WPC6 2 BPZ Courier 10cpi#|C,wx6X@8;X@HP LaserJet IIIHPLASIII.PRSx  @,\,k%X@2LN< ZXCourier 10cpiCG Times (Scalable)CG Times Bold (Scalable)Univers (Scalable)#|C,HP LaserJet IIIHPLASIII.PRSx6X@87,\,k%X@?xxx,wx6X@8;X@l"3m=6,#{&m P7&P#2p=6,"h&p_ p^7&dp&_22,;_xP7P2 ~V, ("m+O6^6=U\\===\====\\\\\\\\\\==Qs~sm=Gsizbsw===\\=Q\Q\Q=\\33\3\\\\DG3\\\\QQ\Q\\\\\\=\\\\\\\\\3QQQQQz~QsQsQsQsQ=3=3=3=3\\\\\\\\\\Q\\\\\i\QQQ~Q~Q~Q~Q\sQsQsQsQ\\\\\\\\=3=3=3=3fG\s3s3s3s3s3\m\\\\zDzDzDbGbGbGbGs3s3s3\\\\\\\wQwQwQ\s3\zDbGs3\\\\\=\\===WxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxN\\\=QKK\\\\\\A\\\\A==__\00\\pp\\\mff=_\A"\_\壣\==px=\\f\z\=\Q\iwUzpNmń\QQ====фpsfpfzQsGwQ\Q=3QzffQz\Qpi\p\\sQQzpfppppG\33QQQpQpppp==\\\\\\\pppppppppppppppppppGGGGGGG\\\\\\\\\\\\\\\\\\\\333333333333QQQQQQQQQQQQQQQQQQQpppppppppppppppppppp=is=p=\\Q=x"m+O6^6=U\\===\====\\\\\\\\\\==\zzpGXzpfzz===\\=\fQfQA\f3=f3f\ffQG=f\\\Q\\\\\\\\\=\\\\\\\\f3\\\\\QzQzQzQzQG3G3G3G3f\\\\ffff\\f\\\\pf\\\QQQQfzQzQzQzQ\\\\\\ffG3G3G3G3iXfz3z3z3zGz3fff\\ψQQQfGfGfGfGz=z=z=ffffff\zQzQzQfz3fQfGz=\\f\f=\\===WxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxN\\\=\NN\\\\\\A\\\\A==ii\00\\pp\\\sff=i\A"\i\壣\==px=\\f\z\=\Q\i~XzpNmń\\\====фpzfpfzQzGzQQQG3QzffQz\Qpp\p\\zQQzpfppppGQ33QQQpQpppp==\\\\\\\pppppppppppppppppppGGGGGGGQQQQQQQQQQQQQQQQQQQQ333333333333QQQQQQQQQQQQQQQQQQQpppppppppppppppppppp=pzGpG\\Q=x"m+O6^22K^^r222^2222^^^^^^^^^^22No^jlVSol*SdQlrYuaa^lllg\222KK2QVQVQ8VV$$Q$VVVV5K8VSSSHCKC^^^^^^2^^^^^^K^\$oQoQoQoQoQjQVQVQVQVQ*$*$*$*$lVrVrVrVrVlVlVlVlVgSoQlVrVrVgSlVYVoQoQoQjQjQjQjQlVVQVQVQVQoVoVoVoVoVoVlVlV*$*$*$*$zHSdQQ$Q$Q$Q6Q$lVlglVlVrVrVa5a5a5aKaKaKaK^8^8^8lVlVlVlVlVlVgS\H\H\HlVQ$lVa5aK^8gSgSlVrVlV2KK222WddddddddddddddddddddddddddddddddddddddddNlllK^^2NSS^^^==^::KK^:22KK^88^^\\rKKlKg\\2KK:"llKlOllK喖K22lYllllllllllx2Ko^S^loK2^lK^VluallllllllllQllllll}d\ul@YlllllllKlllllllCllllClllllllllllllllllllllllllllllllllllllllllll2lll2lll2lll2llllllllllllloS^QSKoQVE\@lVrQ*$dKoNSlS^@rVlVYQYYC^EgQzjlHwgorSEV$$VQQrQSrgg22^^^^^^^SSSSSSSSSSSSSSSSSSSEEEEEEEVVVVVVVVVVVVVVVVVVVV$$$$$$$$$$$$VVVVVVVQQQQQQQQQQQQrrrrrrrrrrrrrrrrrrrr2VoVl*rgo*gQKC2x24  #f\  PC#{&P# sfPreface In January of 1993 the National Institute of Standards and Technology (NIST) initiated the preparation of this and other publications on various aspects of the civilian cryptography issue. The purpose of this project was to prepare concise summaries of information, based upon research in open source literature, on a particular topic of interest relevant to the public discussion of cryptographicrelated issues. This study was prepared under contract from the National Institute of Standards and Technology (NIST). No claim is made by NIST as to the accuracy or completeness of the information contained herein. The document does not constitute the official position of the U.S. Government on the subject matter covered in this publication. Comments, additions, or corrections on this study are welcomed, as it is our intent to update it periodically. Submissions should be directed to: PMr. Lynn McNulty PAssociate Director for Computer Security PComputer Systems Laboratory PNational Institute of Standards and Technology PGaithersburg, MD 20899 PFax: 3019481784 PEmail: mcnulty@ecf.ncsl.nist.gov  T Thank you. YREVIEW AND ANALYSIS OF U.S. LAWS, W=REGULATIONS, AND CASE LAWS PERTAINING XyTO THE USE OF COMMERCIAL ENCRYPTION \bPRODUCTS FOR VOICE AND DATA b COMMUNICATIONS :G \DProfessor James P. Chandler `Diana C. Arrington _Donna R. Berkelhammer b:William L. Gill :G cJanuary 1994 5Prepared by "National Intellectual Property Law Institute and *JThe George Washington University R1350 Eye Street NW, Suite 820 V Washington, DC 20005 SSubcontract No. 19KRF105C i [DOE Project No. 2042E024A1 i i i i i cPrepared for SData Systems Research and Development Program _lTechnical Operations `tOak Ridge K25 Site ZbOak Ridge, Tennessee 378317620 dManaged by WMARTIN MARIETTA ENERGY SYSTEMS, INC. ffor the ]U.S. DEPARTMENT OF ENERGY Yunder contract DEAC0584OR21400X)0*0*0* :G    І J ddx !b ddx J     pG #WTo> P}_P# ` This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or  pG| any agency thereof. | ` #h [ P!':#{&P#   0*0*0*  S   #S\  PC=P#X01Í ÍX01Í Í#f\  PC[6&P#`!g K/DSRD/SUB/93RF105/2 ă `!hLimited Distribution  S * REVIEW AND ANALYSIS OF U.S. LAWS, REGULATIONS, AND CASE LAWS V 1PERTAINING TO THE USE OF COMMERCIAL ENCRYPTION ' 3PRODUCTS FOR VOICE AND DATA COMMUNICATIONS ;Professor James P. Chandler ?Diana C. Arrington F>Donna R. Berkelhammer AWilliam L. Gill BJanuary 1994 ,CPrepared by 0National Intellectual Property Law Institute and 8The George Washington University B:1350 Eye Street NW, Suite 820 x>Washington, DC 20005 ;Subcontract No. 19KRF105C #:DOE Project No. 2042E024A1 H BPrepared for 2x Data Systems Research and Development Program >Technical Operations ?Oak Ridge K25 Site 9Oak Ridge, Tennessee 378317620 *CManaged by e6Martin Marietta Energy Systems, Inc. Efor the <U.S. Department of Energy 9under contract DEAC0584OR21400'0*0*0* #f\  PC[6&P#  0*((PPԒ  ] D CONTENTS ă X` hp x (#%'0*,.8135@8: Constitutional and Statutory Dimensions, 26 Wm & Mary L. Rev. 805, 806 (1985); see U.S. CONST. Preamble. The Supreme Court in Haig v. Agee recognized that national security is the most important interest that could be threatened by  S4 uncontrolled dissemination of speech.b,4Y oJ ԍ453 U.S. 280, 306!08 (1981); see Funk, supra, at 439.b Nevertheless, in New York Times Co. v. United States, Justice Harlan in dissent stated that constitutional considerations forbid a complete abandonment of judicial control of the President's authority to determine issues that threaten national  S security.-VY oJ ԍ403 U.S. 713, 757 (1971) (Harlan J. dissenting) [quoting U.S. v. Reynolds, 345 U.S. 1, 8 (1953)]. Assuming scientific information is protected speech, it would still be necessary to determine the nature of that speech whose dissemination could pose either a compelling or substantial threat  S to national security.>.Y oJ ԍFunk, supra, at 439.> In the case of fully protected speech, a compelling threat to national  S security is a danger that poses an immediate,J/Y oJ ԍNew York, 403 U.S. at 726!27.J certain,.0 Y oJO ԍId. . and exceptional=1: Y oJ! ԍNear, 283 U.S. 716.= threat. For instance, fully protected scientific information is subject to regulation if it conveys a message that would allow a potential or actual enemy to develop a significant weapon or countermeasure to a U.S.  S~ weapon within a period too short for the United States to take corrective measures.D2~ Y mJI$ ԍ30 UCLA Law Rev. at 440, n.239. D For example, an immediate threat would entail a short time frame from receipt of an article by a foreign power to its actual application, as measured on an appropriate time scale of technological  S development.-3 Y oJ' ԍId.- A certain threat is created if the information poses a threat with direct militaryc 30*((PP  S application or related production applicability.-4Y oJh ԍId.- Scientific information poses an exceptional threat when it would give the enemy an identifiable military advantage over the United States in  S military terms.-5IY oJ ԍId.- In determining whether scientific information poses a substantial threat, the above three criteria  S8 are applicable.;68Y oJ ԍId. at 440!41.; If the possible time of application is remote as measured on an appropriate time scale of technological development, the threat to national security is too speculative to justify  S controls.57Y oJ{ ԍId. at 441.5 Accordingly, if the information has uncertain military or related application, again the  S threat may be too speculative.-8tY oJ ԍId.- If the United States is not the exclusive source, attempts to  S control the information would seem to serve no rational purpose.-9-Y oJ ԍId.- In national security cases, many courts and commentators have often suggested that there is an  S exception to the prior restraint doctrine.l: Y oJ ԍShinn, supra, at 384; see U.S. v. Donas-Botto, 363 F.Supp. 191, 1194 (E.D. Mich. 1973). This case involved the export of blueprints and technical data concerning an armored vehicle. The district court disposed of the First Amendment: when matters of foreign policy are involved the government has the constitutional authority to prohibit  oJ individuals from divulging technical data related to implements of war to foreign governments; U.S. v. Van Hee, 531 F.2d 352 (6th Cir. 1976) (First Amendment was not raised on appeal); Department of Justice, Constitutionality Under the First Amendment of ITAR Restrictions on Public Cryptography 4 n.7, reprinted in the Government Classification of Private Ideas: Hearings Before a Subcomm. of the House Comm. on Government Operations, 96th Cong., 2d Sess. 268 (1980).l These cases suggest that if there is such an exception, it allows the government only to seek an injunction in appropriate situations, not the use of an  S administrative licensing procedure.C; Y mJJ ԍ58 Geo Wash. Law Rev. at n.108.C  S The judicial recognition of the national security exception stems from Near,8< Y Y mJ ԍ283 U.S. 697 (1931).8 in which the Court stated that although the defendant's conduct would not justify an injunction, there might be circumstances involving national security that would provide justification for one. The Court in  S  Near applied a clear and present danger test,5=  Y oJ ԍId. at 716.5 which has evolved into a more speech-protective  S test articulated in Brandenburg v. Ohio.E> Y mJ ԍ395 U.S. 444 (1969) (per curiam).E The national security exception was implicitly affirmed  S when the government sought to enjoin the Pentagon Papers in New York Times, Inc. v. United  S States, when the district court denied the government's motion for an injunction. However, the Second Circuit Court issued a stay and remanded, relying on the exception. The Supreme Court finally reversed and held that the government did not carry its burden. In concurrence, Justice Stewart argued that an injunction would be improper because the publication would not surely  S result in direct, immediate, and irreparable damage to our nation or its people.J?Y oJR% ԍNew York Times, 403 U.S. at 730.J 9?0*((PPԌThese decisions might suggest that the government could not carry its burden unless the  S information involved was classified and would have a difficult case to make even if classified.?