Charlie, Al, and I were just trying to maintain a sense of humor in fairly tough times, knowing that the first who would see the key would be the folks we were working with at the ministry.
https://en.m.wikipedia.org/wiki/Crypto_Wars
"In the U.S." since "the immediate post WWII period" the "crypto software was included as a Category XIII item into the United States Munitions List." That meant that exporting software with strong encryption was legally the same as exporting weapons.
What they Ray Ozzie and colleagues implemented was at that moment (1996) claimed to be a "superior exportable encryption technology when compared to other US products on the market":
https://packetstormsecurity.com/files/21281/lotus.notes.nsa....
To compare:
https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
To be able to export Netscape web browser with SSL (a predecessor of TLS) "Netscape developed two versions of its web browser. The "U.S. edition" supported full size (typically 1024-bit or larger) RSA public keys in combination with full size symmetric keys (secret keys) (128-bit RC4 or 3DES in SSL 3.0 and TLS 1.0). The "International Edition" had its effective key lengths reduced to 512 bits and 40 bits respectively (RSA_EXPORT with 40-bit RC2 or RC4 in SSL 3.0 and TLS 1.0).[6] Acquiring the 'U.S. domestic' version turned out to be sufficient hassle that most computer users, even in the U.S., ended up with the 'International' version,[7] whose weak 40-bit encryption can currently be broken in a matter of days using a single computer."
Only later:
"In January 2000, the U.S. Government relaxed export regulations over certain classes of mass-market encryption products. In line with these changes, Netscape has made the strong-crypto versions of Communicator and Navigator available worldwide." (1)
The principled thing to do would be to have never tried to ship our product outside the US, knowing the export regime.
But we had customers who wanted to communicate and collaborate with teams globally. Their alternative was to send everything in the clear, and I wanted to deliver a secure comms system for my global customers.
Ultimately I felt that they were better off with something to protect them - even a compromise - rather than nothing. The bet was that we could get rid of the compromise over time. (Thankfully, the hack was only necessary for a few short years.)
While “working the issue” in DC, I personally came to the viewpoint that most of the policy makers were not inherently evil or stupid; they truly didn’t fully grasp the myriad implications of this new technology. The issues are complex, the pressures great, and it is difficult for them to know how to balance equities. And so, right or wrong, I felt my best bet to change the system was to use methods that I suppose Bruce Lee would call “fighting without fighting”, as opposed to purely principled extremism.