Phil Zimmermann: "No regrets" about developing PGP

  ------------------------------------------------------------------------

   * Date: Fri, 28 Sep 2001 12:40:47 -0400
   * To: politech@politechbot.com
   * Subject: FC: Phil Zimmermann: "No regrets" about developing PGP
   * From: Declan McCullagh <declan@well.com>

  ------------------------------------------------------------------------

Previous Politech message:

"PGP author Phil Zimmermann under fire for terrorist crypto use?"
http://www.politechbot.com/p-02548.html

----- Forwarded message from Sandy Sandfort <sandfort@mindspring.com> -----

From: "Sandy Sandfort" <sandfort@mindspring.com>
Subject: No Regrets About Developing PGP
To: "Cypherpunks" <cypherpunks@lne.com>
Date: Mon, 24 Sep 2001 07:59:50 -0700

C'punks,

Phil Zimmermann asked me to post this.  He would like it freely
disseminated, so feel free to post it wherever you wish.

 S a n d y

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

No Regrets About Developing PGP

The Friday September 21st Washington Post carried an article by
Ariana Cha that I feel misrepresents my views on the role of PGP
encryption software in the September 11th terrorist attacks.  She
interviewed me on Monday September 17th, and we talked about how I
felt about the possibility that the terrorists might have used PGP in
planning their attack.  The article states that as the inventor of
PGP, I was "overwhelmed with feelings of guilt".  I never implied
that in the interview, and specifically went out of my way to
emphasize to her that that was not the case, and made her repeat back
to me this point so that she would not get it wrong in the article.
This misrepresentation is serious, because it implies that
under the duress of terrorism I have changed my principles on the
importance of cryptography for protecting privacy and civil liberties
in the information age.

Because of the political sensitivity of how my views were to be
expressed, Ms. Cha read to me most of the article by phone before she
submitted it to her editors, and the article had no such statement or
implication when she read it to me.  The article that appeared in the
Post was significantly shorter than the original, and had the
abovementioned crucial change in wording.  I can only speculate that
her editors must have taken some inappropriate liberties in
abbreviating my feelings to such an inaccurate soundbite.

In the interview six days after the attack, we talked about the fact
that I had cried over the heartbreaking tragedy, as everyone else
did.  But the tears were not because of guilt over the fact that I
developed PGP, they were over the human tragedy of it all.  I also
told her about some hate mail I received that blamed me for
developing a technology that could be used by terrorists.  I told her
that I felt bad about the possibility of terrorists using PGP, but
that I also felt that this was outweighed by the fact that PGP was a
tool for human rights around the world, which was my original intent
in developing it ten years ago.  It appears that this nuance of
reasoning was lost on someone at the Washington Post.  I imagine this
may be caused by this newspaper's staff being stretched to their
limits last week.

In these emotional times, we in the crypto community find ourselves
having to defend our technology from well-intentioned but misguided
efforts by politicians to impose new regulations on the use of strong
cryptography.  I do not want to give ammunition to these efforts by
appearing to cave in on my principles.  I think the article correctly
showed that I'm not an ideologue when faced with a tragedy of this
magnitude.  Did I re-examine my principles in the wake of this
tragedy?  Of course I did.  But the outcome of this re-examination
was the same as it was during the years of public debate, that strong
cryptography does more good for a democratic society than harm, even
if it can be used by terrorists.  Read my lips: I have no regrets
about developing PGP.

The question of whether strong cryptography should be restricted by
the government was debated all through the 1990's.  This debate had
the participation of the White House, the NSA, the FBI, the courts,
the Congress, the computer industry, civilian academia, and the
press.  This debate fully took into account the question of
terrorists using strong crypto, and in fact, that was one of the core
issues of the debate.  Nonetheless, society's collective decision
(over the FBI's objections) was that on the whole, we would be better
off with strong crypto, unencumbered with government back doors.  The
export controls were lifted and no domestic controls were imposed.  I
feel this was a good decision, because we took the time and had such
broad expert participation.  Under the present emotional pressure, if
we make a rash decision to reverse such a careful decision, it will
only lead to terrible mistakes that will not only hurt our democracy,
but will also increase the vulnerability of our national information
infrastructure.

PGP users should rest assured that I would still not acquiesce to any
back doors in PGP.

It is noteworthy that I had only received a single piece of hate mail
on this subject.  Because of all the press interviews I was dealing
with, I did not have time to quietly compose a carefully worded reply
to the hate mail, so I did not send a reply at all.  After the
article
appeared, I received hundreds of supportive emails, flooding in at
two
or three per minute on the day of the article.

I have always enjoyed good relations with the press over the past
decade, especially with the Washington Post.  I'm sure they will get
it right next time.

The article in question appears at
http://www.washingtonpost.com/wp-dyn/articles/A1234-2001Sep20.html

 -Philip Zimmermann
 24 September 2001
 (This letter may be widely circulated)

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.3

iQA/AwUBO69F2sdGNjmy13leEQIn+QCg2DjDeyibtRe61tUSplSAobdzAqEAoOMF
ir3lRc4c1D/0Mmmv/JtP/E73
=HmRO
-----END PGP SIGNATURE-----

----- End forwarded message -----

-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
Declan McCullagh's photographs are at http://www.mccullagh.org/
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------