Philip Zimmermann: The king of encryption reveals his fears for the protection of privacy
Phil Zimmermann at the V&A Museum in London. Photo: Frantzesco Kangaris for the Guardian
(Republished with translation from: The Guardian, “Philip Zimmermann: king of encryption reveals his fears for privacy”, by Juliette Garside @JulietteGarside, Monday 25 May 2015 17.02 BST)
The creator of PGP (Pretty Good Privacy) has moved his mobile encryption company, Silent Circle, to Switzerland to be free from mass surveillance in the U.S. In this article, he explains why.
When Philip Zimmermann campaigned for nuclear disarmament in the 1980s, he had an escape plan in his pocket. The inventor of the world's most widely used email encryption system, Pretty Good Privacy (better known as PGP), was ready to move his family from Colorado, USA, to New Zealand on short notice.
It never needed to happen, and the Zimmermanns never moved. Until this year. At 61, the Internet Hall of Fame and founder of the three-year-old mobile encryption startup Silent Circle, just left the U.S. for Switzerland. In the end, it wasn’t the nuclear threat that convinced him to leave his homeland, but the surveillance arms race.
“Every dystopian society has excessive surveillance, but now we see even Western democracies, like the US and England, operating in this way,” he warns. “We need to reverse this. People who are not suspected of committing crimes should not have their information collected and stored in a database. We don’t want to end up like North Korea.”
Zimmermann stopped in London to hold a reception at the Victoria & Albert Museum, where his cryptographic device, the Blackphone, was on display, along with the remains of a laptop that was destroyed on government orders by Guardian editorsbecause it contained a trove of secret documents leaked by Edward Snowden.
Philip Zimmermann is interviewed by the Guardian
YouTube video, duration 00:02:27
Philip Zimmermann and Snowden are 30 years apart in age, but their actions have shaped the privacy debate. Philip Zimmermann shifted his focus from campaigning against nuclear weapons to resisting government surveillance in 1991, when he released PGP for free online as an act of civil disobedience. His protest helped prevent legislation from being passed that would have forced software companies to build “backdoors” into their products, allowing the government to read encrypted communications at will (e.g., the Clipper chip).
The PGP user manual, written by Philip Zimmermann in 1991 and updated seven years later, is a striking foreshadowing of the mass surveillance methods eventually adopted by the NSA after 9/11. It warns us:
“Today, e-mail can be routinely and automatically scanned for interesting keywords, on a large scale, without anyone noticing. This is like fishing with driftnets.”
It will take another 20 years before Snowden's revelations bring these concerns to light for the broader public's attention. But when the former contractor at the NSA came into contact with journalists to help him become a whistleblower, he did so using PGP.
Numbers on the size of their customer base have not yet been released, but in discussions among well-informed venture capital investors you say that Silent Circle is expanding rapidly; at the beginning of the current year it raised $50 million in a second round of external financing. Among its supporters is also Ross Perot Jr., son of the 1992 U.S. presidential candidate.
Protesters support Edward Snowden, the NSA whistleblower, outside the US consulate in Hong Kong. Photo: Bobby Yip / Reuters
The second-generation Blackphone 2, priced at around $700, is due to be released later this year, and will likely be followed by a first attempt at a tablet computer (a “Blacktablet,” perhaps). Philip Zimmermann started the company with former U.S. Marine sniper Mike Janke, and the pair have had success selling their technology to special operations forces in the U.S., Canada, the U.K., and Australia. The Silent Phone and Silent Text, which allow secure voice calls and text messaging with Android and Apple devices, are even more popular, especially among journalists working in dangerous locations and businesses handling sensitive information.
Despite the Silent Circle pin on his lapel, Philip Zimmermann is less interested in talking about his products, instead he wants us to discuss the need to reverse what he calls the “golden age of surveillance” enjoyed by Western governments.
Silent Circle's move to Switzerland began during the Lavabit scandal. Lavabit was a company that provided an encrypted email service to 410,000 people, including Edward Snowden. In the summer of 2013, its founder, Ladar Levison, was served with a court order requiring the installation of surveillance equipment at his company. Despite protests, he ultimately decided to shut down the service and his company.
In Silent Circle they were scared. They also offered, together with voice and text communications, and email. The content was encrypted, but who, where and when of the messages (sender and recipient, and all metadata) was there for anyone who wanted to breach them and see them, either “illegal” or legally by court order. Thus, the email tool closed and their database was completely erased. The next step was the relocation to Geneva. “It is less likely that we will face legal pressure there than if we stayed in the USA”, says Philip Zimmermann.
