ENCRYPTION SOURCE CODE AND THE FIRST AMENDMENT

The First Amendment does not cover all speech acts. It instead extends constitutional protection to media for the communication of ideas, which are forms of social interaction that realize First Amendment values. The constitutional question, therefore, is whether particular uses of encryption source code are embedded within such media. It is insufficient to distinguish, as do current federal regulations, the publication of encryption source code in electronic form from its publication in written form. Instead it is necessary to focus on the social contexts within which encryption source code is used, whether in electronic or written form. From a constitutional perspective, it is one thing to use source code to convey ideas to an audience, and it is quite another to use source code to run a computer. The article suggests how each of these situations might be constitutionally analyzed.

Source code is a high level computer language typically used by programmers to compose computer software.^¹ Federal regulations prohibit the unlicensed export of computer software, including source code, designed to encrypt messages.^² To post encryption source code to the Internet is in most circumstances to “export” it under the terms of the regulations.^³ Federal regulations do not seek to prohibit the unlicensed export of “a printed book or other printed material setting forth encryption source code,” but they do extend to “encryption source code in electronic form or media (e.g., computer diskette or CD ROM).”^⁴

Daniel J. Bernstein, a professor of mathematics, statistics, and computer science, composed an encryption program called Snuffle in source code.^⁵ He wished to “present his work on Snuffle within the academic and scientific communities.”^⁶ Bernstein brought suit challenging the federal regulations as a prior restraint on his ability to speak. The Bernstein case raises the fascinating and controversial question of whether computer programs written in source code can be a form of expression for purposes of the First Amendment. Lee Tien’s rich and complex article substantially contributes to our understanding of this question.^⁷

Tien’s distinction between “coverage” and “protection,” for example, is exactly right.^⁸ To conclude that the First Amendment “covers” conduct, like the export of encryption source code, is to assert that the constitutionality of the conduct’s regulation must be determined by reference to First Amendment doctrine and analysis. To conclude that the conduct is “protected” by the First Amendment, on the other hand, is to assert that the regulation of the conduct is unconstitutional. The question of First Amendment coverage goes to the threshold issue of the kind of analysis that should be brought to bear in evaluating the constitutionality of state regulations; the question of First Amendment protection goes to the ultimate judgments that we ought to reach in a particular case.

The threshold question posed by the Bernstein case is whether federal regulation of encryption source code is to be assessed under the doctrines of the First Amendment. This is a question of coverage, and it shall be my focus in this brief comment. Bernstein answered this question in the affirmative, holding that the constitutionality of the federal regulations was to be determined by First Amendment principles. A closely analogous case, however, has seemingly reached the contrary conclusion.^⁹

In his article, Tien argues that First Amendment coverage should presumptively extend to all speech acts, by which he means all acts of communication in which a speaker intends “to produce understanding in a hearer by resort to or in virtue of the conventional meaning of what the speaker says.”^¹⁰ Thus for Tien the question of whether the publication of encryption code ought to be covered by the First Amendment depends upon whether publishing source code is a speech act.^¹¹

For reasons I have articulated elsewhere, I believe that the premise of Tien’s argument is untenable.^¹² There are many forms of speech acts that the First Amendment does not cover. Product warnings are clearly speech acts according to Tien’s definition, for example, and yet they are universally regulated in ways that are not covered by the First Amendment.^¹³ Contracts are certainly speech acts, and yet contract law proceeds without the interference of First Amendment analysis. The general point is that social life largely occurs through language; social life is thus filled—one might even say composed of—interactions that meet Tien’s definition of speech acts. A First Amendment that covered all these aspects of social life would be nothing like the First Amendment which we currently possess. The presence of a speech act is therefore not sufficient to justify First Amendment coverage.^¹⁴

First Amendment coverage is sometimes triggered by what a legal rule regulates, and sometimes it is triggered by why a legal rule seeks to regulate.^¹⁵ These inquiries are logically and practically independent of each other, and in this comment I shall focus exclusively on the first. I shall address the question whether the regulation of encryption source code ought to be subject to First Amendment scrutiny, but I shall not discuss whether the purpose of the federal regulations at issue in Bernstein would independently warrant First Amendment coverage.

If the presence of a speech act is not a sufficient condition for First Amendment coverage, how are we to specify the class of actions that does trigger First Amendment analysis? The view I have defended elsewhere is that First Amendment coverage is triggered by those forms of social interaction that realize First Amendment values.^¹⁶ If we believe that the function of the First Amendment is to protect a marketplace of ideas, we will extend First Amendment coverage to those forms of social interaction that constitute such a marketplace. If we believe that the function of the First Amendment is to protect the communications necessary for democratic self-determination, we will extend First Amendment coverage to social interactions that instantiate the value of self-government.

