UNITED STATES DISTRICT COURT
   NORTHERN DISTRICT OF OHIO
   EASTERN DIVISION
   
   
   PETER D. JUNGER, ) CASE NO.
   )
   Plaintiff ) JUDGE
   )
   v. )
   ) DECLARATION OF 
   WARREN CHRISTOPHER, et al. ) PETER D. JUNGER
   ) (in lieu of affidavit pursuant
   ) to 28 U.S.C. § 1746)
   Defendants. )
   
   
   
   I, PETER D. JUNGER, declare as follows:
   
   
   1. I am a professor of law at Case Western Reserve University ("CWRU")
   in Cleveland, Ohio. I have personal knowledge of the facts set forth
   herein, unless otherwise indicated, and if called as a witness could
   and would so testify.
   2. I regularly teach a course entitled "Computers and the Law" at the
   Case Western Reserve University Law School. I taught this course in
   1986 and each year from 1992 to 1995. I am scheduled to teach it again
   in fall 1996.
   3. My course addresses, among other issues, the patentability of
   computer programs and algorithms, the copyrightability of computer
   programs, trade secret protection of computer programs, government
   regulation of computers and computer programs, and the security of
   computer data and computerized communications.
   4. I am currently writing a textbook for "Computers and the Law." I
   have been using a version of this as course material for my class. A
   copy of the first 21 pages and pages 67-70 of my most recent draft is
   found in Exhibit A of this declaration.
   5. In that course, I discuss cryptographic programs and algorithms for
   a number of reasons. For one, the RSA and Diffie-Hellman algorithms
   have been patented in apparent disregard of the Supreme Court's
   decision in Gottschalk v. Benson, 409 U.S. 63 (1972), holding that
   algorithms are not patentable.
   6. I also discuss cryptographic programs in relation to computer
   security because lawyers should be aware of the insecurity of
   electronic communications and should know that encryption can help
   keep their communications confidential, a point of great importance
   for those who have a legal and ethical duty to maintain client
   confidences.
   7. On or about May 1, 1993, I started writing a simple cryptographic
   program ("the program") for use in class the coming fall. The program
   was intended to demonstrate aspects of computer programs that lawyers
   who are going to deal with computer-related issues should know, such
   as the nature of an algorithm.
   8. The program, which was written in 8086 assembly language, uses a
   "one-time pad" as a key and should run on any computer running MSDOS
   3.0 or higher. My course materials include the source code and machine
   code representations of the program. The source code for the program
   is shown on pages 18-21 of Pl.'s Decl., Ex. A. The hexadecimal
   representation of machine code is shown in Figure 1.3 on page 10 of
   Pl.'s Decl., Ex. A., and a uuencoded representation of machine code is
   shown in Figure 1.2 on page 9 of Pl.'s Decl., Ex. A..
   9. While writing the program, I realized that teaching or publishing
   the program and any related "technical data" might be subject to
   federal export licensing regulations.
   10. On or about May 7, 1993, I called the Commerce Department's Bureau
   of Export Administration (telephone number (202)482-4811). Eventually
   I reached Mr. Dale Jensen ((202)482-0730), who told me--several
   times--that I would have to apply to the State Department to determine
   whether State or Commerce had jurisdiction and that such a
   determination would take about two months. If it were referred to
   Commerce it would only take two weeks for them to decide whether I
   needed to obtain a license. He kept saying,"You are now in the world
   of bureaucracy, not of common sense."
   11. On or about May 7, 1993, I reached Major Gary Oncale of the State
   Department's Bureau of Politico-Military Affairs, Office of Defense
   Trade Controls ("ODTC") ((703)875-6641). Major Oncale could not‹-or
   would not‹-tell me what criteria are used to determine whether State
   or Commerce had jurisdiction. He also told me that there were no
   established criteria for determining whether a license would be
   required since each determination is made on a "case by case" basis.
   Major Oncale then gave me a telephone number at the National Security
   Agency ("NSA"), but said that he could not reveal the name of the
   person who would answer the phone.
   12. On or about May 7, 1993, I called the number Major Oncale gave me
   ((301)688-7834) and spoke to an anonymous person at the NSA. She told
   me that discussing the program in class should not cause a problem,
   but that posting the program on the internet was a "gray area" that
   could present problems. Finally, after pressing her for more specific
   information, she said that she could not answer hypothetical questions
   and suggested that I call a general information number ((703)875-6640)
   for more information.
   13. On or about May 10, 1993, I called (703)875-6640 and spoke with a
   Ms. Snyder. Ms. Snyder told me that Major Oncale was the only person
   that knew the licensing criteria. She also said that one could not
   claim what she called "the public domain exemption" by placing
   information into the public domain.
   14. On or about May 17, 1993, I called Mr. Jensen at the Bureau of
   Export Administration and he gave me the number of the Bureau's
   attorneys. I called the attorneys' office ((202)482 5305) and was told
   that the State Department exercised jurisdiction under 22 U.S.C. §
   2751 et seq., especially § 2778, and the International Traffic in Arms
   Regulations ("ITAR"), 22 C.F.R. § 120 et seq.,
   15. On or about October 23, 1995, I again called the ODTC and finally
   reached a Mr. Sam Capino ((703)875-7396) who had replaced Major
   Oncale. He told me that questions relating to cryptography should be
   referred to Ms. Karen Hopkinson, an employee of the NSA who was
   working at the ODTC.
   16. I tried to reach Ms. Hopkinson ((703)875-5677) several times over
   the next few days. On or about October 26, 1995, she returned my
   messages. She did not give me any additional information as to the
   criteria for determining whether a disclosure of my program required a
   license or was exempt from ITAR's licensing requirements.
   17. On or about November 16, 1995, I tried again to reach the ODTC,
   but learned that the office was shut down for the duration of the
   federal budget crisis. I have not attempted to contact the ODTC or any
   other agency since then.
   18. My program is very simple, but to my knowledge there is no
   exception from the registration and licensing requirements under ITAR
   for simple encryption; As far as I am aware, even an encryption
   program that merely substitutes the letter "b" for "a," "c" for "b,"
   and so on, is subject to State Department licensing jurisdiction.
   19. On or about August 22, 1994, I exchanged email with Mr. Paul
   Leyland at Oxford University Computing Services in Oxford, England. I
   asked Mr. Leyland if I could include a short encryption program that
   he had written in my course materials. His program, which was written
   in "C," performed the same encryption function as my assembly language
   program. The ANSII C version of Mr. Leyland's program appears in
   Figure 1.4 on page 11 of Pl.'s Decl., Ex. A.. I did not disclose my
   program or Mr. Leyland's program to him for fear of violating ITAR.
   20. Since my attempts to obtain clarification of the status of my
   program, I have refrained from disclosing the program and other
   "cryptographic software" or "technical data," as those terms are
   defined in ITAR, to foreign persons other than some Canadian students
   that I allowed to enroll in my class in 1994 under the belief that
   disclosure to Canadians was exempt from ITAR's licensing requirements.
   
