- 1 Cypherpunk issues
- 2 Cypherpunk activities
- 3 Cypherpunk history
- 4 Log in as "cypherpunk?"
- 5 References
A cypherpunk is an activist advocating widespread use of strong cryptography as a route to social and political change. There has been an active cypherpunk movement since about 1990, heavily influenced by the hacker tradition and by libertarian ideas. Through most of the 90s, there was a very active cypherpunk mailing list and many cypherpunks were involved in the intense political and legal controversies around cryptography of the period. Most have remained active into the 21st century, and others have joined in as the controversies continue.
The basic ideas are in this quote from the Cypherpunk Manifesto:
Privacy is necessary for an open society in the electronic age. ...
We cannot expect governments, corporations, or other large, faceless organizations to grant us privacy ...
We must defend our own privacy if we expect to have any. ...
Cypherpunks write code. We know that someone has to write software to defend privacy, and ... we're going to write it. ... 
Many cypherpunks are technically quite sophisticated; they do understand ciphers and are capable of writing software. Some are or were quite senior people at major hi-tech companies and others are well-known researchers (see list with affiliations below). However, the "punk" part of the name indicates an attitude:
We don't much care if you don't approve of the software we write. We know that software can't be destroyed and that a widely dispersed system can't be shut down. 
This is crypto with an attitude, best embodied by the group's moniker: Cypherpunks.
The people in this room hope for a world where an individual's informational footprints -- everything from an opinion on abortion to the medical record of an actual abortion -- can be traced only if the individual involved chooses to reveal them; a world where coherent messages shoot around the globe by network and microwave, but intruders and feds trying to pluck them out of the vapor find only gibberish; a world where the tools of prying are transformed into the instruments of privacy.
There is only one way this vision will materialize, and that is by widespread use of cryptography. Is this technologically possible? Definitely. The obstacles are political -- some of the most powerful forces in government are devoted to the control of these tools. In short, there is a war going on between those who would liberate crypto and those who would suppress it. The seemingly innocuous bunch strewn around this conference room represents the vanguard of the pro-crypto forces. Though the battleground seems remote, the stakes are not: The outcome of this struggle may determine the amount of freedom our society will grant us in the 21st century. To the Cypherpunks, freedom is an issue worth some risk.
The three masked men on the cover of that edition of Wired were prominent cypherpunks Tim May, Eric Hughes and John Gilmore.
Later, Levy wrote a book Crypto: How the Code Rebels Beat the Government — Saving Privacy in the Digital Age  covering the "crypto wars" of the 90s in detail. "Code Rebels" in the title is almost synonymuous with "cypherpunks".
The term "cypherpunk" is mildly ambiguous. In most contexts in means anyone advocating cryptography as a tool for social change. However, it can also be used to mean a participant in the cypherpunks mailing list described below. The two meanings obviously overlap, but they are by no means synonymous.
Through most of the 90s the cypherpunks mailing list had extensive discussions of the public policy issues related to cryptography and on the politics and philosophy of concepts such as anonymity, pseudonyms, reputation, and privacy. Of course these discussions are continuing elsewhere since the list shut down.
In at least two senses, people on the list were ahead of more-or-less everyone else. For one thing, the list was discussing questions about privacy, government monitoring, corporate control of information, and related issues in the early 90s that did not become major topics for broader discussion until ten years or so later. For another, some list participants were more radical on these issues than almost anyone else.
The list had a range of viewpoints and there was probably no completely unanimous agreement on anything. The general attitude, though, definitely put personal privacy and personal liberty above all other considerations.
This society was built as a free and open society. Our ancestors, our
parents, our peers, and ourselves are all making and building this society in such a way -- because we believe such a society outperforms closed societies -- in quality of life, in liberty, and in the pursuit of happiness.
But I see this free and open society being nibbled to death by ducks,
by small, unheralded changes. It's still legal to exist in our society without an ID -- but just barely. It is still legal to exist by paying with cash -- just barely. It is still legal to associate with anyone you want -- unless they bring a joint onto your boat, photograph naked children for your museum, or work for you building a fantasy roleplaying game. ...
