UNITED STATES ENCRYPTION EXPORT POLICY: TURNING THE CORNER
by: Brian J. Bocketti
Everybody knows that corruption thrives in secret places...and we believe it a fair assumption that secrecy means impropriety.
Woodrow Wilson (1856-1924)
It is a Catch-22 situation. On the one hand, the use of "robust" encryption technology by those in the world who would do wrong is a very serious matter with possibly deadly ramifications. On the other hand, by restricting these technologies in the name of public safety and national security the United States government places encumbrances on the very freedoms it is pledged to defend.
For the majority of this decade this debate has progressed and today it continues at its most intensified level. With landmark cases in the court system and what seem like weekly hearings in Congress, encryption policy is reaching its point of definition. For many in the public, this debate may hold little particular significance or interest but for each of us what happens next will have a very personal impact.
Since their implementation, the U.S. encryption policies have labored under the same presumptive suspicions espoused by President Wilson. This has been especially true in regards to the export of encryption technologies. The following paper endeavors to shed light on these policies, their journey and the present state of affairs. In so doing, it will be helpful to discuss the history of the technology and its most recent appearances within our court system. Finally, this paper will update the reader on the current legislation introduced into Congress in 1997.
Encryption is a way to disguise a message intended for a particular person in such a way that only they will benefit from the information. Specifically it is "any procedure to convert plaintext into ciphertext". Plaintext is your unmodified message while ciphertext is the coded and secure information. Using a complex system of mathematical algorithms these encryption techniques are then formulated into "cryptosystems", systems for sending secure ciphertext. Finally, the term for breaking these systems is "cryptanalysis" while "cryptography" is the art of creating them and "Cryptology" is the study of both of these skills.
Encryption has an illustrious history which, at times, has shaped the course of world events . It is widely recognized that Julius Caesar first used encryption techniques on the theory that ignorant messengers can not divulge sensitive information. His system consisted of a series of juxtapositions of the alphabet which turned "A's" into "D's" or "B's" into "E's" and effectively turned the message into a confusing mix of letters. Although simple, Caesar's system was most effective and what started in handwriting is now carried on in seconds by computers and with a series of increasingly complex equations. In fact, the basic theory behind encryption hasn't changed much since Caesar's time. For centuries this encryption remained within the domain of the military or for those individuals capable of providing it for themselves. As the twentieth century dawned, encryption began to find its way into the business sector. For many large companies it became important to secure their information and gain the advantage over their competitors. By the time World War II began several German and Polish companies had begun using mechanical encryption machines and these machines would have a great impact on the way both sides prosecuted the war. The machines themselves were called "rotor machines" and they were built with the express purpose of automating the reorganization of the alphabet. As the war began, intelligence agencies began converting these commercial machines for military use. In Germany, armed forces created a new set of variables and began transmitting secret communiques. This system, dubbed ENIGMA, presented a serious challenge for England and the Allies and their response is one of the remarkable stories of the century.
Led by Alan Turing, a team of specialists worked round the clock to break the German encryption system and tap into the wealth of Wehrmacht information. In 1938, Turing was an eminent logician and mathematician residing at Cambridge where he was living off the proceeds of a King's College Fellowship. Soon after England entered the war, Turing was invited to become part of a cryptanalysis team so secret that little was known about it until more than fifty years later. With him Turing brought a long-nurtured concept and a belief in the viability of artificial intelligence. It was logical to him that a machine could be built to complete practically any task that a human brain could complete. Furthermore, if a machine could be created to provide its operator with ciphertext then most certainly he could build one to decipher it. Turing, working at Bletchley Park based his work on one of the earlier Polish rotor machines called a BOMBE. Using a complex system of algorithms, the team made their new machine nearly fifteen times as fast as its predecessor. Algorithms are the complex combination of mathematical equations which ultimately drive the encryption or decryption as the case may be. I will not dare to set the record straight on algorithms as I do not pretend to understand how they work. In any event, by late 1940 and early 1941 the team was reading Luftwaffe (German Air Command) directives with relative ease using the new Turing-Welchman Bombe. This at a time when England stood alone against the full-force of German air power. It is a reasonable assumption that if Germany gained air superiority, especially over England's southern approaches, that an amphibious invasion of England would follow. With the information provided by Bletchley Park, however, the Royal Air Force (RAF) was able to defeat a numerically superior enemy in the epic "Battle of Britain".
