The Export Control Act, 22 U.S.C. § 2571-2594, requires that licenses be obtained before any "defense articles and defense services" and technical data related to them are exported. "Export" is defined to include disclosure "(including oral or visual disclosure) or transferring technical data to a foreign person whether in the United States or abroad." As the AAUP report states, "Classroom discussion or collaborative research with a foreign national, the presentation of a paper to an audience that includes a foreign national, inside or outside the United States, or even informal conversations, may be subject to the Act (which can include criminal sanctions), depending on what has been disclosed (or learned)."
The Act exempts "information concerning general scientific, mathematical or engineering principles commonly taught in schools, colleges and universities or information in the public domain. . . ." "Public domain" is defined as information which is generally available to the public, including, as the report observes, "unlimited distribution at a conference, meeting, seminar, trade show or exhibition, generally accessible to the public, in the United States," and information accessible or available, as the law provides,
[t]hrough fundamental research in science and engineering at accredited institutions of higher learning in the U.S. where the resulting information is ordinarily published and shared broadly in the scientific community. Fundamental research is defined to mean basic and applied research in science and engineering where the resulting information is ordinarily published and shared broadly within the scientific community, as distinguished from research the results of which are restricted for proprietary reasons or specific U.S. Government access and dissemination controls. University research will not be considered fundamental research if:
(i) The university or its researchers accept other restrictions on publication of scientific and technical information resulting from the project or activity, or
(ii) The research is funded by the U.S. Government and specific access and dissemination controls protecting information resulting from the research are applicable. 22 C.F.R. § 120.11 (2002).
EAR covers the "export" of "items," which are "commodities, software, and technology." "Export" is a transmission out of the United States, or "release of technology or software" to a foreign national inside the U.S. Such release may occur by verbal exchange in the U.S. or abroad. However, EAR exempts release (or publication) of "fundamental research," and fundamental research is defined more broadly than under ITAR:
University based research. (1) Research conducted by scientists, engineers, or students at a university normally will be considered fundamental research . . . ("University" means any accredited institution of higher education located in the United States.) Id. § 734.8(b).
But, as the AAUP report notes, there is a caveat under the law:
University based research is not considered "fundamental research" if the university or its researchers accept (at the request, for example, of an industrial sponsor) other restrictions on publication of scientific and technical information resulting from the project or activity. Scientific and technical information resulting from the research will nonetheless qualify as fundamental research once all such restrictions have expired or have been removed.
Information is "published" when it becomes generally accessible to the interested public, including:
(1) Publication in periodicals, books, print, electronic, or any other media available for general distribution to any member of the public or to a community of persons interested in the subject matter, such as those in a scientific or engineering discipline, either free or at a price that does not exceed the cost of reproduction and distribution. . . .
* * *
(4) Release at an open conference, meeting, seminar, trade show, or other open gathering.
(i) A conference or gathering is "open" if all technically qualified members of the public are eligible to attend and attendees are permitted to take notes or otherwise make a personal record (not necessarily a recording) of the proceedings and presentations.
(ii) All technically qualified members of the public may be considered eligible to attend a conference or other gathering notwithstanding a registration fee reasonably related to cost and reflecting an intention that all interested and technically qualified persons be able to attend, or a limitation on actual attendance, as long as attendees either are the first who have applied or are selected on the basis of relevant scientific or technical competence, experience, or responsibility. . . .
(iii) "Publication" includes submission of papers to domestic or foreign editors or reviewers of journals, or to organizers of open conferences or other open gatherings, with the understanding that the papers will be made publicly available if favorably received. . . . Id. § 734.7.
EAR further exempts the release of "educational information," which is defined as "instruction in catalogue courses and associated teaching laboratories of academic institutions." Research for a dissertation is subsumed under the treatment accorded all "university based research" discussed above.
The AAUP report observes:
Department of Commerce guidance provides that EAR does not cover publication (or submission for publication) in a foreign journal, presentations at foreign conferences so long as they are "open" under EAR's regulations, or teaching students from countries for which an export license would otherwise be required. The regulations also make clear that some apparent restrictions, for example, on the circulation of a copy of a dissertation not otherwise "published" or the sharing of unpublished research data with a visiting foreign national, do not in fact apply if the contents meet the definition of fundamental research.
EAR includes a separate provision for encryption commodities and software (15 C.F.R. § 740.17). (Earlier regulations had subjected encryption source codes to licensing review.)
Bernstein v. U.S. Department of Justice (University of Illinois at Chicago): Daniel J. Bernstein, a research assistant professor of mathematics at the University of Illinois at Chicago, sought to use the Internet to show other scientists the source code for an encryption program called "Snuffle," which he created as a graduate student. In 1995 he sued the U.S. Department of Justice, contending that the federal encryption regulations that control the export of domestic cryptographic research violates the First Amendment. The district court ruled in 1997, and a three-judge panel affirmed in 1999, that the same governmental encryption restrictions at issue in Junger (below) violated the First Amendment's guarantee of freedom of speech because they constitute an "impermissible prior restraint" on speech. When the Clinton administration revised the EAR regulations, the parties agreed to have the case sent back to the district court. 974 F. Supp. 1288 (N.D. Cal. 1997), aff'd, 176 F.3d 1132 (9th Cir.), rehearing en banc granted and opinion withdrawn, 192 F.3d 1308 (9th Cir. 1999). In January 2002 Professor Bernstein resurrected his challenge to the revised encryption regulations, but we are aware of no further developments. Bernstein v. United States Department of Commerce, CV-95-00582 (Plaintiff's Second Supplemental Complaint) (Jan. 7, 2002).