From this perspective, Tien is fundamentally misguided to believe that he can explain First Amendment coverage “without appealing to a grand theoretical framework of First Amendment values.”^¹⁷ If First Amendment coverage does not extend to all speech acts, then such a framework is at a minimum necessary in order to provide the criteria by which to select the subset of speech acts that merit constitutional attention.

Actually the situation is more complicated than this, because First Amendment coverage is not limited to speech acts. It extends to forms of interaction that realize First Amendment values. In work published elsewhere I have used the term “medium” to designate such forms of interaction.^¹⁸ The Court has held that “motion pictures are a significant medium for the communication of ideas,”^¹⁹ for example, which signifies that film, considered as a genre, serves First Amendment values.

The genre of the cinema, however, encompasses far more than speech acts. It includes materials, like celluloid; functional machines, like projectors; buildings, like movie houses; social organizations, like studios; and so forth. If the state were to prohibit the use of projectors without a license, First Amendment coverage would undoubtedly be triggered. This is not because projectors constitute speech acts, but because they are integral to the forms of interaction that comprise the genre of the cinema. The licensing of projectors would have important effects on that genre, effects that would be quite pertinent to the very First Amendment values that lead us to protect motion pictures in the first place. That is why First Amendment coverage would likely extend to a law requiring projectors to be licensed.

First Amendment coverage, therefore, depends upon how the object of regulation is integrated into First Amendment media. Although a state may without First Amendment scrutiny prohibit public nudity, a First Amendment question would surely be raised if a state were to prohibit nudity within the cinema.^²⁰ It would even raise a First Amendment question if a state were to attempt to apply a general prohibition of nudity to motion pictures.^²¹ First Amendment coverage, in other words, does not attach to nudity considered as an isolated kind of conduct, but rather to the relationship between nudity and the forms of social interaction that the First Amendment seeks to protect.

Some judges and commentators, however, have sought to determine whether the First Amendment covers encryption source code by deciding whether such code, viewed as an isolated thing, is “inherently a functional device.”^²² But if the analysis I have suggested is correct, Tien is certainly right to conclude that one cannot “answer the coverage question by looking at software as a thing.”^²³ Although projectors are unambiguously a functional thing, the First Amendment might well cover their regulation because of the potential impact on motion pictures. The correct focus of constitutional inquiry is, therefore, as Tien properly asserts, “how software is used in an act.”^²⁴ The coverage question depends upon how the licensing of encryption source code affects First Amendment media.

It is clear that the federal regulations at issue in Bernstein attempt roughly to acknowledge this point by distinguishing between encryption source code in “a printed book or other printed material setting forth encryption source code,” and “encryption source code in electronic form or media (e.g., computer diskette or CD ROM).”^²⁵ The regulations do not require a license for reproducing source code in printed material.^²⁶ This exception would be incomprehensible if preventing disclosure of the information contained in encryption source code were the only concern of the regulations. Evidently the regulations were also concerned with protecting First Amendment values.

We can identify one source of these values by attending to Tien’s conclusion that “a computer program in source code form is a procedure written in a programming language.”^²⁷ Authors routinely write books and articles in which they communicate procedures to each other. Examples might be articles that explain the procedures necessary for medical diagnoses, or books that explain the procedures necessary for experiments in the physical sciences. Because we regard books and articles as a medium for the communication of ideas, such writings are unambiguously covered by the First Amendment.

For purposes of the First Amendment, the language in which books and articles are written is without importance. So long as books and articles communicate ideas to others, it makes no difference whether they are written in French, or in mathematical symbols, or in computer source code. Just as the First Amendment would cover a law requiring authors to obtain a license before publishing in an article the mathematical equations describing nuclear fusion, so would it cover regulations requiring a license before printing in an article the source code for an encryption program.

Some analysis roughly like this must explain why federal regulations permit encryption source code to be published without interference in book form. Why, then, do the regulations forbid the unlicensed publication of the identical source code in “electronic form or media (e.g., computer diskette or CD ROM)”? The federal government defended this distinction by arguing that when source code is published in electronic form, it does not implicate First Amendment concerns. In Bernstein, the federal government contended that source code in electronic form is a form of software “used to control directly the operation of a computer without conveying information to the user. In the government’s view, by targeting this unique functional aspect of source code, rather than the content of the ideas that may be expressed therein, the export regulations manage to skirt entirely the concerns of the First Amendment.”^²⁸

The government’s argument, however, can not be correct. Publishing software in print is covered by the First Amendment because it forms part of public discourse and debate. We know that this same discourse and debate can occur over the Internet and in electronic form.^²⁹ So long as the publication of encryption source code forms part of this public discourse and debate, it will be covered by the First Amendment, whether it is set forth in a printed article or in an online discussion. The government’s analysis leads directly to the absurd conclusion that an article about encryption code that would unambiguously be covered by the First Amendment when published in Scientific American, would somehow lose that coverage when scanned and posted to the Internet.