In 1942-43, Turing faced a new challenge as the German U-Boat Command added a new set of complications to the old ENIGMA system. This new cryptosystem, called "fish", was more complex than anything encountered before and for it Turing and his associates would need a new kind of solution. Electronics would provide the answer as the new machine used electrical switching technology to speed the decoding process. In addition, Turing was now able to call on resources from the United States Intelligence community after cooperation was established between the Allies. The result, COLOSSUS, effectively stripped the "Wolfpacks" of the ability to move without detection and restored the allies with the advantage once more. The resulting intelligence made the invasion of France an option as the war entered its fourth year. Sir Harry Hinsley, who worked at Bletchley Park for the entire war, recently estimated that the allied invasion of Europe could have been pushed back to 1946 or 1947. The implications for an extended war could have been great as the atomic bomb was available for use in August of 1945 and President Truman showed that he would unleash its power. Although using atomic weapons on European soil is a completely different dilemma it would still have been a serious consideration. In the Pacific, Turing's work and his cooperation with U.S. armed forces contributed much to U.S. efforts to break the Japanese code. Using this code, Naval Intelligence had provided information which led directly to the pivotal American victory at Midway. So you see in many ways encryption technology had a profound effect on the single most important event of this century.
Perhaps the most significant effect of Turing's work in World War II was the invention of the computer. In an effort to break the German code he had created machines that would complete tasks which had once been assigned to the human intellect. Both the BOMBE and COLOSSUS were applications of Turing's concept of artificial intelligence- the "Turing Machine". After the war, Turing continued to work to combine electronics and decision making, for example attempting to teach his machines to play chess. In 1951, his career was cut short when he was exposed as a homosexual under the discriminatory policies of the English government and as a result lost his security clearance. In 1954, Turing died of cyanide poisoning and was reported to have committed suicide but could quite likely have poisoned himself by mistake.
Turing's legacy is the computer, an invention which has proliferated throughout the world and reaches more and more people everyday. Encryption on the other hand has been slow to filter down. After the war the technology remained with those elites in government and business who could afford to maintain the expense of the systems. In addition, the cryptology which had spawned the main-frame computer now benefited from its ability to mechanize various tasks and groups of information. The result was better encryption technologies each year but with only a limited opportunity for individual use of the technology. And so it remained even into the 1990's.
Today we live in the age of the personal computer. Many in our society have access to the highway of the information age and to things like the E-mail and the Internet. You can pay bills, make reservations or even send a message to the White House through your PC. These opportunities are only the beginning of what's to come and as computer technology becomes more sophisticated it will be crucial to protect one's individual privacy. What many don't know is that big business and government has taken on the responsibility of protecting these interests in the interim. Whether in providing secure ATM's or in insuring private medical records stay private the powerful are using almost unbreakable encryption. A time is coming very soon, however, when encryption will be available to all. Whereas once you needed to be a programmer or hire one in order to use encryption techniques today the tools are being created for the individual PC owner to disguise whatever he or she wants. As you will see the prospect of democratized computer driven encryption has a caused a restrictive knee-jerk reaction from many in the U.S. government which has lessened over time, although not completely. The cases that follow show how three different cryptographers have faced U.S. export policies and how the dispositions of their cases are evidence of a changing atmosphere.