@Y oJ@ ԍShinn, supra, at 385.?  S The Pentagon Papers were classified, and the examples suggested in Near" the sailing dates of  S transports or the location of troops"might also be expected to be classified.AIY oJ ԍNear, 283 U.S. at 716; United States v. The Progressive, 467 F.Supp. 990 (dismissed 610 F.2d 819, 7th Cir. 1979). The district court allowed the government a preliminary injunction against publication of information that described how to construct a hydrogen bomb. Even though the defendant obtained information from the public domain, there was evidence to support that classification was appropriate. These cases reveal that there is a narrow national security exception to the prior restraint doctrine but that it is limited to cases involving classified information. Even then the government has the burden to show in seeking an injunction that release of the information would cause immediate and serious  S damage to the national interest.?B'Y oJ ԍShinn, supra, at 387.?  S  1.1.1.3 General issues addressed  SJ  First general issue. In the first general issue"Is encrypted speech protected speech under the First Amendment?"the Supreme Court has not decided whether the use of cryptography,  S encrypted speech specifically or scientific speech is protected under the First Amendment.C' Y mJ ԍGenerally, scholarly authorities who have written on this topic consider scientific speech or information to include both scientific principles ( basic science) and their technological applications ( applied science). Funk,  oJ  supra, at 406. See, generally, Shinn, supra, at 368; Ferguson, supra, at 639. The  S Court in Virginia Pharmacy considered three major interests that lie at the heart of the freedom of speech guarantee. In an analysis of these interests, the Supreme Court could very likely afford  S these forms of speech full protection under the First Amendment.Dp Y oJc ԍShinn, supra, at 368; Funk, supra, at 436.; Ferguson, supra, at 649. See above State of Law discussion, supra, at 2. However, encrypted speech and the use of cryptography are not essential to public debate on major issues of the day. Indeed, it could be argued that the use of encrypted speech inhibits full and free debate. Several commentaries have explored First Amendment protection in the preservation of the  S  electronic forum, which impacts the use of cryptographic technology.8E)w Y oJ  ԍTaviss, Dueling Forums: The Public Forum Doctrine's Failure to Protect the Electronic Forum, 60 U. Cin. L.  oJ Rev. 757 (1992); Katsh, The First Amendment and Technological Change: The New Media Have a Message, 57 Geo. Wash. L. Rev. 1459, 1483 (1989). 8 The electronic forum encompasses the electronic media (i.e., radio, television, cable satellite, bulletin boards, voicemail, facsimile), and information systems (computer or electronic hardware, software, human users,  SD data).FFD Y oJ ԍTaviss, supra, at 758!62.F The direction of recent First Amendment jurisprudence has displayed that the nature of  S the forum in which expression occurs tends to define the scope of protection for that forum.GpY Y oJM" ԍId. at 762; Katsh, supra, at 1483; Red Lion Broadcasting Co. v. FCC, 395 U.S. 367, 386 (1969) ( differences in the characteristics of new media justify differences in the First Amendment standards applied to them). Therefore, the nature of the electronic forum will become the main issue of an inquiry into the First Amendment rights for electronic or computer-based expression. As forms of communication proliferate, and as problems that are unique to a particular technology or format are discovered,  S| further fragmentation of the First Amendment doctrine will occur.@H| Y oJ' ԍKatsh, supra, at 1483.@ While a few general|H0*((PP principles may still apply to all media, differences in treatment among media can be expected to  S grow.-IY oJ@ ԍId.- Increasingly more apparent are the difficulties in enforcing restrictions on communication in an  S` electronic forum.6J`IY oJ ԍId. at 1484.6 It is anticipated that cases will take into account the effective limits of the law, and decisions will implicitly reflect assumptions about media capabilities for accessing,  S processing, or sending information.-KY oJ ԍId.- The production of information, processing of information, and transmission or publication of information are the most vulnerable areas in the communication  S environment.VLY oJS ԍFor a full discussion see Id. at 1485!92.V An area significant to cryptographic technology is the transmission of information. One of the most obvious victim[s] of the qualities of the new media will be the prior restraint doctrine, which is a means of government control that is doomed to a condition of almost complete  S nonviability.6M tY oJD ԍId. at 1490.6 The two forms of prior restraints, licensing schemes and injunctions, are even more vulnerable as copying and distribution capabilities are enhanced between parties inside and  S outside the U.S. borders.-N -Y oJ ԍId.- As the flow of information accelerates, it is appropriate to be mindful of a comment by a former director of the U.S. Information Agency, who stated that the only way  SX to censor an electronic network moving 648 million bits per second is to pull the plug.6OXY oJ ԍId. at 1491.6 While the prior restraint doctrine may be a potential casualty, the ability of punishment after the fact will also suffer. A concern definitely arises in international communications where punishment of  S sources located outside the U.S. borders is generally not possible.-PY oJW ԍId.-  S  Second general issue. In the second general issue"Does requiring encryption key disclosure to the government in a particular technology violate the user's right to freedom of speech under the First Amendment?"requiring disclosure of a cryptographic key, while using a government algorithm, regulates only the noncommunicative impact form of speech. Regulation of the noncommunicative impact of protected speech is allowed as long as it does not unreasonably interfere with the speaker's communication of his or her message to the targeted audience or as  S long as it leaves other alternative means for communication.VQXY oJ ԍFunk, supra, at 438; see Consolidated Edison Co. v. Public Serv. Comm'n, 447 U.S. 530, 535 (1980) ( time, place, or manner regulations intended to control noncommunicative effects of speech are permitted if they serve a significant governmental interest and leave ample alternative channels for communication. The essence of time, place, or manner regulations lie in the recognition that various methods of speech, regardless of their content, may  oJ" frustrate legitimate governmental interests. Id. at 536).V The regulatory schemes must precisely serve the asserted governmental interest and must be the least restrictive of all means  SP available to the government.>RP Y oJ% ԍFunk, supra, at 438.> Thus, in a key escrow system, as long as the asserted governmental interest is served, the requirement of the disclosure of the cryptographic keys might be permissible. A growing R0*((PP governmental interest within the law enforcement community is the future widespread use of commercial cryptographic technology in criminal activity and the subsequent negative implications that creates in the electronic surveillance area. Also, the government must establish that the key escrow system is the least restrictive means to protect its asserted interest. Therefore, other  S` schemes that could possibly protect the asserted governmental interest must be explored.SJ`Y mJ ԍAnother method suggested has been fair public-key cryptography. This method differs from a key escrow system in that users voluntarily choose to register their keys, whereas in the Clipper Chip proposal the keys are registered as a component of the manufacturing process. Also the keys are associated with users; by comparison, the Clipper Chip proposal would associate the keys with the chip identification number. See Meeting of the Computer System Security and Advisory Board, June 2!4, 1993, at the National Institute of Standards and Technology, Briefing by Silvio Micali, Massachusetts Institute of Technology. However, given the recently available information on the procedures governing key escrow technology, concerns arise on whether the government is requiring disclosure of an encrypted key prior to sufficient probable cause. On each cryptographic device, the government key escrow agents will possess a unique identification number and chip key particular to that chip. Once proper authorization has been secured by law enforcement and the type of key escrow encryption technology has been identified, this chip key can be secured by law enforcement to decrypt the contents of a communication. Therefore, a question arises regarding whether individuals are surrendering their encryption keys prior to the determination of probable cause. The system currently being proposed is analogous to a system of registration by the government so that it can maintain an ability to access the contents of stored electronic communications or perform  S electronic surveillance..T Y oJ2 ԍId. .  S0  Third general issue. In the third general issue"Does government prohibition against use of certain cryptographic technologies infringe individual's right to freedom of speech under the First Amendment?"a government prohibition against the use of certain cryptographic devices would only infringe on an individual's right to freedom of speech if the Supreme Court determines  S encrypted speech to be a protected form of speech.bUY mJ ԍSee Sect. 1.1.1.3, first general issue, for a full discussion.b Currently, the Court has made no determination on this issue. See the first general issue (above) for a full discussion.  