In most of Europe, phone companies don't record the phone numbers when
you call, and they don't show up on your bill. They only tick off the charges on a meter. Now, I was told that this is partly because the Nazis used the call records that they used to have, to track and identify the opposition after taking over those countries in World War II. They don't keep those records any more. ...
The whole conference has spent a lot of time talking about ways to
control uses of information and to protect peoples' privacy after the information was collected. But that only works if you assume a good government. If we get one seriously bad government, they'll have all the information they need to make an efficient police state and make it the last government. It's more than convenient for them -- in fact, it's a temptation for people who want to do that, to try to get into power and do it. Because we are giving them the means.
What if we could build a society where the information was never
collected? Where you could pay to rent a video without leaving a credit card number or a bank number? Where you could prove you're certified to drive without ever giving your name? Where you could send and receive messages without revealing your physical location, like an electronic post office box? 
Modern computing and communications technologies can provide all the facilities Gilmore suggests, but they can also give tremendous facilities either to government snoops or to commercial collectors of information on their "target markets". For cypherpunks, the question of how to preserve privacy and liberty in this changing world is vital.
Privacy of communications
A very basic cypherpunk issue is privacy in communications. Gilmore continued the above speech with:
That's the kind of society I want to build. I want a guarantee -- with physics and mathematics, not with laws -- that we can give ourselves real privacy of personal communications.
Such guarantees require strong cryptography, so cypherpunks are fundamentally opposed to government policies attempting to control the usage or export of cryptography. See politics of cryptography for discussion.
Cypherpunks deplore regulations on cryptography, for encryption is fundamentally a private act. 
This was a central issue for many cypherpunks. Most were passionately opposed to various government attempts to limit cryptography — export laws, promotion of limited key length ciphers, and especially escrowed encryption.
Privacy and self-revelation
A whole set of issues around privacy and the scope of self-revelation were perennial topics on the list.
Consider a young person who gets "carded" when he or she enters a bar and produces a driver's license as proof of age. The license includes things like full name and home address; these are completely irrelevant to the question of legal drinking. However, they could be useful to a lecherous member of bar staff who wants to stalk a hot young customer, or to a thief who cleans out the apartment when an accomplice in the bar tells him you look well off and are not at home. Is a government that passes a drinking age law morally obligated to create a privacy-protecting form of ID to go with it, one that only shows you can legally drink without revealing anything else about you? In the absence of that, is it ethical to acquire a bogus driver's license to protect your privacy? For most cypherpunks, the answer to both those questions is "Yes, obviously!"
What about a traffic cop who asks for your driver's license and vehicle registration? Should there be some restrictions on what he or she learns about you? Or a company that issues a frequent flier or other reward card, or requires registration to use its web site? Or cards for toll roads that potentially allow police or others to track your movements? Or cameras that record license plates or faces on a street? Or phone company and Internet records? In general, how do we manage privacy in an electronic age?
Cypherpunks naturally consider suggestions of various forms of national uniform identification card too dangerous; the risks of abuse far outweigh any benefits.
Questions of privacy in financial matters were another perennial topic.
Cash is almost anonymous; if I pay for dinner with a few bills, then the restaurant (short of doing an analysis of DNA traces on the bills) learns almost nothing about me and my menu choices are not in any record tied to my identity. However, if I pay with a credit card, the bank and the restaurant get more data. This might be used to my disadvantage, perhaps by a data-trolling marketer or a divorce lawyer wondering who my dinner companion was. Various government bodies may also use financial records — the tax department, efforts to seize gangsters' assets, the related effort to trace "money laundering" schemes, attempts to collect financial intelligence, or some countries' controls on currency exchange.
Can we combine the anonymity of cash with the convenience of electronic payment? Technically, the answer is almost certainly yes (see digital cash), but what are the social implications? In particular, what happens to the tax system, or other government controls, if anonymous financial transactions become commonplace? The more radical cypherpunks would say those controls would be destroyed, and that would clearly be a good thing.
This is probably the area where the libertarian influence on cypherpunk thinking is most obvious. Some argued that digital cash could eliminate a whole range of problems brought on by government "interference" in what should naturally be "open markets".
