Bernstein v. United States
Based on Wikipedia: Bernstein v. United States
In 1995, Daniel J. Bernstein, a twenty-four-year-old mathematics Ph.D. student at the University of California, Berkeley, found himself in a legal position that defied the logic of the digital age. He had written a piece of software called Snuffle, an encryption system designed to scramble data so that only the intended recipient could read it. It was a tool for privacy, a mathematical shield against eavesdroppers. Yet, when Bernstein sought to publish the source code for Snuffle on the internet, the United States government informed him that he could not do so without a license. More jarringly, they informed him that he was required to register as an arms dealer. The federal government had classified his mathematical code as a "munition," placing it on the same regulatory list as bombs, flamethrowers, and night-vision goggles.
This was not a bureaucratic oversight; it was a deliberate policy stance that treated the fundamental language of the digital world as a weapon of war. Bernstein's response was not to hide his code, but to challenge the very premise of its classification. With the backing of the Electronic Frontier Foundation (EFF), he filed a lawsuit that would eventually ripple through the corridors of the Ninth Circuit Court of Appeals, reshape the legal understanding of computer code, and lay the invisible groundwork for the secure global economy we rely on today.
The story of Bernstein v. United States is not merely a dry legal dispute over administrative procedure. It is a narrative about the collision between two worlds: the rigid, analog definitions of national security forged in the Cold War and the fluid, borderless reality of the internet. To understand the stakes, one must understand what the government was actually trying to do. In the early 1990s, as the World Wide Web began to connect the world, the U.S. State Department and the Department of Commerce viewed strong encryption with deep suspicion. Encryption was the only way to ensure that credit card numbers, medical records, and private emails could travel across public networks without being intercepted by criminals or foreign governments.
However, the U.S. government feared that if strong encryption became freely available, it would be impossible for intelligence agencies to monitor communications, even those of terrorists or drug lords. Consequently, they imposed strict export controls on cryptographic software. The Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR) mandated that any software capable of strong encryption could not be exported out of the United States without a specific license. Since the internet is inherently global, publishing code on a server accessible from anywhere in the world was legally considered an "export."
Bernstein was not trying to sell his software to a foreign adversary. He simply wanted to share his research with the academic community. He wanted to publish a paper describing his Snuffle system and attach the source code so that other mathematicians and computer scientists could study, verify, and improve it. Under the prevailing regulations, this act of academic sharing required him to navigate a labyrinth of bureaucracy. He would have to register with the State Department as an arms dealer, a status that carried significant stigma and legal peril. He would have to apply for an export license, a process that was opaque, slow, and often denied without clear justification.
The absurdity of the situation was not lost on the legal team that rallied around him. The EFF, a non-profit organization dedicated to defending civil liberties in the digital world, saw Bernstein v. United States as a pivotal test case. They assembled a formidable legal army to represent the young mathematician. Cindy Cohn, a brilliant attorney who would later become the EFF's Executive Director, took the lead on the outside. She was joined by a coalition of pro bono talent that read like a "who's who" of First Amendment litigation: Lee Tien of the EFF, M. Edward Ross of the San Francisco firm Steefel, Levitt & Weiss, James Wheaton and Elizabeth Pritzker of the First Amendment Project in Oakland, and a team from the prestigious Washington, D.C. firm Hogan & Hartson, including Robert Corn-Revere, Julia Kogan, and Jeremy Miller.
Their argument was deceptively simple, yet radical in its implications: Code is speech.
The First Amendment to the U.S. Constitution protects the freedom of speech, but it does not explicitly mention computer code. In 1995, the concept that a sequence of instructions for a machine could be considered a form of human expression was foreign to many legal minds. The government's position was that code was functional, a set of mechanical instructions, and therefore fell outside the realm of protected speech. They argued that the regulation of encryption was a matter of national security, akin to controlling the sale of guns or explosives, and that the First Amendment did not apply to the functional aspects of software.
Bernstein's legal team countered that source code is a language. It is a precise, unambiguous medium through which programmers communicate ideas, algorithms, and solutions to other humans. When a programmer writes code, they are expressing a thought process, a method of solving a problem. Just as a cookbook contains recipes that are protected speech, even though following them results in a functional meal, source code contains algorithms that are protected speech, even though running them results in a functional program.