S  Fourth general issue. In the fourth general issue"Does governmental control of certain cryptographic technologies through export/import laws infringe individual's right to freedom of speech under the First Amendment?"Congress is granted the authority to control exports of articles for national security purposes. The Constitution gives Congress the power to regulate  Sx foreign commerce and to do what is necessary to provide for a common defense.IVxJY mJ ԍU.S. CONST. Preamble, art. I,  8.I This authority  SP is expressed principally in three statutes: the Export Administration Act (EAA),DWPY mJ)" ԍ50 U.S.C.  2401!2420.D the Arms  S( Export Control Act (AECA),DX(Y mJ# ԍ22 U.S.C.  2751!2796.D and the Invention Secrecy Act (ISA).IY(o Y mJo$ ԍ35 U.S.C.  181!188 (1982).I Several law review articles have asserted that the EAA, the AECA, and the ISA restrict scientific  S and technical speech that merits constitutional protection.^Z& Y oJ' ԍShinn, supra, at 377; see Funk, supra, at 434.^ These authorities cite (1)prior Z0*((PP restraint without judicial review, (2) overbreadth and vagueness, and (3) regulations not narrowly  S tailored to a compelling state interest of national security.[Y oJ@ ԍShinn, supra, at 384!94; see Funk, supra, at 434. The Justice expressed doubt in 1978 that the AECA provides sufficient statutory authority for the broad controls that the ITAR regulates over unclassified scientific research. The Government's Classification of Private Ideas: Hearings Before a Subcomm. of the House Comm. on Gov't Operations, 96th Cong., 2d Sess. 268 (1980).  Each of these is discussed below. The first assertion, prior restraint through a licensing scheme, can be viewed as a lack of due process. Due process protects the liberty interests of the Fifth and Fourteenth Amendments, which  S8 include the First Amendment rights.R\8nY oJ~ ԍPaul v. Davis, 424 U.S. 693, 710 (1976).R Since the landmark case of Goldberg v. Kelly, the Supreme Court has required some form of due process in cases in which the government has sought to  S deprive individuals of liberty or property interests.8]'Y mJ ԍ397 U.S. 254 (1970).8 The Goldberg court required New York City to provide nearly full judicial process prior to terminating welfare benefits. Other cases have  S firmly established this principle.?^Y oJR ԍShinn, supra, at 389.? The second assertion, the overbreadth doctrine, applies when fully protected speech is the object of regulation. This doctrine allows a defendant being prosecuted under a statute affecting fully protected speech to argue against it on the grounds that it restricts or chills the speech of others  S not before the court.D_ Y oJC ԍFunk, supra, at 441 n.249.D The statute must have a real and substantial impact on speech,-` PY oJ ԍId.- and it  S must be as narrowly drawn as possible.va' Y oJ ԍFunk, supra, at 441; Consolidated Edison Co. v. Public Ser. Comm'n, 447 U.S. 530, 540 (1980) (declaring that when a government restricts the speech of a private person, the state action may be sustained only if government can show that the regulation is a precisely drawn means of serving a compelling state interest).v Whether the export control acts would survive an overbreadth attack would presumably depend on whether the courts would regard the controlled  S\ speech as incidental to conduct.?b\0 Y oJd ԍShinn, supra, at 391.? In Edler, the AECA and International Traffic in Arms Regulations (ITAR) survived an overbreadth challenge because the court read the definition of technical data as restricted data related directly to specific articles that are subject to control and  S incidental to regulated conduct, thus unprotected by First Amendment.Ac Y oJ ԍEdler, 579 F.2d at 520.A As written, the ITAR  S is subject to an overbreadth attack; however, the judicial reaction is uncertain.?d Y oJ8 ԍShinn, supra, at 391.? The EAA seems more vulnerable to overbreadth attack due to the fact the definition of technical data is  Sn much broader.@en[ Y mJ ԍ15 C.F.R.  379.1 (1988).@ Although the Munitions List that defines the scope of the ITAR is relatively  SF specific, thus facilitating the holding in Edler, the Commodity Control List is extensive and  S  contains a number of general catchall entries.Ff  Y oJ # ԍShinn, supra, at n.61!63.F ISA offers the most difficult case of the three statutes. The authority to extend a secrecy order extends to any invention, in the judgment of the head of the interested government agency, that  S could be detrimental to national security.7g Y mJ#' ԍ35 U.S.C.  181.7 Neither the Act nor the regulations suggest anyg0*((PP standard of review or guidelines by which such a judgment could be made. The lack of judicial review has the potential to restrain protected speech. Also, ISA has no regulated items or conduct to which controls on speech might be considered incidental. ISA purports to control information itself"pure speech, a circumstance where the overbreadth doctrine is most likely to be  S` applied.?h`Y oJ ԍShinn, supra, at 392.? However, if the Courts were to construe all information in a patent application commercial speech, the overbreadth doctrine would be inapplicable. Shinn considers this unlikely because the definition of commercial speech is that proposing a commercial transaction, and patent applications contain detailed technical descriptions of inventions, unrelated to proposing a  S commercial transaction.Li'IY oJ ԍId. at 392. It would be possible for someone to include information from a patent application in such a proposal; however, the central purpose of ISA is to control all disclosure and export of controlled data, not just the use of controlled data in commercial proposals. 35 U.S.C.  181.L The courts have consistently upheld that the export control laws are not unconstitutionally  SH vague.jH pY oJ ԍUnited States v. Gregg, 829 F.2d. 1430 (1987); United States v. Geissler, 731 F.Supp. 93 (E.D. NY 1990). The Supreme Court considers a criminal statute unconstitutionally vague if it does not provide to the defendant and the trier of fact reasonably clear guidelines in establishing whether  S a crime has been committed so as to prevent arbitrary and discriminating enforcement.Sk )Y oJ ԍSmith v. Gogen, 415 U.S. 566, 573 (1974).S Also,  S a vagueness challenge can be addressed only by the facts in the case before the court.cl Y oJ ԍUnited States v. Geissler, 731 F.Supp. 93 (E.D. NY 1990).c In the third assertion, according to Shinn the export control regulations do not fall within the  SX national security exception for three reasons.?mXY oJ ԍShinn, supra, at 387.? First, the exception has been recognized only when the government sought an injunction against publication of certain information, except in the special circumstance of a Central Intelligence Agency (CIA) employee, in order to protect classified information. Thus, except for the special case of the CIA, the security exception to prior restraint amounts only to allowing the government to seek an injunction. The concern with current export control laws is that the government is not required to proceed in this manner. The possible  Sh exporter of information must apply for a license that the government can deny at will.nphTY oJ ԍEdler upheld the licensing scheme, but only because the court interpreted the definition of technical data narrowly. The case law makes clear that before any restraint upon protected speech may become final it must be subjected to prompt judicial review in a proceeding in which the government will bear the burden of justifying its decisions. Second, the cases invoking national security exception have all involved or suggested a limitation to classified data. In contrast, the export laws aim primarily at unclassified data. Although the EARs do not distinguish between classified and unclassified information and the ITAR covers both classified and unclassified information, the Acts control only exports of information to foreign places, not release to American citizens. They are not necessary to control export of  S classified information, which is subject to much stricter regulation under executive order.]oY oJt% ԍShinn, supra, at 388; Exec. Order No. 12356 (1982).] The national security exception is limited to protecting classified information; it cannot support export} o0*((PP  S control laws concerned primarily with unclassified information..pY oJh ԍId. . The ISA extends further than the EAA or AECA, because an invention secrecy order requires that the invention be kept secret and forbids issuance of a patent. The inventor is not able to disclose the information to anyone in the United States or abroad. Therefore, the ISA imposes a kind of classification, although it  S` does not use the term.5q`IY oJ ԍId. at 392.5 Finally, the national security exception standard of direct, immediate, and irreparable damage to our nation could not conceivably be satisfied in the wide range of circumstances covered by these statutes, which regulate a full spectrum of ordinary commercial transactions. The national security statutes clearly were not developed to regulate the noncommunicative effects of exchanges between scientists. Congress desired to control the dissemination of certain kinds of information because it feared what potential or actual enemies of the United States might accomplish with that information. It was the effect of the message on the audience, and not the means or method of communication and its interference with the achievement of an unrelated  S governmental purpose, that Congress intended to regulate.>r Y oJ ԍFunk, supra, at 439.