Philip Zimmermann and 'Guilt' Over PGP

Philip R. Zimmermann, creator of PGP, was quoted in a recent Washington Post article as saying he has been "overwhelmed with feelings of guilt" about the use of PGP by suspected terrorists. Zimmermann says the story was not entirely accurate, and has written a response to it (below) that he hopes will clear things up. He has also consented to a Slashdot interview, so please post any questions you have for him. As usual, we'll send 10 of the highest-moderated ones to Zimmermann by email, and post his replies verbatim as soon as we get them back.

No Regrets About Developing PGP

The Friday September 21st Washington Post carried an article by Ariana Cha that I feel misrepresents my views on the role of PGP encryption software in the September 11th terrorist attacks. She interviewed me on Monday September 17th, and we talked about how I felt about the possibility that the terrorists might have used PGP in planning their attack. The article states that as the inventor of PGP, I was "overwhelmed with feelings of guilt". I never implied that in the interview, and specifically went out of my way to emphasize to her that that was not the case, and made her repeat back to me this point so that she would not get it wrong in the article. This misrepresentation is serious, because it implies that under the duress of terrorism I have changed my principles on the importance of cryptography for protecting privacy and civil liberties in the information age.

Because of the political sensitivity of how my views were to be expressed, Ms. Cha read to me most of the article by phone before she submitted it to her editors, and the article had no such statement or implication when she read it to me. The article that appeared in the Post was significantly shorter than the original, and had the abovementioned crucial change in wording. I can only speculate that her editors must have taken some inappropriate liberties in abbreviating my feelings to such an inaccurate soundbite.

In the interview six days after the attack, we talked about the fact that I had cried over the heartbreaking tragedy, as everyone else did. But the tears were not because of guilt over the fact that I developed PGP, they were over the human tragedy of it all. I also told her about some hate mail I received that blamed me for developing a technology that could be used by terrorists. I told her that I felt bad about the possibility of terrorists using PGP, but that I also felt that this was outweighed by the fact that PGP was a tool for human rights around the world, which was my original intent in developing it ten years ago. It appears that this nuance of reasoning was lost on someone at the Washington Post. I imagine this may be caused by this newspaper's staff being stretched to their limits last week.

In these emotional times, we in the crypto community find ourselves having to defend our technology from well-intentioned but misguided efforts by politicians to impose new regulations on the use of strong cryptography. I do not want to give ammunition to these efforts by appearing to cave in on my principles. I think the article correctly showed that I'm not an ideologue when faced with a tragedy of this magnitude. Did I re-examine my principles in the wake of this tragedy? Of course I did. But the outcome of this re-examination was the same as it was during the years of public debate, that strong cryptography does more good for a democratic society than harm, even if it can be used by terrorists. Read my lips: I have no regrets about developing PGP.

The question of whether strong cryptography should be restricted by the government was debated all through the 1990's. This debate had the participation of the White House, the NSA, the FBI, the courts, the Congress, the computer industry, civilian academia, and the press. This debate fully took into account the question of terrorists using strong crypto, and in fact, that was one of the core issues of the debate. Nonetheless, society's collective decision (over the FBI's objections) was that on the whole, we would be better off with strong crypto, unencumbered with government back doors. The export controls were lifted and no domestic controls were imposed. I feel this was a good decision, because we took the time and had such broad expert participation. Under the present emotional pressure, if we make a rash decision to reverse such a careful decision, it will only lead to terrible mistakes that will not only hurt our democracy, but will also increase the vulnerability of our national information infrastructure.

PGP users should rest assured that I would still not acquiesce to any back doors in PGP.

It is noteworthy that I had only received a single piece of hate mail on this subject. Because of all the press interviews I was dealing with, I did not have time to quietly compose a carefully worded reply to the hate mail, so I did not send a reply at all. After the article appeared, I received hundreds of supportive emails, flooding in at two or three per minute on the day of the article.

I have always enjoyed good relations with the press over the past decade, especially with the Washington Post. I'm sure they will get it right next time.

The article in question appears at http://www.washingtonpost.com/wp-dyn/articles/A1234-2001Sep20.html

-Philip Zimmermann
24 September 2001

(This letter may be widely circulated)

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.3

iQA/AwUBO69F2sdGNjmy13leEQIn+QCg2DjDeyibtRe61tUSplSAobdzAqEAoOMF ir3lRc4c1D/0Mmmv/JtP/E73 =HmRO
-----END PGP SIGNATURE-----

Comments

Journalists (and editors)

[Merk]

This isn't a question for Zimmermann, it's a question for anybody who knows. What can you do when, like him, you're misquoted in by a journalist?

From the sounds of it, he did everything you could expect someone to do to avoid being misquoted. He emphasized to her he did not feel "overwhelmed with guilt", had her read the article to him over the phone before it was published, and was still misquoted thanks to an editor.

