Code blues - electronic privacy protection

Reason, May, 1994 by Ronald Bailey

Phil Zimmerman gave electronic privacy protection to the masses, and for that he may go to jail.

IN 1991 PHIL ZIMMERMAN DEVELoped a software program called Pretty Good Privacy (PGP), designed to shield electronic information from prying eyes, and gave it away for free. Zimmerman, a Boulder, Colorado, software consultant, thereby provided unbreakable "military-grade" encryption to the masses. After he released PGP, someone put it on the Internet, making it available, with a few keystrokes, to the whole world. In a short time, PGP could be found in London or Moscow. This has upset some powerful people in Washington, especially the National Security Agency.

Agents from the U.S. Customs Service visited Zimmerman in February 1993 to ask him about the "export" of PGP. Under the current interpretation of the International Traffic in Arms Regulations, cryptographic software like PGP is classified as "munitions" and cannot be legally exported without permission from the federal government. "The mere posting of encryption software is tantamount to exporting it," explains Danny Weitzner of the Electronic Frontier Foundation.

Zimmerman says he has been told that he is the primary target of an ongoing federal grand-jury investigation. In September, he says, an encryption company was served with a subpoena to produce documents related to "ViaCrypt |the commercial version of PGP~, PGP, Philip Zimmerman, and anyone or any entity acting on behalf of Philip Zimmerman for the time period June 1, 1991, to the present." Assistant U.S. Attorney William Keane, who is in charge of the grand-jury investigation, says he cannot comment on an on-going case, but there may be "some activity shortly."

If Zimmerman is convicted of "exporting munitions," he could go to jail for four years. He would probably view himself as a political prisoner. "I didn't do it to make money," he says. "I did it to inoculate the body politic." In October he told a congressional subcommittee: "When making public-policy decisions about new technologies for the government, I think one should ask oneself which technologies would best strengthen the hand of a police state. Then, do not allow the government to deploy those technologies. This is simply a matter of good civic hygiene."

Zimmerman believes the expansion of digital communications networks could pose a serious threat to individual liberty. He makes the point by contrasting how government agencies can monitor regular mail with how they can sift through electronic mail. Previously the authorities could only intercept and steam open envelopes sent to a few people. This is like using a hook to catch a fish. With the development of data networks, officials can scan thousands of electronic messages simultaneously for key words. This is like using a drift net.

IN A MOVE THAT COULD HELP WEAVE such a net, the federal government is trying to persuade the U.S. computer and telecommunications industry to adopt an encryption standard developed by the National Security Agency called the Clipper Chip. The Clipper Chip has a "back door" that allows government officials to tap and decode any messages encrypted with it. (See "Hide and Peek," November 1993.) Spooks and law-enforcement officials say this back door is needed so they can monitor the communications of terrorists, drag runners, and wire-fraud artists. They say ordinary citizens would enjoy the same constitutional protections as in the past, since tapping a phone or reading some-one's e-mail would still require a court order.

"The government has the balance of costs and benefits all wrong," says the EFF's Weitzner. "We grant that there are some number of people who would use cryptography to further illegal acts, but should we compromise the privacy of all American citizens just to do an ineffective job of trying to police terrorists and mobsters?" Philip Dubois, Zimmerman's attorney, puts it this way: "We can have the kind of country where people can speak freely and privately and take the consequences of that. Or we can have the kind of country where they can't and take the far worse consequences of that."

By creating and disseminating PGP, Zimmerman made it clear which side he comes down on. The program uses an unbreakable algorithm in combination with "public-key" cryptography. In public-key cryptography, everyone has two complementary keys, a public one and a secret one. Each key deciphers the code the other key makes, but the secret key cannot be deduced from the public key. The public key is disseminated widely so that anyone can use it to encode messages to its originator, who decodes them using his secret key. No one but the recipient can decrypt a message sent using his public key, not even the person who encrypted it.

PGP made it easy for the average computer jockey to use public-key cryptography to protect his or her electronic data and messages from snoops, be they government, criminal, or corporate. Zimmerman named his program Pretty Good Privacy as a folksy homage to Ralph's Pretty Good Grocery in Garrison Keillor's mythical Lake Wobegon. He proudly points out that breaking PGP would take "more computing resources than are currently available"--a mathematician's understated way of saying that there aren't enough computers on earth to break it.