and almost every 
supreme court justice would at least reject, if not laugh at, that 
argument.  The trend is away from assertions of jurisdiction over 
foreigners without minimum contacts, e.g. Asahi (sp?).

> And, in any case, if such a criminal case were to be brought, the
> government would almost certainly be able to allege additional facts
> to help justify the claim that the US does have jurisdiction over the
> matter under international law.

I'm sorry, but everything that follows the line above is irrelevant.  If
there are other grounds to prosecute, the court will use those and avoid
the constitutional problem.  If the foreigner isn't really foreign, then
he's not a foreigner.  I'm going to respond in detail anyway because I
think that the FUD factor may be coming in to play... 

> 
> For example, the defendant might be French, and the French government
> might be cheering the United States government on.  If the crime is a
> crime under both French law and the law of the United States then
> there is going to be no problem with the United States asserting
> jurisdiction.  (That is, if I understand it correctly, Mr. Froomkin's
> murder example.)

I don't see what dual criminality has to do with this.  Am I supposed to 
be on notice that if I do an illegal thing here to my neighbor, I'm 
supposed to be at risk of prosecution in Sri Lanka?  Anyway, recall that 
in the original hypo foreigner A is talking *legally* to foreigner B.  
Even if they are not, it's not within the competence of the US 
government to do anything about it.  Nor -- I have to say this over and 
over and over and over -- has the US government ever asserted in any form 
that it would seek to do anything about this.  Just because an 
over-literal reading of a regulation could lead to that view does not 
equal an actual assertion of jurisdiction by the government.

> 
> Or the defendant may have studied cryptography in the United States,
> before he returned home and disclosed the information.
>
Not relevant.  Note, by the way, that on these facts the "export" was by 
the (us person?) who taught the foreigner crypto in the US, not later.
 
> Or the information that he disclosed had previously been unlawfully
> exported from the United States in violation of the ITAR (PGP, for
> example).

Not relevant.  

> 
> Or the foreign person is an employee of a United States company or a
> foreign company doing business in the United States.
> 
Not a foreigner, or the export is traced to a non-foreigner who then is 
the one charged with the ITAR violation.

> Or even that the disclosure was done by a message transmitted over the
> Internet that happened to be routed through the United States.

So what? The people are still outside the US.

> 
> But the matter is even more simple than that since the government is
> not going to bring those criminal charges against a foreign person or
> a United States person or anyone else if they can possibly avoid it.
> The ITAR's provisions on cryptographic software are used by the
> government to spread fear, uncertainty, and doubt, and to discourage
> the spread of strong cryptography.  Since an actual criminal case
> would almost certainly result in at least significant parts of those
> provisions being held unconstitutional, the government is not going to
> bring such a case if it can find any other ways of satisfying its
> goal.
> 
> And looked at that way, our foreign person who discloses cryptographic
> software to one or more other foreign persons abroad is going to be
> the perfect fall guy.  As I have suggested before, the government will
> simply bar him from getting a visa to enter the United States since
> violation of United States foreign trade regulations is a ground for
> denying a visa--at least an immigrants visa.  And, despite Mr.
> Froomkin's claim that our foreign person would have a cause of action
> if his ``petition'' were denied, he would probably have no recourse
> whatsoever.  Certainly he would have no claim that the United States
> has no jurisdiction to exclude him for acts done by him outside the
> United States; the United States has jurisdiction to exclude
> foreigners for things that the foreigners did outside the United
> States, like believing in polygamy.  And a foreign person outside the
> United States may not have standing to complain of violations of his
> freedom of speech outside the United States in an American court.
> 

I invite you to consider the recent decision of the 9th circuit that 
foreigners in the US have full 1st Am. rights.  Of course, the position 
of the would-be enterant is not the same as the position of even the 
temporary visitor to our shores, since constitutional rights don't attach 
to foreigners until they are in the country, but the language of that 
case is very suggestive.


> But let us assume, contra-factually that Mr. Froomkin is right, and
> that the poor, excluded foreign person would have a good cause of
> action to force the government to give him a visa.  (Though I really
> am curious as to what that action would be.)  That cause of action is
> going to cost tens of thousands of dollars to pursue, and it will take
> years before it is resolved in favour of our foreign person, who will
> be excluded--or sitting in jail with a bunch of Cuban and Chinese
> refugees--until the case is resolved in his failure.

Yes, litigation is expensive.  The foreign person unjustly excluded on 
this hypo will spend the time at home, writing crypto for profit, and 
reducing our tax base.  Meanwhile academic lawyers such as us will be 
representing her free of charge.  The government is sometimes unjust; 
even when you win against it you are worse off often than if you hadn't 
had to fight.  That's a wholly different issue from whether you win in 
court, which is what I thought we were arguing about.

> 
> I am sorry to have written such a long message, and to have been so
> slow in writing it, but I think that part of the problem is that both
> Mr. Froomkin and I were shooting from the hip, and that is why our
> disagreement grew.
> 
> But perhaps it has all been worthwhile, for I do think that there are
> a few useful conclusions that can be drawn from this discussion:
> 
>   (i) We academic lawyers tend to try to settle real world questions
>   as if they were academic questions;

Speak for yourself please.

I do not accept this accusation.  I assert that my "solution" to the
"problem" of whether a court would allow a criminal prosecution of a
foreigner, however "evil", for discussing crypto with another foreigner in
a foreign locale absent the most explicit and direct instructions from
Congress is the correct one: probability near zero.  Direct, clear
instructions from Congress supported by a legislative history or
legislative findings that made it clear that this was a result Congress
intended would raise the probability considerably, but I'd still bet on
the court striking the statute down as violating due process.

The academy is part of the real world.  All so-called real world questions
are fit subjects for academic study.  Much of my work is inspired by
concrete problems, or is (I hope) applicable to them.  Some of my work is
more abstract.  They applications are less immediate.  I'm proud of that
too. 

> 
>   (ii) It is never safe to assume that any court will construe a
>   statute or a regulation as meaning something other than what it
>   says; 

It at least as dangerous to believe that a court will formalistically 
apply text as if statutory construction, especially in the shadow of the 
constitution, were a mechanistic process.

> 
>   (iii) One can only construe a legal text in a particular context;
>   even if one thinks that one can figure out how any court would
>   interpret the text in qustion, one still nees to know how the text
>   got before the court; and

This is a fair point.  The facts *do* matter.  This is why "hard cases 
make bad law."  

> 
>   (iv) The fact that you can always sue the police for unconstitutional
>   harassment isn't of much help when they reach for the rubber hose.

But the fact that you can do so is part of the reason why rubber hoses are 
less common than they would otherwise be.

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin@law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's warm here.