Anonymity and pseudonyms
Arguably, the possibility of anonymous speech and publication is vital for an open society, an essential requirement for genuine freedom of speech — this was the position of most cypherpunks. A frequently cited example is that some of the leaders of the American Revolution published anonymously. On the other hand, the possibility of anonymity may facilitate various forms of criminal activity, notably conspiracy and libel.
On the net, one can use a pseudonym, often shortened to just nym. This has some of the advantages and problems of anonymity, but adds its own complications. A pseudonym can be tied to a public key so that only an authorised person can use it. Several people might share a pseudonym, as for the mathematician Nicolas Bourbaki who published a number of papers but never actually existed or "Publius", the pseudonym three authors (Alexander Hamilton, James Madison and John Jay) used jointly for the Federalist Papers. One person might have multiple pseudonyms. A pseudonym can acquire a reputation — if clever things often appear under the pseudonym, then a new message using that name will be taken seriously. On the other hand, if many messages from a nym are idiotic, a new one may not even be read and will certainly not be accepted without caution.
Censorship and monitoring
Questions of censorship and government or police monitoring of various things were also much discussed. Cypherpunks almost invariably opposed both.
In particular, the US government's Clipper chip scheme for escrowed encryption of telephone conversations (encryption secure against most attackers, but breakable at need by government) was seen as anathema by many on the list. This was an issue that provoked strong opposition and brought many new recruits to the cypherpunk ranks. List participant Matt Blaze found a serious flaw  in the scheme, helping to hasten its demise.
Some cypherpunks make analogies with gun laws. Widespread use of strong cryptography is desirable for exactly the same reason that an armed citizenry is; it limits the power of a repressive government. Legal restrictions on cryptography, like restrictions on guns, only create problems for honest citizens; criminals naturally ignore such laws.
Cypherpunks are by no means just a bunch of people chatting about ideas; they are often activists, using a variety of tactics to further their goals. Of course they have been rather vocal in various public debates. They have also written software, built hardware, written papers, filed Freedom of Information Act requests, filed lawsuits, set up web sites, and advocated civil disobedience.
As the Manifesto says "Cypherpunks write code" ; the notion that good ideas need to be implemented, not just discussed, is very much part of the culture.
John Gilmore, whose site hosted the original cypherpunks mailing list, wrote:
We are literally in a race between our ability to build and deploy technology, and their ability to build and deploy laws and treaties. Neither side is likely to back down or wise up until it has definitively lost the race.
Cypherpunks have built and deployed quite a bit of code. Anonymous remailers such as the Mixmaster Remailer were almost entirely a cypherpunk development. Among the other projects they have been involved in were PGP for email privacy, FreeS/WAN for opportunistic encryption of the whole net, Off-the-record messaging for privacy in Internet chat, and the Electronic Frontier Foundation EFF's TOR project for anonymous web surfing.
List subscribers also participated, along with other experts, in several reports on cryptographic matters.
One such paper was Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security.  It suggested 75 bits was the minimum key size to allow an existing cipher to be considered secure and kept in service. At the time, the Data Encryption Standard with 56-bit keys was still a US government standard, mandatory for some applications.
Other papers were critical analysis of government schemes. The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption , evaluated escrowed encryption proposals. Comments on the Carnivore System Technical Review.  looked at an FBI scheme for monitoring email.
Cypherpunks provided significant input to the 1996 National Research Council report on encryption policy, Cryptography's Role In Securing the Information Society (CRISIS) This report, commissioned by the U.S. Congress in 1993, was developed via extensive hearings across the nation. It recommended a gradual relaxation of the existing U.S. government restrictions on encryption. Like many such study reports, its conclusions were largely ignored by policy-makers. Later events such as the final rulings in the cypherpunks lawsuits forced a more complete relaxation of the controls on encryption software.
List participants were also on the panel that created a later report on "Trust in Cyberspace".
The project leader was John Gilmore, and the goal of the project was to demonstrate beyond question that DES was insecure. As many cypherpunks saw it, this was necessary because the US government had been telling deliberate lies about the security of DES for some time.
Cypherpunks, or at least list subscribers, have set up a number of web sites over the years.
