Doomed to Repeat History? Lessons from the Crypto Wars of the 1990s

Below is the executive summary for "Doomed to Repeat History? Lessons From the Crypto Wars of the 1990s." Read the full paper here. 

In the past year, a conflict has erupted between technology companies, privacy advocates, and members of the U.S. law enforcement and intelligence communities over the right to use and distribute products that contain strong encryption technology. This debate between government actors seeking ways to preserve access to encrypted communications and a coalition of pro-encryption groups is reminiscent of an old battle that played out in the 1990s: a period that has come to be known as the “Crypto Wars.” This paper tells the story of that debate and the lessons that are relevant to today. It is a story not only about policy responses to new technology, but also a sustained, coordinated effort among industry groups, privacy advocates, and technology experts from across the political spectrum to push back against government policies that threatened online innovation and fundamental human rights.

Encryption is a method by which two parties can communicate securely. Although it has been used for centuries by the military and intelligence communities to send sensitive messages, the debate over the public’s right to use encryption began after the discovery of “public key cryptography” in 1976. In a seminal paper on the subject, two researchers named Whitfield Diffie and Martin Hellman demonstrated how ordinary individuals and businesses could securely communicate data over modern communications networks, challenging the government’s longstanding domestic monopoly on the use of electronic ciphers and its ability to prevent encryption from spreading around the world. By the late 1970s, individuals within the U.S. government were already discussing how to solve the “problem” of the growing individual and commercial use of strong encryption. War was coming.

The act that truly launched the Crypto Wars was the White House’s introduction of the “Clipper Chip” in 1993. The Clipper Chip was a state-of-the-art microchip developed by government engineers which could be inserted into consumer hardware telephones, providing the public with strong cryptographic tools without sacrificing the ability of law enforcement and intelligence agencies to access unencrypted versions of those communications. The technology relied on a system of “key escrow,” in which a copy of each chip’s unique encryption key would be stored by the government. Although White House officials mobilized both political and technical allies in support of the proposal, it faced immediate backlash from technical experts, privacy advocates, and industry leaders, who were concerned about the security and economic impact of the technology in addition to obvious civil liberties concerns. As the battle wore on throughout 1993 and into 1994, leaders from across the political spectrum joined the fray, supported by a broad coalition that opposed the Clipper Chip. When computer scientist Matt Blaze discovered a flaw in the system in May 1994, it proved to be the final death blow: the Clipper Chip was dead.

Nonetheless, the idea that the government could find a palatable way to access the keys to encrypted communications lived on throughout the 1990s. Many policymakers held onto hopes that it was possible to securely implement what they called “software key escrow” to preserve access to phone calls, emails, and other communications and storage applications. Under key escrow schemes, a government-certified third party would keep a “key” to every device. But the government’s shift in tactics ultimately proved unsuccessful; the privacy, security, and economic concerns continued to outweigh any potential benefits. By 1997, there was an overwhelming amount of evidence against moving ahead with any key escrow schemes.

While the domestic fight over key escrow wore on throughout the mid-1990s, another related battle was brewing on the international front over U.S. export controls and encryption technology. The question at the center of that debate was whether American technologies containing strong encryption should be made available overseas — which would in turn have a significant effect on the domestic availability and use of encryption tools. Until 1996, cryptographic tools were classified as munitions in the United States, with strict limits on the type of encryption that could be exported and the maximum cryptographic key length. Despite growing opposition to these restrictions, the U.S. government had a strong incentive to maintain encryption export controls as a means to delay the spread and adoption of strong encryption technology abroad. The practical result of the policy was that many companies exported weaker versions of their encrypted products, or were kept out of foreign markets altogether. By the mid-1990s, experts projected billions of dollars in potential losses as a result of these policies. Coupled with growing evidence that foreign-made encryption was readily available around the world, the rationale behind maintaining these controls became increasingly tenuous. Many of the same organizations and individuals that rallied against the Clipper Chip came together to mobilize against encryption export controls, arguing that they undermined U.S. economic competitiveness and individual privacy, with little evidence that they were actually achieving their stated goals.

From 1996 to 1999, the Clinton Administration gradually liberalized encryption export controls, beginning with the 1996 Executive Order that moved most commercial encryption tools from the U.S. Munitions List to the Commerce Control List. The next step involved relaxing limits on the strength of encryption keys. Although these concessions were originally used as a bargaining chip in the commercial key escrow debate — companies would be allowed to export higher strength encryption if they agreed to retain the keys — those requirements were eventually abandoned after pressure from industry and public interest groups. In September 1999, the White House announced a sweeping policy change that removed virtually all restrictions on the export of retail encryption products, regardless of key length. As journalist Steven Levy put it succinctly: “It was official: public crypto was our friend.”

In the decades since the resolution of the Crypto Wars, many of the predictions about how strong encryption would benefit the economy, strengthen Internet security, and protect civil liberties have been borne out. In particular, the widespread availablility of robust encryption laid the groundwork for the emergence of a vibrant marketplace of new Internet services based on secure digital communications and the widespread migration of sensitive communications online. The emergence of foundational technologies like the Secure Sockets Layer (SSL) and the Secure Shell Protocol (SSH) allowed the encrypted web to expand rapidly to include electronic banking, electronic medical records systems, online bill payment tools, home automation systems, e-filing systems for taxes, and VPNs. The evolution of the ecosystem for encrypted communications has also enhanced the protection of individual communications and improved cybersecurity, and today, strong encryption is an essential ingredient to the overall security of the modern network. And finally, the end of the Crypto Wars ushered in an age where the security and privacy protections afforded by the use of strong encryption also help promote free expression.

Unfortunately, the consensus that strong encryption is good for security, liberty, and economic growth has come under threat in recent years. The June 2013 revelations about the U.S. National Security Agency’s pervasive surveillance programs — not to mention the NSA’s direct attempts to thwart Internet security to facilitate its own spying — dramatically shifted the national conversation, highlighting the vulnerabilities in many of the tools and networks on which we now rely for both everyday and sensitive communications. While ordinary individuals, civil liberties advocates, and major technology companies have since embraced greater use of encryption as a necessary step to address a wide range of modern threats from both government and nongovernment actors, intelligence agencies and law enforcement officials have also become increasingly outspoken against measures to strengthen these systems through encryption. To make their case, they have revived many of the arguments they made about encryption in the 1990s, seeming to have forgotten the lessons of the past.

It seems like we may once again be on the verge of another war: a Crypto War 2.0. But it would be far wiser to maintain the peace than to begin a new and unnecessary conflict. There is no reason to repeat our previous mistakes.