What We Can Learn from Crypto’s Anti-Hero

Reckoning with the talented and terrible Timothy May, the original crypto anarchist

“The house of Cypherpunks has many rooms.”

–Timothy May

Last month, Timothy May, the incendiary co-founder of the Cypherpunks mailing list and author of the Crypto Anarchist Manifesto, died, leaving behind a complicated legacy for the cryptosphere.

May kickstarted the Cypherpunk movement in the late 1980s, clearing the ground for the crypto surge today. The Cypherpunks mailing list was a forum for cryptographic pioneers like Adam Back (hashcash) and Nick Szabo (smart contracts) to talk shop, and it laid out many of the functions and protocols that would underlie Satoshi Nakamoto’s Bitcoin solution in 2008.

But in later years, May alienated himself from the community and close allies. His bigoted comments and extreme views in online forums would be hard to swallow for even the staunchest First Amendment advocates.

Reckoning with May’s legacy is an exercise in the perennial challenge of acknowledging our cultural architects without glossing over their sometimes irreconcilable actions and allegiances. Jefferson’s slave plantation. Heidegger’s rectorship under the Nazi party. How can we comfortably learn from these intellectual titans knowing the jagged reality of their lives?

Everybody gets to build the Internet — that’s the amazing and disconcerting thing. A time will come, perhaps, when Tim May’s protocols will have outlived his name. But looking back might help us understand the shape of the cryptosphere today and the tensions we still need to resolve.

Crypto is all around us

If you right-click and inspect the server certificate that’s validating your connection to this page, you’ll find fingerprints, signatures, and a secure hash algorithm called SHA-256. This split-second hello between your browser and the Medium Corporation’s far-off server that’s “serving up” this web page is a Transport Layer Security protocol commonly called the TLS handshake. Your browser needs proof that this content is coming from someplace — and from someone — you can trust.

A handshake is, in many ways, one of our original cryptographic tools. Cryptography is the practice of securing communication. A handshake in the olden days would verify that we hold no weapons and that our connection is secure.

As the Web sprawled worldwide in the late 1990s, there was a lot of handshaking to be done — between databases and servers and web browsers and email clients. The diffuse, digital layers of the Internet’s architecture opened up all sorts of backdoors for malicious and sometimes just curious actors to hack accounts, forge content into web browsers, and in one coming-of-age case, lose track of a self-replicating, bandwidth-consuming computer worm. It took years for Netscape engineers to get a protocol off the ground that could handle the micro-negotiations between servers and clients and ultimately secure communication across the Web.

That protocol wasn’t perfect. It still isn’t. In 2001, the NSA helped the Internet handshake by releasing a royalty-free patent for a set of cryptographic hash functions. That set included the SHA-256 algorithm which is currently helping your web browser trust this content. However, later that year, the NSA also launched a surveillance program called Stellar Wind, a large-scale data mining operation that captured and analyzed everything from citizens’ IP logs to financial records to email metadata (your to, from, and bcc information).

As citizens, we’ve become more vigilant about these surveillance programs, though many have been reactivated under new names and under new administrations.

A slide overviewing the NSA’s PRISM surveillance program, which began in 2007.

As a people, we are slowly learning to question the routine data collection of everyday life. Facebook’s Cambridge Analytica scandal was the beginning of a public awakening, but perhaps still too esoteric to hit home for the average citizen and consumer. Political conditioning sounds like an academic abstraction. However, The New York Times’ recent report on the mobile location industry — how smartphone apps sell your geodata to advertisers and hedge funds — makes it palpable how systematic data collection conditions and steers our very bodies.

“We see crypto all around us,” Tim May wrote. “The keys in our pockets, the signatures on our driver’s licenses … locks on doors, combinations to safes.” Yet we’ve been lacking crypto in our digital lives, the strong crypto we need — not necessarily to hide, but to prove we are who we say we are. Computer networks scaled rapidly without the protocols in place to protect individual users, and so the Web has both connected and isolated us, liberated and subjected us. What Thoreau famously wrote in 1854 about the railroad holds true for the Internet today: “We do not ride on the railroad; it rides upon us.”