On average among law-abiding citizens, activists like Zimmermann may seem a bit paranoid. Public support for Snowden in the United Kingdom was lukewarm compared to that in Germany, where the realities of life under a police state do not require much imagination.
British society is “very accepting of surveillance,” believes Philip Zimmermann. “Here people have a comfortable relationship with their own government and perhaps that is why they do not raise objections to it. Future governments that come to power may not be so nice, and if they inherit a surveillance infrastructure they could then use it to create a regime that cannot be changed.” (note: as is very characteristically done in the script of the film “V for Vendetta”)
It warns us about point-and-click prosecutions, about the “innocent” traffic control cameras and about facial recognition technology that can detect journalists who dine with whistleblowers or informants, political meetings with their mistresses, or even private individuals who drive after far too many beers.
Of course, Silent Circle's commercial interests are clearly served by discussing the threats to our privacy. Other internet pioneers have become billionaires, and Philip Zimmermann is looking for his own share of the digital goldrush. "If I could make some money from this, it wouldn't be such a big deal," he admits. "I'm getting older, so I have to think about these things."
PGP-encrypted email messages to prevent monitoring by third parties. Photo: Pawel Kopczynski / Reuters / Corbis
The secret life of PGP
His own life, Philip Zimmermann, is a lesson for what can happen to those who question the US's ability to gather information.
Born in New Jersey and raised in Florida, his father was a cement truck driver. There was no expectation that he would be able to go to college. But the boy wanted to be an astronomer. “My family was poor, sometimes we didn’t even have a house to live in, so I went to a lot of schools, and then when I went to college my life stabilized.”
Florida Atlantic University in Boca Raton didn’t have a mainframe computer. Its terminals, some with punchcards instead of screens, were connected via telephone lines to Miami. Zimmermann wrote his first program, teaching the computer to learn his name. “There was something really cool about the ghost inside the machine. The computer was a machine that could respond to a human.”
By 1980, he had moved to Boulder, Colorado, and was working as an IT consultant, but was spending 40 hours a week as a peace activist. In 1984, he met the famous astronomer Carl Sagan, the actor Martin Seen, and the Pentagon PapersDaniel Ellsberg – in a police station detention center. They had been arrested after their raid on the Nevada Test Site.
In April 1991, the coding community was alerted to a clause in the post-Gulf War Senate anti-terrorism bill S.266 (Comprehensive Counter-Terrorism Act of 1991), which allowed the government to obtain “the plain text content” of voice, data, and other communications, “upon appropriate judicial authorization.”
Zimmermann had, until then, designed PGP in his free time and released its source code in June of the same year. He hoped that if enough Americans began to protect their electronic mail, just as mail is protected with letters in envelopes, the related “intervention” legislation would have no meaning.
PGP works by assigning each user a pair of keys – a public one and a private one. The user shares their public key with the recipients of their messages – but messages sent to those who use it can only be decrypted with their private key. There is no central database of private keys to facilitate interception.
An engineer named Kelly Goen began distributing copies of PGP on file hosting computers. Fearing government intervention (prosecution and/or arrest), he took all the appropriate precautions. Instead of working from home, he drove around the San Francisco Bay Area with a laptop, a headset, and a cell phone. He would stop at a phone booth, load copies for a few minutes, and then log out and go to another phone booth.
Goen’s uploads were banned from websites in the US, but eventually PGP began to spread elsewhere. The clause was removed from Bill 266, but in February 1993, Zimmermann was visited by two agents. The government, it seems, was trying to prosecute him for illegal export of “munitions” (Export of cryptography from the United States). Strong encryption was considered a weapon under the law, and Zimmermann was the subject of a criminal investigation for three years before all charges against him were dropped.
Today, his biggest concern is not backdoors in software, but the petabytes (1 petabyte = 1 million gigabytes) of information that companies like Google and Facebook are amassing. “If you have all that data, it becomes an attractive resource. It’s the kind of thing that a siren calls out to someone to come and try to get it. Governments say that if it’s okay for private sector companies to have it, why can’t their intelligence agencies have it?”
At the end of the interview, Philip Zimmermann answers a question with a short video. “To do their job, the police need a little secrecy. But if they become too secretive, they can easily develop into a police state. I think a little bit of this secrecy needs to be cut.”
Before videotaping the message, remove the corporate pin from its feather. Zimmermann hopes to make some money, but for the father of email encryption, the policy still remains above trade.
