Phil Zimmermann, Cyber Rebel

[an366601@anon.penet.fi (** CRAM **)]

brought to you by CRAM

===cut=here===

Cyber Rebel
by Maureen Harrington
Denver Post Sunday Empire Section
March 3, 1996

Boulder -- On a frigid Thursday morning in January, attorney
Philip DuBois received a fax in his Boulder office from the
Justice Department telling him the criminal investigation of
his client, computer engineer Philip Zimmermann, had been
dropped. It had been a nerve-racking three years for
Zimmermann, his family, friends, and the high-powered legal
team that had been advising him. Hailed as a folk hero and
cybersaint, Zimmermann had become a cause celebre in the
computer world. But he was Public Enemy No. 1 in the
intelligence community. No one would say why the feeds had
dropped their case against him, but many speculated that the
government didn't want to make Zimmermann the first digital
martyr.

Zimmermann's crime? In the early summer of 1991, he gave
away software he designed to scramble, or encrypt, computer
e-mail messages. It was intended to circumvent a critical
shortcoming of the Internet. Since its inception, the
international computer network had been a virtual sieve that
could be siphoned by anyone with a modem. Encryption had
always been a concern of the military and diplomatic corps,
but with the advent of the Internet, protecting information
became a commercial concern. Industry and individuals were
having enormous problems keeping their communications
private.

Zimmermann's software, going by the aw-shucks name of Pretty
Good Privacy, or PGP, solved that problem. He gave the
formula to a friend, who put it out on the Internet, making
it possible for an ordinary citizen to have a private
conversation on-line.

PGP sounds innocent enough. It's sort of an electronic
envelop to protect computer messages. Based on a
mathematical formula, it uses two "keys"--one private, used
only by the individual, and one public, given to anyone.
Each user has a unique set of keys and a digital "signature"
ensuring the reader that the people generating the messages
are really who they say they are.

Zimmermann intended his program to give individuals "the
right to be let alone," as Justice Louis D. Brandeis called
the privilege of privacy. But, his act has had an enormous
impact on the government, computer culture, and the
individuals who use and misuse the technology. Phil
Zimmermann's name may go down in cyberspace history--
whether as a hero or a villain.

PGP made Zimmermann's name a rallying cry for people who
don't want the government reading their e-mail-- and odd
coalition of civil libertarians, the Christian right and
computer professionals. But it also set off a firestorm in
the nation's house of spooks, the National Security Agency,
and lighted a fire under the FBI. Computer crime specialist
William Spernow predicts that criminals will be routinely
encrypting information within two years, making criminal
investigations doubly hard. As far as the surveillance
community was concerned, Zimmermann was the Antichrist,
making it possible for terrorists, pedophiles and drug lords
to flourish behind a shield for messages the super-computers
of the NSA couldn't crack.

Zimmermann acknowledges that his handiwork might be used for
criminal purposes. But the fuel of his motivation was moral
outrage at a government that may spy on its citizens. By
giving away PGP, the designer felt he could strike a pre-
emptive blow before the government made encryption illegal.
As it turns out, he made his move just in time.


Zimmermann, whether a folk hero or an aider and abettor of
criminals, is a man no one would pick out as a cyberspace
guerrilla.

John Perry Barlow, one of the founders of Electronic Freedom
Foundation, an influential cyberspace civil rights group,
describes him as "an apparently unformidable gnome on a
tight budget (who) now terrifies a security monolith which
required half a century, uncounted billions of dollars and
the collective IQs of a few thousand geniuses to develop."

Zimmermann didn't come out of one of the powerhouses of
academia. He went to Florida Atlantic University, where he
admits that his original major, physics, "was to hard. The
calculus got me."  He's definitely the odd man out with just
an undergraduate degree in a field crawling with Ph.D.s.  He
never joined one of the prestigious think tanks or labs on
the coasts. He's been in Boulder for nearly 20 years, on his
own, without benefit of grants. The Massachusetts Institute
of Technology distributes PGP and published "The Official
PGP Users Guide," but Zimmermann isn't one of their own.

Steve Welch, who's known Zimmermann since college and later
went into a boutique computer business with him that went
bust in the `80's, said, "I met Phil one night about 2 a.m.
in the computer room at college. He knew nothing about
computers. He'd just come over from the physics department.
Within one week, he was a better programmer than I was."

Zimmermann suffered the loneliness of many smartest-in-the-
class kids, along with the pain of a bleak childhood with
alcoholic parents. "We moved a lot. I went to a lot of
schools, and I think I got interested in cryptology then. I
played around with it myself."