Strong crypto is a right

The List

In 1992, a trio of engineers came together to work on a cryptographic infrastructure for computer networks. Their names were John Gilmore, Eric Hughes, and Timothy May. At first, they met at Gilmore’s workplace. Eventually, they moved online and started a mailing list — a distributed remailer that ran on multiple nodes and that used encryption to conceal the sender’s identifying information.

The list was eclectic. There were cryptographers and mathematicians, but also Leftists, Republicans, policy wonks, Wobblies, libertarians, capitalists, anarchists, anarcho-capitalists. They called themselves Cypherpunks. They had no leader.

That frantic, roughly 700-member mailing list became the life force of a movement. I imagine it was something like the meticulous and suddenly philosophic developer slack channels at my company. Full of code snippets and formulae and occasional references to stigmergy and Adam Smith and the proletariat. Adam Back was on the list. Wei Dai was on the list. Nick Szabo was on the list. Hal Finney was on the list. Julian Assange was on the list.

The Stakes

Last month, Cameron Winklevoss tweeted, “In 2018 everyone wanted to be in crypto. In 2019, we will find out who really wants to be in crypto.” The Cypherpunks would throw that notion out. Crypto is not a club, or an adventure, or some kind of triple dog dare. Crypto is something we do by nature. As Tim May wrote, “All are part of crypto.” The question is, how strong is your crypto?

Another way of asking that question is, how secure is your speech? How secure are your digital forms of speech? Can someone eavesdrop? Does it affect — even in the smallest of ways — where you go and what you share knowing that a stranger is listening?

And your money. “Money,” May ventured, “is increasingly just speech.” Money expresses your interests, plans, fears, desires, endorsements. Is the way you move your money free from interference?

Taken to the limit, strong crypto is a dangerous premise. The Cypherpunks, and Tim May, acknowledged that. But their principal concern was around the freedom of speech and how unkempt electronic networks had turbocharged and jeopardized that freedom in one fell swoop. May cared about political precedent: “There has never been a ruling or law that persons have to speak in a language that is understandable by eavesdroppers.” For May, a Great Divide existed between freedom and surveillance, with anarchy at one end and an Orwellian State — no matter how subtle or seemingly convenient — at the other: “Anonymity may not be either good or not good, but the outlawing of anonymity would require a police state to enforce.”

In crypto, reputation matters more than ever

“Regard your good name as the richest jewel you can possibly be possessed of — for credit is like fire; when once you have kindled it you may easily preserve it, but if you once extinguish it, you will find it an arduous task to rekindle it again.” –Socrates

Tim May is perhaps best known for his Crypto Anarchist Manifesto, which he distributed in 1988. In the manifesto, May makes a passing but very important remark: once the crypto anarchist revolution has come to pass, “Reputations will be of central importance, far more important in dealings than even the credit ratings of today.”

One misconception about the crypto movement is that it calls for unruly anonymous networks in which no one is held accountable. In fact, quite the opposite is true.

By anonymity, Cypherpunks largely mean pseudonymity: someone can create a digital name for themselves that carries a reputation and credentials, but that does not necessarily trace back to their actual identity. (May acknowledged the downsides of pure anonymity: “I often take ‘anonymous’ messages less seriously.”) Asymmetric cryptography makes it possible for someone to develop a persistent, yet untraceable, digital persona. Reddit’s karma system can be seen as a barebones, single-platform version of the kind of reputation-based systems that Cypherpunks envision (with China’s social credit system as a totalizing and centralized version at the far end).

Reputation is a game we all know and understand — which friend you trust for movie recommendations, the restaurants you frequent. A coworker puts their reputation on the line to vouch for a candidate whom they knew from childhood. The Cypherpunks’ mission is to bake “a man’s word is his bond” into the fabric of the Internet. Do you float rumors, have you burnt someone in a business transaction, do you meet deadlines, are your comments vitriolic? Your fingerprints, your biometrics matter less than your public key, and the history of behavior around it. May made it dead clear in the Cyphernomicon, the FAQs for the Cypherpunks mailing list: “You are your key.”

