Though the ruling technically renders moot all export controls, the government is expected to receive a stay until the issue can be settled once and for all, likely a year or more from now.
"We are another giant step along the way of getting rid of the export regulations," said Cindy Cohn, attorney for plaintiff and University of Illinois professor Daniel Bernstein. "I expect the government will ask for an emergency stay.
In a 2-1 ruling, the San Francisco appeals court attacked both the regulations' effect on free expression and the "boundless discretion to government officials" they said control of encryption technologies engenders. The heart of the ruling dealt mainly with the rights of software designers like Bernstein, who wanted to publish on the Internet the source code for a powerful encryption package he wrote.
Source code, unlike the machine-readable software most people use, can be read easily by programmers. Thus, the court agreed with Bernstein in ruling the Administration violated the First Amendment when it told him he must seek an export license before posting that code to the Internet.
Content vs. function
The government disagreed, saying it wished to control not the content of Bernstein's speech but its function, namely scrambling email, phone calls and other communications so thoroughly even the US military cannot decipher it. The technology itself, attorneys argued, endangered the continued ability of the United States to eavesdrop on terrorists, drug runners and a host of other enemies.
But Judge Betty B. Fletcher dismissed most of the government's free speech arguments. "The First Amendment is concerned with expression, and we reject the notion that the admixture of functionality necessarily puts expression beyond the protections of the Constitution," she wrote.
More telling still was the issue the Administration never raised: privacy itself. Fletcher concluded her remarks with a salvo aimed, it seemed, at the entirety of the White House policy.
Fletcher continued: "Viewed from this perspective, the government's efforts to retard progress in cryptography may implicate the Fourth Amendment, as well as the right to speak anonymously, the right against compelled speech, and the right to informational privacy."
Dissenting opinion
Of all issues affecting the Internet, Administration controls over cryptography have perhaps been the most bitterly debated.
For more than six years, intelligence and law enforcement have battled civil libertarians and industry over where the government's right to spy ends and others' rights to be left alone begins. To enforce their desire to continue with airborne signals intelligence and wiretaps, the FBI and NSA have successfully blocked most commercial encryption exports from the United States. Government officials argue foreign terrorists and criminal cartels will soon be immune from surveillance if exports of the most powerful cryptography become commonplace.
Shrinking gap
American makers have been predictably upset by the disparity. Indeed, Network Associates last year circumvented the export controls via a foreign subsidiary which bought a "cloned" version of the company's popular Pretty Good Privacy encryption programs from a Swiss company. Though the action was arguably risky, sources with firsthand knowledge of the project told Inter@ctive Week the job was simple and lawful, thanks to a loophole which lets Americans export source code in book form with few restrictions.
Civil libertarians, like Judge Fletcher, warn of a creeping surveillance state already in the making of encryption technologies are restricted further. FBI Director Louis Freeh, meanwhile, has called for domestic restrictions on encryption as well as export controls. The White House has refused to rule out even domestic restrictions while dozens of members of Congress move to lift almost all controls.
High-impact decision
"It's probably the most significant decision affecting the Internet since the Supreme Court struck down the Communications Decency Act," said David Sobel, legal counsel to the Electronic Privacy Information Center. Encryption policy, he said, "is no longer within the sole discretion of the administration. There will have to be some means of judicial review."
Getting from free-speech rights for cryptographers to letting companies export at will may not be so easy, however. If opponents of the current regime want to win, they may have to bring the issues Fletcher referenced as an aside front and center.
A. Michael Froomkin, a law professor at the University of Miami, said opponents could still argue that machine code is speech, even if it is far more difficult to read than source code. Alternately, he said, they could bring suit over a case that involves the constitutional right to anonymous speech. Since cryptography can assure anonymity, he said, plaintiffs could argue encryption technologies are necessary to have it in the first place. "My dream test case is a minority religious group with persecuted relatives abroad," he said.
Judge Thomas Nelson dissented: "The ultimate purpose of encryption code is, as its name suggests, to perform the function of encrypting message," he wrote. "Thus, while encryption source code may occasionally be used in an expressive manner, it is inherently a functional device."
But the world continues to catch up to U.S. encryption prowess. Indeed, hundreds of foreign encryption products now use encryption algorithms theoretically billions of times more secure than what U.S. makers can export to most customers. And though close U.S. allies, banks, insurance companies and other selected organizations may buy the strongest U.S. encryption products abroad, their numbers are far smaller than the market as a whole.
Activists hailed today's decision.
