Phil Zimmermann Gave PGP Away for Free. Then the U.S. Government Investigated Him for Years.

In 1991, Phil Zimmermann gave away a program that let ordinary people encrypt their email.

It spread around the world.

Then the U.S. government spent roughly three years investigating him.

The software was called Pretty Good Privacy — PGP.

The issue was not that PGP was malware.

The issue was that strong cryptography was treated by U.S. export rules as a controlled technology.

Code had become powerful enough to raise the same legal questions as weapons.

Zimmermann built PGP because he thought privacy would become political

Zimmermann was a software engineer with a long-standing interest in cryptography and military policy.

By the late 1980s and early 1990s, electronic communication was becoming more important.

He believed ordinary people should be able to protect private messages without asking a government agency or large corporation for permission.

One political trigger was Senate Bill 266, an anticrime proposal that included language encouraging the ability of law enforcement to access encrypted communications.

Zimmermann feared a future in which secure communication systems would be required to contain access mechanisms for government surveillance.

So he stopped treating PGP as a someday project.

He finished it.

The important breakthrough was not inventing public-key cryptography

Public-key cryptography already existed.

The mathematical ideas had been developed in the 1970s.

The problem was usability.

Strong cryptography was still difficult for ordinary computer users to deploy.

PGP packaged several cryptographic techniques into software that individuals could use to encrypt messages and files.

A person could publish a public key that others used to encrypt messages for them.

The corresponding private key stayed secret.

Digital signatures could help verify authorship and integrity.

Zimmermann’s contribution was to move strong cryptography out of specialist environments and into the hands of ordinary Internet users.

Then he made it free

Zimmermann initially imagined PGP might become a commercial product.

But he became convinced that the political window was closing.

In June 1991, PGP was released publicly and distributed through the Internet.

Once the software was available, copying it was trivial.

It spread beyond the United States.

That mattered because U.S. export rules at the time treated strong cryptographic software as a controlled munition or defense-related technology.

What looked to users like downloading a program could look to regulators like exporting restricted cryptography.

Software crossed a border without a shipping crate

This was one of the strange new problems of the networked world.

Traditional export controls assumed physical objects.

Crates.

Machines.

Hardware shipped from one country to another.

PGP was software.

Once someone placed it on the Internet, users elsewhere could copy it instantly.

The border was crossed by information.

That collision between old regulation and network distribution helped make Zimmermann a central figure in the 1990s “crypto wars.”

The investigation lasted years

In 1993, Zimmermann became the target of a federal criminal investigation over the international distribution of PGP.

A grand jury was involved.

His communications and actions were scrutinized.

The investigation lasted about three years.

Zimmermann was never charged.

In early 1996, federal prosecutors closed the case without prosecution.

Only then did he found PGP Inc.

By that point, PGP had become one of the world’s most widely used email encryption tools.

The strange thing about software is that distribution can be the invention

Zimmermann did not invent every cryptographic primitive inside PGP.

What he changed was access.

There is a large difference between a technique existing in a paper and a tool existing on millions of computers.

Technology often becomes socially important only when the friction of use collapses.

TCP/IP mattered because networks implemented it.

Public-key cryptography mattered to ordinary users when usable software delivered it.

Machine learning existed for decades before APIs, GPUs and products made it broadly accessible.

The last mile of usability can be as consequential as the original theorem.

Security tools become more valuable when users do not need permission

PGP embodied a controversial idea.

Privacy could be a property of the software itself.

The user did not need to trust the network operator.

The user did not need the email provider to promise confidentiality.

The user could encrypt before the message left the machine.

This model now feels familiar in end-to-end encrypted messaging.

In 1991, it was politically and technically disruptive.

It moved power from infrastructure owners toward end users.

The broader lesson is about technologies that change who controls the default

Some innovations improve speed.

Some reduce cost.

Some do something more uncomfortable.

They change who gets to decide.

Encryption lets the sender decide who can read.

Open-source software lets users inspect and modify.

Self-hosting lets organizations choose where data lives.

Peer-to-peer systems can reduce dependence on central intermediaries.

These technologies tend to create political arguments because they do not merely improve the old system.

They redistribute control inside it.

Zimmermann’s story matters because PGP turned cryptography from a specialist capability into a user-controlled default.

That made the software useful.

It also made it controversial.

Which technologies today look controversial mainly because they let ordinary users do something that previously required institutional permission?

Explore

Stay connected