- Cypherpunks Tonga is a general reference site, the best source for recent cypherpunk information.
- Cypherpunks Canada is the distribution site for Off-the-record messaging, a system for encrypting Internet chat
- Cryptome has been publishing "material on freedom of expression, privacy, cryptology, dual-use technologies, national security, intelligence, and secret governance -- open, secret and classified documents" since 1996.
- WikiLeaks has been publishing leaked material since 2006
Cypherpunks have filed a number of lawsuits, mostly suits against the US government alleging that some government action is unconstitutional.
Phil Karn sued the State Department in 1994 over cryptography export controls  after they ruled that, while the book Applied Cryptography could legally be exported, a floppy disk containing a verbatim copy of code printed in the book was legally a munition and required an export permit, which they refused to grant. Karn also appeared before both House and Senate committees looking at cryptography issues.
Daniel Bernstein, supported by the EFF, also sued over the export restrictions, arguing that preventing publication of cryptographic source code is an unconstitutional restriction on freedom of speech. He won, effectively overturning the export law. See the politics of cryptography article for details.
Peter Junger also sued on similar grounds, and won.
John Gilmore has sued two US Attorneys General (Ashcroft and Gonzales), arguing that the requirement to present identification documents before boarding a plane is unconstitutional. These suits have not been successful to date.
Cypherpunks encouraged civil disobedience against what they saw as idiotic laws, in particular US law on export of cryptography. Until about 2000, cryptographic code was legally a munition and export required a permit.
#!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)
People did use it that way, so then every time they sent email to a foreigner or to an international mailing list, they were violating the export laws. There were also T-shirts sold with the code and mailing labels with it printed on them. A few people even got the code put into tattoos; would that make it illegal for them to go abroad?
Vince Cate put up a web page that invited anyone to become an international arms trafficker; every time someone clicked on the form, an export-restricted item — originally PGP, later a copy of Back's program — would be mailed from a US server to one in Anguilla. There were options to add your name to a list of such traffickers and to send email to the president registering your protest.
These protests did get some attention. According to the sites, the New York Times covered the mailing labels, the BBC mentioned the T-shirts, and CNN showed the arms trafficker page.
Until about the 1970s, cryptography was mainly done in secret by military or spy agencies. However, in the 70s, there were two publications that brought it out of the closet, into public awareness. One was the US government publication of the Data Encryption Standard, a block cipher which became very widely used. The other was the publication by Whitfield Diffie and Martin Hellman of the first publicly available work on public key cryptography.
From that time on, cryptography was openly discussed and people began to examine its political and social consequences. There are substantial issues there; cryptography can be used to protect personal privacy or government and corporate secrets, but it can also be used by criminals to hide their schemes or their profits. Should strong cryptography be widely used or strictly limited? From the beginning, some of the speculations and some of the arguments were along lines we would now call cypherpunk.
Sometime around 1990, these ideas coalesced into something like a movement, and Wired magazine writer Jude Milhon coined the term "cypherpunk", derived from cipher and cyberpunk. The Oxford English Dictionary added "cypherpunk" in 2006. 
The cypherpunks mailing list
Through most of the 90s, cypherpunks communicated largely through the cypherpunks mailing list. There were also cypherpunk "physical meetings" and parties. The list was set up in 1992 and shut down around 2001. In its heyday in the late 90s, it was a very active list with technical discussion ranging over mathematics, cryptography, and computer science, political and philosophical discussion, personal arguments and attacks, with some spam thrown in. An email from John Gilmore shows an average of 30 messages a day Dec 1, 1996 to March 1, 1999, and suggests that the number was probably higher earlier. There were well over a thousand subscribers at the peak. There is an archive available of all list posts 1992-1998.
An obituary written when the list shut down summarised:
for all the irrelevant comments, vicious infighting and radical libertarian politics that flourish on the list, Cypherpunks has chronicled every important event in the short history of modern cryptography, as well as the cyber-rights movement that grew out of it. ... Seemingly every major figure in cryptography and computer security has passed through the list from time to time.
