Phil Zimmermann

Philip R. Zimmermann (born February 12, 1954, in Camden, New Jersey) is an American software engineer and privacy activist who wrote Pretty Good Privacy and published it for free on the internet in 1991. PGP's spread beyond the United States made him the subject of a three-year federal criminal investigation into whether he had illegally exported a munition, an inquiry the government closed without charges in 1996. He later founded PGP Inc., worked on encrypted internet telephony with the ZRTP protocol and the Zfone software, and cofounded the secure-communications company Silent Circle. He was inducted into the Internet Hall of Fame in 2012.¹²

Background and the Release of PGP

Zimmermann took a bachelor's degree in computer science from Florida Atlantic University in 1978 and worked for two decades as a software engineer in cryptography, data security, and embedded systems. His interest in the politics of cryptography grew out of his earlier involvement in the anti-nuclear movement and military-policy activism of the late Cold War, work in which he came to see communications privacy as a civil-liberties question rather than a purely technical one. He has said he built PGP as a human-rights tool, intended to give ordinary people and political dissidents access to encryption strong enough to resist a government.¹³

He wrote that he was prompted to release the software by Senate Bill 266 of 1991, an anti-crime measure carrying a provision that would have pressed makers of secure communications equipment to build in government access. Zimmermann published PGP electronically without charge in June 1991, and within hours it spread across the internet and out of the country. He later summarized his motive in the essay "Why I Wrote PGP," arguing that "the only way to hold the line on privacy in the information age is strong cryptography," and in the slogan "If privacy is outlawed, only outlaws will have privacy." The technical design of the software is treated on the Pretty Good Privacy page.³⁴

The Criminal Investigation

Because PGP traveled overseas almost immediately, it fell under the International Traffic in Arms Regulations, which classified strong cryptographic software as a munition that could not be exported without a license. The United States Customs Service opened a criminal investigation in 1993, run out of the office of the United States Attorney for the Northern District of California, into whether Zimmermann had violated the export controls when PGP appeared abroad. The case made him the most prominent individual target of what became known as the crypto wars, and for three years he faced the possibility of indictment for exporting a weapon.¹²

Zimmermann and his supporters answered with a First Amendment argument that source code is constitutionally protected speech. In 1995 the MIT Press published the complete PGP source code as a printed book set in an optical-character-recognition font, so that it could be exported legally as a book, scanned abroad, and recompiled, a maneuver designed to test whether the government would treat the printed word as a munition. The United States Attorney's office declined to prosecute and the investigation closed in January 1996. Zimmermann received the Electronic Frontier Foundation Pioneer Award and the Chrysler Award for Innovation in Design in 1995, and the Louis Brandeis Award from Privacy International in 1999.⁵²

PGP Inc. and the Commercial Years

After the case closed, Zimmermann founded PGP Inc. in 1996 to develop and sell the software commercially. The company was acquired by Network Associates in December 1997, where Zimmermann stayed on as a Senior Fellow for about three years. He hired Hal Finney, who had been a central volunteer contributor to PGP 2.0 since 1991, as an employee once the investigation ended. When Network Associates sold the product line, a new PGP Corporation acquired it in 2002 and Zimmermann served as a special adviser; Symantec bought PGP Corporation in 2010.²⁶

During these years Zimmermann also advised privacy-oriented services built on his software, including the encrypted-webmail provider Hushmail. The open OpenPGP standard and the free GNU Privacy Guard reimplementation carried the design well beyond any single corporate owner, so that the message format Zimmermann had defined remained in wide use regardless of who held the commercial product.⁶⁷

Encrypted Voice, Zfone, and Silent Circle

Zimmermann turned in the 2000s to securing internet telephony. He designed ZRTP, a protocol that lets two parties on a voice-over-IP call negotiate an encryption key directly between their devices for each conversation, without a central server holding the keys, and built the Zfone software around it beginning in 2006 to encrypt VoIP calls. ZRTP uses a short authentication string the two callers read aloud to detect a man-in-the-middle interceptor.⁶⁸

In 2012 Zimmermann cofounded Silent Circle with the former Navy SEAL Mike Janke and the cryptographer Jon Callas to sell encrypted voice, video, text, and email to businesses and individuals. The company later moved its operations to Switzerland and shut down its Silent Mail email service in 2013 rather than comply with anticipated government demands for access, a decision that followed the closure of the encrypted-email provider Lavabit during the Edward Snowden disclosures. Silent Circle went on to develop the privacy-focused Blackphone handset.⁸⁹