Transcription performed by LeahTranscribes[FULL TRANSCRIPT]
JACK: My grandfather went most of his life without using or needing encryption but now we live in a time where encryption is intertwined in almost all of our electronic communications. That shift to go from a world where everyday people didn’t use encryption at all to a world where everyone uses it and doesn’t even know it was a major transformation and there was nothing easy about it. There were powers at play that didn’t want everyday people to encrypt their messages but human rights and civil rights activists fought and fought and fought. You know the outcome of this story but you may not know what it took for us to get here. Let’s take a journey through time back to the 1990s and understand exactly what were to be known as the Crypto Wars.
JACK (INTRO): [INTRO MUSIC] This is Darknet Diaries, true stories from the dark side of the internet. I’m Jack Rhysider. [INTRO MUSIC ENDS]
JACK: Before we get started, I feel like I should say something. It’s really hard for me to stay neutral on this topic because I’m such a privacy and security advocate. This is a topic that’s important to me and I’m staunchly on a specific side, so upfront I just want to say that I apologize if I don’t represent both sides fairly in this story. To help take us through this pivotal piece of history, we have a very special guest.
CINDY: My name is Cindy Cohn and I’m the Executive Director of the Electronic Frontier Foundation.
JACK: The EFF is a non-profit digital rights group. It helps protect your civil liberties online. Cindy has been with the EFF for over twenty years and she’s played a crucial part in the Crypto Wars as we’ll soon discover. But before we get into her role in it we need to take a quick glimpse into the history of cryptography.
CINDY: Cryptography has been used by military people to protect their plans and share information say, across between the generals and the front lines for as far back as Julius Caesar. Caesar had a cypher that they used. In World War II there’s some great stories about how the ability to break the German code, the enigma machine which they were using to code had a tremendous influence on the ability of the allies to win the war. There’s great stories about both the code breakers in Bletchley Park breaking the German code, there were also really successful efforts to break the Japanese codes. Lots of people will, I think quite credibly say that the allies’ ability to break encryption codes had a lot to do with us actually winning the war.
JACK: [BEEPING] Encryption is when you take a message and encode it in such a way that if someone else were to get that message, they would not be able to read it. But then whenever the receiver gets the message, they would be able to decode it and read the message. This is also known as cryptography.
CINDY: The military has always viewed encryption as a part of its tool set, part of what they needed to do in order to help us win military wars. The US State Department keeps a list called the US Munitions List that has all of the things that the government treats as a military tool such that it can’t be exported without a license from the government. The US Munitions List is pretty long. It has things that will be – it has tanks and surface-to-air missiles and submarines and things like that that you can’t – and military subs, that if you build them or a piece of them you need to get a license from the US government before you export it.
JACK: During the Cold War era, sometime in the 1970s or 80s, the US State Department added cryptography to the Munitions List.
CINDY: It wasn’t particularly important to the rest of us [00:05:00] because the rest of us didn’t really need to have strong encryption in what we did every day. [MUSIC] That’s kind of what the world looked like heading into the early days of the internet. The shift came as the internet was getting to be developed, especially in the early 1990s, just before the World Wide Web but when a lot more people were beginning to think about what the world would look like if we had everybody in the world connected via digital technology. The realization that we were going to need to have privacy and security in this new world and that encryption was one of the ways that you could get it was fairly obvious to a lot of early thinkers about this.
Suddenly this thing that wasn’t particularly relevant to the rest of us, the fact that the government controlled encryption technology suddenly became very relevant as we started thinking about how to build an internet that would really work for every day, ordinary people who wanted to do commerce or have a private conversation or use this technology to develop new tools that they might need to protect as trade secrets, or keep confidential. Also, keep the network secure. Encryption does both of these things; it both keeps things private and it keeps things secure. It emerged as one of the really important technologies that we were going to have to have available if we were going to have an internet that really worked for everybody. The government created an encryption standard that it let people use so that there could at least be some encryption but it was very, very weak.
JACK: This standard was known as DES and stood for Data Encryption Standard. With it you can encrypt your data or a message and anyone who reads the encrypted message could not understand what it said. The person receiving the message had a key to decrypt the message but by the time the internet was taking shape DES had already been around for twenty years and was starting to show its age.
CINDY: Most cryptographers, most mathematicians knew this for years. By the 90s DES was clearly not good security anymore. The government was pretending like it was, and one of the – it was kind of one of those situations in which the government policy people wanted something to be true, that DES was really secure, because they had back-doored it, because they knew that it wasn’t really secure. They could always break it and were pretending like it was really secure and hoping that nobody noticed. But of course, people did notice.
JACK: The government knew 40-bit DES encryption was not very strong but insisted we use it anyways.
