Cohn Testimony

[Cindy Cohn <Cindy@mcglashan.com>]

Here is the text of my testimony before the Senate Judiciary Committee's
Subcommittee on Constitution, Federalism and Property Rights on Tuesday
March 17.

TESTIMONY OF CINDY A. COHN; 
	LEAD COUNSEL, BERNSTEIN v. DEPARTMENT OF JUSTICE, ET AL.

	I want to thank the Sub-Committee for inviting me here today.  Although
there have been very many hearings and much discussion about cryptography
here in Washington, this is the first, I believe, to seek testimony from one
of the attorneys directly involved in the legal challenges to the
cryptography regulations.

	I've been asked here because I am lead counsel in the case of Bernstein v.
Department of Justice, et al.  With the help of the Electronic Frontier
Foundation, Professor Daniel J. Bernstein has been trying for over six years
to publish on the Internet a simple cryptographic computer program which he
wrote.  He has been told that if he does, he will be prosecuted.  

	We argued that American scientists, be they academics, in industry or
hobbyists, should not have to submit their own work prior to publication to
faceless government bureaucrats.  This is especially so when those same
bureaucrats have unchecked discretion to bar them from publishing his work.
That is what the current scheme allows.  In fact, before we brought suit
those same agency bureaucrats told Professor Bernstein that publishing an
academic paper about his software would be illegal and that putting his
software into a public library would be illegal.  The Federal District Court
for the Northern District of California has agreed with us that the
regulations are in violation of the First Amendment on their face, meaning
that they violate the First Amendment rights of all Americans, not just
Professor Bernstein.  

	KARN AND JUNGER: TWO OTHER LEGAL CHALLENGES

	Two other similar cases are also pending.  The first, Karn v. U.S.
Department of State, is here in D.C. District Court.  The Karn case is the
clearest example of the quip often made about the Administration's
cryptography policy--that it is based upon the belief that terrorists can't
type.  Mr. Karn was told that, although a book containing computer source
code could be freely sent abroad, a floppy disk containing the exact same
information could not.  The second case, Junger v. Christopher, is in
Cleveland, Ohio, and is based upon the government's position that Professor
Junger, a law professor at Case Western University could be prosecuted for
teaching a Computers and the Law course in his usual way.

	RULINGS OF THE BERNSTEIN CASE

	In the Bernstein case we have received three rulings from the District
Court so far, all in our favor:
		1)	April 1996:  Computer program source code is speech;
		2)	December 1996: ITAR was unconstitutional;
		3)	August 1997: New Commerce Department cryptography regulations 			issued
in December, 1996 are unconstitutional.

	In short, the Federal District Court has declared that every single one of
the current (and previous)  regulations of encryption software are
unconstitutional.  

	The final ruling in our favor was appealed by the Administration, argued in
December, 1997 before the Ninth Circuit Court of Appeals, and is now
awaiting decision.  I have attached a copy of the third District Court
opinion to my written statement for your review.  I hope you have your staff
take the time to review it--it gives a clear and concise statement of some
of the key constitutional requirements that any legislation on cryptographic
software must meet and a better explanation than I could ever give you about
why the current regulations are unconstitutional.

	As I mentioned before, the Bernstein case challenges the current government
restrictions on cryptographic software on the grounds that they are in
violation of the First Amendment.  Although our case focuses, as it must, on
the current regulations, the analysis would apply as well to proposed
domestic restrictions which would restrict or license the creation,
distribution or receipt of cryptographic software.  Indeed, the
constitutional problems which would arise if domestic controls were imposed
are even more severe than those of the current scheme.   

	The first doctrine of First Amendment law which the cryptography
regulations violate is prior restraint of speech.  The Bernstein case
focuses on the  easiest flaws to see in the current scheme--the lack of
procedural protections.  The Supreme Court has long held that if the
government wants to institute a prepublication licensing scheme, it must
contain:
		1)	Prompt decision - no more than 2 weeks;
		2)	Only a court can stop publication; the government must bring a court
case rather than act administratively; 
		3)	Government bears burden of proof in Court.
This comes from a seminal Supreme Court case called Freedman v. Maryland. 

	I should point out that as much as I would like to take credit for our
legal analysis, we were not the first to see this problem.  In fact, the
first people to point out this problem in the regulations were in the
Justice Department's Office of Legal Counsel in 1978.  You see, the agencies
have known for 20 years that this scheme is unconstitutional.  Their own
lawyers told them so.  That is why you never hear them mention the First
Amendment in their presentations to you.

	COMPUTER SOFTWARE IS PROTECTED EXPRESSION

	The key point in our case, and in your consideration of any proposed
legislation, is that source code is protected expression for purposes of the
First Amendment.  On this point, the administration largely agrees.  Let me
repeat that--the Administration has not denied that in regulating computer
software it is also regulating the "expressive activities" of Americans.
This conclusion, which is obvious to anyone who has ever written or read a
computer program, is also consistent with what Congress has repeatedly
acknowledged.  Software is treated as identical to other forms of protected
expression in both the Copyright Act and the Freedom of Information Act.  