The original cypherpunks list, and the spin-off coderpunks, were hosted on John Gilmore's toad.com. The coderpunks list, open by invitation only, took up more technical matters and had less discussion of public policy implications.
There was a long complex controversy over list management, mainly Gilmore's refusal to apply any protection against spam since he saw any content-based filtering as censorship. Later there was a distributed cypherpunks list, hosted on several sites; this continued after Gilmore shut down the hosting on his site, but was far less active.
To some extent, the cryptography list is a successor to cypherpunks; it has many of the people and continues some of the same discussions. However, it is a moderated list, considerably less zany and somewhat more technical. An unmoderated crypto list, also with many of the same people, was started in 2010 largely because moderation on the other one was painfully slow. Since then, the moderation has been fixed and both lists remain active.
The cypherpunks list became very active again after Edward Snowden's revelations in 2013. It helped that an additional host name, cpunks.org, became available; the list had been hosted at al-qaeada.net (no relation to Bin Laden's organisation, just a name to irritate the NSA) and that made some people reluctant to subscribe. As of mid-2014 the current list seems alive and well.
Well-known list participants
Cypherpunks list participants included many notable computer industry figures. Not all were list regulars, and not all would call themselves "cypherpunks".
- Julian Assange — most obvious person at Wikileaks; an archive of his cypherpunks mailing list posts is at Cryptome
- John Perry Barlow — lyricist for some Grateful Dead songs, one of the founders of the Electronic Frontier Foundation
- Steven Bellovin — Bell Labs researcher, later Columbia professor
- Jim Bizdos — chairman of RSA Security
- Matt Blaze — Bell Labs researcher, later professor at U of Pennsylvania
- Jon Callas — technical lead on Open PGP specification and Chief Technical Officer of PGP Corporation
- Kent Crispin — researcher at Lawrence Livermore labs, later at ICANN
- Matt Curtin — founder of Interhack Corporation, lecturer at Ohio State University
- Hugh Daniel — former Sun Microsystems' employee, manager of the FreeS/WAN project
- Dorothy Denning — professor at Georgetown
- Whitfield Diffie — one of the inventors of public key cryptography
- David Farber — well-known computer scientist, then at U Pennsylvania, later Carnegie Mellon
- John Gilmore — Sun Microsystems' fifth employee, one of the founders of the Electronic Frontier Foundation, project leader for FreeS/WAN *
- Mike Godwin — Electronic Frontier Foundation lawyer
- Ian Goldberg — professor at University of Waterloo, designer of the Off-the-record messaging protocol *
- Lucky Green — author of first free software implementation of ring signatures
- Peter Gutmann — researcher at University of Auckland, New Zealand
- Peter Honeyman — professor at U of Michigan
- Eric Hughes — author of A Cypherpunk's Manifesto *
- Peter Junger — Law professor at Case Western Reserve University
- Phil Karn — Bell Labs researcher, later at Qualcomm
- Tim May — former chief scientist at Intel, author of A Crypto Anarchist Manifesto  and the Cyphernomicom 
- Declan McCullagh — journalist specializing in security and privacy issues
- Ron Rivest — MIT professor, the 'R' in RSA
- Marshall Rose — active IETF participant, author of several networking books
- Bruce Schneier — well-known security author *
- William Allen Simpson — designer, with Karn, of the Photuris protocol, an alternative to Internet Key Exchange
- Cliff Stoll — author of The Cuckoo's Egg
- Theodore Ts'o — main designer of Kerberos and the Linux random device
- John Young — started the Cryptome web site
- Tatu Ylonen — designer of the 'secure shell', SSH
- Philip Zimmermann — creator of PGP
* indicates someone mentioned in the acknowledgements of Stephenson's Cryptonomicon (see next section).
In Neal Stephenson's novel Cryptonomicon many characters are on the "Secret Admirers" mailing list. This is fairly obviously based on the cypherpunks list, and several well-known cypherpunks are mentioned in the acknowledgements. Much of the plot revolves around cypherpunk ideas; the leading characters are building a data haven which will allow anonymous financial transactions, and the book is full of cryptography. But, according to the author the book's title is — in spite of its similarity — not based on the Cyphernomicon , an online cypherpunk FAQ document.
