December 30, 1996 VIA FACSIMILE AND MAIL Anthony Coppolino, Esq. U.S. Department of Justice Civil Division Federal Programs Branch P.O. Box 883 Washington, D.C. 20044 Re: Bernstein v. U.S. Department of State Dear Mr. Coppolino: We understand that as of today, December 30, 1996, your clients have shifted licensing jurisdiction over encryption software and related technical data and defense services from the International Traffic in Arms Regulations (ITAR) to the Export Administration Act and Export Administration Regulations, which are currently kept in place by the International Economic Emergency Powers Act (collectively referred to as the IEEPA/EAR Scheme). Our initial review of the new licensing scheme reveals that it does not differ significantly from the previous ITAR Scheme, but rather merely seeks to license the same encryption software and encryption-related items and activities as the ITAR did under new regulatory authority. Brief Summary of the New Regulations Under the new regulations, primary license administration shifts from Defendant State Department to another named Defendant in this action, the Commerce Department. A license is required for "encryption items" which were formerly controlled under Category XIII(b) of the ITAR, including items which were controlled as both software and technical data. A license is also required prior to providing "technical assistance" under the new regulations, just as a license was required for "defense services" under the ITAR. The new regulations divide these encryption items into three sub-categories: 1) encryption software, which is controlled as a "commodity" unlike any other software subject to the EAR (5A002); 2) software "specially designed or modified for the development, production or use" of encryption software and "having the characteristics or performing or simulating the functions of "encryption software, among others (5D002); 3) technology, which is the "information and know how that can be used to manufacture, utilize or reconstruct encryption software" (5E002) The Departments of Justice and Energy, as well as the Central Intelligence Agency, have also been added as reviewing agencies under the new scheme. The New Regulations Are Also Unconstitutional Our review of the new regulations reveals that they contain the same facial Constitutional violations as Judge Patel found in the ITAR, specifically: 1. The IEEPA/EAR Scheme does not meet the requirements of Freedman v. Maryland in that it fails to limit bureaucratic discretion to censor protected expression and does not contain provisions for: a. A short time limit on the licensing decision. We understand that the IEEPA/EAR does contain some time limits on initial licensing decisions. If a license request is denied, however, there are no time limits on the appellate process outlined in 15 C.F.R. 756.2(c)(1), but only the comment that decisions must be made within a "reasonable time." b. Prompt judicial review. The IEEPA, whose judicial review provisions are currently in force, does not preclude judicial review entirely as the ITAR did, but still fails to provide the Freedman protections that any such review must be prompt, that it must be initiated by the agency and that the agency bears the burden of proof before the court. Should Congress reenact the EAA and bring it back in force as the governing statute, judicial review of licensing decisions is precluded. 50 U.S.C. App. 2412(a), (e). The EAR also separately precludes judicial review. 15 C.F.R. 756.2(c)(2). c. A duty on the part of the agency to bring the court action and defend a denial of a license. As noted above, the IEEPA/EAR provides for no such duties. 2. The IEEPA/EAR Scheme fundamental research provisions are the same as those found void for vagueness in the ITAR. The clear effect of this shift is to undermine the Memorandum and Order issued by Judge Patel on December 16, 1996, which found the ITAR licensing provisions unconstitutional on their face. As part of this, the imposition of the new regulatory scheme means that, despite Judge Patel's Order, Professor Bernstein is once again at risk of prosecution for his intended activities in conjunction with his teaching at the University of Illinois at Chicago which begins on January 13, 1997. Proposed Stipulation and Order Given this turn of events, we seek a Stipulation and Order from you to do two things, and enclose a form for your review and signature. First, we seek a stipulation that we may file a Supplemental Complaint pursuant to F.R.C.P. 15(d) so that our Complaint may properly reflect the new licensing scheme to be applied to Professor Bernstein's encryption-related activities. Second, the Stipulation should provide that the IEEPA/EAR regulations will not be enforced against Professor Bernstein and others pending final review by Judge Patel. This Stipulation will ensure that Professor Bernstein and others will not be restrained from their protected speech activities by the new regulations while they are under Court review. We believe that this Stipulation is consistent with the spirit and findings of Judge Patel's recent Memorandum and Order, specifically her concluding observation: "In view of the fact that the court has ruled on the merits and has found certain provisions of the ITAR invalid, plaintiff cannot be prosecuted under those provisions absent reversal on appeal." (Memorandum and Order, page 37:14-17). While