ENCRYPTION EXPORT POLICIES and the COURTS
As the United States government began to realize how accessible encryption technology would be, it also realized that many of its enemies would obtain the technology and this would, in turn, weaken national security. Encryption technologies became a target for stringent export restriction. These technologies are now considered so seriously by several federal agencies that they have been listed on the United States Munitions List. This list is mandated under International Traffic in Arms Regulations (ITAR) and is promulgated under the Arms Export Control Act of 1976 (22 U.S.C. 2778) which gives the President the power "to control the import and the export of the defense articles and defense services". These defense "articles" and "services" are what make up the USML and cryptographic materials have been enumerated as one of these munitions. For agencies like the NSA (National Security Agency), who depend on eavesdropping on a global level, the prospect of widespread encryption would make many of its procedures obsolete. The argument is that terrorist organizations and sophisticated criminals would be presented with the unprecedented opportunity to communicate in complete secrecy. Admittedly, stripping agencies like the F.B.I. and NSA of these advantages may have serious side effects. However, as we will see the implementation of AECA and ITAR may have risen to an unconstitutional level in recent years. Each challenges to U.S. Encryption Export Policy, the Karn and Bernstein cases show two very different ideas of where the line should be drawn. The final case, involving Phillip Zimmerman, may be a hint for the future of the enforcement and implementation of encryption policies.
Karn v. Department of State(925 F.Supp. 1(D.D.C. 1996))
In 1994, Philip Karn, Jr. sought to publish the book Applied Cryptography by Bruce Schneier. The book was a compilation of cryptographic techniques which included, among other things, a history of cryptography and information on encryption algorithms. The book also included information which could be forwarded, upon request, to the reader on a computer disk. Karn knew that in order to go ahead with his plans he would have to obtain federal approval. This permitting process, which is overseen by the State Department's Office of Defense Trade Controls (ODTC), includes several major steps: (1) First, ITAR requires that where speech is involved the applicant must apply for what is called a "commodity jurisdiction" in order to release the restricted information, (2) Second, if the "CJ" request is rejected then the applicant will be required to register as an arms dealer under AECA and ITAR. (3) Once duly registered the applicant then has to obtain a license to trade the article or service in question and finally (4) the applicant must clear the respective recipients of the information with the State Department prior to the release of the information. As a result, Karn filed his commodity jurisdiction for the book in February of 1994 and the ODTC replied in March. The ODTC took the stance that it did not wish to regulate the book but that the two disks would need to be dealt with separately. Karn, seeking compliance, then filed a separate "CJ" for the diskettes and the algorithms contained therein. This time the ODTC rebuffed him stating that the international distribution of the information could not go forward without a license because the disks had been "designated as a defense article under Category XIII(b) of the United States Munitions List". This list, promulgated under AECA, includes things like bombers and rockets but Category XIII(b) also includes encryption technologies like Schneier's. Karn then sought to fight this designation and after exhausting his administrative appeals filed suit in federal court in September of 1995.
The complaint asked for judicial review of the ODTC determination and alleged that the permitting process violated the plaintiff's First and Fifth Amendment rights. The court never considered the designation of the encryption as a defense article, however, as Justice Charles R. Richey pointed out that AECA barred such review. AECA section 2778(h) reads:
The designation by the President (or by an official to whom the President's functions under subsection (a) of this section have been duly delegated), in regulations issued under this section, of items as defense articles or services ...shall not be subject to review.
Richey and the district court refused to disturb the ODTC's determination and opined that as long as the State Department had followed the procedures laid out in AECA and ITAR then the designation of the diskettes was not in question.
The court then dealt with Karn's constitutional claims. Karn had argued that the regulatory scheme was a restraint on free speech because it was evidence of government intent to single out cryptography for restriction. Karn also attempted to invoke the Fifth amendment in order to argue that when the ODTC treated the book and disks separately, they had in fact violated his right to due process. The court did not agree and granted the defendant State Department summary judgement on both issues. It noted that the regulations passed the tests laid out by the Supreme Court for the protection of free speech and that they were content-neutral not discriminatory. As for the Fifth Amendment claim the court noted the "due process provided in the Fifth Amendment, absent the assertion of a fundamental right, merely requires a reasonable fit between governmental purpose and the means chosen to advance that purpose.".
The Karn decision was handed down in March of 1996 and it seems indicative of judicial response to the debate over cryptography up until that time. Justice Richey noted that the case was part of a larger trend as it was a "classic example of how courts today, particularly the federal courts, can become needlessly invoked, whether in the national interest or not, in litigation involving policy decisions made within the power of the President". What Richey and others like him overlooked, however, was the fact that with the advent of global networking and Internet transaction, the security provided by encryption was becoming a quasi-fundamental right. If Richey had considered all of the relevant facts he would have understood that encryption technologies will be crucial to the way we conduct our lives in the future and that for that reason alone the Karn decision would not be the last time a federal court fielded such a challenge. Several months later, the Bernstein decision would contrast the Karn court's conservatism.