CINDY: A guy named Bobby Inman who was the head of the NSA in the 90s, but there are other people as well, who were making representations about DES that were I think not really true. You have to either think that they knew what they were talking about and were basically trying to convince the rest of us that it wasn’t, or that they didn’t know what they were talking about, in which case it’s a little troubling because they’re the NSA.
JACK: Businesses and banks were digitizing their data and the need for all this data to be encrypted slowly became more and more important. The early 90s was a place where…
CINDY: The people are engaging in various kinds of protest activity, political organizing, all of that sort of activity. Encryption is tremendously important for people who are trying to change the government, who are trying to change corporate polices, who are trying to stand up for building a world that is better than the one that we have. We know that the US government has traditionally spied on people who are engaging in political protests. We know they spied on Martin Luther King, we know they spied on John Lennon, we know that they spied on all of the civil rights movement.
JACK: This is why PGP got started. Phil Zimmermann, a software engineer, developed a much more secure way of communicating called PGP which stood for Pretty Good Privacy. He helped human rights activists use it. He put his PGP code on a FTP server for anyone to download and use. While Phil said he did not spread it outside the US, it eventually found its way to the other side of the US borders. Because cryptography was considered a munition, Phil was investigated by the US Customs Service for violating the Arms Export [00:10:00] Control Act. This would be the same violation if someone were to export stinger missiles outside the US without an Arms Permit. Businesses were originally fine with DES as the standard even though they knew stronger encryption existed, because in the 80s the only adversary to businesses were other businesses.
They knew other businesses didn’t have strong crypto analytic capabilities. Even if it was weak, nobody had the ability to crack it except for governments but it started to become clear that other nations were trying to develop ways to break DES so businesses were starting to get a little worried and wanted to use stronger encryption. Businesses started using PGP as a form of communicating trade secrets and sensitive data. Using PGP internally was legal as long as the encryption didn’t cross the US border.
For the next few years Phil would be continually investigated for spreading his encryption method around the world. A case was brought against him by the government for violating the Arms Export Control Act. From what I can tell, the battle between Phil Zimmermann and the US government was the first battle of the Crypto Wars. The users of the internet, security companies, and banks were all starting to request higher and higher security encryptions to be used by the people.
CINDY: On the other side was the military and law enforcement saying no, we need to keep the encryption weak so we can catch the bad guys. We were pointing out that most of us would rather be secure in the first instance and not get robbed than have very low security but slightly increase the chance that they might catch the robbers afterwards.
JACK: In 1993 Bruce Schneier published a book called Applied Cryptography. This book describes various cryptographic algorithms and how to use them. It even contains algorithms which were not allowed to be used on the internet. An electronic engineer named Phil Karn asked US State Department for a commodities jurisdiction for the book. He wanted to know if he could legally ship the book across US borders. Since there’s no export regulations on books, he was given permission to export the book. Then Phil Karn took a few pages from the book which contained some cryptographic algorithms and placed them on a floppy disc. He then requested a commodity jurisdiction for the floppy disc. The State Department had a discussion with the NSA and denied the request. We know they had a discussion with the NSA because of records requested through the Freedom of Information Act years later.
Because the encryption was in electronic form it was now considered a regulated munition and was not allowed to cross US borders in that form. This created quite a controversy. A book containing a mathematical algorithm can be sent across the border but a floppy disc with the same algorithm cannot? So Phil Karn sued the US State Department. He believed that if the data contained in a book was considered protected under the First Amendment, then data contained on a floppy disc should also be protected in the same way. Once Phil Zimmermann heard of this lawsuit he decided to print his PGP source code in a book format. He even took great care into making the book easily scannable. He too, asked for a commodity jurisdiction on his book but the State Department was now more aware of the situation and did not grant him the right to export the book, but really didn’t deny him either. The State Department just sat on the request for a while.
Phil Zimmermann’s publisher didn’t wait for a response; instead they started shipping the book containing his PGP code all over the world. The security community took this in various other directions too, such as printing algorithms on t-shirts which would then make the t-shirt a regulated munition, and when something is a regulated munition like that, you can’t even allow foreigners to read the t-shirt. Simply wearing that shirt in front of a foreigner violated the Arms Export Control Act.
CINDY: Several things happened; I launched a team from EFF with the EFF lawyers, launched a lawsuit against the encryption technologies. There were actually three lawsuits that were filed. We handled one called Bernstein vs. Department of Justice.
JACK: Another cryptographer named Dan Bernstein was developing encryption methods that were above the regulated limit. In 1995 Bernstein wanted to write about his encryption, give talks about it, and publish the source code on the internet. The Arms Export Control Act and the International Traffic and Arms Regulation required Bernstein to submit his ideas about cryptography to the government for review which also required him to register as an arms dealer and to apply for a license. All this simply to publish his ideas about cryptography to the internet. Bernstein decided to do battle against the [00:15:00] US Department of Justice and he got help from the EFF; specifically, Cindy Cohn herself.
