RE: ITAR Amendment—Revisions to Definitions; Data Transmission and Storage.
I am writing to you regarding the proposed ITAR Amendment (RIN 1400-AD70). This amendment endeavors to make substantial changes to several definitions within ITAR and the Department’s claim is that these modifications are necessary to modernize the regulations. However, the proposal is also rife with dangers that could snare otherwise law abiding Americans who are simply exercising their constitutionally protected rights. While State may feel that these changes are well intentioned, First/Second Amendment issues, enforceability concerns, and economic consequences of the changes should not be ignored.
The first problematic change is the revision to the definition of “defense article” which results in a much broader application of the term. According to the ITAR Amendment, applicable software would be considered a defense article, rather than “technical data” as it currently is treated. This is troublesome because encryption technologies and cryptographic algorithms are likely to fall within this scope. While section 120.6 lays out exceptions to the classification, these relate primarily to academic research and existing technologies. Independent, private research is not necessarily protected and new software is likely to be held to this definition. These changes are particularly worrisome because they potentially lower the threshold for software to be regulated under ITAR. Currently, software is categorized as technical data, meaning it must closely relate to a separate defense article in order to be ITAR relevant. The changes would remove this barrier (safeguard) by classifying software as a defense article itself. Thus, sharing such software could be considered an “export” according to ITAR. Practically all types of software are developed collaboratively, often as multinational efforts. These changes render it impractical to develop any sort of software that might have any sort of appeal to the defense community. This is potentially a grave violation of the First Amendment, but it could also carry massive economic consequences as security software developers attempt to contend with the new rules.
Following the changes to defense articles, the ITAR Amendment proposes substantial modifications to the definition of technical data. For lawful gun owners, proposed paragraph (a)(1) is one of the most ominous pieces of the amendment. According to State, the definition of technical data would be broadened to account for practically any information relating to a defense article and the applicable formats for such data expanded to include all practical communications. Since firearms have frequently been deemed defense articles by State, this expansion of relevant technical data could put firearms discussions and training at risk. According to the new definition, merely posting a tutorial for cleaning an AR-15 on the Internet could constitute an export of technical data according to this new definition. Popular tutorials outlining firearm build processes would almost assuredly be subject to ITAR. This is absolutely unacceptable from both a First and Second Amendment perspective.
I must also question State’s motivation for the changes the definition of technical data. It is no secret that the Department is the defendant in a lawsuit brought forth by Defense Distributed after the company was threatened by State and forced to remove CAD files of firearm components from their website. State’s rationale for the threat was that Defense Distributed’s files were ITAR controlled data. However, none of the files posted would have contained classified information and many of them were Defense Distributed’s intellectual property and original designs. It is perfectly legal to manufacture firearms and parts for personal use and State’s attempt to regulate this activity represents an unlawful usurpation of power. It also gives the outward appearance of a move to adapt the rules to benefit the Department in its ongoing legal dispute. Moreover, this sort of information is already widely available and regulatory efforts to halt its dissemination are absolutely unenforceable.
State has elected to take a very specific stance in defining public domain. Effectively, public domain is to be taken as any mode of communication that is accessible for the general public. This includes magazines, libraries, trade shows, the Internet, and many more formats. While State indicates that some data must be available to the public domain (including “fundamental research”), the Department does not make the scope of this information clear. It is probable that a substantial portion of small arms data that most gun owners consider public domain would actually be taken as technical data under these new rules. In large part, this is because the Department of State (or the U.S. Government as a whole) has taken sole authority for determining what technical data may be “released” to the public domain. Without explicit permission from the U.S. Government, relevant parties would be prohibited from releasing any information that might be considered technical data. In this sense, the proposal is absolutely a “gag order” and these changes should be thrown out as unconstitutional infringements on free speech.
Because it is impossible for firearms and security enthusiasts to determine what existing information truly constitutes technical data, this new definition of public domain is likely to lead to heavy self-censorship in online communities and at trade seminars. It is not reasonable to expect that individual practitioners would obtain express permission from State prior to releasing any technical information about something that may be considered a defense article. As the gatekeeper of this information, the Department takes on a unique, powerful, and legally uncertain position in regulating “free” speech.
According to 120.49, there are only two approved ways for information from research studies that would typically be considered technical data to be classified as public domain. The first encompasses research done in the U.S. by accredited universities and colleges. This information, intended for publication, would be considered public domain only after prepublication review. Likewise, any research funded by the U.S. government would also be considered fundamental and its results would be subject to prepublication review prior to dissemination. The ITAR Amendment makes no provisions for independent research. This is problematic because most firearms and information security development is done privately. These changes suddenly make it illegal for private groups to independently release information that might have some sort of defense application.
According to State, this regulation is not expected to have an impact on the economy that exceeds $100 million. I must disagree with this assertion. In fact, it is likely that the economic impact of the ITAR Amendment will far exceed this figure. According to the National Shooting Sports Federation (NSSF), the total economic impact of the firearms and ammunition industry was over $42 billion in 2014. The industry also generated over $5 billion in federal and state tax revenue. In 2013, data from Gartner indicated that the information security industry is expected to exceed $86 billion in total size by 2016. If even a tiny fraction of these two industries is affected by the ITAR Amendment, the total economic impact of the changes will far exceed $100 million.
Regardless of the Department’s stated intentions, to move forward with the current ITAR Amendment would be a mistake. As proposed, the new regulatory definitions present sizeable constitutional questions that will not go unchallenged if adopted. Moreover, enforcement of these changes will be practically impossible given the prevalence of relevant information already available for public consumption. Lastly, State grossly underestimates the potential economic side effects of the ITAR Amendment. Using just the aforementioned industries and assuming State could successfully enforce the regulations, it is easy to see that the economic impact of the changes could far surpass $100 million. Given these factors, the Department should abandon the proposed changes.
The Department of State has currently received only 6,877 comments for the ITAR Amendment. This is well short of where I had hoped we would be by this point. Please take time to make your voice heard. Submissions can be made on the regulations.gov web portal or by email. Comments via the web portal are limited to 5000 characters, so longer entries should be emailed. Emailed submissions must be sent to DDTCPublicComments@state.gov and must use subject line “ITAR Amendment—Revisions to Definitions; Data Transmission and Storage.” The comment period closes August 3 so time is running out.