Bernstein v. U.S. Department of State(945 F.Supp. 1279 (N.D. Cal. 1996)
In 1992, Daniel Bernstein was a graduate student in mathematics at the University of California at Berkeley. Through his own efforts he had developed an useful new computer program called Snuffle 5.0 which had as its main function encryption techniques for "civil applications". As any ambitious graduate student would do, Bernstein wanted to share his studies with those who would be interested. His plan was to publish his work in hardcopy and on "electronic international networks" and if need be to engage in speaking engagements to discuss them. Like Phil Karn, Bernstein realized that the federal government would want to review any such plans and so he filed for a commodity jurisdiction in June of 1992. After a delay which lasted a year and a half the ODTC denied this request and informed Bernstein that he would need a license in order to release anything. This would require, Bernstein, a math student, to register himself as an international arms dealer under AECA and ITAR before he did anything. Bernstein was left with no reasonable option. Thus, after being backed into a corner, and with his work getting older each day, he filed suit against the State Department, four other agencies and a host of administrators.
Bernstein sought, among other things, injunctive relief and damages in conjunction with the government's regulation of his work. The complaint alleged inherent deficiencies in the AECA/ITAR regulatory scheme and specifically sought redress of certain constitutional violations. It was alleged that these statutes, as implemented, constituted a prior restraint on free speech and that the government had denied Bernstein the right:
to speak, to publish, to assemble to receive information and to engage in academic study, inquiry and publication.
In addition it was alleged that the registration and licensing procedures were unconstitutional as they contained generalizations which did not limit the agencies' powers or fully define an applicant's duties and rights. Bernstein's attorney, Cindy Cohn, pointed out that both the AECA and ITAR were vague and threatened prosecution even though cryptographers could not determine how to comply. Criminal and Civil penalties (which included a $1,000,000 fine), had a paralyzing effect on many mathematician and programmers. These men and women were not sure if what they were creating was to be classified as a "munition" and Cohn argued that these doubts were having a chilling effect on their entire field. If a math student looked at the statutes should he know that he needed to register as an arms dealer? The Bernstein complaint also alleged that the AECA/ITAR system had been implemented in an over broad manner. ITAR's jurisdiction is supposed to apply only to articles "specifically designed, developed, configured, adapted or modified for a military application". Bernstein's intention was never military. As Cohn set out to defend him she needed to show the court how government officials had been overly restrictive. It was probably true that the State Department and the NSA (State Department consultant on AECA/ITAR licenses) felt it better to err on the side of safety. As in World War II, the threat that encryption technologies will be adapted from commercial use is very great. Cohn was arguing, however, that this could not justify such a confining policy. The final counts of Bernstein's complaint dealt with alleged constitutional violations to the plaintiff's freedom to associate and viewpoint discrimination.
Overall, Cohn presented a pretty realistic view of the status quo under AECA/ITAR. After all, Bernstein was an academic who posed no particular threat to the national security and yet he had suffered significantly. It would now be up to the district court to decide where the balance between individual rights and national security would be drawn.
In a lengthy opinion, Judge Patel delivered the court's verdict. Patel noted that the central issue of the case was whether or not encryption policies were inconsistent with First Amendment of the Constitution. The court thus recognizing that the case's implications went well beyond the immediate dispute. The State Department argued that the statutes were acceptable since they were content-neutral and that they should be allowed a certain amount of latitude especially in light of the government's concern for national security. The court disagreed, however, stating this could not justify such restrictive policies:
defendant's interests here, in being able to break foreign encryption and conduct adequate surveillance in "furtherance of world peace and the security of the United States,", are clearly insufficient without more.