It may be the case, of course, that there are stronger justifications for prohibiting the publication of encryption code in electronic form than in printed form, a question about which I intimate no view. I observe only that this question goes to the issue of First Amendment protection; it is relevant to whether or not electronically reproduced encryption software may be regulated when analyzed under applicable First Amendment doctrines. It does not go to the question of First Amendment coverage.^³⁰

The decisive question for coverage is whether or not the publication of the source code forms part of a First Amendment medium, and this question can be affirmatively answered even if the publication of the source code is in electronic form. For purposes of First Amendment coverage, it makes no difference whether an author wishes to discuss an encryption program written in source code in an article published in hard copy, or in an article electronically distributed through the Internet.

Suppose, however, that a person does not wish to discuss an encryption program written in source code, but to use an encryption program. We might imagine a consumer who buys a disk containing encryption software, intending to insert the disk into his computer to employ the software to encrypt his messages. In this situation, the content of the source code is not a subject of discussion or debate.^³¹ The consumer does not know what the source code says; the code speaks directly to the consumer’s computer.

The author of encryption software who distributes encryption source code to consumers to be used in this fashion is therefore not participating in public dialogue or debate. For this reason, regulation of encryption software in such contexts would seem to raise very different constitutional questions than any we have so far discussed. Such regulation appears, on its face, no different than the regulation of hardware in computers.

No doubt this is the paradigmatic situation that the government had in mind when it argued that the publication of encryption source code in electronic form was “used to control directly the operation of a computer without conveying information to the user.”^³² The difficulty with the government’s position, however, is that for encryption source code to function in this way, it is a necessary but not sufficient condition for it to be written in electronic, rather than printed form. To know whether encryption source code forms part of a dialogue between humans or instead serves as instructions to computers, we must know more than that it is written in electronic form; we must also know the social circumstances of its sale and application.

For purposes of First Amendment coverage, therefore, the relevant distinction is not between encryption source code published in electronic as opposed to printed form, but rather between encryption source code that is itself part of public dialogue and encryption source code that is meant merely to be used. This latter distinction is surely messier—more difficult to formulate and enforce—than that presently contained in federal regulations. But it is the only constitutionally defensible distinction.

Unfortunately the distinction does not completely settle the question of First Amendment coverage. This is because encryption software can affect First Amendment media in various different ways. If encryption source code is itself a subject of discussion within a First Amendment medium, First Amendment coverage clearly ought to apply to attempts to regulate the publication of the code. That is why the Court in Bernstein was assuredly correct to hold that in the circumstances of the case the validity of the federal regulations had to be determined by reference to applicable First Amendment principles.^³³ But even if encryption source code is not itself a subject of public discussion, its regulation might nevertheless affect public discussion in ways that ought to trigger First Amendment coverage.

To see how this might be so, recall our earlier discussion of movie projectors. Such projectors form no part of the speech content of movies. But a law forbidding the screening of films without a licensed projector would probably be covered by the First Amendment. We would be concerned about the law’s potential impact on the medium of movies, in exactly the same way that we would be concerned about the potential impact on the press of a law that required all books to be printed on presses that were licensed by the state.^³⁴

The First Amendment concerns that immediately spring to mind in these examples are those of viewpoint discrimination. We know that certain kinds of licensing schemes can be used to distort the ideas expressed through the media of film or books. Because we wish ideas to be freely and fully expressed through these media, we are alert to scrutinize licensing schemes under First Amendment standards to ensure that they do not compromise this constitutional value. The licensing scheme challenged in Bernstein, applied to the public discussion at issue in that case, raises analogous constitutional concerns.

State regulation, however, can compromise First Amendment media in ways that do not involve viewpoint discrimination. An obvious instance might be a law that prohibits newsprint in order to save trees. Newsprint is a material necessary for the publication of most newspapers. Although a law proscribing newsprint would be viewpoint (and content) neutral, it would carry the potential for so significantly affecting the First Amendment medium of newspapers that we would certainly review it under First Amendment principles. We would want to assure ourselves that it would not compromise the constitutional value we attribute to newspapers.