"The government had placed encryption, a method for scrambling messages so they can only be understood by their intended recipients, on the United States Munitions List, alongside bombs and flamethrowers."
The case began in 1995. For four years, the legal battle dragged on, a grinding war of attrition against a bureaucratic machine. The government moved the goalposts, changing regulations and attempting to argue that the controls were necessary to prevent the proliferation of weapons. But the core of the dispute remained: Could the government silence a mathematician from publishing his work simply because the work involved numbers that could be used to keep secrets?
In 1999, the legal tide began to turn. The Ninth Circuit Court of Appeals issued a three-judge panel opinion in Bernstein v. U.S. Dept. of Justice, 176 F.3d 1132 (9th Cir. 1999). The panel agreed with Bernstein. They ruled that software source code was indeed speech protected by the First Amendment. The court found that the government's regulations, which prevented Bernstein from publishing his code, were an unconstitutional prior restraint on free speech. The decision was a landmark victory. It suggested that the digital age required a new legal framework, one that recognized the expressive power of code.
But the government was not ready to surrender. They requested an en banc review, asking for the entire Ninth Circuit to rehear the case, effectively nullifying the three-judge panel's decision. In 1999, the court granted the request. The original opinion was withdrawn, and the case was reheard by a larger panel of judges. This was a critical moment. The legal community watched with bated breath. Would the full court uphold the idea that code is speech, or would they defer to the government's claims of national security?
The en banc court did not immediately issue a final ruling that settled the matter definitively in the way the panel had. Instead, the government, facing the prospect of an adverse ruling from the full court, decided to change the regulations. They modified the rules, substantially loosening the restrictions on the export of cryptography. The government effectively conceded that the old rules were too restrictive, but they did so in a way that attempted to maintain some control.
Faced with these new regulations, Bernstein, who had by then moved on to become a professor at the University of Illinois at Chicago, found himself back in court. The legal landscape had shifted, but the fundamental issues remained. The government had relaxed the rules, but had they gone far enough? In a twist of irony, Bernstein chose to represent himself in this second phase of the litigation. He had no formal legal training, yet he possessed a deep understanding of the mathematics and the policy at stake. He was no longer the student fighting for his thesis; he was a professor fighting for the integrity of his field.
This second legal battle, Bernstein v. United States, continued for years. It highlighted the difficulty of regulating a technology that evolves faster than the law. On October 15, 2003, almost nine years after Bernstein first brought the case, the judge dismissed the lawsuit. The dismissal was not a victory for the government in the sense of a definitive legal ruling, but rather a procedural end. The judge asked Bernstein to return only if the government made a "concrete threat" against him. By that point, the regulatory environment had changed so significantly that the specific constraints Bernstein had fought against in 1995 were largely a thing of the past.
The impact of Bernstein v. United States, however, extended far beyond the dismissal of a single case. The case is now recognized by First Amendment and technology advocacy groups as a foundational moment in the history of digital rights. It affirmed a "right to code," establishing the precedent that software is a form of expression. This principle has since been cited in numerous other cases and has influenced the development of international norms regarding encryption.
The relaxation of export restrictions facilitated the development of secure international e-commerce. Before Bernstein, the fear of legal repercussions stifled the development and deployment of strong encryption. Companies were hesitant to implement robust security measures for fear of violating export laws. After the legal battles, and the subsequent deregulation, encryption became the standard for online transactions. The secure socket layer (SSL) protocols that protect your credit card information when you shop online, the encrypted messaging apps that protect your conversations, and the secure connections that power the modern internet all owe a debt to the legal precedent set by Bernstein's struggle.
The legacy of the case is also evident in the way it has been invoked in modern conflicts between privacy and law enforcement. In 2016, during the high-profile standoff between Apple and the FBI over the San Bernardino shooter's iPhone, Apple cited Bernstein v. United States in its refusal to create a "backdoor" in its operating system. Apple argued that they could not be compelled to "speak"—that is, to write code that would compromise the security of their users. The company's legal team leaned on the reasoning that code is speech and that forcing a company to write code that undermines security is a violation of their First Amendment rights. While the specific legal battle with the FBI was settled when the FBI found another way to unlock the phone, the argument Apple used was a direct descendant of the principles Bernstein fought for.
"The decision has been recognized by First Amendment and technology advocacy groups for affirming a 'right to code' and applying First Amendment protections to code as a form of expression."