The court then found category XIII (b) of the USML to be a prior restraint on the freedoms guaranteed by the first amendment. The court found that in targeting cryptography the licensing process had unacceptably targeted a certain kind of speech.  The same court had acknowledged encryption as a form of speech in an earlier Bernstein action. Category XIII (b), if you will recall was completely passed over by the Karn court. The Bernstein result was a more pragmatic consideration of the debate and without the stricken provision the government could not thereafter enforce it against the plaintiff. Finally, the court hinted that the government and Bernstein should reach an agreement whereby Bernstein would be allowed to teach a course in cryptography at the University of Illinois at Chicago in 1997 while he agreed not to post his studies on the Internet. The Internet was of particular concern to the government since it completed in minutes what the AECA/ITAR sought to prevent.
The Zimmerman Investigation
Perhaps the most interesting of the encryption cases over the past two years is the case that never went to trial. The Zimmerman investigation involved the posting of encryption technology on the Internet. Phillip Zimmerman, described as a "soft spoken data security consultant" from Boulder, Colorado had created a software package called Pretty Good Privacy with the intent to "strengthen democracy, to ensure that Americans could continue to protect their privacy." The problem was that "PGP" was more than pretty good and the NSA was meeting with little success decoding it. Federal authorities were considering banning the program when it suddenly appeared on the Internet. Zimmerman had released his program to friends within the industry in 1991-92 and from there they had brazenly placed it on the world wide web. In 1993, the United States Attorney's office served subpoenas on some of these friends, their firms and Zimmerman. For the next two years, Zimmerman withstood government probing but in the end the case was dropped in January of 1996. Although this decision was announced before the verdicts in Karn and Bernstein were settled, it is symptomatic of changing attitudes towards the enforcement of AECA and ITAR. By the end of 1995, it is reasonable to assume that the U.S. Attorney for the Northern District of California, Michael Yamaguchi, could see changes coming. Despite having sufficient evidence against Zimmerman, he chose not to proceed and soon after the Bernstein decision confirmed his instincts. In 1997, the U.S. Congress is trying to decide the future of encryption statutes and to put to rest the debate and uncertainty which exists in the courts and in enforcement agencies.
THE ENCRYPTION DEBATE IN CONGRESS 1997
The "liberalization plan" for encryption technologies was originated in 1996 by President Clinton and by the end of that year several drafts had been introduced into the House and Senate. In 1997, these bills were re-introduced and the Congress has been considering the fate of encryption controls in the hopes that a balanced policy can be agreed upon. There are currently three bills before Congress: Senate Bills 376 and 377 and House Bill 695.
Senate Bill 376, entitled "Encrypted Communications Privacy Act of 1997" is a bill "to affirm the rights of Americans to use and sell encryption products". The bill is intended to enunciate clearly the individual rights which should be protected from regulation by the federal government. In addition, the "key recovery encryptions systems" which, some argue, will strike a balance between privacy rights and national security. These systems provide agencies like the NSA and F.B.I. with the keys necessary to continue surveillance while protecting the individual in their everyday dealings. Senate Bill 377, entitled "Promotion of Commerce On-Line In The Digital Era (Pro-Code) Act of 1997" this bill is intended to boost "electronic commerce" by easing restrictions on strong encryption. In particular, this bill seeks to set up an exclusive jurisdiction for the control of encryption technologies intended for civil application. Under the act, the Secretary of Commerce would control these products but would now be barred from "imposing Government-designed encryption standards on the private sector by restricting the export" of computer technology with "encryption capabilities". There is also a provision which loosens the restrictive licensing procedures of the past, requiring only a general license for those wishing export commercial encryption products. Finally, the statute establishes the Information Security Board which will be charged with formulating and updating a national encryption policy. House Bill 695, is also an amendment bill and could re-write the United States Code (Title 18) to add language establishing personal encryption rights at law. The bill is named the "Security and Freedom Through Encryption (SAFE) Act" and it would make serious advances towards free encryption. Most importantly it would codify the freedom to use and sell encryption and protect citizens from mandatory key escrow. Mandatory key escrow, once again, is the surrendering of encryption keys to the government. This is very important because government agencies without such a system will not be able to penetrate individual privacy at will. As you can see, there is definitely a movement on to loosen the hold on encryption. This movement is not without its opponents, however. Since they were introduced, these bills have been referred to committee and have remained there while the House and Senate field testimony from interested parties.
