Could it be time for another Bernstein v US sort of case?
The idea that source code publication can be restricted (prior restraint) by classifying it as “arms” seems like an attempt at an end run around the bill of rights.
The idea that source code publication can be restricted (prior restraint) by classifying it as “arms” seems like an attempt at an end run around the bill of rights.
Tipper Gore?
Or they could delete the code, spend their time engineering instead of lawyering, secure in the knowledge a copy of the code is almost certain to end up hosted somewhere outside the US anyway.
My take is it will be significantly more nuanced if it goes to a fight.
Bernstein v US is too blanket of a ruling to say "all code is 100% protected under free speech". It's like trying to argue "all speech is protected under free speech" - this is a gross misunderstanding. There are clear examples of things you cannot freely say - one of them being classified information[0]. Otherwise Snowden wouldn't have to fear anything (he absolutely does).
Like wise, saying all code is free speech is too obtuse. If my code was open source "puts classified_information_str" I'd be in lots of trouble.
Where this falls isn't up to me to decide - I'm not smart enough, but it's just not so clear cut.
[0] https://www.mtsu.edu/first-amendment/article/859/classified-...
It is like the situation with trade secrets - anyone can publish trade secrets except those who have a duty not to disclose them, and often they can as well once the secret becomes public knowledge.
There are, however, statutory exceptions for national defense information like plans to a military base or plans and specifications for certain weapons. In those cases it doesn't matter how you came into possession of the related documents you can't legally publish it anyway.
1. Actual classified information (Secret, TS, SCI, SAP). This information is classified by people with clearances according to a set of guidelines and all information has to be more or less manually classified. If you were to independently produce this information (without knowledge or information from the classified project), you are legally in the clear to publish.
2. Restricted information (RD, FRD, SNM). Unlike with classified information, what is or isn't considered restricted is regulated by the DOE. Because of this, information can be "restricted at inception" which prevents it from being published regardless of how it was obtained or produced.
Point being that just because information isn't classified and you may have acquired it through independent means, you can still be restricted from sharing it because the US has deemed it "inherently dangerous" to national security.
Note: I don't think the code in question could by any stretch be considered RD or FRD.