united-states cryptography export munition itar
What exactly makes encryption a weapon?
<p>As a followup from <a href="https://law.stackexchange.com/questions/3696/is-the-right-to-keep-and-bear-crypto-protected-by-the-second-amendment">Is the right to keep and bear crypto protected by the Second Amendment?</a>, for export control purposes, United States has been classifying <em>crypto</em> as <em>munition</em>.  In the old days, maybe late 1990s and very early 2000s, it was not uncommon for there to be two version of Netscape Navigator -- one with and one without "strong crypto".</p>

<p><em>Bernstein v. United States.</em> <a href="http://export.cr.yp.to/" rel="nofollow noreferrer">http://export.cr.yp.to/</a></p>

<p>On what exact legal basis is crypto considered munition?</p>

<p>I mean, has anyone ever been killed with crypto?  Is that even possible?</p>

<p>Encryption is not a weapon.</p>

<p>Encryption, or rather cryptographic technology and systems, is a munition. What makes it a munition is the <a href="https://www.pmddtc.state.gov/regulations_laws/itar.html" rel="noreferrer">International Traffic in Arms Regulations (ITAR)</a> managed by the U.S. Department of State.</p>

<p>Weapons are a subset of munitions.</p>

<p>Many U.S. laws grant authority to the executive branch to promulgate regulations for enforcement of the law. ITAR is a set of regulations managed by the U.S. Department of State to implement 22 U.S.C 2778 of the <a href="https://www.pmddtc.state.gov/regulations_laws/aeca.html" rel="noreferrer">Arms Export Control Act (AECA)</a>.</p>

<p>As part of the implementation, ITAR must define those items that are regulated by the AECA. Part 121 of those regulations defines "<a href="http://www.ecfr.gov/cgi-bin/text-idx?SID=86008bdffd1fb2e79cc5df41a180750a&amp;node=22:1.0.1.13.58&amp;rgn=div5" rel="noreferrer">The United States Munitions List</a>."</p>

<p>There are many items on that list that are not weapons, yet they are regulated under the authority of the <a href="https://en.wikipedia.org/wiki/Commerce_Clause#Text_and_pairing" rel="noreferrer">Commerce Clause of the United States Constitution</a> granting power to the U.S. government to regulate international commerce.</p>

<p>The extent of the definition of cryptography as a munition, for purposes of this discussion, is limited to the meaning created in the AECA and ITAR.</p>

<p>There has been a <a href="https://www.eff.org/cases/bernstein-v-us-dept-justice" rel="noreferrer">somewhat successful challenge to the ITAR definition</a> as it relates to cryptography mounted by the Electronic Frontier Foundation.</p>

<p>I'll give the explanation for the thinking here.  Since that is what you seem to be asking about.  Please, don't take it to mean that I am endorsing this point of view.</p>

<p>In the sword/shield analogy, encryption is the shield.  </p>

<p>No one has ever been killed with a bullet-proof vest, either.  But a bullet-proof vest can be used to protect a criminal from being taken down while he is shooting at a police officer.  So it would increase the deadliness of other weapons wielded by someone.  </p>

<p>In the same way, encryption can be used to make deployment of sophisticated attack vectors more difficult to uncover.  Ultimately, it can even make attacks more potent and deadlier.  This is the function of any shield in the sword/shield analogy.  The shield protects the wielder of the sword.</p>

<p>I sense the classification of cryptography as a munition is a relic from the past.</p>

<h3>Cryptography has historically been the domain of the military</h3>

<p><a href="http://www.nytimes.com/1996/11/08/business/us-classifies-a-device-to-surf-the-web-as-a-weapon.html" rel="nofollow noreferrer">Look at this NY Times article from 1996, for example</a>. There it describes "boxes used to surf the World Wide Web" as weapons.</p>

<p>Cryptography has historically been a major deal in warfare. Sending messages to coordinate troop movements without the enemy being able to decode them in order to maintain the element of surprise is a huge strategic and tactical advantage in combat.</p>

<h3>Historical Examples</h3>

<p>Consider the following subjects of history:</p>

<ul>
<li><a href="https://en.wikipedia.org/wiki/Code_talker" rel="nofollow noreferrer">Code Talkers</a></li>
<li><a href="https://en.wikipedia.org/wiki/Operation_Overlord" rel="nofollow noreferrer">Operation: Overlord</a></li>
<li><a href="https://en.wikipedia.org/wiki/Manhattan_Project" rel="nofollow noreferrer">Manhattan Project</a></li>
<li><a href="https://en.wikipedia.org/wiki/Zimmermann_Telegram" rel="nofollow noreferrer">Zimmerman Telegram</a></li>
<li><a href="https://en.wikipedia.org/wiki/Alan_Turing" rel="nofollow noreferrer">Alan Turing</a> and <a href="https://en.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma" rel="nofollow noreferrer">Cryptanalysis of the Enigma</a></li>
</ul>

<p>Before the internet, the military (and banking and finance) was the primary domain for encryption technology. The NYT article suggests to me that when the internet became popular, it fueled military concern of superior encryption technology being used for its historical military purpose. They had no frame of reference in history to give them a sense of its peaceful, commercial applications. Most likely.</p>

<h3>Courts haven't caught up yet</h3>

<p>If encryption is still classified as a munition, it's probably because that issue has not had time to work its way through the legal system. And that might likely be because it hasn't been enforced in a way that would lead a company like, say Google or Amazon, to challenge it.</p>