F.B.I. Director, Louis J. Freeh, has testified on several occasions and has pleaded for a balanced encryption policy. As he puts it, "The enactment of any one of these bills, as drafted, would have a negative effect on National Security". Director Freeh also states that any balanced policy must include key recovery encryption (key escrow), what he has described as "Trusted Third Party" systems. Without such systems he predicts the "adverse consequences... to public safety, crime prevention and effective law enforcement" will be "huge". For the F.B.I., and similar agencies, world-wide recovery systems will strike the proper balance between privacy and their need for effective surveillance. While acknowledging that key recovery systems will not keep powerful encryption from all criminals, Freeh has argued that these systems are the only acceptable option discussed in the current debate.
The key recovery proposal has many critics in Washington. Jerry Berman, one of these critics, laid out the problems with accepting such a system in a speech before the Senate Commerce Committee. Berman is the Executive Director of the Center for Democracy and Technology (CDT). Berman and others believe that key recovery or "escrowed" systems are not justified since the threat to national security is not as bleak as stated by Freeh. Also, the systems will not prevent sophisticated criminals from obtaining the technology but will only work to reduce privacy rights. Such a system would also hamper an individual's ability to transact on a global scale. This is true because the government has yet to show that escrowed transactions will be "globally endorsed". Without such endorsement, many banks or corporations will refuse to communicate electronically because the possibility exists that a third party is capable of observing. For opponents of key recovery, like Berman, the only logical conclusion is an encryption policy which will provide for unrestricted export and development of the technology. In their opinion, there is nothing that would justify keeping this critical protection from the law abiding citizens of the world.
There is no doubting the power of encryption. As you can see, however, whether or not this power should be released, without restriction, is a much harder question to answer. The AECA/ITAR structure is not acceptable in its present form and has become outdated for its intended purpose. Recently, the National Research Council published a report which detailed some of these inadequacies. The NRC noted that challenges similar to Karn and Bernstein:
suggest quite strongly that the traditional National Security paradigm of export controls (one that is based toward denial rather than approval) is stretched greatly by current technology. Put differently, when the export control regime is pushed to an extreme, it appears manifestly ridiculous.
With this in mind, the debate has been reduced to a choice between mandatory or voluntary key recovery systems and unrestricted encryption. Mandatory key recovery would be a drastic and perhaps unconstitutional next step. Freeh and others have argued that the "Genie" is not yet out of the bottle and that controls may still be effective through the use of some form of key recovery. This is not a reasonable assessment. For example, Phil Zimmerman's "PGP" has been downloaded off the Internet thousands of times and it is more than two times as powerful as anything allowed under AECA and ITAR.
The conservative argument is unappealing for other reasons as well. Criminals or terrorist organizations will not be prevented from exposure to the technology. If they don't already have powerful encryption, it may be obtained at a price or created first-hand by friends. In the end, the only ones affected by a world-wide key recovery system will be those acquiescing to the program's requirements. Presumptively, these parties will have nothing to hide and the only product will be the resulting loss of personal privacy.
The hardest concept for government agencies' to accept seems to be that each one of us has a right to the most powerful encryption available. Each day that we pass in the "Information Age" increases the need to secure our personal privacy. Furthermore, as more people trust the Internet to conduct their business and personal matters, it will be up to the government to provide its constituents with the ability to protect themselves. This should not mean that we must surrender our rights in the process. Hopefully, Congress will realize this.
