PGP Corporation

» see pgp.com as it lived, on the wayback machine

~ the last words ~

Phil Zimmermann released Pretty Good Privacy in June 1991 and it went around the world in weeks, which made him the formal target of a federal criminal investigation in February 1993 for exporting munitions. MIT Press published the entire source code as a printed book in 1995, because a book crossing a border was speech and a floppy disk was a weapon. The investigation closed in 1996 without charges, Zimmermann built PGP Inc. around the software that year, and Network Associates bought the company in December 1997.

That is the prehistory, and it is the part everyone knows. What happened next is the part that produced a company. In October 2001 Network Associates announced the PGP assets were for sale and stopped developing them, and by February 2002 it had canceled support for everything except the command line version. The most recognizable name in encryption was sitting on a corporate shelf with nobody assigned to it.

Jon Callas and Phil Dunkelberger formed PGP Corporation in Menlo Park in June 2002 for the purpose of buying it, and closed the purchase in August. Callas took the technical side, Dunkelberger ran the company, Zimmermann came along as an advisor. The product line went enterprise: PGP Universal for key management across a whole organization, and PGP Desktop underneath it doing whole disk encryption. That is a less romantic business than a cypherpunk mailing list, and it is the business that paid for the code to keep being maintained.

I have generated a keypair more than once and never once had anyone to use it with. That is the whole shape of PGP's problem and it has nothing to do with the software. Encryption between two people requires two people, and every person I have ever needed to email securely was reachable only on whatever their employer had installed. The company that sold PGP for eight years understood this perfectly, which is why it sold to organizations rather than individuals.

~ the record ~

~ the fall ~

PGP's usability was a running joke in the security field for two decades, and the joke had a citation. Key management asks an ordinary person to hold two long strings, understand which one is secret, and verify a stranger's fingerprint out of band before trusting anything. The web of trust was a fine idea that in practice meant key signing parties, which is a social event for people who already agree.

PGP Corporation's answer was to remove the user from the loop entirely. PGP Universal put a server in the mail path so encryption happened at the gateway and the employee did nothing. It worked, and it also quietly conceded the original argument: PGP was built so an individual could keep a secret from a government, and it survived by becoming a way for a legal department to keep a secret from a competitor.

~ the postmortem ~

Symantec announced on 29 April 2010 that it was buying PGP Corporation for about $300 million and GuardianEdge for another $70 million, folding both into its enterprise security group. Symantec's own filing puts the PGP close at 4 June 2010 and the final purchase price at $306 million. Zimmermann left rather than go with it and went on to found Silent Circle.

Symantec sold the enterprise security division to Broadcom in 2019. The products still exist under the Symantec Encryption name, several owners downstream, with the acquisition history of a company that was created to rescue this exact code from exactly this fate.

~ what got buried with it ~

The standard survived and the independent company did not. OpenPGP is an IETF standard and GnuPG has been the free implementation everybody actually runs since the late nineties, so nothing was lost at the protocol layer. What was lost is the idea that the most political piece of software of the 1990s could support a business of its own.

Zimmermann's later projects went the same way. Silent Circle shut down Silent Mail in 2013 rather than comply with the kind of demand that had just closed Lavabit, and the Blackphone did not change how anyone communicates. What actually delivered encrypted messaging to a billion people was Signal's protocol inside WhatsApp, given away for free, invisible, with no key for the user to lose.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »