UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF OHIO EASTERN DIVISION PETER D. JUNGER, ) CASE NO. ) Plaintiff ) JUDGE ) v. ) ) DECLARATION OF WARREN CHRISTOPHER, et al. ) PETER D. JUNGER ) (in lieu of affidavit pursuant ) to 28 U.S.C. � 1746) Defendants. ) I, PETER D. JUNGER, declare as follows: 1. I am a professor of law at Case Western Reserve University ("CWRU") in Cleveland, Ohio. I have personal knowledge of the facts set forth herein, unless otherwise indicated, and if called as a witness could and would so testify. 2. I regularly teach a course entitled "Computers and the Law" at the Case Western Reserve University Law School. I taught this course in 1986 and each year from 1992 to 1995. I am scheduled to teach it again in fall 1996. 3. My course addresses, among other issues, the patentability of computer programs and algorithms, the copyrightability of computer programs, trade secret protection of computer programs, government regulation of computers and computer programs, and the security of computer data and computerized communications. 4. I am currently writing a textbook for "Computers and the Law." I have been using a version of this as course material for my class. A copy of the first 21 pages and pages 67-70 of my most recent draft is found in Exhibit A of this declaration. 5. In that course, I discuss cryptographic programs and algorithms for a number of reasons. For one, the RSA and Diffie-Hellman algorithms have been patented in apparent disregard of the Supreme Court's decision in Gottschalk v. Benson, 409 U.S. 63 (1972), holding that algorithms are not patentable. 6. I also discuss cryptographic programs in relation to computer security because lawyers should be aware of the insecurity of electronic communications and should know that encryption can help keep their communications confidential, a point of great importance for those who have a legal and ethical duty to maintain client confidences. 7. On or about May 1, 1993, I started writing a simple cryptographic program ("the program") for use in class the coming fall. The program was intended to demonstrate aspects of computer programs that lawyers who are going to deal with computer-related issues should know, such as the nature of an algorithm. 8. The program, which was written in 8086 assembly language, uses a "one-time pad" as a key and should run on any computer running MSDOS 3.0 or higher. My course materials include the source code and machine code representations of the program. The source code for the program is shown on pages 18-21 of Pl.'s Decl., Ex. A. The hexadecimal representation of machine code is shown in Figure 1.3 on page 10 of Pl.'s Decl., Ex. A., and a uuencoded representation of machine code is shown in Figure 1.2 on page 9 of Pl.'s Decl., Ex. A.. 9. While writing the program, I realized that teaching or publishing the program and any related "technical data" might be subject to federal export licensing regulations. 10. On or about May 7, 1993, I called the Commerce Department's Bureau of Export Administration (telephone number (202)482-4811). Eventually I reached Mr. Dale Jensen ((202)482-0730), who told me--several times--that I would have to apply to the State Department to determine whether State or Commerce had jurisdiction and that such a determination would take about two months. If it were referred to Commerce it would only take two weeks for them to decide whether I needed to obtain a license. He kept saying,"You are now in the world of bureaucracy, not of common sense." 11. On or about May 7, 1993, I reached Major Gary Oncale of the State Department's Bureau of Politico-Military Affairs, Office of Defense Trade Controls ("ODTC") ((703)875-6641). Major Oncale could not�-or would not�-tell me what criteria are used to determine whether State or Commerce had jurisdiction. He also told me that there were no established criteria for determining whether a license would be required since each determination is made on a "case by case" basis. Major Oncale then gave me a telephone number at the National Security Agency ("NSA"), but said that he could not reveal the name of the person who would answer the phone. 12. On or about May 7, 1993, I called the number Major Oncale gave me ((301)688-7834) and spoke to an anonymous person at the NSA. She told me that discussing the program in class should not cause a problem, but that posting the program on the internet was a "gray area" that could present problems. Finally, after pressing her for more specific information, she said that she could not answer hypothetical questions and suggested that I call a general information number ((703)875-6640) for more information. 13. On or about May 10, 1993, I called (703)875-6640 and spoke with a Ms. Snyder. Ms. Snyder told me that Major Oncale was the only person that knew the licensing criteria. She also said that one could not claim what she called "the public domain exemption" by placing information into the public domain. 14. On or about May 17, 1993, I called Mr. Jensen at the Bureau of Export Administration and he gave me the number of the Bureau's attorneys. I called the attorneys' office ((202)482 5305) and was told that the State Department exercised jurisdiction under 22 U.S.C. � 2751 et seq., especially � 2778, and the International Traffic in Arms Regulations ("ITAR"), 22 C.F.R. � 120 et seq., 15. On or about October 23, 1995, I again called the ODTC and finally reached a Mr. Sam Capino ((703)875-7396) who had replaced Major Oncale. He told me that questions relating to cryptography should be referred to Ms. Karen Hopkinson, an employee of the NSA who was working at the ODTC. 16. I tried to reach Ms. Hopkinson ((703)875-5677) several times over the next few days. On or about October 26, 1995, she returned my messages. She did not give me any additional information as to the criteria for determining whether a disclosure of my program required a license or was exempt from ITAR's licensing requirements. 