4 Guerilla Cryptographers

1 2 3 4 5 6 7 8

reverse engineering: taking a product apart to work out what it does and then building a different product that does the same thing by different means. Companies as large and diverse as Compaq, Borland, and Microsoft have all created products by this means (respectively, Compaq PCs, Borland's Quattro Pro spreadsheet, and Microsoft Windows, which is still trying to catch up to the Macintosh interface pioneered in 1984). Then leading software companies Lotus (since bought by IBM) and Borland (then as now struggling) fought a long and bitter legal battle over just this question after Borland copied the ordering of certain program commands for Quattro Pro from Lotus's classic 1-2-3 spreadsheet. Borland eventually won a ruling on appeal that this was not a violation of Lotus's intellectual property rights.


Software is just one area where the extension of intellectual property rights is being hotly debated. Biotechnology companies are claiming rights over natural substances they discover and even human genes they've mapped. On December 2-20, 1996, the World Intellectual Property Organization met to consider a database treaty which would create new rights in databases that might, some specialists warned,[12] bring certain types of facts, such as sports statistics, stock prices, and even weather reports, into private ownership from the public domain, where they've always been thought to belong.


So when Net users argued that a mathematical algorithm is a discovery rather than an invention, they had more in mind than rationalizing their own use of PGP. And there was an odd twist to the patent situation: the RSA patent is not valid outside the United States. The reason has to do with its publication in print. In Europe generally, if print publication precedes the patent application, as it did in this case, the patent isn't granted. This created a weird situation in which PGP, developed in Colorado using technology dreamed up in California and Massachusetts, was illegal to use in the United States, illegal to export, and yet legal for non-Americans to use abroad once it got there. This is probably not something any of the lawmakers would have thought desirable.


The odd thing about the ferocity of these discussions and the passion of PGP supporters is that there were competing products, even then, built to conform to the Internet RFCs on privacy-enhanced mail.[13] RSA Data Security had a $200 product called Mailsafe, and other programs such as RiPEM were also available. In his December 1992 document on the legal issues surrounding PGP, Zimmerman stated that he thought the patent controversy had given PGP the air of forbidden fruit, and he may be right. Its being free didn't hurt either. In any case, it acquired a cachet no other encryption program has had, enhanced by Net users' habit of appending their public keys to their Usenet postings as a show of solidarity. The Justice Department's investigation of Zimmerman probably added an air of authenticity to the program, since it's logical to think the government would hardly bother investigating the deployment of a program that didn't work.


Even odder is the fact that the program was not all that easy to use. In the years since, people have written add-ons that help ease the process of getting started with PGP and Windows front ends that make it more intuitive. But even as late as 1995, one of the program's own international developers admitted in private conversation that the development team preferred to send unencrypted email because it was so much more convenient.


But PGP was a cause célèbre, even though for a long time many people who had downloaded the software and were keeping copies "just in case" refused to use it because of the patent issues. These were resolved in 1993, when Zimmermann made a deal with a Phoenix, Arizona, company called Lemcom which had obtained a license from RSA Data Security to sell software based on the RSA algorithm. Lemcom got the rights to sell a commercial version of PGP called Viacrypt; Zimmermann and the PGP development teams got the legal right to distribute the


    

Copyright © 1997-99 NYU Press. All rights reserved.
Reproduction in whole or in part in any form or medium without written permission of New York University Press is prohibited.


Be sure to visit the NYU Press Bookstore

[Design by NiceMedia]