I imagine in certain circumstances you could sue the newspaper for libel, but what else can you do? What are your rights to: 1) not sound like a complete moron, 2) not be quoted out of context, 3) not be misquoted, 4) not have words put in your mouth.

And while we're on the topic, another question for the masses. From what the DoJ and others are doing, I'm getting less and less willing to send my email in plain text. The problem is that my technically unsophisticated friends don't have PGP, and I'm afraid it might be too tough for them. I know I could point them at hushmail (http://www.hushmail.com/), but are there any other good options? Also, what good arguments can I use to convince them it's worth the effort?

Btw, by "technically unsophisticated" I mean one until a couple of months ago was using a 486 and windows 3.1. I can't expect them to switch to Linux yet, but I want to help them find a good way to use pgp.

Question for Mr. Zimmerman

[deque_alpha]

You obviously have quite a bit of experience in influencing legislation and policy in the US. In your opinion, what is the most effecive way for "John Q Public" to help influence public opinion and legislators?

PGP, secrets and authority.

[neo]

Privacy of communication appears to be extremely important. My private conversations should only involve the persons intended to hear them, or many ideas might never be expressed.

Privacy for citizens carries much more weight than privacy for organizations. Government agents who wish secrecy can afford many levels of secrecy to ensure private communication. Political groups, like terrorists, can also hide their actions through secrecy. Removing secure communications from normal citizens in an attempt to discover political groups is horrible doomed to only remove private speach from the citizens.

There is, however, one divide where people are lost from this equation. Currently private communication requires money. PGP is not available to the vast majority of those under the poverty line. What, if anything, are you doing to bridge this gap?

Re:Tools are never evil

[lohen]

Absolutely. Some people are great people just about all the time, sure. Some people are not-so-great, others are great on occasion, others still are admittedly complete shit-bags. Just about all the time. Not everyone would agree upon who is whom. But who, really, can point at their past and show a completely pure sheet, where they never did a single thing that might be regretable or avoided doing a single thing that morally they should have done? We all have a degree of guilt, and yes, it is relative. To view the world entirely in black-and-white is to paint over the middle ground we all live in. Even a murderer can fall in love. The kindest person is sometimes hurtful, and not only through negligence. It's all about being human, really.

Totalitarian vs Individualist Morality

[wytcld]

Encryption is among the least of a great many modern technologies by which those who are determined and intelligent and lucky can do great evil. At a time when our government admits it doesn't have nearly enough people who can even understand the languages those who've committed the most recent evil speak, concern with encryption seems particularly misplaced.

Greater individual power for evil requires greater individual conscience for good as counterbalance. Nuturing individual consciences on a vast scale requires analysis of what defeats individual conscience. The main threat to individual conscience is totalitarian ideology. The main method of totalitarian ideologies is to convince those who surrender their natural judgment to them that they are the straight and narrow path to some sort of heaven or utopia, and that their formulas must be adopted because the individual's own native sense of rightness and beauty is fundamentally flawed and cannot be trusted, so the first-hand knowledge of, for instance, the goodness of the female form should be renounced as delusional, while the evil of suicide bombing should be accepted as on the side of heaven.

The evil manifests in political and religious ideologies which (1) provide specific pseudo-rational formulas to replace individual thought while (2) providing images of some over-the-horizon heaven or worker's paradise to replace vision and the evidence of the eyes in the world.

In general, the tools of individual empowerment correlate with the development of individual conscience. What was shocking in the WTC case was that totalitarian drones were able to use some of those tools without shaking their totalitarian mindset. Despite that, if we limit the tools, we also limit the further advance and development of individual conscience, whose development in the larger picture is our only hope.

Rather, we might consider directly attacking what enables evil on this scale: the promulagation of simplistic formulas for and unreal images of heaven. Fundamentalist religion is the main reservoire of such conscience-obliterating evil, particularly since Communist ideology has lost most of its force, and the Thousand Year Reich been vanquished. Fundamentalism consists entirely of simplistic formulas meant to supplant the individual's own native sensibility, which it views as being corrupt by nature, coupled with patently absurd images of rewards beyond, which make up for the removal of motivation by the real rewards we naturally seek in this world - which are incompatible with atrocity.

Much of religion is quite compatible with conscience - but the problem is people of conscience generally hold to the formula of never criticizing other religions, even those variations whose leaders openly preach suicide bombing, as does, for instance, the highest-ranking Muslim cleric on the Gaza Strip.

Religion is finally a technology of social control, a way of subverting our natural coding. Our natural coding, as response to the WTC tragedy demonstrates, is strongly altrustic. Religion is a virus evolved and designed to override nature, and the more virulent forms can be identified by their explicit rejection and vilification of nature.

It is precisely to oppose the potential of religious totalitarianism - which is not a distant prospect when Falwell is a close friend of Bush - that encrption, among other technologies of individual empowerment, is most needed. And we must suspect that this, not the occassional convenience of encryption to terrorists who in any case can communicate in dialects we can barely translate, is the main motivation of those who'd remove such a tool.