Crypto Wars chronology (1991 - 2024)

This is the history, so far, of the western government's war against encryption and privacy enhancing technologies, which has recently hit Bitcoin as well.

1991 - The US Senate includes in an omnibus decree (Bill 266) the obligation to insert backdoors in cryptographic algorithms to allow access to data by authorities.

1991 - Zimmerman develops and releases PGP, a protocol for encrypting data and communications, free and public. He called it "guerrilla freeware".

1992 - Eric Hughes publishes the Cypherpunk Manifesto: "privacy in an open society requires anonymous transaction systems. Until now, cash has been the primary such system [...] Privacy in an open society also requires cryptography."

1993 - Zimmerman is investigated for unauthorized export of ammunition without a license. During these years, cryptographic algorithms were equated with weapons of war, and their dissemination was strictly controlled. Zimmerman managed to defend himself ingeniously: he published the source code of PGP in paper format, within a book. In the United States, unauthorized export of weapons (including encryption software) was prohibited, but certainly not books. The courts ruled that the source code of PGP was not a weapon of war, but a simple expression of the author's thought, therefore protected by the First Amendment.

1994 - The Clinton administration proposes a new anti-cryptography strategy: to require manufacturing companies to install a chip in every phone (Clipper Chip) that would allow access to the communications of all Americans. The plan failed also thanks to a strong social campaign by those individuals, like Zimmerman, who were defined as "cypherpunk".

1995 - During this period, FATF (Financial Action Task Force) releases recommendations to limit the use of cash and instead promote traceable payments, such as checks, payment cards, and direct deposit of salaries. It marked the beginning of a long and enduring offensive against cash and the anonymity it provided.

2004 - Hal Finney publishes his idea of "reusable proof of work", a way to use cryptographic proof of work (hashcash) and create "POW tokens".

2008 - Satoshi Nakamoto publishes the Bitcoin whitepaper.

2013 - Edward Snowden publishes tens of thousands of classified documents showing how the NSA and British intelligence were engaged in mass surveillance activities of hundreds of millions of people, both in the US and abroad.

2015 - The Obama administration explores technical ways to overcome the obstacles of encryption along with the big tech sector. At least 4 solutions were found, but then never publicly pushed due to fear of reactions.

2019 - The US Department of Justice sends a letter to Mark Zuckerberg kindly demanding not to implement, as planned, end-to-end encryption systems in Facebook chat systems.

2019 - FATF releases recommendations for "crypto assets": "Guidance for a risk-based approach to virtual assets and VASPs." The guidelines clearly state that the goal is to combat any form of anonymity and counter the use of "mixers, tumblers, privacy wallets, and other technologies capable of obscuring people's identities".

2020 - The Five Eyes countries (US, UK, AUS, NZ, CAN) sign an international agreement to combat online child pornography.

2020 - The European Commission announces a new strategy against online child pornography.

2020 - The Council of the European Union publishes a document describing the problems of encryption. At the same time, research is commissioned to find ways to overcome the obstacles of end-to-end encryption and access data.

2021 - In the EU, the first 'chatcontrol' regulation comes into force to legalize voluntary scanning of chats by communication service providers to identify and report potentially child pornographic content. Since 2016, Facebook had been doing this, but the chatcontrol regulation became necessary due to another European regulatory update that would have made this activity illegal.

2021 - The director of EUROPOL states in an interview that the single most problematic barrier to fighting crime is encryption.

2021 - The European Union announces a new AML (anti-money laundering) package in adherence to recent FATF recommendations in the crypto sector. The package limits cash transactions to a maximum of 10k and also prohibits anonymous bank deposit boxes.

2022 - In the United States, the developer of Tornado Cash is arrested on charges of facilitating money laundering through the development of open-source code.

2022 - USA, UK, and EU begin to enact laws against online child pornography, which will require communication service providers to adopt technologies capable of scanning chat contents (text, audio, video). The three laws are practically copy-paste of the principles contained in the international agreement signed in 2020 among the Five Eyes.

2023 - The Online Safety Bill comes into force in the UK, the law against child pornography and other illegal online content. Signal threatens to exit the UK market due to impositions against encryption of communications. Concurrently, another law allows law enforcement to seize any element related to "crypto assets" (even a piece of paper with 12 words written on it) in case of suspected crime.

2023 - In the EU, the AML package presented in 2021 is approved, which also includes the obligation of "travel rule" for the crypto sector: namely, total surveillance of transactions and obligation for exchanges to consider the risk of receiving transactions from unidentified "unhosted wallets" (and possibly block them).

2024 - The founders of Samourai Wallet are arrested, with the same accusation as the developers of Tornado Cash: facilitating money laundering by writing open-source software for privacy.

In recent weeks, many crypto wallets have ceased their services out of fear of retaliation; the FBI has recommended the public to beware of those who do not identify customers and track transactions.

I've been covering the recent developments of the "crypto wars" (and more) since 2021 in my substack newsletter, which you can find here: Privacy Chronicles