> A recurring theme in cases implicating the First Amendment is the requirement of a close relation between the law and a compelling state interest. Therefore, a regulation that impinges on First Amendment values in order to serve a compelling state interest, but which does not in fact serve that interest, is subject to constitutional challenge. Shinn suggested three reasons why the export laws, as applied to control the flow of scientific and technical information, do not satisfy compelling state interest of national security. The main paths of leakage to other countries is espionage directed toward classified material and diversion of physical items of technology in  S@ violation of the export laws.sL@Y oJ ԍShinn, supra, at 393; see National Academy of Sciences, Balancing the National Interest 71-75 (1987) (otherwise known as the Allen report). The Allen Report was chaired by General Lew Allen, former Chief of Staff of the Air Force and Director of the National Security Agency (NSA), and Bobby Iman, former Director of NSA and Deputy Director of the CIA. Despite a strong defense viewpoint, the Allen Report noted that controls should be implemented with great refrain because of the potential chilling effect on research and development. This conclusion was arrived at based on classified intelligence community briefings. A National Academy of Sciences study found that in contrast to leakage from these sources, open scientific communications did not present a significant danger,  S mainly because of the problems of translating scientific knowledge into actual military usage.tY mJ ԍWhether the export control acts would fail an overbreadth attack would presumably depend on whether the courts would regard the controlled speech as incidental to conduct. Scientific Communication and National Security 24-25 (1982). This first major study of the conflict between national security goals and open communication was prepared with support by the Defense Department. Thus, if the export laws have no effect on leakage through these two most important pathways, it is difficult to see how controlling an unimportant path can serve national security interests  Sx sufficiently to justify encroaching on First Amendment rights.?ux Y oJ3$ ԍShinn, supra, at 393.? Second, controls on scientific communications impede the progress and growth of technology, thus reducing U.S. military capabilities. The Corson Report, in examining the ways controls affect both military and economic security, stated that a policy seeking national security through scientific achievement is preferable to one based on secrecy. Third, a growing part of the world's scientific and technological u0*((PP capability is outside the United States, thus beyond control through export law. The Allen Report expressed this concern and determined that in many areas unilateral controls by the United States  S were ineffective because technology was available through other suppliers,KvY oJ ԍAllen Report, supra, at 54!69.K a situation very similar to the current state of encryption technology. It is hard to understand how the national interest is served by restraining communication in an attempt to control information already available elsewhere. Shinn notes that judgments about national security issues are better left to the legislatures than to the courts. Yet, when publication of information has been threatened, the courts have examined closely to see whether a sufficiently important national interest is served.  S  1.1.2 Privacy 1.1.2.1 General issues 1.hDDDoes a government prohibition against use of certain cryptographic technologies infringe individual's right to privacy under the First Amendment?!D 2.hDDIs a key escrow system that ensures government access to encrypted speech an invasion of the right of privacy under the First Amendment? !D  S ` 1.1.2.2 State of the law In a dissenting opinion, Justice Brandeis defined the constitutional right to privacy as the right  S to be let alone"the most comprehensive of rights and the right most valued by` men.swIY oJ ԍOlmstead v. United States, 277 U.S. 438 (1928) (Brandeis J., dissenting).s The Supreme Court has recognized freedom of association as a necessary concomitant to the specific guarantees of the First Amendment, since the exercise of freedom of speech, the press, assembly,  S and petition routinely requires group activity.xpY oJ ԍNote, The Interest in Limited Disclosure of Personal Information: A Constitutional Analysis, 36 Vand. L. Rev. 139, 151 (1983). [T]he Constitution does not provide an explicit  S right to privacy, and therefore its development has been slow and irregular.yrY oJ: ԍColes, Todd R., Does the Privacy Act of 1974 Protect Your Right to Privacy? An Examination of the Routine  oJ Use Exemption, 40 Am. U. L. Rev. 957, 960; see Paul v. Davis, 242 U.S. 693, 712 (1976) (stating that the right to  oJ privacy is not found in any specific constitutional guarantee); Roe v. Wade, 410 U.S. 113,112 (1973) (finding no explicit mention of right of privacy in constitution). In Griswold v.  S Connecticut, the Supreme Court declared that various guarantees in the Bill of Rights produce  S zones of privacy.hzTY mJ ԍ381 U.S. 479, 484 (1965) (recognizing right to privacy in marriage).h Specifically, the Court recognized the zone of privacy formed by the First Amendment right of free association, the Third Amendment prohibition of peace time quartering of soldiers in homes without consent, the Fourth Amendment protection of unreasonable search and seizure of private individuals by government, and Fifth Amendment protection against  S self-incrimination..{ Y oJ# ԍId. . The Constitution only protects private individuals from governmental  S intrusion; protection from private action is left to the states.`|Y oJx% ԍKatz v. United States, 389 U.S. 347, 351!53 (1967).` The language of the U.S.} |0*((PP Constitution has hindered judicial development of the right to privacy; however, state constitutions  S have specifically recognized the right to privacy.5}Y oJ@ ԍId. at 964.5  S In Whalen v. Roe, the Supreme Court distinguished between the privacy of autonomy"an interest in independence in making certain kinds of important decisions"and disclosural  S: privacy"an individual interest in avoiding disclosure of personal matters.~n:IY mJ[ ԍ429 U.S. 589, 599!600 (1977) (court upheld a state statute requiring disclosure of private medical information to state authorities). The right to privacy of autonomy has been recognized in decisions relating to marriage, procreation, contraception, family relationships, obscene material in the home, and child rearing and  S education.LY oJQ ԍColes, supra, at 961 n.23!n.27.L Although the Court has continued to develop a right to privacy of autonomy, it has  S rarely advanced the right to disclosural privacy.6pY oJ ԍId. at n.28.6 Traditionally associated with the First and Fourth Amendments, disclosural privacy concerns the  S" right of an individual to control the flow of personal information.r" )Y oJ# ԍNAACP v. Alabama, 357 U.S. 449, 460!63, 466 (1958) (discussing the role of the First and Fourth  oJ Amendments and their protection to right of privacy); Katz, 389 U.S. at 351!53 (1967). The Court has noted that freedom of association often depends on the concealment of one's associations, by the prevention  S of disclosure of information pertaining to a particular association.< Y mJE ԍ36 Vand. L. Rev. at 151.< The Supreme Court has  S seldom recognized the constitutional right of disclosural privacy,? RY oJ ԍColes, supra, at 962.? and it has yet to find the  S right violated=) Y oJe ԍId.; Whalen, 429 U.S. at 599 (finding no unconstitutional right of disclosural privacy violated); Nixon v.  oJ Administrator of General Services, 433 U.S. 425, 457!59 (1977) (concluding no unconstitutional invasion of right to disclosural privacy).= except in a Freedom of Information Act case which weighed the public interest  SZ in disclosure against individual interest in privacy.hZ4 Y oJf ԍDepartment of Justice v. Reporters Comm., 489 U.S. 749 (1989).h  S  In Whalen, the Supreme Court upheld a state statute requiring disclosure of private medical  S information to state authorities.: Y mJ ԍ429 U.S. at 603!04.: The Court emphasized the importance that the state restrictions placed on the disclosure of medical information, which made public exposure  S unlikely.; Y oJ ԍId. at 600!02.; Of importance was the Court's recognition of the threat to individual privacy posed by the government collection of personal information. Justice Stevens, writing for the majority opinion declared: hDDWe are not aware of the threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks or other massive government files. The collection of taxes, the distribution of welfare and social security benefits, the supervision of public health, the direction of Armed Forces and enforcement of criminal laws, all require the orderly preservation of great quantities of information, much of which is personal in character and potentially embarrassing or harmful if disclosed.... [N]evertheless New York's statutory scheme, and its implementing administrative] 0*((PP procedures, evidence a proper concern with, the protection of, individual's interest in  S privacy.;Y oJ@ ԍId. at 605!06.; Ɣ D  S While recognizing the potential threat to privacy, the Whalen Court refused to decide any question which might be presented by unwarranted disclosure of accumulated data, whether intentionally or by a system that did not contain comparable security standards. Justice Brennan, in his concurring opinion, analyzed the restrictions placed on dissemination of  S medical data by the statute and found sufficient safeguards against unwarranted disclosure.;IY oJ ԍId. at 606!07.; He cautioned that a constitutionally protected privacy right would be implicated if the restrictions  Sr were not in place and information was widely disseminated.-rY oJL ԍId.- In a situation where a protected privacy interest was threatened, the state must establish a compelling interest to justify  S" deprivation of the right to privacy.5" Y oJ ԍId. at 607.5  S Justice Brennan, writing for the majority in Nixon, considered disclosural privacy involving the  S Presidential Records and Materials Preservation Act.A tY oJ ԍNixon, 433 U.S. at 429.A Under this Act, the Administrator of the General Services Administration was directed to take custody of Nixon's presidential papers and supervise their examination to determine which documents the government would keep. Reviewing the Act's screening process, Justice Brennan emphasized that the Act was written to minimize invasion of privacy and concluded that no less restrictive means existed to accomplish the purpose of the Act, and that Nixon's legitimate expectation in privacy had not been  S violated.;-Y oJ ԍId. at 464!65.;  Sl While in Whalen and Nixon the Supreme Court failed to find that a constitutionally protected right to disclosural privacy had been violated, the Court has held that a similar statutorily protected  S privacy was violated under the Freedom of Information Act.rY oJ ԍDepartment of Justice v. Reporter's Committee, 489 U.S. 749, 762 (1989).r In Reporter's Committee, the Court found a protected privacy interest in the disclosure of personal information contained in a  S Federal Bureau of Investigation criminal rap sheet.