CINDY: Yeah.
JACK: The EFF took their best lawyers to go and help out Bernstein.
CINDY: Yeah, that was exactly what the goal of the litigation was, to make sure that people could publish. Publishing on the internet always is an export, right, because everybody in the world can see what gets published on the internet. We wanted people to be able to publish and share strong encryption on the internet. To get there, what we did was we argued that computer programs, computer code was protected speech under the First Amendment and that the government’s regulations of that speech in the form of the Munitions List Regulations were not consistent with the First Amendment.
JACK: For the next year Bernstein, Cindy, and the EFF did battle against the US Department of Justice. [MUSIC] In 1996 a professor at Case Western University named Peter Junger also joined the battle.
CINDY: Yeah, Peter Junger is the third case. He also was arguing – he was a law professor but he also had a computer science background. He argued basically the same thing as professor Bernstein, that he wanted to publish code as well.
JACK: Not only did he want to publish code to the internet but he also wanted to teach a class on cryptography. But because he included cryptography as a topic of his class, he was restricted from accepting foreign students in his class. This resulted in Junger challenging the export laws as well.
CINDY: That case was going on in Cleveland. Our case, the EFF’s case was going on in California and then Phil Karn’s case was going on in DC. The three of us all worked together to try to make sure that we were putting as much pressure on the government as we could collectively.
JACK: By this point there were numerous businesses expressing a need for stronger encryption for their data. Banks in particular were requesting the government allow them to use a stronger encryption method. Specifically, the US government was not allowing encryption that was over 40 bits in length to be used on the internet. Around this time AT&T created a phone that would encrypt a phone call. It basically created a modem connection from one end to the other and digitized the voice and then did a DES encryption on the data. AT&T sold these phones for $1,400 in the mid-90s. The US government freaked out about this phone. They contacted AT&T and said they have a better solution. The government had been working on a new way to encrypt data electronically using a specialized computer microchip.
The encryption was far superior to the common DES, possibly even unbreakable. The government called this the Clipper Chip. The government developed this chip for anyone who wanted to use stronger encryption and so, a solution was found. The government urged AT&T to use the chip on their phone. AT&T was hesitant at first but the government offered to buy a bunch of these phones if they added the chip. AT&T added the Clipper Chip into the phone and the US government bought a ton of these phones, but in the features of the Clipper Chip there was one rather large asterisk. The Clipper Chip had a backdoor key built into it which allowed the government to decrypt any message encrypted by the chip. The government was basically allowing people to use a rather strong encryption method but had a key to break the encryption if they needed it. The idea was that the government would be the only one who would ever have the key.
CINDY: One of the things that happened right after that got released, is a guy by the name of Matt Blaze, who’s now a professor at the University of Pennsylvania of Computer Science, a very famous computer science professor demonstrated that these Clipper Chips were really insecure and demonstrated what we all know is true right now, is that if you’re going – you can’t build a door into strong encryption and only expect the good guys to ever figure out what the key is, to ever have a key to it. If you’re going to weaken the encryption, they’ll let the good guys have a key. You’re going to weaken the encryption such so that the bad guys will have access too.
The demonstration of the flaws in the Clipper Chip that Matt Blaze did was really central to this [00:20:00] conversation because ultimately it meant that the government dropped the Clipper Chip idea. That was the first nail in the coffin of the government’s crypto policy. The second thing that happened was we were beginning to win our lawsuit. We won it at the District Court and then we also won it at the Court of Appeals. At the same time there were efforts in Congress that were moving along a little more slowly. There was also direct pressure on the administration from the tech companies and Al Gore, who was wanting to be president after Clinton and was a pretty technically savvy guy. He understood that this position wasn’t very good and he wanted to curry favor with this growing Silicon Valley group of companies. Ultimately what happened, the government decided that they were not going to keep encryption on the Munitions List anymore.
JACK: On November 15, 1996, Bill Clinton signed Executive Order 13026 which removed encryption from the Munitions List. The Executive Order also moved who oversees encryption from the US State Department to the US Department of Commerce. Signing the Executive Order was a major victory for the civil rights activists.
CINDY: I’m sure that we had a party because we always had parties back then. I’m sure that we did. I think there was much champagne and we were really happy about it. We were a little nervous that they would backtrack. We actually had some meetings with the government about it and ultimately I flew to DC and we had some meetings with them to settle on exactly what this was going to look like.
JACK: Actually, it turns out the government was still holding a position on the battlefront. See, the government was still requiring you to get a license for encryption and still regulated it.
CINDY: The government only licensed 40-bit DES. They said you can have all the encryption you want as long as it’s 40-bit which is a little like saying you can have all the security you want as long as there’s nothing but a really weak lock on your door. It was becoming obvious that people needed more encryption than something that was stronger encryption than just 40 bits.