There was a pornographic cypherpunk movie called Cryptic Seduction, produced by someone using the pseudonym Randy French. It caused great amusement in cypherpunk circles, but did not make money. At one point the copyright for it was up for auction. 
Jim Bell and "Assassination Politics"
Imagine for a moment that as ordinary citizens ... see an act by a government employee or officeholder that they feel violates their rights ... If only 0.1% of the population, or one person in a thousand, was willing to pay $1 to see some government slimeball dead, that would be, in effect, a $250,000 bounty on his head. Further, imagine that anyone considering collecting that bounty could do so with the mathematical certainty that he could not be identified, ... Perfect anonymity, perfect secrecy, and perfect security.
He worked out the mechanisms for this in considerable detail, and speculated extensively on the political consequences. Naturally, the discussion on the list was intense. Later, Bell was arrested and convicted  for tax evasion, with accusations of attempts to intimidate IRS agents. Still later, another case was brought against him, alleging "stalking and intimidating local agents of the IRS, Treasury Department and BATF"  Another list subscriber, Carl Johnson, was also convicted of sending threatening emails. Discussion of Bell's essay played a prominent part in all three trials.
Log in as "cypherpunk?"
Cypherpunk, cypherpunks or cpunks are sometimes used as a username and password on websites which require registration, for users who do not wish to reveal information about themselves. The account is left for later users. Many such accounts were publicly announced on the list.
- Eric Hughes (1993) A Cypherpunk's Manifesto
- Steven Levy (May 1993), Code Rebels, Wired
- Steven Levy (2001). "Crypto: How the Code Rebels Beat the Government — Saving Privacy in the Digital Age. Penguin, 56. ISBN 0-14-024432-8.
- Tim May (1992) Crypto Anarchist Manifesto
- Tim May, Cyphernomicon
- John Gilmore (March 1991), Privacy, Technology, and the Open Society
- Matt Blaze (1994), Protocol failure in the escrowed encryption standard
- Blaze, Diffie, Rivest, Schneier, Shimomura, Thompson & Wiener (1996). Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security.
- Hal Abelson, Ross Anderson, Steven M. Bellovin, Josh Benaloh, Matt Blaze, Whitfield Diffie, John Gilmore, Peter G. Neumann, Ronald L. Rivest, Jeffrey I. Schiller & Bruce Schneier (1998), The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption
- Steven Bellovin, Matt Blaze, David Farber, Peter Neumann & Eugene Spafford, Comments on the Carnivore System Technical Review
- Kenneth W. Dam and Herbert S. Lin, Editors (1996). Cryptography's Role In Securing the Information Society. Washington, D.C.: National Research Council, 688. ISBN 0-309-05475-3.
- Fred B. Schneider, ed. (1998), Trust in Cyberspace, Committee on Information Systems Trustworthiness, National Research Council
- Electronic Frontier Foundation (1998), Cracking DES: Secrets of Encryption Research, Wiretap Politics, and Chip Design, Electronic Frontier Foundation, ISBN ISBN: 1-56592-520-3
- The Applied Cryptography Case: Only Americans Can Type!.
- Schneier, Bruce (2nd edition, 1996,), Applied Cryptography, John Wiley & Sons, ISBN 0-471-11709-9
- Gilmore v. Gonzales
- Adam Back, export-a-crypto-system sig, web page
- Adam Back, post to cypherpunks list, RSA in six lines of Perl
- Vince Cate, ITAR Civil Disobedience (International Arms Trafficker Training Page)
- James Gleick (November 2006), "Cyber-Neologoliferation", New York Times
- Will Rodger (November 2001), R.I.P. Cypherpunks, Security Focus
- Neal Stephenson, Cryptonomicon cypher-FAQ
- Andrew Orlowski (March 2002), "Alice, Bob and Eve too: Crypto porno movie goes up for auction", The Register
- Jim Bell (1997) Assassination Politics
- Associated Press (December 1997), Jim Bell sentenced
- Deborah Natsios (June 2001), Homeland Defense and the Prosecution of Jim Bell
- Jim Bell files
- Carl Johnson files