-Y oJG ԍId.- Balancing the public interest in disclosure against the individual interest in privacy, the Court found the former at its nadir and the latter  S at its apex.5XY oJ ԍId. at 750.5 The Court concluded that disclosure of law enforcement records is an  SX unwarranted invasion of privacy.5XY oJA" ԍId. at 749.5 While the Court has neither consistently recognized a disclosural privacy nor clearly outlined requirements for raising a claim of disclosural privacy, the Court seems to have determined the0*((PP  S appropriate standard of review to be applied.DY oJh ԍColes, supra, at 962 n.34.D A heightened scrutiny test is applied, balancing  S individual interest in nondisclosure against government's interest in disclosure.rIY oJ ԍSee Seng, The Constitution and Informational Privacy, or How So-Called Conservatives Countenance  oJ Governmental Intrusion into a Person's Private Affairs, 18 J. Marshall L. Rev. 871, 875 (1985). With an explicit constitutional right to privacy in personal information held by the federal  S` government absent, congressional legislation provided the only remaining safeguard.-`Y oJ ԍId.- The  S8 Privacy Act of 1974@8tY mJ ԍ5 U.S.C.  552(a) (1988).@ was the first attempt by Congress to strike a balance between the government's interest and need to gather personal information and individuals' competing interest  S to keep control over personal information.?+Y oJ ԍColes, supra, at 964.? The Privacy Act requires every federal agency maintaining a record on an individual within a system of records to (1) allow the individual to control the use and dissemination of information contained in the record; (2)allow the individual to review, to correct, or to amend information contained in the record; (3)control and restrict the collection, use, maintenance, and dissemination of information in the record; and (4) be subject  S to civil suit for specified violations of the Privacy Act.7 Y mJ ԍ5 U.S.C.  552a.7 The first safeguard prohibits any federal agency from disclosing any information contained in a system of records without written consent of the individual to whom the record pertains. The scope of this prohibition on nonconsensual disclosure, however, is subject to numerous exemptions. General and specific exemptions allow the heads of federal agencies to promulgate rules that exempt their federal agency's system of records from provisions of the Privacy Act.  S Specific exemptions exist for law enforcement purposes in response to exigent circumstances.=Y mJS ԍ5 U.S.C.  552a(b)(8).= Law enforcement officials may have access to information in a showing of compelling circumstances affecting health or safety of an individual if upon such disclosure notification is  Sh transmitted to the last known address of such an individual.-hRY oJ ԍId.- The broadest of these exemptions, the routine use exemption, permits nonconsensual disclosure of personal information where the purpose for collection is compatible with its use by the federal agency. Law enforcement agencies, such as the CIA and the Department of Justice, have employed the routine use exemption to avoid the restrictive language of an applicable disclosure  Sx exemption.Dx Y oJ[! ԍColes, supra, at 980, 988.D Neither the federal agencies nor the Office of Management and Budget have actively overseen the exemption's use, and statutory and procedural barriers have precluded the  S( courts from averting abuse of the exemption through judicial review.?(Y oJ# ԍColes, supra, at 959.? Because the final version of this Act was a result of a lastminute compromise between competing House and Senate bills, the Act has become an internally inconsistent statute with no reliable indication of legislative intent. } 0*((PPԌ S 8 1.1.2.3 General issues addressed  S  First general issue. In the first general issue"Does a government prohibition against use of certain cryptographic technologies infringe individual's right to privacy under the First 8Amendment?"given the direction of the Supreme Court's view of First Amendment privacy, this concern would either be construed as a privacy interest in independence in making certain kinds of important decisions (i.e., privacy of autonomy) or an individual interest in controlling the  S flow of personal information (i.e., disclosural privacy).LY oJP ԍColes, supra, at 961 n.23!n.27.L The Court continues to actively develop the right to privacy of autonomy; however, the right has only been recognized in decisions relating to family matters such as marriage, procreation, contraception, family  Sp relationships, obscene material in the home, and child rearing and education.-pIY oJ ԍId.- A government's attempt to regulate cryptographic use does not naturally relate to decisions involving family matters, and the Court has never decided if scientific or technological matters would be viewed in such a manner. Thus, the prohibition or regulation of certain cryptographic technologies would probably not offend the Court's current view of an individual's right in privacy of autonomy. Although the Court has continued to develop a right to privacy of autonomy, it has rarely  SX advanced the right to disclosural privacy.DXY oJ2 ԍColes, supra, at 962 n.28.D In cases involving the disclosural privacy doctrine, the Court's interpretation is focused on the individual's interest in control of personal information. The prohibition of certain cryptographic technology could implicate this doctrine. However, all the cases implicating this doctrine involved instances where the local or federal government by statute had the right to disclose certain personal information. Therefore, it is not clear if the regulation of cryptography would offend a legitimate privacy right under the First Amendment.  S@  Second general issue. In the second general issue"Is a key escrow system that ensures government access to encrypted speech an invasion of the right of privacy under the First Amendment?"an encryption key escrow system where the government is the escrow agent might implicate the disclosural privacy doctrine, because it concerns the protection of an individual's interest to control the flow of personal information and the government's interest in gathering and controlling the use of personal information. The heightened scrutiny test would be applied to balance both private and government interests in disclosure of personal information. In light of  S( the rationales used in both Whalen and Nixon, the Supreme Court would weigh the individual concerns in (1) the potential harm of disclosure of information and (2) the individual's legitimate expectation of privacy in nondisclosure, versus the government's concern in (1) the need to collect, use, or maintain individual information; (2) the implementation of adequate administrative  S procedural safeguards; and (3) the practice of the least restrictive alternative.vY oJ" ԍSee discussion of Whalen, Nixon, and Reporter's Committee cases.v A legitimate individual interest in the potential threat of disclosure of private cryptographic keys could have serious detrimental effects on both domestic and national security. Nonclassified data accumulated from an increasing number of sources, including hostile governments or groups,  S! could adversely affect the national security of the United States.p!tY oJ' ԍFranks, The National Security Agency and Its Interference with Private Sector Computer Security, 72 Iowa L. Rev. 1015, 1017 (1987). Examples of this information!0*((PP are weather and crop reports, trading reports, electronic fund transfers, and various types of  S economic information.-Y oJ@ ԍId.- This gives the National Security Agency (NSA) reason to be concerned  S with the computer security standards used by civil government agencies and private entities.-IY oJ ԍId.- The cases interpreting this doctrine considered only a privacy interest in information intimately related to that particular individual, for example, an individual's criminal record, medical information, and personal papers. A question could arise in assessing a privacy interest of an individual if the desire to use any general nonclassified cryptographic technology can give an individual a legitimate expectation of privacy. The cryptographic process is a reversible process designed to make information unreadable to all but the intended recipient; thus, a certain level  Sp of privacy is expected by a user.tpY oJJ ԍTerry v. Ohio, 392 U.S. 1, 9 (1968); Katz, 389 U.S. 347, 360!61. t Yet, the legitimate expectation of privacy centers around the encrypted data, not on the type of cryptographic technology used. Therefore, a Court must resolve the scope of a legitimate expectation of privacy on encrypted communications, which would probably be influenced to a certain extent by the type of medium used to communicate. A governmental interest within the law enforcement community is the future widespread use of cryptographic technology in criminal activity and the enormous impediment that creates in the  SX electronic surveillance arena.nXY mJ ԍMeeting of the Computer System Security and Advisory Board, July 29!30, 1993, at the National Institute of Standards and Technology, Briefing by Law Enforcement Community on Cryptography. Also, the Court would scrutinize the administrative procedures to determine if there was proper protection of the encryption keys. Given the recent public disclosure regarding the set-up of the key escrow system, it would seem that the government has developed adequate procedural safeguards to ensure the protection of keys from improper  S disclosure.