Junger v. Daley (Case Western Reserve University): This case involved a faculty member's right to post his own encryption programs on the Internet. Peter D. Junger is a law professor at Case Western Reserve University who teaches a course called "Computers and the Law." He submitted requests to the Commerce Department to publish encrypted software programs as required under the prior EAR regulations. The Commerce Department found that some of the codes Junger sought to publish were subject to EAR and could not be published. Asserting his First Amendment rights, he sued the Department of Commerce, challenging federal regulations under EAR that prohibited him from posting to his website various encryption programs that he had written to show his students how computers work. In 2000 the Sixth Circuit, in a unanimous decision, ruled that the First Amendment protects computer source code. 209 F.3d 481 (6th Cir. 2000). The court observed, however, that national security interests "should overrule the interests in allowing the free exchange of encryption source code."
c. The Digital Millennium Copyright Act
In addition to EAR and ITAR, courts are struggling to apply national security, academic freedom, and copyright principles in areas of academic research under the Digital Millennium Copyright Act (DMCA).
In 1998 Congress enacted the DMCA in an attempt to balance the interests of creators and users of intellectual property in relation to emerging technologies. The DMCA includes an anticircumvention provision that makes it a crime for an individual to distribute decryption technology, which can circumvent the encryption technology used to bar access to copyrighted works. The DMCA also provides an exception from its coverage for certain kinds of "legitimate research," the scope of which is sufficiently unclear that litigation has ensued.
Felten v. Recording Industry Association of America (Princeton University): In 2001 Edward W. Felten, an associate professor of computer science, sued the Recording Industry Association of America (RIAA) and the Verance Corporation. Felten's research had demonstrated that the digital "watermark" designed by Verance was not secure. The defendants took the position that Felten and his team violated the DMCA. The plaintiffs asked the court to grant the researchers immunity from prosecution under the DMCA and to declare the law unconstitutional. The DMCA includes a provision that makes it a crime for an individual to distribute decryption technology that can circumvent access controls on copyrighted works. The researchers contended that the breaking of the watermark code was not "an end unto itself" but a "crucial step, either in attempting to improve the technology or in attempting to prove that the technology cannot be made to do what it is supposed to do." The RIAA alleged that allowing Dr. Felten to publish or present his research would contribute to copying of electronic music and violate copyright law. Later that year the district court dismissed Dr. Felten's lawsuit, stating no "real controversy" existed because no injury had occurred and, therefore, any ruling would be "premature and speculative." The judge opined from the bench that the computer scientists "liken themselves to Galileo," but they are really "modern-day Don Quixotes threatened by windmills that they mistake for giants." Case No. 01-CV-2669 (N.J. Dist. Ct., Nov. 30, 2001); Andrea L. Foster, "Computer Scientists Back Scholar's Challenge to Music Industry," The Chronicle of Higher Education (Sept. 7, 2001); Andrea Foster, "Judge Dismisses Digital-Copyright Lawsuit by Princeton Professor," The Chronicle of Higher Education (Dec. 14, 2001); see Donna R. Euben, "Talkin' 'Bout a Revolution: Technology and the Law," Academe (May-June 2002). The professor decided not to appeal the district court opinion, reportedly relying on the assurances of industry and government officials that "they will never again threaten publishers of scientific research that exposes vulnerabilities in security systems for copyrighted works."
Pavlovich v. DVD Copy Control Association (Purdue University): Matthew Pavlovich, a former student at Purdue University, was sued along with others by the movie industry for publishing on the Internet a code that unscrambles encrypted DVDs. In August 2001, the state court ruled the state had jurisdiction because Pavlovich's web posting could harm the movie industry in California. The California Supreme Court ruled that the court had no such jurisdiction, and the Supreme Court, which had initially issued a stay, rescinded it in January 2003. 29 Cal. App. 4th 262 (App. Div. 2002); Andrea L. Foster, "Free Speech Group Backs Former Purdue U. Student Accused in DVD-Decoding Case," The Chronicle of Higher Education (May 2, 2002).
Universal City Studios, Inc. v. Corley: While this case did not involve faculty, it demonstrates the limitations on professors who wish to publish research on computer source code. The Second Circuit ruled that Eric C. Corley and his company, 2600 Enterprises, Inc., violated the copyright protections of eight motion picture studios under the DMCA when Corley published a computer program on the Internet that is able to circumvent the recording industry's technology devised to block the copying of DVD movies. In so doing, the court ruled that the DMCA does not violate the First Amendment. The court reasoned that, while computer source code is protected by the First Amendment, the scope of that protection is limited, because the DMCA provisions on posting such code constitute a content-neutral restriction. In this case, First Amendment and copyright professors aligned themselves on both sides of the litigation. The counsel for Corley was Stanford University Law School Dean Kathleen Sullivan, and amicus briefs included one filed by Professor Julie E. Cohen, Georgetown University Law Center, on behalf of a group of intellectual property law professors. The movie studios were represented by David E. Kendall, and amicus briefs included one filed by Professor Rodney Smolla, University of Richmond. 273 F.3d 429 (2d Cir. 2001); "2600 Magazine Seeks Another Opinion in NY DeCSS Case" < www.newsbytes.com/news/02/173635.html >.
In the end, the academic community must closely monitor legal challenges to the DMCA to ensure that the judiciary strikes a proper balance between and among support of copyright protections and national security on the one hand, and, promotion of the principles of free speech, academic freedom, and reasonable access to information, on the other.