Revisiting 'Why I Wrote PGP': A Precursor to Cryptographic Free Software

In the Hacker News tech community, an old essay written in 1991 and revised in 1999 has once again been pushed to the discussion board—Phil Zimmermann's "Why I Wrote PGP." This personal account from years ago remains illuminating today, because it's about more than just a piece of software—it's an early debate about privacy, freedom, and technology.

Why PGP Was Written

PGP (Pretty Good Privacy) was born in 1991, and in this article, author Phil Zimmermann gives his most direct explanation: at the time, he saw an increasingly digital society where citizens' private communications were almost completely exposed to the surveillance capabilities of governments and corporations. He wrote PGP in the hope of putting strong encryption tools into the hands of ordinary people, rather than leaving them solely in the hands of the military and intelligence agencies.

This motivation seems simple, yet it touched the most sensitive technological and legal boundaries of the time. Zimmermann recalls in the article that what worried him was a future in which ordinary people's phone calls, letters, and emails could all be recorded, scanned, and archived, while they had no ability to resist. PGP sought to reverse this asymmetry.

Interestingly, Zimmermann did not package encryption as an "anti-government tool." What he emphasized was citizens' right to self-defense—just like locking your front door, encryption is a basic protective measure, not a confrontational political statement.

PGP (Pretty Good Privacy) is an encryption software package released by Phil Zimmermann in 1991, primarily used for email and file encryption. Its core capabilities include symmetric encryption, public-key encryption, and digital signatures. PGP originally used the RSA public-key algorithm and the IDEA symmetric algorithm, and managed public keys through a "Web of Trust" model rather than relying on a centralized certificate authority.

This design was groundbreaking at the time: it compressed encryption capabilities that were originally complex, expensive, and institution-oriented into a free tool that could run on a personal computer. PGP's source code was public, and anyone could inspect its implementation. This was important, because encryption software that cannot be verified is difficult to trust. PGP later evolved into the OpenPGP standard and gave rise to widely used open-source implementations such as GnuPG. Today, in scenarios like email encryption, software package signing, and code commit signing, PGP's established technical path can still be seen.

Why Strong Encryption Deserves to Be Public

A core argument of the article is that strong encryption should not be monopolized. Zimmermann believed that if only governments and large corporations could use strong encryption, ordinary people would be at a structural disadvantage in the information society. Publicly available encryption software is a necessary condition for maintaining some semblance of balance.

When he wrote PGP, he chose the path of open source and free distribution, and deliberately made it easy to spread. This strategy was not common at the time—encryption algorithms were once regarded as munitions, and their export was strictly controlled. The spread of PGP itself became a challenge to the old rules.

From today's perspective, this idea of "democratizing strong encryption" has become mainstream: browsers, instant messaging, and disk encryption all trace back to the path PGP pioneered. But in 1991, this was still a judgment made with a sense of adventure.

Encryption export controls are the key background for understanding PGP's historical situation. During the Cold War and for a long time afterward, the United States placed strong encryption technology on the U.S. Munitions List under the International Traffic in Arms Regulations (ITAR), on the grounds that encryption capabilities could be exploited by foreign governments, terrorist organizations, or criminal groups. Therefore, distributing strong encryption software outside the United States required a license and could even be regarded as exporting weapons.

This set of rules quickly became outdated in the digital age: software could be copied to disks, uploaded to networks, or even exported in the form of printed books. The spread of PGP directly challenged this regulatory logic. Zimmermann was investigated precisely because he put strong encryption tools into channels accessible to ordinary people. This controversy ultimately helped push the United States to gradually relax encryption export restrictions from the late 1990s to the early 2000s, and it also profoundly influenced the legal environment for later open-source encryption projects.

Controversy and Cost

The article also candidly acknowledges that PGP came at a cost for him. In the mid-1990s, the U.S. government's investigation into encryption software exports briefly put Zimmermann at legal risk. This experience later became a landmark case in the debate over encryption export controls, and it prompted more people to rethink: should encryption technology really be regulated as a weapon?

At the same time, PGP itself also encountered technical controversy. Early versions were not invulnerable in algorithm design and key management, and the security community later had many discussions about this. Zimmermann did not avoid these real-world problems in the article, but instead focused on the more fundamental level: "encryption should be usable and accessible."

Key management is the most easily overlooked yet most error-prone part of an encryption system. No matter how reliable the strong encryption algorithm itself is, if public keys are replaced, private keys are leaked, or passwords are too weak, communication security can still be compromised. Early PGP used a "Web of Trust" to confirm public-key ownership: users signed each other's keys, forming decentralized trust relationships. This approach was flexible, but it also required users to understand and actively maintain the chain of trust, which was not easy for ordinary users.

Later criticism of PGP from the security community was often not aimed at its encryption algorithms, but focused on usability and key lifecycle management. For example, key revocation, expiration, recovery after loss, and how to confirm that the other party's public key is genuinely valid. These practical difficulties remind us that the adoption of encryption tools depends not only on algorithm strength, but also on whether ordinary people can use them correctly. Zimmermann's emphasis in the article that "encryption should be usable and accessible" touches on this deeper engineering and social problem.

Relevance Today

Revisiting this article reveals a clear thread: the popularization of encryption tools has never happened naturally, but has depended on specific people pushing it forward and taking on risks. The motivation Zimmermann wrote down in 1991—protecting ordinary people's private communications—still holds today, except that the adversaries now range from government surveillance to platform data collection, commercial surveillance, and more complex security threats.

For developers and technical professionals, what makes this article worth reading is that it shows how to elevate a technical choice into a public issue. PGP is not just a piece of code; it is also a statement about "whom technology should serve."

In the Hacker News discussion, many readers mentioned that similar debates are still ongoing: end-to-end encryption, backdoor legislation, and the maintenance of open-source encryption libraries are all different versions of the same question. The reason Zimmermann's words are repeatedly cited is that these questions have never truly gone away.

End-to-end encryption (E2EE) is the most direct contemporary continuation of the PGP spirit. It means data is encrypted at the sender's end and decrypted at the receiver's end, and intermediary servers cannot read the plaintext. Today, communication tools such as Signal, WhatsApp, and iMessage all use end-to-end encryption, and their design goals are highly consistent with PGP's original purpose of protecting private communications.

But unlike the PGP era, today's data collectors are often no longer a single government, but platforms, advertising networks, and commercial surveillance systems. Encryption has therefore expanded from "preventing government surveillance" to "preventing platform abuse." At the same time, policy debates over backdoor legislation and client-side scanning continue to emerge, attempting to leave law enforcement access points in encryption systems. These debates are essentially still answering the question Zimmermann raised as early as 1991: in whose hands should strong encryption ultimately rest, and should ordinary people's private communications have a door that can truly be locked?

One-line Summary

Revisiting Phil Zimmermann's "Why I Wrote PGP" to understand the original intent, costs, and contemporary echoes of democratizing strong encryption.

Paragraph Summary

The article reviews Phil Zimmermann's motivation for writing PGP when he released it in 1991: to let ordinary people use strong encryption, rather than letting encryption capabilities remain solely in the hands of governments and the military. Zimmermann argued that strong encryption should not be monopolized, so he chose open source and free distribution, and made PGP easy to spread. This strategy directly challenged the old rules that treated encryption as munitions and strictly controlled its export, and it also led to a U.S. government investigation, becoming a landmark event in the encryption policy debate. The article also notes that early PGP was not invulnerable in algorithms and key management, but Zimmermann was more concerned with the accessibility of encryption. Revisiting this article shows that today's debates over end-to-end encryption, backdoor legislation, and commercial surveillance are still a continuation of the same question.