Politech: FC: US law makes it a crime to disclose crypto-secrets

[Declan McCullagh <declan () well com>]

Current law makes it a felony for anyone in the US to disclose classified
cryptographic or communications intel-related information. It was enacted
in 1950 and was discussed during the Church committee hearings in 1975 (p7
of the
transcript).

It is, of course, reasonable for the government to punish its employees or
contractors for disclosing info they promised to keep secret.

But the law appears to apply to anyone, including journalists, no matter
how they obtained the data. That raises First Amendment issues.

If I get a "NSA crypto secrets" email or letter from an anonymous source
that checks out and I write an article based on that info, I go to prison
for up to 10 years. Even if the NSA "secret" info really wasn't all that
secret and really shouldn't have been classified in the first place.

I'm not even allowed to publish info "concerning the communication
intelligence activities of the United States or any foreign government."

An analysis from a very well-informed lawyer is below.

-Declan
(who was at NSA crypto-museum yestreday. if you haven't been recently, it's
worth another visit. they've expanded the gift shop with posters and more
stuffed animals.)

**********

http://www4.law.cornell.edu/uscode/18/798.html

Sec. 798. Disclosure of classified information 

     (a) Whoever knowingly and willfully communicates, furnishes,
     transmits, or otherwise makes available to an unauthorized person,
     or publishes, or uses in any manner prejudicial to the safety or
     interest of the United States or for the benefit of any foreign
     government to the detriment of the United States any classified
     information - 
          (1) concerning the nature, preparation, or use of any code, 
          cipher, or cryptographic system of the United States or any 
          foreign government; or 
          (2) concerning the design, construction, use, maintenance, or 
          repair of any device, apparatus, or appliance used or
          prepared or 
          planned for use by the United States or any foreign
          government 
          for cryptographic or communication intelligence purposes; or 
          (3) concerning the communication intelligence activities of the 
          United States or any foreign government; or 
          (4) obtained by the process of communication intelligence
          from 
          the communications of any foreign government, knowing the
          same to 
          have been obtained by such processes - 
          Shall be fined under this title or imprisoned not more than ten
          years, or both. 

     (b) As used in subsection (a) of this section - 
     The term ''classified information'' means information which, at the
     time of a violation of this section, is, for reasons of national
security,
     specifically designated by a United States Government Agency for
     limited or restricted dissemination or distribution; 
     The terms ''code,'' ''cipher,'' and ''cryptographic system'' include in
     their meanings, in addition to their usual meanings, any method of
     secret writing and any mechanical or electrical device or method
     used for the purpose of disguising or concealing the contents,
     significance, or meanings of communications; 
     The term ''foreign government'' includes in its meaning any person or
     persons acting or purporting to act for or on behalf of any faction,
     party, department, agency, bureau, or military force of or within a
     foreign country, or for or on behalf of any government or any person
     or persons purporting to act as a government within a foreign
     country, whether or not such government is recognized by the United
     States; 
     The term ''communication intelligence'' means all procedures and
     methods used in the interception of communications and the
     obtaining of information from such communications by other than the
     intended recipients; 
     The term ''unauthorized person'' means any person who, or agency
     which, is not authorized to receive information of the categories set
     forth in subsection (a) of this section, by the President, or by the
     head of a department or agency of the United States Government
     which is expressly designated by the President to engage in
     communication intelligence activities for the United States.  [...]

**********

> Key terms here are "knowingly and willfully," "unauthorized person," and
> "to the detriment of the United States."
>
> Note that structurally there are really 2 distinct offenses (I would argue)
> regarding the 4 categories of information:
> --knowing and willful "making available" to an "unauthorized person"
> --knowing and willful publication or use "to the detriment of the United
> States."
>
> I don't know of any constitutional challenges to the law.  It's been
> discussed in law review articles as part of more general discussions of the
> Espionage Act.  I recall a long Harvard L.Rev. "Developments in the Law -
> National Security" piece about it, probably more than 20 years ago.
>
> My vague recollection is that it has actually been used in a prosecution, I
> think in U.S. v. Boyce (remember the movie Falcon and the Snowman, where
> one of the guys was a mole); that wouldn't be hard for someone with a Lexis
> or WESTLAW account to figure out.
>
> It has been held as a (b)(3) FOIA "exemption" statute so that the
> government need not disclose classified cryptographic information under
> FOIA.
>
> There are far broader provisions respecting "national defense information"
> in the Espionage Act.  One of the classic cases is Gorin v. United States
> (sometime in the '40s or '50s), which upheld one of these provisions
> against a vagueness challenge because the provision required a showing of
> intent for conviction.  It's an interesting question whether modern First
> Amendment law alters that result.  There are occasional Espionage Act
> cases, like U.S. v. Morrison (or Morison), who was a gov't employee.  In
> any case, none of these provisions is drafted especially well.
>
> I'm sure it won't surprise you to learn that I did some research on this...
> Let's just say that I felt it
> necessary to analyze its constitutionality then.  One of the major and
> difficult issues in the provision is the role of "classified" as defined in
> (b).  My recollection is that under Boyce, the defendant may not challenge
> the propriety of the classification -- all that matters is that it was
> formally classified.
****************



--------------------------------------------------------------------------
POLITECH -- the moderated mailing list of politics and technology
To subscribe: send a message to majordomo () vorlon mit edu with this text:
subscribe politech
More information is at http://www.well.com/~declan/politech/
--------------------------------------------------------------------------