   21. I have not disclosed my program and other "cryptographic software"
   or "technical data" at faculty discussions in the presence of foreign
   colleagues.
   22. I require that each student who enrolls in my computer and law
   class certify that he or she is a U.S. citizen or permanent resident.
   Other than allowing Canadian students to take my class in 1994, I have
   not allowed foreign students to enroll. I understand that a Russian
   graduate student was thus excluded from my class in 1995.
   23. Classes at CWRU law school are scheduled to begin on August 26,
   1996. To the best of my knowledge, no foreign student has yet
   registered for my computer and law class. However, foreign students
   admitted to the L.L.M. program usually enroll for classes at an
   orientation a few weeks before the beginning of classes so foreign
   students may still enroll for my class. Students also have until
   August 30, 1996, to add a class.
   24. On or about May 29, 1996, Peter M. Gerhart, who was then the Dean
   of CWRU Law School requested a copy of my course materials to send to
   a colleague in the People's Republic of China. I had to refuse his
   request and explain to him that the materials contained information
   that could not be sent to China without a license.
   25. I want to publish my course materials as a case book, and I have
   begun writing a law review article on ITAR and cryptography that
   includes my program and other "cryptographic software" or "technical
   data." I hesitate to publish my course materials and the law review
   article, when completed, without first obtaining a license or approval
   from the government.
   26. I have refrained from disclosing my program and "cryptographic
   software" and "technical data" as described in the above paragraphs
   for fear of violating ITAR.
   27. Based on my understanding of the ITAR, even describing my program
   in class would require a license or approval from the government if
   the class were to include foreign students who are neither U.S.
   citizens nor admitted to permanent residence in the United States.
   28. I have given, and will continue to give, copies of my course
   materials, including my program and other "cryptographic software" and
   "technical data" to my students. For example, I have included an
   explanation of the RSA algorithm and a version of the algorithm
   written in the "Perl" programming language in my course materials.
   Discussion of the RSA algorithm and the Perl source code appears on
   pages 67-70 of Pl.'s Decl., Ex. A.. I also would like to make my
   course materials freely available to students and others who are
   interested in the subject on my FTP server and/or on a World Wide Web
   ("WWW") page that I have designed and which is located at
   http://samsara.law.cwru.edu. Based on my understanding of the ITAR, I
   would be in violation of ITAR if I hand out my course materials to
   foreign students in my class or put the materials on my FTP server or
   on my WWW page without first applying for and obtaining a license or
   approval from the government.
   29. None of the "cryptographic software" or "technical data" that I
   want to teach, publish or otherwise disclose is classified information
   and much of it is widely available to the public.
   30. ITAR's restrictions on the export of "cryptographic software" and
   "technical data" without a license or the government's approval have
   chilled my speech and have caused me to censor my research,
   publications and communications with foreign persons.
   I declare under penalty of perjury under the laws of the United States
   that the foregoing is true and correct and that this Declaration was
   executed at Cleveland, Ohio, on this the ___ day of August, 1996.
   
   By ____________________
   Peter D. Junger