%)Y mJ ԍMeeting of the Computer System Security and Advisory Board, July 29!30, 1993, at the National Institute of Standards and Technology, Briefing by Geoffrey Greiveldinger, Special Counsel, Narcotic and Dangerous Drug Section, Department of Justice. The Court might note the fact that two key components are split between two escrow agents and are not personally identifiable to the key escrow agents. The key components are received by an authorized law enforcement official in encrypted form sent directly to a blackbox in order to maintain confidentiality of the key components that make up the decryption key. The government is not collecting evidently personal information. The escrowed key components are not related to particular individuals. The chip keys are not formed and related to individuals until they are used, and they are discarded after use. Because the government is not developing a database of personal information, the requirement of privacy may not apply. However, the proposed government key escrow system could be construed as the collection, use, and maintenance of personal information, whereby the prescribed key escrow agents (i.e., presumably a federal agency) could be subject to the requirements of the Privacy Act. Even though the government would only directly control the encryption keys and not the information itself, the maintenance and use of the keys are intimately related to the access of private encrypted information. The Privacy Act's main goal was to protect an individual interest in controlling the8N0*((PP  S use of personal information after its release to the government.>Y oJh ԍNote, supra, at 143.> One of these requirements prohibits any federal agency from disclosing any information contained in a system of records, without written consent of the individual to whom the record pertains. Yet, the scope of this prohibition on nonconsensual disclosure is subject to numerous exemptions. Specific exemptions exist for law enforcement purposes in response to exigent circumstances, although keys may only be released through Title III and the Federal Information Security Agency. However, the routine use exemption as used by the CIA must be scrutinized closely by the Court for its potentially  S perilous impact on the key escrow system.=IY mJ ԍ5 U.S.C.  552a(b)(8).=  Sp  1.2 SECOND AMENDMENT"RIGHT TO BEAR ARMS  S  1.2.1 General Issues 1.hDDShould cryptographic technology be categorized as a weapon, such as a gun, and thus regulated by the right to bear arms under the second amendment?!D  SX  1.2.2 State of the Law The Second Amendment states that a well regulated Militia, being necessary to the security of  S a free State, the right of the people to keep and bear Arms, shall not be infringed.;Y mJ ԍ U.S. CONST. amend. II.; It is an  S area of constitutional jurisprudence that still awaits its philosopher.rY oJG ԍCottrol, Robert J., Raymond J. Diamond, The Second Amendment: Toward an AfroAmericanist  oJ Reconsideration, 80 Geo. L. J. 309, 310 (1991). The Supreme Court has  S directly ruled on the Second Amendment in only four cases.r)Y oJ ԍMiller v. Texas, 153 U.S. 5353 (1984); U.S. v. Miller, 307 U.S. 174 (1939); Presser v. Illinois, 116 U.S. 252  oJJ (1886); U.S. Cruishank, 92 U.S. 542 (1876). The first three cases have  Sh recognized the individual right and a bar to federal infringement of the right. The Court in Miller limited the Amendment protection to weapons useful for militia duty. Since then, lower federal courts have heard Second Amendment claims, often dismissing them on grounds that the Amendment has not been incorporated into the Fourteenth Amendment, which would make it binding on the states. Most of these cases pertained to persons involved in criminal activity who were also convicted of firearms charges; thus these cases were not really a good test of the extent  Sz to which the Second Amendment protects the rights of the public at large.EzY oJ ԍCottrol, supra, at 312 n.3.E One legal scholar has recently examined the Second Amendment within the context of the Bill of Rights and concluded the purpose of the Amendment as preventing Congress from disarming  S freedmen, so that the public could resist tyranny by a standing army.9TY oJ$ ԍId. at 312 n.5.9 However, some scholars believe the purpose of the Second Amendment was to maintain the militia, not to provide an  S individual right to bear arms.5 Y oJo& ԍId. at 313.5 Opponents of stricter gun controls tended to stress the0*((PP Amendment's clause arguing that the framers intended a militia of the whole, who was expected  S to perform its duties with privately owned weapons.-Y oJ@ ԍId.-  S 8 1.2.3 General Issues Addressed  Currently, courts have not addressed the regulation of cryptography in the context of a right to bear arms under the Second Amendment. However, cryptographic technology is listed as a 8munition on the U.S. Munitions List promulgated by the AECA. Nevertheless, cryptography would  S have to fall into the limitation imposed by Miller, thereby construing cryptography as a weapon  S useful for militia duty.4IY mJ ԍ307 U.S. at 180.4  S"  1.3 FOURTH AMENDMENT 1.3.1 Search and Seizure of Stored Communications and Data 1.3.1.1 General issues  S2  1.hDDMay the government seize encrypted electronic/computer stored documents or papers without prior notification to owner?!D 2.hDDDoes requiring disclosure of the encryption key to the government in advance of there being probable cause sufficient to allow the government to seize an encrypted stored communication and to search and seize the key to such communication violate the Fourth Amendment? !D  S  1.3.1.2 State of the law  S  The Fourth Amendment states that the right of people to be secure in their persons, houses,  Sz papers, and effects, against unreasonable searches and seizures, shall not be violated....:zY mJR ԍU.S. CONST. amend. IV.: This right protects individuals against arbitrary invasions of their privacy by law enforcement officials, thus preserving a balance between the needs of law enforcement and those of  S individuals.Y oJ ԍRetz C., Warrant Requirement for Searches of Computerized Information, 67 B.U. L. Rev. 179, 180 (1987). The Amendment restricts searches and seizures that infringe upon an individual's  S reasonable expectation of privacy;MpY oJ"! ԍTerry v. Ohio, 392 U.S. 1, 9 (168).M with a few exceptions, a search warrant must be obtained  S prior to a search.Q')Y oJ" ԍStanley v. Georgia, 394 U.S. 557 (1969). The Fourth Amendment explicitly provides that no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. U.S. CONST. amend. IV.Q Law enforcement officials are not required to obtain warrants for every search. The police do not need warrants to conduct certain searches of automobiles, searches  Sb incident to a lawful arrest, searches in emergency, or situations involving hot pursuit.DbPY oJ& ԍRetz, supra, at 184!85.D : 0*((PPԌThe courts used to construe the Fourth Amendment to protect only tangible property against  S physical searches and seizures.YY oJ@ ԍOlmstead v. United States, 277 U.S. 438 (1928).Y In 1967, the Supreme Court in Katz v. United States=IY mJ ԍ389 U.S. 347, 352 (1967).=  S explicitly rejected the Olmstead view, stating the Fourth Amendment protects people not simply places against unreasonable search and seizure. What a person knowingly exposes to the public,  Sd even in his own home or office, is not subject to Fourth Amendment protection..dY oJ< ԍId. . The Supreme Court has subsequently held that a search occurs when an expectation of privacy that  S society is prepared to consider reasonable is infringed.Y oJ ԍUnited States v. Karo, 486 U.S. 705, 712 (1984); Katz, 389 U.S. at 361. (First time the Court outlined a twofold test to determine what protections are afforded to people under the Fourth Amendment. The first prong required that the individual exhibit an actual expectation of privacy, and the second prong required that the expectation be one that society is prepared to recognize.) Whether a person has standing to contest a search on Fourth Amendment grounds depends on whether the person had a legitimate  S expectation of privacy in the area searched, not merely in the items seized.]Y oJ3 ԍUnited States v. Skowronski, 827 F.2d. 1414 (1987).] The Electronic Communications Privacy Act (ECPA) amended Title III of the Omnibus Crime Control and Safe Street Act. The ECPA extends the reach of Title III to electronically stored information. The Act makes unlawful access to stored communications, when a person intentionally accesses without authorization a facility through which an electronic communication service is provided or intentionally exceeds an authorization to access that facility and thus obtains, alters, or prevents authorized access to a wire or electronic communication while it is in  S storage in such system.D PY mJ ԍ18 U.S.C.  2701(1), (2).D Exceptions to this prohibition are made for entities providing wire or electronic communications service, an intended user, or an authorized government law  S4 enforcement officer.V4Y oJ ԍId. at  2701(c)(1), (2), 2702(b)(6).V Section 2703 outlines the requirements for governmental access. The government may require the disclosure by a provider of electronic communication service of the contents of a communication  S in electronic storage, pursuant to a warrant.>Y oJ, ԍId. at  2703(a).> The government may require a provider of remote computing services to disclose contents of an electronic communications, pursuant to a  SD warrant, without prior notice to the subscriber or customer.>Dy Y oJ ԍId. at  2703(b).>  S ` 1.3.1.3 General issues addressed  S  First general issue. The first general issue"May the government seize encrypted electronic/computer stored documents or papers without prior notification to owner?`"is addressed by the ECPA on two levels, depending on the forum in which the electronic communication is being stored. Section 2703(a) specifically states that an authorized government agency may require the disclosure by a provider of electronic communication of the contents of electronic  S communication in electronic storage, pursuant to a warrant.>2 Y oJ& ԍId. at  2703(a).> The contents of electronic communications that are held or maintained on that service in a remote computing service! 0*((PP environment can be disclosed to an authorized government entity without required notice to the  S  subscriber or customer of this type of service, with a proper warrant.`Y oJ@ ԍId. at  2703(b)(1)(A), (B), (b)(2), (b)(2)(A).