Such review, including the threshold question of whether to engage in such review (which is the coverage question), will always rest upon a constitutional sociology by which we specify the social aspects of the medium that carry constitutional significance. This sociology can often prove difficult and puzzling, especially when it involves new and evolving technologies.

Consider, for example, a viewpoint (and content) neutral law that prohibits CD players. We know that music is a First Amendment medium.^³⁵ CD players are machines that do not form part of the content of that medium, and yet today most music is distributed and heard through the technology of compact disks. Prohibiting CD players would materially disrupt the pattern of social relationships that comprise the contemporary medium of music. The First Amendment question would be whether this disruption threatens to undermine the constitutional values that have led us to classify music as a First Amendment medium. In such circumstances, the extension of First Amendment coverage would signify that we find this a sufficiently close or important question as to require us to decide it under First Amendment principles.

An analogous argument might be made to justify extending First Amendment coverage to encryption software. Even when such software functions purely as a “machine”^³⁶ to make digital messages secret, we must ask whether its regulation might compromise the constitutional values we attribute to particular First Amendment media. The empirical and normative aspects of such an inquiry are, to say the least, formidable. First, we would have to assess the effects of federal regulation of encryption source code on the production and use of encryption software. Second, we would have to specify the impact of these effects on the various First Amendment media that employ encryption software. Finally we would have to face the normative question of whether this impact would raise sufficient constitutional concerns as to merit First Amendment coverage.

Tien offers the valuable suggestion that encryption software might be conceived as providing the equivalent of envelopes which protect the privacy of underlying digital messages.^³⁷ In some circumstances, a law that strips speech of privacy would certainly merit First Amendment coverage. Consider, for example, a regulation prohibiting mail from using envelopes and requiring that the contents of all letters be made legible to mail handlers. I have no doubt that courts would scrutinize such a law under relevant First Amendment doctrine. This is because the chill on participating in a First Amendment medium that comes from exposure is a well-recognized First Amendment interest.^³⁸ Laws prohibiting anonymous political leaflets have thus been struck down because of their potential impact on speakers.^³⁹

Encryption software is a way of preventing an analogous chill within digital media. It is probable that First Amendment coverage would extend to a law requiring a live operator to monitor all phone conversations.^⁴⁰ We might imagine an analogous argument for First Amendment coverage of federal regulations of encryption source code if the world were such that digital phone conversations were routinely monitored, and if the effect of the regulations were essentially to deprive us of the ability to avoid such eavesdropping. It is not difficult to think up analogous arguments about communication over the Internet.

It is far beyond the ambition of this brief comment to make or to evaluate any such arguments. Digital First Amendment media, like the Internet, are so new and have such labile patterns of social interaction, that it seems to me enormously difficult to acquire reliable normative or descriptive traction on the relevant questions. My point in raising this line of inquiry is not to suggest a final resolution of the problem, but instead to indicate that it will be necessary to pursue this line of inquiry if we ever aspire to a more complete understanding of the issue of First Amendment coverage of federal regulation of encryption source code.

1 . See Bernstein v. United States Dep’t of Justice, 176 F.3d 1132, 1140 (9th Cir. 1999), withdrawn pending en banc reh’g, 192 F.3d 1308 (9th Cir. 1999), appeal dismissied without prejudice and remanded, No. 97-16686 (9th Cir. April 11, 2000) [hereinafter Bernstein IV].

2 . See Bernstein v. United States Dep’t of State, 974 F. Supp. 1288, 1294-96 (N.D. Cal. 1997) [hereinafter Bernstein I]. To encrypt a message is to make it incomprehensible to someone who does not have the encryption code. Encryption code applies to messages that are sent in digital form. See Andrew L. Shapiro, The Control Revolution 73 (1999) (“Encryption tools . . . are the locks and keys of the digital age.”).

3 . See Junger v. Daley, 8 F. Supp. 2d 708, 713 (N.D. Ohio 1998), rev’d and remanded, No. 98-4045, 2000 U.S. App. LEXIS 6161 (6th Cir. April 4, 2000) (“Almost any posting of software on the Internet is an export.”).

