When Philip Zimmermann was campaigning for nuclear disarmament in the 1980s, he kept an escape plan in his back pocket. The inventor of the world’s most widely used email encryption system, Pretty Good Privacy – more commonly known as PGP – was ready to move his family from Colorado to New Zealand at a moment’s notice.
The button was never pressed and the Zimmermanns stayed put. Until this year, that is. At 61, the Internet Hall of Fame inductee and founder of three-year-old mobile encryption startup Silent Circle has just left the US for Switzerland. In the end, it was not the nuclear threat that convinced him to leave his homeland, but the surveillance arms race.
“Every dystopian society has excessive surveillance, but now we see even western democracies like the US and England moving that way,” he warns. “We have to roll this back. People who are not suspected of committing crimes should not have information collected and stored in a database. We don’t want to become like North Korea.”
Zimmermann stopped in London to host a reception at the Victoria & Albert Museum where his cryptographic handset, the Blackphone, is currently on display, alongside the remains of a laptop destroyed on government orders by Guardian editors wielding angle grinders, because it contained a trove of secret documents leaked by Edward Snowden.
Zimmermann and Snowden are 30 years apart in age, but their actions have framed the privacy debate. Zimmermann switched his focus from campaigning against nuclear weapons to pushing back on state snooping in 1991, when he released PGP for free over the internet in an act of political defiance. His protest helped prevent legislation which would have forced software companies to insert “backdoors” in their products, allowing the government to read encrypted messages.
The user manual for PGP, written by Zimmermann in 1991 and updated seven years later, is a startling prediction of the mass surveillance methods that were eventually adopted by the NSA after 9/11. It warns:
Today, email can be routinely and automatically scanned for interesting keywords, on a vast scale, without detection. This is like driftnet fishing.”
It would take a further 20 years before Snowden’s revelations brought these concerns to the attention of the wider world. But when the former NSA contractor reached out to the journalists who would help him blow the whistle, he did so using PGP.
No customer numbers have been released, but the chatter among well-placed venture capitalists is that Silent Circle is expanding fast – earlier this year it raised $50m (£32m) in a second round of outside funding. Its backers includes Ross Perot Jr, son of the 1992 US presidential candidate.
The second generation Blackphone 2, costing around $700, is on its way this year, and will be followed by a first attempt at a tablet computer. Zimmermann started the company with former US navy seal sniper Mike Janke and the pair have been successfully selling their technology to special operations forces in the US, Canada, the UK and Australia. The Silent Phone and Silent Text apps, which allow secure voice calls and text messages over Android and Apple handsets, are even more popular, particularly with journalists working in dangerous places and businesses handling sensitive information.
Despite the Silent Circle pin in his jacket lapel, Zimmermann is less interested in talking about his products than discussing the need to push back against what he calls the “golden age of surveillance” being enjoyed by western governments.
Silent Circle’s move to Switzerland was prompted by the Lavabit affair. Lavabit provided an email service for 410,000 people, including Edward Snowden. In the summer of 2013, its founder, Ladar Levison, was served with a court order requiring the installation of surveillance equipment. Despite protests, he decided to close his service.
Silent Circle took fright. Along with voice and text it offered email. The content was encrypted, but the who, where and when of messages was there to be hacked or extracted by court order. So the email tool was shut down and its database wiped. The next step was relocation to Geneva. “We are less likely to encounter legal pressures there than in the US,” says Zimmermann.
To the average law-abiding citizen, campaigners such as Zimmermann might seem a little paranoid. Public support for Snowden in the UK was tepid compared to Germany, where the realities of living under a police state require no leap of imagination.
British society is “too accepting of surveillance”, Zimmermann believes. “Here people have a comfortable relationship with their own government and maybe that’s why they don’t raise objection to it. Future governments that come to power might not be so nice, and if they inherit a surveillance infrastructure then they could use this to create an incumbency that cannot be changed.”
He warns of point-and-click prosecutions, with traffic cameras and facial recognition detecting journalists lunching with whistleblowers, politicians meeting mistresses, or private citizens getting behind the wheel of a car after one too many pints.
Of course, Silent Circle’s commercial interests are clearly served by talking up the privacy threat. Other internet pioneers have become billionaires and Zimmermann is prospecting for his own share of the digital goldrush. “If I made some money from this it wouldn’t be such a terrible thing,” he admits. “I’m getting older now so I have to think about such things.”
The secret life of PGP
Philip Zimmermann’s own life is a lesson in what can happen to those who challenge the US’s ability to gather information.
Born in New Jersey and brought up in Florida, his father was a cement truck driver. There was no expectation he would go to university. But the boy wanted to be an astronomer. “My family was poor, sometimes we didn’t have a place to live, so I went to many schools, and then when I went away to college my life settled down.”
Florida Atlantic University in Boca Raton did not have a mainframe computer. Its terminals, some with punchcards instead of screens, were connected by phone lines to Miami. Zimmermann wrote his first program, teaching the computer to learn his name. “There was something really cool about the ghost in the machine. The computer was a machine that could react to a human.”
By the 1980s he had moved to Boulder, Colorado, and was working as an IT consultant, but spending 40 hours a week as a peace activist. In 1984, he met the celebrity astronomer Carl Sagan, the actor Martin Sheen and the Pentagon Papers whistleblower Daniel Ellsberg – in a police jail. They had been arrested after breaking into the Nevada nuclear test site.
In April 1991, the coding community was alerted to a clause in the post-Gulf war anti-terrorism Senate bill 266, that allowed the government to obtain “the plain text contents” of voice, data, and other communications “when appropriately authorised by law”.
Zimmermann had by then designed PGP in his free time and agreed to the release of his source code in June of that year. The hope was that if enough Americans began protecting their electronic mail, just as postal mail is protected by envelopes, the legislation would become pointless.
PGP works by assigning each user a pair of keys – one public and one private. The user shares their public key – but any messages sent to them using it can only be decrypted by their private key. There is no central database of private keys to facilitate snooping.
An engineer called Kelly Goen began seeding copies of PGP to host computers. Fearing a government injunction, he took every precaution. Instead of working from home, he drove around the San Francisco bay area with a laptop, acoustic coupler and a mobile phone. He would stop at a payphone, upload copies for a few minutes, then disconnect and head for the next phone.
Goen’s upload had been restricted to US sites, but eventually PGP began circulating elsewhere. The offending clause was dropped from bill 266, but in February 1993 Zimmermann was visited by two customs agents. The government, it seemed, was bent on prosecuting him for the illegal export of “munitions”. Strong cryptography was at the time considered a weapon under US law and Zimmermann was the subject of a three-year criminal investigation before the charges were dropped.
Today, his biggest worry is not software backdoors, but the petabytes (1m gigabytes) of information being hoarded by the likes of Google and Facebook. “If you collect all that data, it becomes an attractive nuisance. It’s kind of a siren calling out inviting someone to come and try to get it. Governments say that if private industry can have it, why can’t our intelligence agencies have it?”
At the end of the interview, Zimmermann answers the question in a short video. “A certain amount of elbow grease has to be expended when the police do their work. If it becomes too frictionless, you can slide more easily into a police state. I think we should restore a little bit of that friction.”
Before recording the message, he has removed his corporate lapel pin. Zimmermann hopes to make money, but for the father of email cryptography, the political still trumps the commercial.
Comments (…)
Sign in or create your Guardian account to join the discussion