The Encryption Tool That Triggered a U.S. Munitions Investigation
In 1991, Phil Zimmermann published Pretty Good Privacy (PGP) for free to protect human rights advocates. Because PGP used RSA keys stronger than 40 bits, the U.S. government viewed it as military-grade hardware under export control laws and launched a three-year criminal investigation against Zimmermann for exporting munitions without a license before dropping charges in 1996.
The Grassroots Origins of Digital Privacy
In 1991, software engineer and anti-nuclear activist Phil Zimmermann created Pretty Good Privacy (PGP) to provide robust, uncrackable encryption for ordinary citizens and human rights advocates. At the time, strong cryptographic tools were largely confined to military and intelligence agencies or large corporate enterprises with mainframe computers. Zimmermann envisioned a freely available utility that would allow private individuals to communicate over emerging computer networks without fear of government wiretapping or corporate eavesdropping.
Rather than commercializing the software through proprietary licensing, Zimmermann made PGP available to the public without charge. In June 1991, with the assistance of associates, the source code and executable files were uploaded to Usenet, the global decentralized discussion system. Within days, PGP spread across university networks, international bulletin board systems, and early internet nodes, putting high-grade cryptography into the hands of users worldwide.
The Hybrid Architecture Behind the Tool
PGP solved a fundamental problem in cryptography: public-key encryption was computationally expensive and slow for large files, while symmetric-key encryption required a secure way to share a secret key beforehand. Zimmermann resolved this by designing PGP as a hybrid cryptosystem. When a user encrypted a message, PGP generated a temporary, single-use symmetric session key to rapidly encrypt the plaintext data, using symmetric algorithms such as IDEA. The software then used the recipient's asymmetric public key, based on the RSA algorithm, to encrypt only that short session key.
The encrypted session key and the encrypted message body were bundled together in a single package. Upon receipt, the recipient used their private RSA key to recover the symmetric session key, which in turn decrypted the main body of the message. In addition to confidentiality, PGP incorporated digital signatures through cryptographic hashing to verify sender identity and ensure data integrity, along with automated data compression to thwart cryptanalysis patterns and reduce transmission size.
Cryptography as a Munitions Violation
During the Cold War, the United States government treated high-strength cryptographic software as auxiliary military hardware. Under the International Traffic in Arms Regulations (ITAR) and the Arms Export Control Act, cryptography systems utilizing keys longer than 40 bits were classified alongside missiles, tanks, and chemical weapons as Munitions List items. Exporting such technology outside the United States required formal licenses and government review, which were routinely denied for strong consumer-grade cryptography.
PGP, by contrast, utilized RSA public keys ranging from hundreds to over a thousand bits, paired with strong symmetric encryption that vastly exceeded the 40-bit export threshold. The federal government maintained that distributing software capable of resisting sovereign cryptanalysis compromised national security and foreign intelligence operations, effectively creating an export ban on robust encryption algorithms.
The Federal Criminal Investigation
In 1993, the U.S. Customs Service and federal prosecutors launched a formal criminal investigation into Phil Zimmermann for exporting munitions without an export license. Because PGP had been uploaded to public networks and quickly downloaded by users in Europe and elsewhere, prosecutors treated the electronic distribution as an unlicensed international arms shipment. Zimmermann faced the prospect of federal indictment, heavy financial fines, and a multi-year prison sentence.
The investigation spanned three years and became a central battleground in the so-called Crypto Wars—a broader societal struggle between state intelligence agencies seeking lawful access to communications and technologists advocating for individual privacy rights. Zimmermann and his defense team argued that posting code on an open digital network did not constitute an intentional physical export, and that restricting the dissemination of mathematical algorithms infringed upon basic constitutional liberties.
The First Amendment and the Printed Book Loophole
To highlight the legal contradictions of export controls on software, Zimmermann devised an innovative legal challenge involving print publishing. While the export of machine-readable computer files was tightly regulated under munitions rules, printed books were explicitly protected under the First Amendment of the U.S. Constitution and exempted from export bans. In 1995, MIT Press published the complete source code of PGP in a physical, hardback book titled 'PGP Source Code and Internals'.
The printed book was legally shipped across international borders without requiring an export license. Volunteers overseas then purchased copies of the book, scanned the printed pages using optical character recognition (OCR) software, and recompiled the functional PGP binary abroad. This demonstration established that the software was fundamentally composed of text and mathematical ideas, making export restrictions on digital code legally and practically untenable.
Resolution and the Shift to Open Standards
In February 1996, the United States Attorney's Office officially dropped its criminal investigation against Zimmermann without bringing an indictment. The closure of the case, combined with growing commercial demand from the software industry for secure electronic commerce, accelerated a major policy transition. The Clinton administration subsequently transferred jurisdiction over non-military cryptography exports from the State Department's munitions framework to the Department of Commerce's Export Administration Regulations, substantially loosening restrictions on strong commercial encryption.
Following the legal resolution, Zimmermann and other developers worked to standardize the protocol through the Internet Engineering Task Force (IETF), leading to the creation of the open OpenPGP standard. This standard enabled widespread, interoperable implementations, including the open-source GNU Privacy Guard (GnuPG), cementing end-to-end asymmetric cryptography as a standard foundation for global digital communications.
Key takeaways
•PGP combined symmetric session encryption with asymmetric RSA public-key cryptography to make military-grade encryption computationally practical on personal computers.
•Under 1990s U.S. ITAR regulations, software containing encryption stronger than 40 bits was classified as a munition, leading to a three-year federal criminal investigation of creator Phil Zimmermann.
•Zimmermann bypassed digital export rules by publishing PGP source code as a physical book through MIT Press, leveraging First Amendment protections on printed text to allow overseas users to scan and recompile the software.
•The dropping of charges in 1996 helped spur regulatory reform that shifted cryptography oversight from munitions controls to commercial trade rules and established the OpenPGP open standard.