JACK: Because encryption was limited to only 40 bits in length it severely limited how secure our computers could be. There were numerous stronger cyphers available but under government regulation this was not allowed to be used. A company called RSA Security sponsored a DES challenge. They offered a reward for anyone who could crack the DES cypher. In 1997 a group found a way to brute-force and crack a DES message. It took them 39 days to decipher the message. Cryptographers thought this would be enough for the government to allow people to use stronger encryption but that didn’t happen. NIST, the National Institute of Standards and Technology, still considered DES to be safe. The government downplayed the issue by saying 39 days to crack the code was too long of a time for it to be a significant threat.
CINDY: One of the things that happened as a result of this weird disconnect is that EFF created a tool called the DES Cracker. They still exist. It was a hardware tool that basically, very cheaply, could break DES. The reason to do that was to demonstrate that the government wasn’t being straight with people about how secure the technology was and that we needed to move to a more secure government standard. DES is a government standard. If you’re going to sell to the government or you’re in the financial industry you need to be licensed by the government.
JACK: The EFF called this tool Deep Crack and could crack a DES message in just 56 hours. But still, the government did not change their stance on DES and still continued to endorse it. A few months after that the EFF and the winners of the first DES challenge joined together to develop an even faster way to crack DES. They were able to crack a message in just 22 hours.
CINDY: We did it because we weren’t getting anywhere with the government. They were pretending, again, continuing to pretend that the emperor had clothes on when we were pointing out that the emperor didn’t have any clothes. What EFF built was completely available for bad guys to build all over the world. We didn’t create anything. We just demonstrated to the public what was long-known privately which was any bad guys with access to really straightforward, off the shelf technology could build something that would break the security that all these financial institutions were relying on to protect our money.
JACK: This was the [00:25:00] last battle of the war. Once someone could crack a DES message in under a day, the US government agreed it was no longer secure. They released a new cypher called Advanced Encryption Standard, or AES. AES used 120-bit strength and was far superior to the 40-bit DES. They also allowed triple DES which was a stronger version of DES. By 1999 all court cases were dropped by the US government and new, stronger encryption methods were allowed. By the year 2000 the government stopped requiring licensing or restricting key lengths altogether.
People were now allowed to encrypt their communication with as strong of encryption method as they wanted. Businesses were able to utilize the most cutting-edge encryption to secure their transactions and data. Of course, Phil Zimmermann could publish his code online and Peter Junger could accept non-US students in his class that talks about cryptography. By the year 2000 the first set of the Crypto Wars were over, marking a major victory for our civil rights. We are now safer and our privacy is more protected because of it. We have these internet crypto warriors to thank for paving the way for our privacy and security.
CINDY: I think personally, it’s the thing I’m most proud of, that I’ve accomplished by working with EFF. I think EFF has done lots of other things but I had such a central role in this. I’m very, very proud of the work that we did. I think we set up today’s internet to be a place where people have the right to have strong security.
JACK: But this story’s not over. This is just the story of the first Crypto Wars. Shortly after this the government began attacking crypto in new ways which went entirely undetected for a long time. But that’s a story for another time. People ask me if I think we’re becoming more secure or less secure online over time. After researching this episode I definitely think we’re becoming more secure because once crypto was allowed at any strength on the internet, it opened up the doors for websites to encrypt their whole website and not just a log-in page or a credit card page. More and more websites are going full HTTPS, making all of their communication to it private. The EFF creates tools like HTTPS everywhere, which is a browser plug-in to allow us to use HTTPS where available. What’s more is when strong encryption is showing up in our everyday lives without us even knowing it’s there.
We don’t even have to enable it and in fact, we can’t disable the encryption even if we wanted to. For instance, Facebook uses a protocol called Signal to do end-to-end encryption of their messaging service. PGP had a hard time getting mass adoption because it was hard to use but now even the most technologically illiterate people are using strong encryption when talking with their friends on Facebook. When these strong encryption methods become integrated into our lives in ways that make it easy for us to use, we become safer and our privacy is protected. Encryption is becoming more seamless and more integrated in so many products.
Yes, a lot of technology we use every day still isn’t using good security practices like text messaging and standard phone calls. But there are still major wins in the name of privacy and online security that happen all the time. We’ll never become fully safe and secure online because it’s simply a hostile environment but we can stay vigilant and speak up when we feel our privacy and security is not being looked after. When enough of us raise our voices, we can win the next Crypto War.
JACK (OUTRO): [OUTRO MUSIC] You’ve been listening to Darknet Diaries. For show notes and links check out darknetdiaries.com. There you’ll be able to see a picture of the Clipper Chip and Deep Crack. Music in this episode is provided by Ian Alex Mac and Kevin MacLeod.
[OUTRO MUSIC ENDS]
[END OF RECORDING]