The Lock That Opened the Door

Steven Levy's *Crypto* ends on a note of triumph. The privacy advocates won. The Clipper Chip was buried. Export controls on strong cryptography were relaxed. Phil Zimmermann was not indicted. Public key cryptography became infrastructure. In 2001, this read as a satisfying conclusion to a decades-long struggle between individual liberty and state surveillance. In 2026, it reads like the first act of something far stranger and more ambiguous than Levy or his subjects could have anticipated. The book is meticulous about the technical and political battles of the 1970s through the 1990s — the Diffie-Hellman breakthrough, the RSA trio's search for one-way functions, the NSA's institutional panic at losing its monopoly on secrecy — and nearly everything it documents is accurate and well-sourced. What it could not have known is that winning the crypto wars would turn out to be the easy part.

The prescience is real but narrow. Levy understood that cryptography would become the substrate of digital commerce and communication, and he was right. TLS, end-to-end encrypted messaging, blockchain — all are downstream of the ideas he chronicles. The cypherpunk vision of crypto anarchy, documented here through manifestos and mailing list dispatches, predicted with eerie accuracy the emergence of cryptocurrency, decentralized finance, and the ideological infrastructure of Web3. David Chaum's early work on anonymous digital cash, mentioned in passing, turned out to be a seed that germinated into Bitcoin seven years after publication. But the book's frame is almost entirely about privacy versus the state, and that binary now looks quaint. The greater disruption was not that individuals could hide from governments but that cryptographic tools would be weaponized by state actors, criminal enterprises, ransomware operators, and platforms whose business models depend on selectively encrypting some things while surveilling others. The NSA did not lose; it adapted, as the Snowden revelations of 2013 made grotesquely clear. Levy's narrative ends before that reckoning.

The blind spots are those of the era. There is no anticipation of social media, no sense that the average person would voluntarily surrender more personal data in a decade than any government could extract by force. The book assumes that the primary threat to privacy is a wiretapping state, not an advertising economy built on consensual self-exposure. The cypherpunks imagined a world where strong crypto would make individuals sovereign; instead, strong crypto made platforms sovereign. End-to-end encryption protects your messages, but the metadata — who you talk to, when, how often, from where — proved to be more valuable than the content ever was. Levy could not have seen this because in 2001 the internet was still understood as a network of peers, not a handful of extraction machines. The absence of any discussion of metadata, of traffic analysis at scale, of the ways cryptographic security can coexist with total surveillance, is the book's most telling gap. It is not a failure of the author; it is a photograph of what the smartest people in the room did not yet know.

Within the larger corpus of technology writing, *Crypto* sits at a hinge point. It inherits from David Kahn's *The Codebreakers* the conviction that cryptographic history is world history, and it passes forward to writers like Andy Greenberg and Edward Snowden's own memoir the understanding that code is policy. Levy's great contribution was making the human drama legible: Diffie's contrarian wandering, Zimmermann's anxious idealism, Clint Brooks's genuine belief that key escrow could be a reasonable compromise. These are not caricatures. The book treats the NSA's position with more sympathy than most popular accounts, and that generosity has aged well. Brooks's argument — that law enforcement needs some mechanism to access communications under legal authority — is now the mainstream position of democratic governments worldwide, from the EU's chat control proposals to Australia's Assistance and Access Act. The cypherpunks won the battle and then watched the war shift to terrain they hadn't mapped.

What hits hardest now is the epilogue on James Ellis and GCHQ's secret, independent invention of public key cryptography. A man has a world-changing idea, is forbidden to publish it, watches others receive the credit, and dies in 1997 just as the truth begins to surface. Levy tells this story with restraint, letting the institutional logic of secrecy speak for itself. It is a parable about what classification does to knowledge — and, by extension, about what happens when the tools of freedom are born inside the architecture of control. The question the book now raises, twenty-five years on, is one its triumphant ending never needed to ask: what happens to a society that won the right to strong encryption and then discovered it had no idea what to do with it?