17. On or about November 16, 1995, I tried again to reach the ODTC, but learned that the office was shut down for the duration of the federal budget crisis. I have not attempted to contact the ODTC or any other agency since then. 18. My program is very simple, but to my knowledge there is no exception from the registration and licensing requirements under ITAR for simple encryption; As far as I am aware, even an encryption program that merely substitutes the letter "b" for "a," "c" for "b," and so on, is subject to State Department licensing jurisdiction. 19. On or about August 22, 1994, I exchanged email with Mr. Paul Leyland at Oxford University Computing Services in Oxford, England. I asked Mr. Leyland if I could include a short encryption program that he had written in my course materials. His program, which was written in "C," performed the same encryption function as my assembly language program. The ANSII C version of Mr. Leyland's program appears in Figure 1.4 on page 11 of Pl.'s Decl., Ex. A.. I did not disclose my program or Mr. Leyland's program to him for fear of violating ITAR. 20. Since my attempts to obtain clarification of the status of my program, I have refrained from disclosing the program and other "cryptographic software" or "technical data," as those terms are defined in ITAR, to foreign persons other than some Canadian students that I allowed to enroll in my class in 1994 under the belief that disclosure to Canadians was exempt from ITAR's licensing requirements. 21. I have not disclosed my program and other "cryptographic software" or "technical data" at faculty discussions in the presence of foreign colleagues. 22. I require that each student who enrolls in my computer and law class certify that he or she is a U.S. citizen or permanent resident. Other than allowing Canadian students to take my class in 1994, I have not allowed foreign students to enroll. I understand that a Russian graduate student was thus excluded from my class in 1995. 23. Classes at CWRU law school are scheduled to begin on August 26, 1996. To the best of my knowledge, no foreign student has yet registered for my computer and law class. However, foreign students admitted to the L.L.M. program usually enroll for classes at an orientation a few weeks before the beginning of classes so foreign students may still enroll for my class. Students also have until August 30, 1996, to add a class. 24. On or about May 29, 1996, Peter M. Gerhart, who was then the Dean of CWRU Law School requested a copy of my course materials to send to a colleague in the People's Republic of China. I had to refuse his request and explain to him that the materials contained information that could not be sent to China without a license. 25. I want to publish my course materials as a case book, and I have begun writing a law review article on ITAR and cryptography that includes my program and other "cryptographic software" or "technical data." I hesitate to publish my course materials and the law review article, when completed, without first obtaining a license or approval from the government. 26. I have refrained from disclosing my program and "cryptographic software" and "technical data" as described in the above paragraphs for fear of violating ITAR. 27. Based on my understanding of the ITAR, even describing my program in class would require a license or approval from the government if the class were to include foreign students who are neither U.S. citizens nor admitted to permanent residence in the United States. 28. I have given, and will continue to give, copies of my course materials, including my program and other "cryptographic software" and "technical data" to my students. For example, I have included an explanation of the RSA algorithm and a version of the algorithm written in the "Perl" programming language in my course materials. Discussion of the RSA algorithm and the Perl source code appears on pages 67-70 of Pl.'s Decl., Ex. A.. I also would like to make my course materials freely available to students and others who are interested in the subject on my FTP server and/or on a World Wide Web ("WWW") page that I have designed and which is located at http://samsara.law.cwru.edu. Based on my understanding of the ITAR, I would be in violation of ITAR if I hand out my course materials to foreign students in my class or put the materials on my FTP server or on my WWW page without first applying for and obtaining a license or approval from the government. 29. None of the "cryptographic software" or "technical data" that I want to teach, publish or otherwise disclose is classified information and much of it is widely available to the public. 30. ITAR's restrictions on the export of "cryptographic software" and "technical data" without a license or the government's approval have chilled my speech and have caused me to censor my research, publications and communications with foreign persons. I declare under penalty of perjury under the laws of the United States that the foregoing is true and correct and that this Declaration was executed at Cleveland, Ohio, on this the ___ day of August, 1996. By ____________________ Peter D. Junger