"I thought I was a smart guy, figuring out codes, until I
read enough in the field to see how bad I really was," he
said, looking back from the safe distance of success.
Zimmermann claims he isn't humble, but he is quick to point
out, "I'm not the best cryptographer in the would. I figured
that out pretty quickly. But I'm probably the most famous."
He is powerful because of the fame. But he's more than a
little skittish about that.

"I think I've been effective with very few resources, so I'd
like to see what I could do with a company where I could
afford to have people working full time. But it's the power
structure I've been questioning most of my life, so I'm wary
of it... being seduced by it."


Watergate was the incubator of Zimmermann's political
awareness.

"I began to question a lot of things that government does
during that time. I worked for a year on a rape crisis
center line and I think... in some ways, I became more of a
humanist."

Graduating with a degree in computer science, Zimmermann and
his wife moved at the urging of friends to Boulder in 1978.
It was in that politically volatile environment that
Zimmermann became aware of the threat of nuclear
proliferation.

"In the early `80s we were ready to relocate to New
Zealand," he recalled. "We'd had our first child. I began to
think about the future and the threats to that future. We
had our visas and work papers all ready when we attended a
conference on the nuclear threat, in Denver." It was a
speech by Daniel Ellsberg that changed the Zimmermanns'
minds. "We decided to stay and fight," he said.

And fight he did. He began as any techno-wonk would, by
learning everything he could about the issues. Zimmermann
read military strategy and listened to the thinkers in the
opposition. He felt that too often the left refused to know
anything about those who disagree with them

"That makes you weak," he said.

The left was technophobic, as well. It became clear to
Zimmermann that the right had some real firepower. The
republicans had made very good use of computers in the 1984
campaign. To prevail, the newly minted activist realized
that the movement had to use everything in its power. And
that included computers.

Chet Tchozewski doesn't see as much of Phil as he did during
the `80s when both men were immersed in the nuclear freeze
community in Boulder, but he has watched Zimmermann's career
with interest and pride.

"Phil was invaluable to us," said Tchozewski. "Not only as a
speaker, at which he was very good, but because of his
technical knowledge and his remarkable intellectual
capacities. He asked very tough questions. He started a
study group and then he contributed his technical
expertise."

Tchozewski, now running the Boulder-based Global Green
Grants Fund, says that Zimmermann was arrested twice at anti-
nuclear demonstrations, but he thinks Zimmermann has been
more sorely tested in recent years.

"The first thing you see in Phil is his brightness, but it's
his integrity that is even more striking to me. Imagine the
courage it took not to cave in to the government. Imagine
what it took for this guy to give away PGP-- to walk away
from money-- what most people consider success. He took the
risk for something he believed in. He could work for big
industry or the government, but he doesn't."

"Phil may be gifted in computers, but clearly he's thought
deeply about civil disobedience and is influenced by Gandhi
and Thoreau, as well as by science."

Zimmermann did take the risk. He had begun thinking about
encryption after realizing that the government was breaking
into radical organizations.

"Mostly they were taking floppy disks with membership
information. It didn't take much to know we needed to keep
our communications secret. So I began to read the scholarly
papers on the subject and knew that some of the original
problems of encryption had been solved in the `70's by two
scholars at Stanford. I began to work on the problems."

One of the people Zimmermann contacted for help was Charlie
Merritt, a cryptographer in Arkansas. Merritt and his wife,
Hobbit, had made their own encryption program years earlier.

"We were selling encryption software abroad-- there wasn't
much use for it in the U.S. then, but a lot of foreign
customers were interested," said Merritt. "The NSA shut us
down. Pretty near ruined us. I'd been holding a grudge for
years, when Zimmermann called me. I was happy to help."

For two years, Zimmermann and Merritt talked on the phone.
Eventually Merritt spent a week in Boulder and showed
Zimmermann how to run the enormous series of numbers
necessary to create PGP. They continued to talk on the phone
until the program was nearly completed.

Hobbit Merritt added, "I think that the success of PGP is
due in part to the growing anti-government feeling in the
country. There are so many people-- conservative, liberal,
all kinds-- who have an uneasy feeling about the
government."

By 1990 Zimmermann had most of the pieces for PGP, but he
hadn't put it together. So he bit the bullet, taking on very
little consulting business and working seven 12-hour days a
week on the encryption program. It took him six months and
he missed five mortgage payments during that time. "I'm
pathologically optimistic," he said. "I had no idea it would
take that long."

