In early 1994 the U.S. State Department ruled that Bruce Schneier’s book Applied Cryptography, with its full source listings of strong ciphers, could leave the country freely. A floppy disk holding the same source code, Phil Karn was told, was a “defense article under category XIII(b)(1) of the United States Munitions List.” Karn’s summary of the ruling was that the government had long believed “only Americans (and maybe a few Canadians) can write C code, but now they have apparently decided that foreigners can’t type either!” Until the last days of 1996, the United States regulated encryption software the way it regulated weapons.
A criminal investigation (1991–1996)
Phil Zimmermann wrote that he released PGP for free in 1991 because of Senate Bill 266, “a 1991 omnibus anticrime bill” with “an unsettling measure buried in it”: a resolution that would have pushed makers of secure communications equipment to put “trap doors” in their products. PGP was posted to USENET that June, and from there it spread abroad.
In the preface Zimmermann wrote in November 1994 for a book of PGP’s printed source code, he put it plainly: “I am under criminal investigation because of PGP’s spread overseas, which the Government holds is in violation of US export restrictions.” It would be “politically difficult,” he reasoned, for the Government to stop the export of a book anyone could find in a library, and the State Department had already ruled that way on Schneier’s. So the source went into a book “which may be scanned in with OCR,” and he applied for the same ruling. A footnote added later names another volunteer on PGP 2.0, Hal Finney, left out in 1994 “because it was not safe to do so, since Hal lived in the US within easy reach of US prosecutors.”
On January 11, 1996, Zimmermann told the Cypherpunks list that the U.S. Attorney’s office had written that he “will not be prosecuted in connection with the posting to USENET in June 1991 of the encryption program Pretty Good Privacy. The investigation is closed.” He signed the message with PGP and wrote: “The medium of email cannot express how I feel about this turn of events.” His lawyer, Philip Dubois, added in the news release: “Nobody should conclude that it is now legal to export cryptographic software. It isn’t.”
Shirts and signatures (1995)
The list answered the rules with jokes that were also tests. On March 9, 1995, Adam Back posted RSA in a few lines of Perl, short enough to carry as an e-mail signature, and kept a list of ever-smaller versions. The three-line version went onto a T-shirt. Its seller, Don Henson, explained the joke in his August 1995 post: under the regulations, “if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material.” By then he had shipped over 500. Back’s 1997 Hashcash announcement still carried the Perl under “Have you exported RSA today?”
The floppy disk (1994–2000)
Karn filed his pair of commodity jurisdiction requests with the State Department in early 1994, choosing Schneier’s book because it was widely available and full of source code for ciphers such as IDEA and DES. The ruling split the book from the disk, and Karn took the split to all three branches of government, from the State Department and the Commerce Department to the federal courts and two congressional hearings. He never won in court. On January 14, 2000, new export rules made publicly available encryption source code “effectively freely exportable,” and he let the case be dismissed as moot: “for all practical purposes I got everything I wanted.”
The hash function (1995–1999)
Daniel Bernstein went after the rules with their own wording. As a doctoral candidate at Berkeley he had developed Snuffle, which the Ninth Circuit described as “a zero-delay private-key stream encryptor based upon a one-way hash function,” and wrote it up both as a paper and as source code. The rules controlled encryption but not one-way hash functions. Bernstein believed an encryption system could easily be built from any of the hash functions already in print, found the line absurd, and built Snuffle to show it. His source code even left the hash function out; on its own, the court noted, it could not encrypt anything at all. When he asked whether he needed a license to publish it, the State Department answered that Snuffle was a munition; he sued. On May 6, 1999, the Ninth Circuit held that the export regulations, by then the Commerce Department’s, “constitute a prior restraint on speech that offends the First Amendment,” and wrote that “never has our ability to shield our affairs from prying eyes been at such a low ebb.”
Off the Munitions List (1996)
On November 15, 1996, President Clinton directed that encryption products in Category XIII of the Munitions List “shall be transferred to the Commerce Control List,” except those designed for military use, and signed Executive Order 13026 to govern them there. The transfer took effect with the Commerce Department’s interim rule of December 30, 1996. From that day, ordinary encryption software was no longer a munition, but it was still an export-controlled item, now under the Export Administration Regulations.
Zimmermann’s 1999 revision of Why I Wrote PGP closed the account: “It has been a long struggle, but we have finally won, at least on the export control front in the US.” When Bitcoin’s source code went up on SourceForge in January 2009, publicly available encryption source code had been, in Karn’s words, effectively freely exportable for nine years. What opened that door was not a policy paper. It was a floppy disk, a hash function and a T-shirt, each built to make one rule say something absurd in public. I count that as the sharpest tool anyone used in this fight.