` The ability to seize does not depend on the form of the contents of electronic communication at time of seizure; thus encrypted speech is governed by this statute.  S8  Second general issue. When the second general issue"Does requiring disclosure of the encryption key to the government in advance of there being probable cause sufficient to allow the government to seize an encrypted communication and to search and seize the key to such communication violate the fourth amendment?"is considered, given the current available information on the procedures governing key escrow technology, a question arises: Is the government requiring disclosure of an encrypted key prior to sufficient probable cause? For each cryptographic device, the government has two key escrow agents. Each agent will possess a unique encrypted component of the chip key along with the identification number particular to that chip. Thus, an individual agent does not have the capability to combine the components necessary to form a chip key. Once proper authorization has been secured by law enforcement and key escrow encryption technology has been identified, this chip key can be secured by law enforcement to be used to decrypt the contents of a communication. Therefore, a question arises regarding whether individuals are surrendering their encryption keys prior to the determination of probable cause. The system currently being proposed is analogous to a system of registration by the government so that it can maintain an ability to access the contents of stored electronic  S communications..IY oJ ԍId. .  S  1.3.2 Search and Seizure of Voice and Data Transmission 1.3.2.1 General issues  S  1.hDDIn a situation were one or both users of the proposed key escrow system are located outside U.S. borders, does a warrant requirement exist for the U.S. Government to seize voice or data communication between the users?!D 2.hDDDoes requiring disclosure of the encryption key to the government in advance of there being probable cause sufficient to allow the government to seize an encrypted transmitted communication and to search and seize the key to such communication violate the Fourth Amendment? !D  S : 1.3.2.2 State of the law  S8  In Berger v. New York, the Supreme Court discussed the guidelines for authorization of interception of communications. To obtain authorization, the law enforcement official must :particularly describe the place to be searched and the persons or things to be seized, and the official must show probable cause sufficient to warrant a person of reasonable caution to believe  S" that an offense has been or is being committed.4"Y mJt& ԍ388 U.S. 41, 57.4 The order must describe the type of conversation sought with particularity, by indicating the specific objective of the government inr#"0*((PP entering the constitutionally protected area and the limitations placed upon the officer executing  S the warrant.-Y oJ@ ԍId.- The limitations placed on the officer provide that the officer does not search  S unauthorized areas and that the officer only seizes the property sought.-IY oJ ԍId.- The order must also limit the intrusion, and a new order may be issued if probable cause is shown for a succeeding  S` period of intrusion.-`Y oJ: ԍId.- The officer must make a report of how the order was executed and what  S8 was seized.-8Y oJ ԍId.- The Court believed through these precautions that the danger of an unlawful search and seizure was minimized, thus allowing the search to be within the limits of the Fourth  S Amendment.-tY oJ4 ԍId.-  S  Title III of the Omnibus Crime Control and Safe Street Act. In formulating Title III of the  Sp Omnibus Crime Control and Safe Street Act [hereinafter referred to as Title III],?p-Y mJu ԍ18 U.S.C.  2510 et seq.? Congress attempted to balance two important interests: the legitimate needs of the law enforcement and the  S privacy concerns of the public.) Y oJ ԍBalmforth, Kathyrn and Michael Goldsmith, The Electronic Surveillance of Privileged Communications: A  oJ Conflict in Doctrine, 64 S. Cal. L. Rev. 903, 904; see Carr, J.G., The Law of Electronic Surveillance 1-8 to 2-13 (1989), for a discussion of the history of electronic surveillance in the judicial system and development of Title III. Thus, Congress outlined a comprehensive scheme for regulating the interception of wire or oral communications. Title III prohibits the use of any electronic, mechanical, or other device for the interception of  S communications,A Y oJe ԍId. at  2511(1)(b).A and such devices can be seized or confiscated by the United States.; Y oJ ԍId. at  2513.; This prohibition applies to all private eavesdropping and governmental eavesdropping without a court order. It prescribes a punishment of a maximum fine of $10,000, imprisonment for 5 years, or both for any person who willfully intercepts a wire or oral communication, discloses the contents  S of an intercepted communication, or uses such contents.; Y mJ7 ԍ18 U.S.C.  2511(1).; Furthermore, any attempt to commit,  S or solicit another to commit, any of the above acts is a separate offense.-6 Y oJ ԍId.- Section 2511(2) provides certain exceptions to the broad prohibitions of  2511(1), permitting interception where the speaker has given prior consent, or by employees of the Federal Communications Commission (FCC), a common carrier in the ordinary course of monitoring duties, or a person acting under the color of the law to intercept a wire or oral  S communication.@ Y oJ" ԍId. at 2511(2)(d).@ To perform eavesdropping, the principal federal or state prosecutor must apply to a judge of  SP competent jurisdiction for an eavesdrop order.;P Y oJ% ԍId. at  2516.; The judge must find probable cause as to the commission of a crime, the likelihood of intercepting relevant communications, and the failure of(#a 0*((PP  S ordinary investigation.>Y oJh ԍId. at  2518(3).> All orders must be limited in time.>IY oJ! ԍId. at  2518(5).> However, a temporary delay in obtaining the eavesdrop order may be allowed in an exigent situation threatening the national security interest or characteristic of organized crime, as long as application is made within 48  S hours.>Y oJb ԍId. at  2518(7).> Title III imposes an exclusionary rule on all eavesdrop evidence seized without a court order. The rule requires that [w]henever any wire or oral communication has been intercepted, no part of the contents of such communication and no evidence derived therefrom may be received in evidence in any trial, hearing, or other proceeding in or before any court, grand jury, department, office, agency, regulatory body, legislative committee, or other authority of the United States ...  Sp if the disclosure of that information would be in violation of this chapter.;pY oJ ԍId. at  2515.; The following are pertinent definitions as used in Title III.  S hDD Wire communication "any communication made in whole or part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and point of recognition furnished or operated by any person engaged as a common carrier in providing or operating such facilities for the  S0 transmission of interstate or foreign communications.>0tY oJ| ԍId. at  2510(1).> !D  S hDD Oral communication " any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances  S justifying such expectation.>-Y oJ ԍId. at  2510(2).>!D  S@ hDD Intercept "the aural acquisition of the contents of any wire or oral communication through  S the use of any electronic, mechanical, or other device.>Y oJ ԍId. at 2510(4).>!D  S hDD Contents "with respect to wire or oral communication, consists of any information concerning the identity of the parties to such communication or the existence, substance,  Sx purport, or meaning of that communication.>xY oJ ԍId. at  2510(8).>!D  S( hDD Investigative or law enforcement officer "any officer of the United States or of a state or political subdivision thereof, who is empowered by law to conduct investigations of or to make arrests for offenses enumerated in this chapter, and any attorney authorized by law to  S prosecute or participate in the prosecution of such offenses.>XY oJ$ ԍId. at  2510(7).>!D The legislative history of Title III stated that the major purpose of Title III is to combat organized crime and cited the hardship in obtaining proof as the primary reason for the lack of8$0*((PP  S success in prosecution of this type of criminal activity.nY mJh ԍSee Title III Senate Report No. 1097, 90th Cong., 2d Sess., reprinted in 1968 U.S. Code Cong. & Admin. News 2112, 2154!57. Six years after the passage of TitleII,  S the National Wiretap Commission evaluated the effectiveness of the statute.nY mJ ԍNational Wiretap Commission, Electronic Surveillance: Report of the National Commission for the Review of Federal and State Laws Relating to Wiretapping and Electronic Surveillance 33-40 (1976). The majority of the Commission strongly reaffirmed the finding of Congress during the enactment of Title III in 1968 that electronic surveillance is an indispensable aid to law enforcement in finding evidence  S` of crimes perpetuated by organized criminals.Z`lY oJ ԍId. at xiii; see Balmforth, supra, at 907.Z In 1986 the President's Commission on Organized Crime reinforced the opinion that electronic surveillance is critical to the successful  S investigation and prosecution of organized crime.C%Y oJ ԍBalmforth, supra, at 907.C  S Foreign Intelligence Surveillance Act. In Katz, the Court expressly preserved national security surveillance from the reach of its decision that a warrant would be required for electronic  Sr surveillance.9rY mJ( ԍ389 U.S. at 358 n.23.9 Justice White noted the unique requirements of electronic surveillance for national security purposes, concluding no prior judicial review should be required if the President  S" or the Attorney General found surveillance reasonable under the circumstance.;" Y oJ ԍId. at 363!64.; This distinction between law enforcement and national security requirements for electronic surveillance was subsequently recognized by Congress as well. In enacting Title III, Congress specifically disclaimed any intention that its provisions, or those of the Communications Act of 1934, should be construed