In the middle of the process the government proposed Senate
Bill 266, which would essentially outlaw all private
encryption. Zimmermann knew then that he was in a  race with
the government. He beat them. In the summer of 1991, PGP was
posted on the Internet. He didn't post it himself, since "I
didn't know anything about the Internet, then. I barely knew
how to get e-mail."

The legislation has not become law, but the government is
still working on encryption standards. However, the battle
may have been lost-- partly because of Zimmermann. He
estimate there are 1 million users of PGP worldwide.

Early in 1993, Zimmermann got a call from U.S. customs
agents in San Jose, Calif. He thought they were asking for
his help. When he realized they were investigating him,
Zimmermann hired Phil DuBois, a criminal defense lawyer with
high-tech expertise practicing in Boulder. DuBois made an
unusual decision: He let Zimmermann talk to the agents.
"Usually I don't allow my clients to talk to law enforcement
agents. It's not to their benefit, since they've already
decided that my client is guilty. But Phil is so clearly not
a criminal that I let him talk with them."

The investigation intensified and it became clear to DuBois
and his client that they were investigating with the intent
to prosecute. It was then that Zimmermann put together a
team of lawyers across the country who worked on the case
pro bono.

"Phil has a genius for pulling really talented people around
him," DuBois said. "Most of us worked on this case because
we're concerned about the rights to privacy being violated,
but it's also an exciting legal case."

DuBois estimates that the bill would have been in the low-
to mid-six figures if everyone had charged for their work.
There is a legal defense fund for Zimmermann that, according
to DuBois, has brought in $1 contributions as well as a
$10,000 anonymous donation. It has reached the mid-five-
figure range.


Stewart A. Baker, chief counsel for the NSA, has written
about PGP in Wired magazine, the bible of the digitally
inclined. In his view, the fight for private Internet
communication has its dark side.

"Rather than rely on laws to protect us, (supporters of PGP)
say let's make wiretapping impossible. ... This sort of
reasoning is the long-delayed revenge of people who couldn't
go to Woodstock because they had too much trig homework. ...
Some argue that widespread availability (of PGP) will help
Latvian freedom fighters today (but) one of the earliest
users of PGP was a high-tech pedophile."

Zimmermann acknowledges the possible ugly uses of his
program.

"I've spent some sleepless nights worrying about what this
could be used for. I know that some evil is done, but I
believe that there is a greater good served here-- the right
to privacy."

"Law enforcement says that they need to be able to read
computer messages, just as they tap phones. However, they
have to have more ways to investigate than just tapping.
Criminals leave their footprints in the real world."

"I'm sickened by some of the people using this, but I have
to remember the Burmese freedom fighters using it to survive
and the scientists doing important work that needs to be
kept safe."

In a worst-case scenario of the investigation, the 42-year-
old software designer, husband and father of two would have
faced up to five years in prison and been forced to pay $1
million in fines.

Zimmermann was accused of breaking export laws-- of sending
across international borders what the G-men considered the
same as munitions or nuclear secrets. Zimmermann was seen by
his government as an intellectual gun-runner and threat to
western civilization. Jim Kallstrom, the FBI agent who has
been in charge of computer crime, has said about PGP, "Do we
want a digital superhighway... where major criminals can
operate impervious to the legal process?"

By setting PGP loose on the Internet, Zimmermann was accused
of sending his program across borders with[out] a license.
Of course, the law enforcement community was talking about
geographic borders. Defining cyberspace borders is far
trickier, let alone figuring out how to police them. That
would be the legal sticking point as the investigation
progressed.

The very right to privacy that Zimmermann had sought to
protect is akin to the privilege that President Clinton
invoked when he sought to keep his conversations with his
attorney private during the Whitewater investigations.
Ironically, it is the Clinton administration that has been
giving Zimmermann trouble.


It all began with the Clipper Chip.

Clipper is the technology offered by the government,
designed by the NSA, to encrypt messages, but with a "back
door" through which the government can gain access to read
the coded messages. Individuals and businesses that use the
Clipper would give the government a "key" to their encrypted
messages, allowing law enforcement the same right they have
now to tap phones. The government insists that any business
doing work for them use the Clipper, effectively forcing
them to allow the feds access to their communications.

Zimmermann is one of thousands of computer technocrats who
find that idea ludicrous. And dangerous: "If we let the
government go on in that blind way, we'll have a
surveillance society. And a watched society is a conformist
society. We will have totalitarianism if we don't guard
against it."

