Zimmermann uploads PGP, the government calls it a weapon, and the argument lasts five years

JUN 05 1991 · 12:00

Video: Phil Zimmerman, 'father' of online privacy and winner of the cryptowars against the US - Newsnight Date: 1991-06-05 · Type: primitive · Hub: bay-area · Tags: phil-zimmermann, pgp, encryption, ITAR, munitions, code-is-speech, 1991, bay-area The source code was published as a book to prove that a munition could be a manuscript. Phil Zimmermann uploaded PGP 1.0 to a PeaceNet bulletin board on 5 June 1991, and within hours friends were mirroring it abroad. The package — public-key encryption, suddenly free, suddenly small enough to email — was a direct response to Senate bill S.266, which would have required key-escrow back doors in commercial cryptography. Zimmermann's act was deliberately preemptive: if S.266 passed, a backdoor-free implementation would already be in the wild and impossible to retrieve. In early 1993 the U.S. Customs Service opened a criminal investigation under the Arms Export Control Act. At the time, strong cryptography was classified as a Category XIII munition alongside tanks and fighter aircraft. The investigation ran three years and produced no charges. The cypherpunks watched it closely, because the outcome was going to determine whether the manifesto's program was legal. To circumvent the export ban while the case proceeded, MIT Press in 1995 published the entire PGP source code as an 808-page book — printed matter, exportable under First Amendment protection, scannable back into software by anyone with patience and a flatbed scanner. The gesture was partly legal strategy and partly performance: it made the absurdity of the munitions classification visible in the most literal possible form. The Justice Department dropped the case in January 1996. The lesson the cypherpunks extracted — that code is speech, that the state's regulatory categories would not survive contact with determined engineers and sympathetic lawyers — would become the operating assumption of the Bernstein case and, eventually, of the entire open-source cryptographic ecosystem. Facts • PGP 1.0 released 5 June 1991 via PeaceNet BBS • Cryptography classified as ITAR Category XIII munition at time of release • U.S. Customs Service criminal investigation opened January 1993; dropped January 1996 without charges • PGP Source Code and Internals (MIT Press, 1995) — 808-page book of source code exploiting the printed-matter export exemption • Zimmermann founded PGP Inc. 1996; later acquired by Network Associates, then Symantec Primary Documents • Phil Zimmermann — Wikipedia — https://en.wikipedia.org/wiki/Phil_Zimmermann • Phil Zimmermann personal site — https://philzimmermann.com/EN/background/index.html