9 . See Junger v. Daley, 8 F. Supp. 2d 708, 708 (N.D. Ohio 1998), rev’d and remanded, No. 98-4045, 2000 U.S. App. LEXIS 6161 (6th Cir. Apr. 4, 2000). As this article was going to press, however, the District Court Opinion in Junger was reversed by the Sixth Circuit. Junger v. Daley, No. 98-4045, 2000 U.S. App. LEXIS 6161 (6th Cir. Apr. 4, 2000). In the Junger case, Peter Junger, a law professor teaching courses on computer law, challenged the federal export regulations as violating his First Amendment right to post encryption programs to his web site in order to use them as teaching materials. See Junger, 8 F. Supp. 2d at 714. The federal government had specifically allowed Junger to publish encryption programs in his textbook, Computers and the Law. See id. The District Court in Junger appeared to hold that because encryption source code in electronic form was “inherently functional . . . indistinguishable from dedicated computer hardware that does encryption,” id. at 716, the electronic source code was not covered by the First Amendment. The holding is ambiguous, however, because the Court spoke in terms of First Amendment “protection,” id. at 716-18, and it in fact purported to apply various First Amendment doctrines.

11 . This is essentially the position of the Sixth Circuit decision reversing the District Court opinion in Junger. See Junger, 2000 U.S. App. LEXIS 6161. The Court holds that “[b]ecause computer source code is an expressive means for the exchange of information and ideas about computer programming, we hold that it is protected by the First Amendment.” Id. at *10.

14 . I should also note that the presence of a speech act is also not necessary to justify First Amendment coverage. Campaign expenditures, for example, do not meet Tien’s definition of a speech act, and yet they are covered by the First Amendment. See Buckley v. Valeo, 424 U.S. 1 (1976). In general, First Amendment coverage can be triggered by certain justifications for government regulations, whether or not those regulations are addressed to speech acts. See Post, supra note 12, at 1255-60.

21 . See Post, supra note 12, at 1259 (discussing Barnes v. Glenn Theatre, Inc., 501 U.S. 560 (1991)); cf. Cohen v. California, 403 U.S. 15 (1971) (holding that California cannot prohibit the wearing of a jacket bearing an obscenity in an effort to remove the word from the public vocabulary).

22 . Bernstein IV, 176 F.3d 1132, 1148 (9th Cir. 1999) (Nelson, J., dissenting); see also Junger v. Daley, 8 F. Supp. 2d 708, 716 (N.D. Ohio 1998), rev’d and remaned, No. 98-4045, 2000 U.S. App. LEXIS 6161 (6th Cir. April 4, 2000); Patrick Ian Ross, Bernstein v. United States Department of State, 13 Berkeley Tech. L.J. 405, 410-15 (1998); John P. Collins, Jr., Note, Speaking in Code, 106 Yale L.J. 2691, 2696 (1997). But see Thinh Nguyen, Cryptography, Export Controls, and the First Amendment in Bernstein v. United States Department of State, 10 Harv. J.L. & Tech. 667, 677-78 (1997).

26 . Hence Peter Junger was able without interference to publish encryption software in his textbook. See Junger v. Daley, F. Supp. 2d 708, 714 (N.D. Ohio 1998), rev’d and remanded, No. 98-4045, 2000 U.S. App. LEXIS 6161 (6th Cir. April 4, 2000).

29 . See Reno v. American Civil Liberties Union, 521 U.S. 844 (1997) (holding that the Communications Decency Act of 1996 was a constitutionally impermissible content based restriction on First Amendment speech).

30 . This point is made by the Sixth Circuit decision in Junger, 2000 U.S. App. LEXIS 6161, at *10-11 (“The functional capabilities of source code, and particularly those of encryption source code, should be considered when analyzing the governmental interest in regulating the exchange of this form of speech. . . . We recognize that national security interests can outweigh the interests of protected speech and require the regulation of speech.”)

31 . Most likely, of course, the disk would be written in object code, not source code. See Mark A. Lemley and Eugene Volokh, Freedom of Speech and Injunctions in Intellectual Property Cases, 48 Duke L.J. 147, 236-37 (1998).

33 . Even the dissenting opinion of T.G. Nelson conceded that “Bernstein may very well have a claim under an as-applied First Amendment analysis.” Id. at 1149. It is for this same reason that the District Court in Junger was almost certainly incorrect to hold that the First Amendment did not apply to the circumstances of that case. See Junger v. Daley, F. Supp. 2d 708 (N.D. Ohio 1998), rev’d and remanded, No. 98-4045, 2000 U.S. App. LEXIS 6161 (6th Cir. April 4, 2000).

34 . See Thomas I. Emerson, The System of Freedom of Expression 504 (1970) (noting that prior restraint originated in part in opposition to laws forbidding books to be printed except by printing presses licensed by the state); see also Talley v. California, 362 U.S. 60, 64 (1960) (discussing effects of press licensing law).

36 . See Pamela Samuelson et al., A Manifesto Concerning the Legal Protection of Computer Programs, 94 Colum. L. Rev. 2308, 2320-24 (1994); see also Ross, supra note 22, at 410-11; Lemley & Volokh, supra note31 , at 236.