As Barlow put it, allowing the government to monitor your
computer communications is like "having a peeping Tom
install your window blinds."

Thousands of computer professionals have signed letters and
petitions decrying the use of Clipper. With Vice President
Al Gore's enthusiasm for the information highway and so many
allies in the computer business, the industry was taken by
surprise when Gore and the administration supported the
Clipper Chip. But then along came PGP. Within hours of
posting PGP on the Internet, the code was sent all over the
world, for anyone's use. That's what upsets the U.S.
government, in particular the NSA.

The super-secret intelligence arm of the U.S. government,
the NSA spends nearly $1 million an hour, $8 billion a year,
on around-the-world eavesdropping. They monitor computers,
phone lines, faxes, and telexes. With the defrosting of the
Cold War, NSA has had to rethink its priorities. Who was it
supposed to be listening to? On top of that was the
frustration of a whole new generation of eavesdropping-proof
technologies such as fiber-optic cable and the pesky PGP.
Zimmermann's stonewalling software was one problem too many.

NSA staffer Clint Brooks used to speak alongside Zimmermann
at privacy convention panels, but the agency now has gone
silent on PGP. According to a spokeswoman, "The agency does
not wish to comment on Mr. Zimmermann's personality,
business or other endeavors. We make no comments about
private encryption. We have nothing to say about the
investigation of Mr. Zimmermann."

At a conference on privacy at CU-Boulder in 1994, Dorothy
Denning, a proponent of the Clipper and chair of computer
sciences at Georgetown University in Washington, D.C.,
defended the chip. She told the crowd that the government
requests fewer than 1,000 wiretaps a year and the Clipper
"wouldn't make it any easier to tap phones, let alone
computer networks."

Denning insists that if the government had no key to
encrypted information too many criminals and terrorists
would find their work easier.

Marc Rotenberg, an expert on privacy and a lawyer for the
Electronic Privacy Information Center, or EPIC, sees
Zimmermann in quite a different light: "It's significant
that one person who sticks by his principles can make the
U.S. government back down. That doesn't happen every day.
The decision (to discontinue the investigation) doesn't
(establish a judicial precedent)... but it may mean the
government will be more careful in considering future
prosecutions."

Rottenberg says the Zimmermann case has forced the public to
raise questions about the role of the NSA in regulating
encryption, and "perhaps he has helped our government take a
look at outdated laws that were drawn up in the Cold Ware
era. Society is changing. Because of the Internet,
encryption is needed not just for the military, but also by
commercial interests as well as individuals. Phil
Zimmermann's actions and stand will affect policy, in my
opinion."

On the other side of the coin, Kallstrom, the FBI agent who
has been involved in the Zimmermann case, sees him as
helping criminals do their worst. However, Kallstrom added,
"Phil Zimmermann is very charming and well-intentioned. If
he would work for government wages we'd be happy to have
him."


Several days after leaning that the federal government was
dropping its investigation, Zimmermann is having a helluva
day. It's his 42nd birthday. He's leaving for Iceland
tomorrow, then on to Monte Carlo with a final stopover in
Paris.

"Only I would go to Iceland in February," he says on this
Monday morning. He'll be speaking on privacy and seeing
bankers, venture capitalists and other cryptologists.

He'd like to squeeze in the Louvre. He's never been to
Paris. He's taking his wife, Casey. She stood by him through
some tough years, waiting to see if he was going to be
spending time in prison, with no idea of what the future
held.

Zimmermann's future is finally here, now that the feds have
thrown in the towel and he's free to get on with his life.
And he's not missing one nanosecond of his 15 minutes.

There was a party in his honor the previous Saturday night.
He's been up since 9 a.m. having his picture taken,
something he's done an average of once a week for two years
since his case hit the media. Venture capitalists from
Atlanta, a genial father-and-son duo, flew in for a brief
dinner with him on Sunday night and 20 minutes of his time
Monday morning. They came bearing a gift: a black glove-
leather motorcycle jacket with a Harley Davidson logo. The
gift must have set them back $500. There's millions more
dollars where that came from, and they'd like to give some
to Zimmermann to help fund his new business.

The new company is going to make PGP look like small
potatoes, according to Zimmermann. He says he has developed
an encryption program for telephones. This software
application will make phone tapping virtually impossible.

"It'll have the government going ballistic," crows
Zimmermann. The uses are unlimited, especially if it's
inexpensive, impenetrable and easy to use. So far, the test
model has fulfilled all those criteria. The word is out and
entrepreneurs are coming out of the woodwork.

