The opinion of the court was delivered by: PATEL
Plaintiff Daniel Bernstein brought this action against the Department of State and the individually named defendants seeking declaratory and injunctive relief from their enforcement of the Arms Export Control Act ("AECA"), 22 U.S.C. § 2778, and the International Traffic in Arms Regulations ("ITAR"), 22 C.F.R. §§ 120-30 (1994), on the grounds that they are unconstitutional on their face and as applied to plaintiff. Now before this court is defendants' motion to dismiss for lack of justiciability.
Having considered the parties' arguments and submissions, and for the reason set forth below, the court enters the following memorandum and order.
Encryption basically involves running a readable message known as "plaintext" through a computer program that translates the message according to an equation or algorithm into unreadable "ciphertext." Decryption is the translation back to plaintext when the message is received by someone with an appropriate "key." The message is both encrypted and decrypted by common keys. The uses of cryptography are far-ranging in an electronic age, from protecting personal messages over the Internet and transactions on bank ATMs to ensuring the secrecy of military intelligence.
As a graduate student, Bernstein developed an encryption algorithm he calls "Snuffle." He describes Snuffle as a zero-delay private-key encryption system. Complaint Exh. A. Bernstein has articulated his mathematical ideas in two ways: in an academic paper in English entitled "The Snuffle Encryption System," and in "source code" written in "C", a high-level computer programming language,
detailing both the encryption and decryption, which he calls "Snuffle.c" and "Unsnuffle.c", respectively. Once source code is converted into "object code," a binary system consisting of a series of 0s and 1s read by a computer, the computer is capable of encrypting and decrypting data.
B. Statutory and Regulatory Background
The Arms Export Control Act authorizes the President to control the import and export of defense articles and defense services by designating such items to the United States Munitions List ("USML"). 22 U.S.C. § 2778(a)(1). Once on the USML, and unless otherwise exempted, a defense article or service requires a license before it can be imported or exported. 22 U.S.C. § 2778(b)(2).
The International Traffic in Arms Regulations, 22 C.F.R. §§ 120-30, were promulgated by the Secretary of State, who was authorized by executive order to implement the AECA. The ITAR is administered primarily within the Department of State by the Director of the Office of Defense Trade Controls ("ODTC"), Bureau of Politico-Military Affairs. The ITAR allows for a "commodity jurisdiction procedure" by which the ODTC determines if an article or service is covered by the USML when doubt exists about an item. 22 C.F.R. § 120.4(a).
Categories of items covered by the USML are enumerated at section 121.1. Category XIII, Auxiliary Military Equipment, includes "Cryptographic (including key management) systems, equipment, assemblies, modules, integrated circuits, components or software with the capability of maintaining secrecy or confidentiality of information or information systems . . . ." 22 C.F.R. § 121 XIII(b)(1). A number of applications of cryptography are excluded, such as those used in automated teller machines and certain mass market software products that use encryption. Id.
C. Plaintiff's Commodity Jurisdiction Determinations
On June 30, 1992 Bernstein submitted a commodity jurisdiction ("CJ") request to the State Department to determine whether three items were controlled by ITAR. Those items were Snuffle.c and Unsnuffle.c (together referred to as Snuffle 5.0), each submitted in C language source files, and his academic paper describing the Snuffle system. Complaint Exh. A. On August 20, 1992 the ODTC informed Bernstein that after consultation with the Departments of Commerce and Defense it had determined that the commodity Snuffle 5.0 was a defense article under Category XIII of the ITAR and subject to licensing by the Department of State prior to export. The ODTC identified the item as a "stand-alone cryptographic algorithm which is not incorporated into a finished software product." Complaint Exh. B. The ODTC further informed plaintiff that a commercial software product incorporating Snuffle 5.0 may not be subject to State Department control and should be submitted as a new commodity jurisdiction request.
Plaintiff and ODTC exchanged copious and contentious correspondence regarding the licensing requirements during the spring of 1993. Still unsure if his academic paper had been included in the ODTC CJ determination of August 20, 1992, Bernstein submitted a second CJ request on July 15, 1993, asking for a separate determination for each of five items. According to plaintiff these items were 1) the paper, "The Snuffle Encryption System," 2) Snuffle.c, 3) Unsnuffle.c, 4) a description in English of how to use Snuffle, and 5) instructions in English for programming a computer to use Snuffle.
On October 5, 1993 the ODTC notified Bernstein that all of the referenced items were defense articles under Category XIII(b)(1). Complaint Exh. E; Defendant Exh. 18. After plaintiff initiated this action, the ODTC wrote to plaintiff to clarify that the CJ determinations pertained only to Snuffle.c and Unsnuffle.c and not to the three items of explanatory information, including the paper. Defendant Exh. 21. Bernstein appealed the first commodity jurisdiction determination on September 22, 1993. That appeal is still pending.
Plaintiff seeks to publish and communicate his ideas on cryptography. Because "export" under the ITAR includes "disclosing . . . technical data to a foreign person, whether in the United States or abroad", Bernstein asserts that he is not free to teach the Snuffle algorithm, to disclose it at academic conferences, or to publish it in journals or online discussion groups without a license.
A motion to dismiss will be denied unless it appears that the plaintiff can prove no set of facts which would entitle him or her to relief. Conley v. Gibson, 355 U.S. 41, 45-46, 2 L. Ed. 2d 80, 78 S. Ct. 99 (1957).; Fidelity Financial Corp. v. Federal Home Loan Bank of San Francisco, 792 F.2d 1432, 1435 (9th Cir. 1986), cert. denied, 479 U.S. 1064, 93 L. Ed. 2d 998, 107 S. Ct. 949 (1987). All material allegations in the complaint will be taken as true and construed in the light most favorable to the plaintiff. NL Industries, Inc. v. Kaplan, 792 F.2d 896, 898 (9th Cir. 1986). Although the court is generally confined to consideration of the allegations in the pleadings, when the complaint is accompanied by attached documents, such documents are deemed part of the complaint and may be considered in evaluating the merits of a Rule 12(b)(6) motion. Durning v. First Boston Corp., 815 F.2d 1265, 1267 (9th Cir.). cert. denied sub. nom. Wyoming Community Dev. Auth. v. Durning, 484 U.S. 944, 98 L. Ed. 2d 358, 108 S. Ct. 330 (1987).
The designation by the President (or by an official to whom the President's functions under subsection (a) of this section have been duly delegated), in regulations issued under this section, of items as defense articles or defense services for purposes of this section shall not be subject to judicial review.
22 U.S.C. § 2778(h). Defendants conclude that this language, as well as the Constitution, precludes review of commodity jurisdiction determinations by this court. ...