	From a legal standpoint, the Bernstein case is not complex, nor does it
break any dramatic new ground.  It simply asks the courts to recognize that
the First Amendment extends to science on the Internet, just as it does to
science on paper and in the classroom.  For it is this scientific freedom
which has allowed us to even have an Internet, as well as the many other
technologies which we enjoy today.	   

	OTHER FIRST AMENDMENT TESTS WHICH 	
	CRYPTOGRAPHY REGULATION MUST MEET

	Up to this point everything I've said isn't just my opinion.  It's been
decided by the Federal District Court.  My legal team and I believe that
there are other strong Constitutional reasons which prevent the regulation
of cryptographic software. The District Court did not need to address these
additional reasons, since it agreed with us that the first alone was
sufficient to invalidate the regulations. 

	In addition to procedural protections, the Constitution requires that any
regulation which institutes a licensing scheme, or any other form of prior
restraint, pass the strictest of tests.  Even a claim of national security
or public safety must be carefully weighed against our fundamental rights,
and must be supported with hard evidence of direct, immediate and
irreparable harm, not just conjecture and a few frightening scenarios.  

	Further, aside from prior restraint, a scheme which targets speech on the
subject of cryptography and treats that speech differently from speech on
other topics must pass the tests of strict scrutiny--that the regulation
address a compelling government interest and be narrowly tailored to reach
only that interest and no further.  That is, the government's concern about
national security cannot reach so broadly as to prevent law-abiding citizens
from having access to software which they can use for completely lawful
purposes.  Put into another context, it means that the government cannot
require all of us to deposit our house keys with them on the off chance that
one of us is a criminal.

	Further, the government must prove that their restrictions on speech
actually meet their goals.  Here, such proof would be difficult since
terrorists, pedophiles and drug dealers can simply purchase or download
strong German, Swiss or Japanese encryption software that is freely
available all over the U.S. and the world--over 500 at last count.  If
necessary, criminals could even type in or scan one of the computer programs
printed in the many books published on the subject.  

	THE ADMINISTRATION'S LEGISLATIVE PROPOSALS 
	FAIL THESE FIRST AMENDMENT TESTS

	Neither the current scheme nor any administration-supported, so-called
"compromise" schemes proposed so far addresses these First Amendment
problems.  And even the SAFE bill, which is well-intentioned, fails to
contain an assurance of judicial review of any agency decision to prevent
publication due to alleged national security concerns, a key element
required by the Constitution.  SAFE also does not clearly protect scientists
such as Professor Bernstein, but only protects those who seek to distribute
mass market software already available abroad.  This means that American
scientists can no longer participate in the ongoing international
development of this vital and important area of science.  


	ENCRYPTED SPEECH IS STILL SPEECH

	In addition, we believe that regulation of encryption software and
technology violates the First Amendment because of what encryption does.
Encryption allows people to use electronic envelopes to protect their
speech.  The Supreme Court has noted that a state could not regulate ink or
paper without raising constitutional concerns.  We believe that similarly
the government cannot prevent Americans from using electronic envelopes or
require them to use key-escrowed envelopes without violating their First
Amendment rights.  This is because such rules compel them to speak to the
Government anytime they wish to speak to anyone else.  Encrypted speech is
still speech.  The elimination of privacy creates a chilling effect on that
speech which implicates the First Amendment.  

	ENCRYPTION WAS USED BY THE FOUNDING FATHERS

	In fact, in our research for this case we have discovered that the Founding
Fathers used cryptography on a regular basis.  Even the Constitution and the
Bill of Rights themselves were often encoded, as Thomas Jefferson and James
Madison exchanged drafts of those seminal documents.   Cryptography was used
by a virtual Who's Who of the American Founding Fathers--not only Jefferson
and Madison but Benjamin Franklin, Alexander Hamilton, John and Abigail
Adams, Aaron Burr, and many others.  In sharp contrast to the
Administration's arguments today, they viewed cryptography as an  essential
instrument for protecting information, both political and personal.  Our
research indicates that when the First and  Fourth Amendments were enacted
in the late 1700s, any suggestion that the Government should have the
ability to prevent individuals from encrypting their messages, or that the
Government should have a back-door key to all encrypted messages, would have
struck the Constitution's framers as ridiculous.  

	CONCLUSION

	In sum, our legal challenge to the current restrictions on encryption
software is succeeding.  It is succeeding because the First Amendment is
clearly violated when the government institutes a prepublication licensing
scheme which allows agency bureaucrats unfettered discretion to prevent
American scientists from publishing their own ideas.  It is succeeding
because the Courts have recognized the importance of keeping the First
Amendment intact as we move into the information age.  As you consider the
many legislative proposals about cryptography, we hope you will do the same.  

	
	



******************************
Cindy A. Cohn, Cindy@McGlashan.com
McGlashan & Sarrail, P.C.
177 Bovet Road, 6th Floor
San Mateo, CA 94402
(650) 341-2585 (tel)
(650) 341-1395 (fax)