Zimmermann's pace has accelerated. He can hardly answer his
e-mail and admits that every once in a while when the voice
mail is out of hand he just dumps it all and assumes anyone
with something important to say will call back. On his phone
answering tape, he patiently explains that he can't help
everyone who calls him for help with PGP.

He's tired of "the guys who think they see black
helicopters, but I have had some extraordinary conversations
with people using PGP." He may have to take his `60s vintage
Volkswagen bus to the shop to be fixed. He used to fix it
himself.

Even though his schedule has gone into warp speed,
Zimmermann is finding the time to do a few things for
himself. A little absent-minded, perennially rumpled, with
curly hair and beard, he's decided to throw of the sartorial
schackles and become "Phil Zimmermann: Bad Boy
Cryptologist." He laughs, but he's not kidding. He loves
that motorcycle jacket.

"After all this attention and tension," he says, "I just
want to do some things for fun. I've been wearing a suit and
being careful of what I say and how I appear because of this
investigation. Now it's time for some other things."

Ever since the feds dropped their investigation Jan. 11,
he's been spending time in fancy hotels in Silicon Valley,
listening to CEOs woo him and consulting with the behemoths
of technology.

"It's a lot of fun," he says, a bit incredulous. "Guys who
have run huge companies want to talk to me."

Zimmermann may have become familiar with the toys and
terrain of the Silicon Valley potentates and he may miss the
Louvre if the French bankers demand all his attention, but
Saturday night was like old times.

His wife threw a "Phil Got Off the Hook Party" at the Rocky
Mountain Peace Center, a funky meeting hall for lefties.

It was a gathering of peacenik friends from his nuclear
protest days, family and lawyers. Guys with shoulder-length
hair scarfed potluck casseroles and talked gigabytes. It
ended early. The kids had to get up to bed. Phil cleaned up,
recycling the trash, and carefully bagging the leftovers.


(Mareen Harrington is the staff writer for Empire Magazine)


Sidebar: PGP was huge leap forward for cryptography

Historically cryptology has been the realm of spies. It was
the veil drawn over military secrets and diplomatic pouches.
The cracking of the super-secret Nazi code Enigma by the
Allies helped win the Second World War.

With the invention of cyberspace, the need to identify
message senders and to send messages so that others cannot
read them has become a necessity in business and personal
lives. The shift was created by the computer, fax, and phone
communications. It has become increasingly obvious that
almost anyone can listen to or read information from these
sources.

Two-key cryptography, one of the most important advances in
the field and which made PGP possible, was discovered by
Whitfield Diffie and Martin Hellman, professors at Stanford
University. In this system every user has two keys. The
first is a public one, given out to correspondents. The
second is a private one, kept by the individual. Before,
there had been a third party, a key manager, who kept the
keys. In two-key cryptography there is no their party to be
trusted.

After Diffie and Hellman published their findings in 1976,
three MIT mathematicians developed a system to put two-key
cryptography into practice. Their company is called RSA.

Philip Zimmermann came along in the 1980s, took the
information others had developed and created PGP.

Using the software's public key, one individual can send a
scrambled message with his digital signature to another.
That person will use his private key to unscramble the
message. As Diffie and Hellman predicted, there is no need
for a trusted third party.

Zimmermann has published his code system in book form so
that it can be examined by anyone. Despite that publication,
no one has been able to break the code, since it is longer
and more complicated than even the most sophisticated of the
known government encryption formulas. Because no one has
been able to break the code, users of PGP know that it is
trustworthy-- so far.



 \   \   \   \   \   \   \   \   \   |   /   /   /   /   /   /   /   /   /   /
          _______       ________          _____        _____  _____
         ///   \\\      |||   \\\        /// \\\       |||\\\///|||
        |||     ~~      |||   ///       |||   |||      ||| \\// |||
        |||     __      |||~~~\\\       |||~~~|||      |||  ~~  |||
         \\\   ///      |||    \\\      |||   |||      |||      |||
          ~~~~~~~       ~~~     ~~~     ~~~   ~~~      ~~~      ~~~
 /   /   /   /   /   /   /   /   /   |   \   \   \   \   \   \   \   \   \   \

C y b e r s p a t i a l  R e a l i t y  A d v a n c e m e n t  M o v e m e n t
--****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION***
Your e-mail reply to this message WILL be *automatically* ANONYMIZED.
Please, report inappropriate use to                abuse@anon.penet.fi
For information (incl. non-anon reply) write to    help@anon.penet.fi
If you have any problems, address them to          admin@anon.penet.fi