The creator of Pretty Good Privacy (PGP), Philip R. Zimmermann, was quoted in
a recent Washington Post article as saying he had been "overwhelmed with
feelings of guilt" about the use of PGP by suspected terrorists. He says the
story was not entirely accurate, and has written a response to it that he
hopes will clarify his views on the matter. This is quoted below.

No Regrets About Developing PGP
The Friday September 21st Washington Post carried an article by Ariana Cha
that I feel misrepresents my views on the role of PGP encryption software in
the September 11th terrorist attacks. She interviewed me on Monday September
17th, and we talked about how I felt about the possibility that the
terrorists might have used PGP in planning their attack. The article states
that as the inventor of PGP, I was "overwhelmed with feelings of guilt". I
never implied that in the interview, and specifically went out of my way to
emphasize to her that that was not the case, and made her repeat back to me
this point so that she would not get it wrong in the article. This
misrepresentation is serious, because it implies that under the duress of
terrorism I have changed my principles on the importance of cryptography for
protecting privacy and civil liberties in the information age.

Because of the political sensitivity of how my views were to be expressed,
Ms. Cha read to me most of the article by phone before she submitted it to
her editors, and the article had no such statement or implication when she
read it to me. The article that appeared in the Post was significantly
shorter than the original, and had the abovementioned crucial change in
wording. I can only speculate that her editors must have taken some
inappropriate liberties in abbreviating my feelings to such an inaccurate
soundbite.

In the interview six days after the attack, we talked about the fact that I
had cried over the heartbreaking tragedy, as everyone else did. But the tears
were not because of guilt over the fact that I developed PGP, they were over
the human tragedy of it all. I also told her about some hate mail I received
that blamed me for developing a technology that could be used by terrorists.
I told her that I felt bad about the possibility of terrorists using PGP, but
that I also felt that this was outweighed by the fact that PGP was a tool for
human rights around the world, which was my original intent in developing it
ten years ago. It appears that this nuance of reasoning was lost on someone
at the Washington Post. I imagine this may be caused by this newspaper's
staff being stretched to their limits last week.

In these emotional times, we in the crypto community find ourselves having to
defend our technology from well-intentioned but misguided efforts by
politicians to impose new regulations on the use of strong cryptography. I do
not want to give ammunition to these efforts by appearing to cave in on my
principles. I think the article correctly showed that I'm not an ideologue
when faced with a tragedy of this magnitude. Did I re-examine my principles
in the wake of this tragedy? Of course I did. But the outcome of this
re-examination was the same as it was during the years of public debate, that
strong cryptography does more good for a democratic society than harm, even
if it can be used by terrorists. Read my lips: I have no regrets about
developing PGP.

The question of whether strong cryptography should be restricted by the
government was debated all through the 1990's. This debate had the
participation of the White House, the NSA, the FBI, the courts, the Congress,
the computer industry, civilian academia, and the press. This debate fully
took into account the question of terrorists using strong crypto, and in
fact, that was one of the core issues of the debate. Nonetheless, society's
collective decision (over the FBI's objections) was that on the whole, we
would be better off with strong crypto, unencumbered with government back
doors. The export controls were lifted and no domestic controls were imposed.
I feel this was a good decision, because we took the time and had such broad
expert participation. Under the present emotional pressure, if we make a rash
decision to reverse such a careful decision, it will only lead to terrible
mistakes that will not only hurt our democracy, but will also increase the
vulnerability of our national information infrastructure.

PGP users should rest assured that I would still not acquiesce to any back
doors in PGP.

It is noteworthy that I had only received a single piece of hate mail on this
subject. Because of all the press interviews I was dealing with, I did not
have time to quietly compose a carefully worded reply to the hate mail, so I
did not send a reply at all. After the article appeared, I received hundreds
of supportive emails, flooding in at two or three per minute on the day of
the article.

I have always enjoyed good relations with the press over the past decade,
especially with the Washington Post. I'm sure they will get it right next
time.

The article in question appears at
http://www.washingtonpost.com/wp-dyn/articles/A1234-2001Sep20.html

-Philip Zimmermann
24 September 2001

(This letter may be widely circulated)

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.3

iQA/AwUBO69F2sdGNjmy13leEQIn+QCg2DjDeyibtRe61tUSplSAobdzAqEAoOMF 
ir3lRc4c1D/0Mmmv/JtP/E73 =HmRO
-----END PGP SIGNATURE----- 

Email this page to a friend Last edit: 28th Sep 2008 at 2:12pm (279 days ago)

Bookmark with: What are these? Delicious Digg reddit Facebook StumbleUpon