it is most appropriate for you to stipulate to refrain from prosecution of any person relating to encryption software under the IEEPA/EAR Scheme, and while we are confident that Judge Patel would grant us such relief should we be forced to bring a Motion for a Temporary Restraining Order, we would be willing to stipulate to less than a full general stipulation in order to avoid the need for expedited relief pending full judicial review. Your representations to Judge Patel concerning the ITAR, indicate that your clients might be willing to stipulate to temporarily refrain from prosecuting Professor Bernstein and others under the IEEPA/EAR regulations at least as to certain activities. Consistent with Judge Patel's suggestion in her Order, therefore, we would consider entering into a Stipulation as to those certain activities for which you do not intend to prosecute. We believe that such a Stipulation will narrow the issues for the Court to consider should we need to seek an Temporary Restraining Order and could even eliminate the need for such an Order entirely. To that end, we list below the key activities by Professor Bernstein and others which we believe might be amenable to such a partial stipulation by you. Our review of the new regulations indicates that these various activities are controlled as "exports" of encryption items under 15 C.F.R. 734.2(b)(2), (3) and (9) and/or as the provision of "technical assistance" under 15 C.F.R. 744.9. Accordingly, without stipulation by you, Professor Bernstein and others face prosecution if they engage in these activities without a license from your clients: 1. Publication of Snuffle 5.0 software and the related technology and software (formerly called "technical data") on the sci.crypt Usenet newsgroup. 2. Engaging in classroom lecture and discussion with both U.S. and foreign students about encryption items, including instruction about theory and use. a. Although under section 744.9 the new regulations state that teaching "information about cryptography" in an academic institution does not require a license, the term "information about cryptography" is not defined. It is therefore not clear whether this includes teaching of encryption software itself, related software and technology, or some combination thereof. b. Our concern on this point is supported by the elimination of the following licensing exceptions for encryption software and technology: 1. "educational information" under 734.9, 2. "publicly available information" under 734.3(b)(3), 3. software which is the result of "fundamental research" under 734.8. 3. Release of encryption software, related software and technology to foreign students in the classroom. 4. Communications with academic and scientific peers and other researchers abroad over the telephone, facsimile, U.S. mail and Internet concerning cryptographic software and related technical data, which communications could include the sharing of encryption items. 5. Publication of cryptographic source code, related software and technology other than Snuffle 5.0 to the sci.crypt Usenet newsgroup and electronic publications. This includes but is not limited to the publication by Professor Bernstein of encryption software called dh227 which is discussed in Plaintiff's Motion for Preliminary Injunction. 6. Creation by Professor Bernstein and others of class Internet sites on the World Wide Web which will serve to distribute the encryption items to be taught and discussed during academic courses, again as detailed in Plaintiff's Motion for Preliminary Injunction. These sites contain no more restrictions as to access than any other University World Wide Web sites. Please note that in order to ensure that Professor Bernstein and others may teach cryptography freely, the Stipulation will have to specify that your clients will not prosecute Plaintiff, other professors teaching cryptography, cryptography students or any others who may receive technical data, cryptographic software or defense services from cryptographic courses. Specifically, it must specify that foreign cryptography students will not be prosecuted for taking their course materials, including encryption software, home with them when they have finished their studies in the United States. If your clients will stipulate to refrain from prosecuting for any or all of the acts mentioned above, please provide us with an appropriately specific stipulation for our review. We note that in the past you have responded to our requests for stipulations with a letter from one of your clients. Given the nonbinding nature of such correspondence and the lack of clarity in those previous letters, we must insist that any agreements between the parties as to these issues be make by specific Stipulation with a corresponding Order from Judge Patel. Unfortunately, since your clients drafted the regulations so that they became effective immediately upon publication, and since the start of Professor Bernstein's course is fast approaching, we will need to seek immediate relief for Professor Bernstein and others should you decline to stipulate to refrain from prosecution under the IEEPA/EAR regulations. As a result, we will seek such an order and injunction unless we receive a sufficient stipulation from you by noon, Pacific time, on Thursday, January 2, 1996. Sincerely, McGLASHAN & SARRAIL Professional Corporation CINDY A. COHN CAC:cac cc: Daniel Bernstein