The story of Daniel Bernstein does not end in 2003. The man who once faced the prospect of being an "arms dealer" for publishing a math paper remained a vocal advocate for privacy and transparency. In 2022, Bernstein filed a second lawsuit against the U.S. government, this time under the Freedom of Information Act (FOIA). He sought records regarding the National Security Agency's role in influencing the National Institute of Standards and Technology (NIST) post-quantum cryptography standards.
Post-quantum cryptography is the next frontier in encryption, designed to withstand attacks from future quantum computers. Bernstein suspected that the NSA had exerted undue influence over the standards-setting process, potentially inserting vulnerabilities or weakening the algorithms to ensure that intelligence agencies could still access encrypted data. This ongoing case, as of 2025, highlights the enduring relevance of Bernstein's work. He continues to challenge the opacity of government surveillance programs and to fight for the integrity of cryptographic standards.
The legal landscape surrounding cryptography has evolved from a regime of strict prohibition to one of complex regulation, but the core tension remains. The government still struggles to balance the need for national security with the rights of individuals to communicate privately. The "munition" label has largely been removed from the lexicon of export controls, but the fight to keep encryption strong and accessible is far from over.
Bernstein's journey from a graduate student to a legal pioneer illustrates the power of individual action in the face of overwhelming bureaucratic inertia. He did not have the backing of a massive corporation or a wealthy lobby. He had a mathematical insight, a belief in the freedom of expression, and a team of dedicated lawyers who believed that the Constitution applied to the digital world just as it did to the physical one.
The case of Bernstein v. United States serves as a reminder that technology and law are inextricably linked. When the law lags behind technology, it can create absurd and dangerous situations where a mathematician is treated as a weapons dealer. But when the law catches up, as it did in the wake of Bernstein's victory, it can unlock the potential of technology to serve humanity. The secure internet we enjoy today, with its billions of transactions and conversations protected every day, is built on the foundation of that legal battle.
It is easy to look at the digital world as a place of seamless connectivity, where encryption is invisible and automatic. We rarely stop to think about the legal and political struggles that made this possible. We do not see the "munitions list" that once stood in the way of our digital privacy. But it was there, and it was fought.
The story of Bernstein v. United States is a testament to the idea that the right to speak, to write, and to express oneself extends to the code that powers our world. It is a story about a young man who refused to be silenced, a story about the courts that recognized the value of that silence-breaking, and a story about the future of privacy in a world where data is the most valuable commodity of all.
As we look to the future, with the rise of quantum computing and the constant evolution of surveillance technologies, the principles established in Bernstein will continue to be tested. The question of who controls the code, and who has the right to write it, remains one of the most critical questions of our time. Bernstein's legacy is not just in the laws he changed, but in the precedent he set: that in the digital age, the right to code is a fundamental human right.
The legal battle may have officially concluded with the dismissal in 2003, but the cultural and technological impact continues to resonate. Every time you send an encrypted message, every time you make a secure online purchase, every time you use a tool that protects your privacy, you are benefiting from the victory of Bernstein v. United States. The case stands as a beacon, reminding us that the principles of liberty must adapt to the technologies of the future, and that the fight for privacy is a fight that never truly ends.
In the end, the story of Daniel Bernstein is a story about the power of ideas. He showed that a piece of mathematical code could change the world, that the First Amendment could be a shield for the digital age, and that one person, armed with the truth and a willingness to fight, could stand up to the might of the United States government and win. It is a story that continues to inspire activists, lawyers, and technologists around the world, proving that the right to code is indeed the right to speak.
The journey from the State Department's munitions list to the global marketplace of secure information was long and arduous. It required the courage of a student, the skill of a legal team, and the vision of a court willing to see the future. But it was worth it. Because of Bernstein v. United States, the internet is a place where privacy can flourish, where commerce can be secure, and where the free flow of information is protected by the very principles that define our democracy. The case is a chapter in the history of the internet, but it is also a chapter in the history of freedom itself.
And so, as we navigate the complex digital landscape of 2026 and beyond, we must remember the lessons of 1995. We must remember that code is speech, that privacy is a right, and that the struggle to protect these values is an ongoing endeavor. The case of Bernstein v. United States is not just a relic of the past; it is a living, breathing precedent that continues to shape our world. It is a reminder that in the battle for the future, the most powerful weapon we have is the truth, and the most powerful shield is the law.