Summary

  • Zimmermann dated PGP’s first public Internet release to 6 June 1991; MIT later limited its own FTP and Web distribution to U.S. citizens inside the country.
  • MIT Press sought a Commodity Jurisdiction ruling for a printed, scan-ready PGP source book. No reply had arrived by Zimmermann’s December 1995 declaration, while a 1996 White House directive treated source code by its function and addressed foreign access over FTP.

What counts as an export when software can cross a border as a file, then reappear as a book full of lines a scanner can turn back into a program? PGP made that question concrete.

Philip Zimmermann later dated PGP 1.0’s first public Internet upload to 6 June 1991. The day before, he had sent it to friends for distribution. The Clinton Presidential Library’s finding aid on cryptography and PGP describes a 1991 FTP release to a small group in an anti-nuclear activist organization and says the release led to an investigation. In his own 2021 account, Zimmermann says he became the target of a criminal investigation over the program’s spread abroad.

By 1994, MIT’s own distribution page had drawn a crisp boundary around its server. Its archived PGP page said MIT distributed the software only to U.S. citizens within the United States. The page offered source-code and executable-only versions through the World Wide Web or anonymous FTP. DOS and Unix users could get PGP 2.6.2; Macintosh users had MacPGP 2.6. The network could reach beyond the country. MIT’s terms narrowed who could use its distribution channel.

The book put the distinction under pressure. In a November 1994 author’s preface, Zimmermann said the MIT Press volume would contain the complete C source code for PGP and could be scanned with OCR. He explained that the publisher would request a Commodity Jurisdiction decision. MIT Press submitted that request on 24 January 1995, seeking confirmation that the book was not controlled under the International Traffic in Arms Regulations. The book appeared in March, with a $55 price listed in Zimmermann’s later sworn declaration.

That declaration in Karn v. U.S. Department of State is unusually precise about the unresolved question. The request described the book as containing all the code needed for a full PGP implementation, printed in a standard font readable by people and scanners. Scanning and compiling it would make executable software. As of Zimmermann’s December 1995 declaration, the State Department had not answered MIT Press. A Department of Justice filing said the export status of printed cryptographic source code was under consideration. Zimmermann separately reported informal, conflicting agency recommendations; his declaration did not present those as a formal decision.

The investigation and the book request followed separate tracks. Zimmermann later wrote that the government dropped the investigation in early 1996. On 15 November 1996, the White House issued a memorandum on encryption export policy. It directed future regulations to treat encryption source code as a product because it could be mechanically transformed into object code and because its functional capacity mattered more than the information it conveyed. The memorandum also said that making code available through an Internet FTP site accessible abroad could constitute an export unless adequate precautions prevented unauthorized transfer. The planned move of most encryption products from State to Commerce would take effect only when final regulations issued; until then, State retained authority.

A book and an FTP directory exposed the same classification problem through different carriers. The final agency response to MIT Press’s January request is absent from this record; that document would establish how the book itself was classified.