to affect the constitutional powers of the President to protect the United States against hostile powers, to obtain foreign intelligence information, or to protect against any  S  other clear and present danger.; NY mJ0 ԍ18 U.S.C.  2511(3).;  S In the leading case on this issue, United States v. United States District Court, the Court concluded that the reservation of Presidential authority in Title III represented merely a neutral statement by Congress that the President has some degree of power in the national security area  SD and was not an attempt to expand, define or contract that power.CDY mJ! ԍ407 U.S. 297, 303!08 (1972).C Thus, it was necessary to  S review the constitutional authority, rather than a statutory basis for surveillance authority.5Y oJ ԍId. at 406.5 The Court never addressed the legality of the Executive to undertake warrantless electronic surveillance for national security purposes. Subsequently, Congress enacted the Foreign Intelligence Surveillance Act, which provides exclusive means of authorizing various types of electronic surveillance for national security purposes. Activities must be authorized in advance by one of the seven district court judges designated by the Chief Justice of the Supreme Court as members of the Foreign Intelligence  S Surveillance Court (FISC).?u Y mJ)& ԍ50 U.S.C.  1801 et seq.? The government presents warrants in camera, ex parte proceedings%, 0*((PP conducted under physical security measures designed to protect sensitive national security  S information.TY oJ@ ԍId. at  1804(a), 1805(a), 1803(c).T The Chief Justice also designates three federal appeals court judges to review  S government appeals in instances in which FISC judges have denied applications for warrants.>IY oJ ԍId. at  1803(b).>   S` All applications to FISC require the Attorney General's approval.N`Y oJ: ԍId. at 1804(a), 1805(a)(3).N The FISC judge must find the location at which the surveillance is directed and the procedures proposed by the government adequately minimize the acquisition, retention, and dissemination of information concerning  S unconsenting persons.VY oJ{ ԍId. at  1804(a)(4)(B), (5), 1801(h).V The application must be accompanied by an official statement for senior government officials that the information sought relates to national defense or foreign  S relations.RtY oJ ԍId. at  1804(a)(7), 1801 (e)(2).R The Act also contains detailed provisions specifying the requirements and procedures mandated when information is intended to be used in a criminal proceeding. Barring such situations or an emergency surveillance approval by the Attorney General, there is no requirement to give notice  S to any target concerning the fact the government has conducted such surveillance.> -Y oJ ԍId. at 1806(j).>  S  1.3.2.3 General issues addressed  S0  First general issue. Regarding the first general issue"In a situation when one or both users of the proposed key escrow system are located outside U.S. borders, does a warrant requirement exist for the U.S. government to seize voice or data communication between the users?"the Supreme Court has held that the Fourth Amendment, particularly its warrant requirement, is inapplicable  S outside the United States.fY oJN ԍUnited States v. Verdugo-Urquidez, 494 U.S. 259, 266 (1990).f Given the proposed key escrow system, obtaining a warrant under Title III for electronic surveillance if one of the sources is located in the United States should present no problem. The government in this instance would wiretap only the line of the source located in the United States. Thus, only in the case where both sources are located outside the United States is it not clear that a warrant requirement exists.  S  Second general issue. Regarding the second general issue"Does requiring disclosure of the encryption key to the government in advance of there being probable cause sufficient to allow the government to seize an encrypted transmitted communication and to search and seize the key to such communication violate the fourth amendment?"see the discussion above in a stored  S communications context.;Y oJw" ԍSee supra, p. 35.; The system currently being proposed is analogous to a system of registration by the government so that it can maintain its ability to perform electronic  S surveillance.;XY mJ$ ԍ50 U.S.C.  2511(2).; `&0*((PPԌ S 8 1.4 FIFTH AMENDMENT"SELF INCRIMINATION  S  1.4.1 General Issue 1.hDDDoes a key escrow system that may involuntarily secure from the user the key to 8decipher the user's encrypted messages violate the Fifth Amendment's privilege against selfincrimination?!D  S  1.4.2 State of the Law  Sp The Fifth Amendment, in relevant part, states that [n]o person . . . shall be compelledpY mJ ԍ Word `compel' as used in constitutional right to be free from being compelled in a criminal case to be a witness against one's self means to be subjected to some coercion, fear, terror, inducement, trickery or threat"either physically or psychologically, blatantly or subtly; the hallmark of compulsion is the presence of some operative force. Black's Law Dictionary. in any  SH criminal case to be a witness against himself.9H lY mJ ԍU.S. CONST. amend. V.9 In Fisher v. United States, 425 U.S. 391 (1976), the Court framed the modern interpretation of Fifth Amendment privilege. The Court held that the compelled production of documents, even if the contents are incriminating, does not violate the Fifth Amendment unless the person is compelled to make a testimonial  S communication. #Y mJ ԍ In order to be `testimonial,' an accused's oral or written communication, or act, must itself, explicitly or implicitly, relate a factual assertion or disclose information. It is consistent with the history of and the policies underlying the SelfIncrimination Clause to hold that the privilege may be asserted only to resist compelled explicit  oJ or implicit disclosures of incriminating information. Doe v. United States, 487 U.S. 201 (1988).  SZ  The production of incriminating evidence . The Court in Fisher noted that the compelled production of evidence containing incriminating evidence did not automatically invoke Fifth Amendment privilege. The Court stated that the Fifth Amendment does not independently proscribe the compelled production of every sort of incriminating evidence but applies only when  S the accused is compelled to make a testimonial communication that is incriminating.\Y oJ ԍFisher v. United States, 425 U.S. 391, 408 (1976).\ The Court recognized that [a] subpoena served on a taxpayer requiring him to produce an accountant's workpapers in his possession without a doubt involves substantial compulsion. But it does not compel oral testimony; nor would it ordinarily compel the taxpayer to restate, repeat,  S or affirm the truth of the contents of the documents sought.5Y oJ ԍId. at 409.5 The Court further stated that the Fifth Amendment would not be violated by the fact alone that the papers on their face might incriminate the taxpayer, for the privilege protects a person only against being incriminated by his  S own compelled testimonial communications.5s Y oJ! ԍId. at 409.5 The Court analyzed the voluntary nature of the evidence produced. With respect to the papers being subpoenaed, the preparation of all of the papers sought . . . was wholly voluntary, and they cannot be said to contain compelled testimonial evidence, either of the taxpayers or of anyone  S else.<, Y oJ& ԍId. at 409!410.< The fact that the documents may have been written by the person asserting the privilege is insufficient to trigger the privilege, . . . [a]nd unless the Government has compelled' 0*((PP the subpoenaed person to write the document, the fact that it was written by him is not controlling  S with respect to the Fifth Amendment issue.;Y oJ@ ԍId. at 410 n. 11.; In essence, the government cannot compel a person to involuntarily create evidence to incriminate himself, whether in the form of a written admission of guilt, development of document, etc. But the government may compel the production  S` of voluntarily created documents, even if documents are selfincriminating.p`IY oJ ԍSee United States v. Doe, 465 U.S. 605, 612 n.10 ( If the party asserting the Fifth Amendment privilege has voluntarily compiled the document, no compulsion is present and the contents of the document are not privileged).  S  Fifth Amendment and the Fourth Amendment's Right to Privacy and Protection from  S Unreasonable Search and Seizure. The Court commented on the relationship between the Fifth Amendment's selfincrimination clause and the Fourth Amendment's privacy and unreasonable search and seizure clauses. The Court, in its analysis of privacy, recognized that one of the several purposes served by the constitutional privilege against compelled testimonial selfincrimination is that of protecting personal privacy. . . . But the Court has never suggested that every invasion of privacy violates the privilege. Within the limits imposed by the language of the Fifth Amendment, . . . the privilege truly serves privacy interests; but the Court has never on any ground, personal privacy included, applied the Fifth Amendment to prevent the otherwise proper acquisition or use of evidence which . . . did not involve compelled testimonial selfincrimination  S of some sort5 Y oJ ԍId. at 399.5 . . . . We cannot cut the Fifth Amendment completely loose from the moorings of its language, and make it serve as a general protector of privacy"a word not mentioned in its text and a concept directly addressed in the Fourth Amendment. We adhere to the view that the Fifth Amendment protects against `compelled selfincrimination, not [the disclosure of] private  S information.'rrY oJ* ԍId. at 401 [quoting U.S. v. Nobles, 422 U.S. 225, 233 n.7 (1975)].r With respect to selfincrimination and unreasonable search and seizure, the Court commented on a line of cases in which the Fifth Amendment was offended by the use of evidence of documents  S@ or property seized in violation of the Fourth Amendment.r@+Y oJC ԍId. at 399, n.5. See Gouled v. United States, 55 U.S. 298 (1921); Agnello v. United States, 269 U.S. 20  oJ (1925); United States v. Lefkowitz, 285 U.S