Endnotes1. The Concise Columbian Dictionary of Quotations, Columbia Univ. Press, N.Y., 1987, pg. 235 2. Federal Document Clearing House Inc., Congressional Testimony, July 25, 1996, Testimony of Louis J. Freeh, Director, F.B.I. before the Senate (Lexis-Nexis) 3. Cryptography FAQ (03/10:Basic Cryptography), sec. 3.1, (http://www.phys.s.u- tokyo.ac.jp/local/other-faq/sci.crypt/3) 4. Id. at section 3.1 5. Id. at section 3.1 6. Id. at section 3.1 7. Id. at section 3.1 8. University of Illinois at Chicago, "Honors Seminar in Cryptography", Spring Semester 1997, Jeremy Teitelbaum, Instructor (http://raphael.math.uic.edu/-jeremy/crypt.html) 9. Alan Turing Home Page, (http://mrh.slip.netcom.com/) 10. The English government continues to release these documents a process which began in 1995. 11. Alan Turing Home Page 12. Alan Turing Home Page 13. Alan Turing Home Page 14. Alan Turing Home Page 15. Alan Turing Home Page 16. Alan Turing Home Page 17. Alan Turing Home Page 18. Alan Turing Home Page 19. Alan Turing Home Page 20. Arms Export Control Act (AECA), 22 United States Code 2778 (a)(1), (Lexis-Nexis) 21. Karn v. Department of State, 925 F.Supp. 1,3 (D.D.C. 1996), (Lexis-Nexis) 22. Id. at 3,4 23. International Traffic in Arms Regulations (ITAR) section 120.4, 22 C.F.R. 120.4 (Lexis- Nexis) 24. AECA 2778 (b)(1)(a) and ITAR 122.1 25. ITAR section 123, 22 C.F.R. 123 26. Karn v. Department of State, 925 F.Supp. 1,4 (D.D.C. 1996) (Lexis-Nexis) 27. Id. at 5 28. Id. at 13 29. Id. at 2-3 30. Bernstein Complaint at paragraph 55, (http:/www.Law.vill.edu/-perritt/berncplt.htm) 31. Id. at paragraph 58 32. Id. at paragraph 61 33. AECA 2778 (b)(1)(a) and ITAR 122.1 34. Bernstein Complaint at paragraph 97 35. ITAR 120.3 (a) and (b) 36. Bernstein v. Department of State, 945 F.Supp. 1279, 1290 (N.D.Cal 1996), (Lexis-Nexis) 37. Id. at 1292 38. Id. at 1290 39. Bernstein v. Department of State, 922 F.Supp. 1426, 1436 (N.D.Cal 1996), (Lexis-Nexis) 40. U.S. News & World Report, "Lost in Kafka Territory", by Vic Sussman (firstname.lastname@example.org) 41. The New York Times, September 21, 1993, "Federal Inquiry on Software Examines Privacy Programs", by John Markoff, (
) 42. U.S. Attorney Press Release, January 11, 1996 (http://www.info-nation.com /phil.zim2.html) 43. See: "Encryption and U.S. Export Policies of Cryptographic Products Clipper 3.1.1", by Jason Klindworth, (Computers & Law Homepage), Fall 1996 44. Bill Tracking Report S.376 (Lexis-Nexis) 45. Bill Tracking Report S.376 (Lexis-Nexis) 46. Bill Tracking Report, Text of bill S.377 (Lexis-Nexis) 47. Bill Tracking Report, Text of bill S.377 (Lexis-Nexis) 48. Bill Tracking Report, Text of bill S.377 (Lexis-Nexis) 49. Bill Tracking Report, Text of bill H.695 (Lexis-Nexis) 50. Bill Tracking Report, Text of bill H.695 (Lexis-Nexis) 51. Bill Tracking Report, Text of bill H.695 (Lexis-Nexis) 52. Federal Document Clearing House Inc., Congressional Testimony, March 19, 1997 Testimony of Louis J. Freeh, Director, F.B.I., before Senate Commerce Committee (Lexis-Nexis) 53. Id. at Freeh Testimony 54. Id. at Freeh Testimony 55. Federal Document Clearing House Inc., Congressional Testimony, March 19, 1997 Testimony of Jerry Berman, Executive Director of the Center for Democracy and Technology (CDT), before Senate Commerce Committee (Lexis-Nexis) 56. Id. at Berman Testimony 57. National Research Council, National Academy of Sciences, "Cryptography's Role in Securing the Information Society", C-2 (May 30, 1996) 58. Federal Document Clearing House, Inc., Congressional Testimony, March 19, 1997, Testimony of Louis J. Freeh, Director, F.B.I., before Senate Commerce Committee (Lexis-Nexis)