The game theory plays out. Yes, you can repeatedly burn your keys and create new usernames, but you’ll have to repeatedly build trust from scratch.

Here’s a strange loop — our inability to comfortably pay tribute to Tim May’s work is proof that reputation capital is real and that reputation-based systems work: we take May’s crypto contributions less seriously because of the comments attached to his name.

Why did he attach his name to everything? Fame? Just an oversight? A double-down on his own reputation game? It’s impossible to say.

Crypto anarchy is about structure, not chaos

“The critic is not the who debunks, but the one who assembles.” –Bruno Latour

The Cypherpunks wanted — and still want — to bring structure to cyberspace, not dismantle it. The notion that Web3 will be a piratical wild west is off the mark. A pirate, after all, is “one who attacks.” Rapid computerization without the proper communication and transaction protocols in place is precisely what has exposed users to surveillance, exploitation, and attack. “Encryption,” May explained in the Cyphernomicon, “provides ‘solidity’ to cyberspace, in the sense of creating walls, doors, permanent structures.” Perhaps it’s no coincidence that Solidity is the name of the programming language for writing smart contracts that run on the Ethereum Virtual Machine.

Source: Stephan Tual

Anarchy, from the Greek an-arkhos, simply means “without a ruler.” Tim May’s crypto anarchist agenda was about using cryptographic protocols to establish shared structures that could operate without an overarching ruler. Market structures. Payment structures. Reputation structures. Incentive structures. In a talk he gave at the Computers, Freedom, & Privacy Conference in 1997, May posited that in an encrypted peer-to-peer network, “Honesty is built in at an ontological level rather than at a regulatory level” — ontological meaning into the very properties of the software. This is an esoteric but profound point. Consider our emerging blockchain networks: in place of a centralized State have come distributed state machines that give users no choice but to act with integrity.

Cypherpunks and crypto anarchists have taken on the monumental task of creating structure for the Internet mid-flight, much to the chagrin of authorities and corporations who have long exploited the Internet’s thin protocols. Crypto anarchy forces us to question the hard binary we often draw between anarchy and order. The crypto anarchist vision is one of leaderless order. Authority is vested in the protocols. The Cypherpunks efforts are constructive, ultimately, not destructive. “Strong crypto,” May believed, “[is] the ‘building material’ for cyberspace.”

Cypherpunks write code

The Cypherpunks had no leader, no offices, no logo, no branding. They weren’t always patient with newcomers. The closest thing they had to a mantra was “Cypherpunks write code.” They were determined to get academic abstractions on the ground, to walk the talk:

“Cypherpunks place more importance in actually changing things, in actually getting working code out, than in merely talking about how things ‘ought’ to be.” –Tim May

The Cypherpunks worked on the PGP encryption program, they wrote remailers, they created pseudorandom number generators, they outlined digital cash systems. On Halloween 2008, a user or group of users under the pseudonym “Satoshi Nakamoto” published the Bitcoin White Paper to a cryptography list that grew out of the Cypherpunks mailing list. In a strange twist of cryptographic fate, SHA-256 — which was patented by the NSA and which is right now securing your connection to the Medium Corporation’s server — became the same algorithm used to verify blocks of transactions in the Bitcoin blockchain, helping users trust one another directly, and without a central server.

“Cypherpunks write code,” however, wasn’t exclusive to bulletproof cryptographers and protocol engineers. The mantra extended beyond the command line:

“‘Cypherpunks write code,’ should be taken metaphorically. I think ‘to write code’ means to take unilateral effective action as an individual … What is important is that Cypherpunks take personal responsibility for empowering themselves against threats to privacy.” –Tim May

Tim May wrote code. He also just wrote, and spread the word. His encyclopedic Cypherpunk FAQs are proof that he cared about onboarding people to the scene. He pointed newcomers to books and journals. He cited experts who had better answers. The mailing list that he launched with Gilmore and Hughes was an effort to mobilize a community and create space for others to write and empower themselves — if not with new code, at least with new rhetoric.

The Internet, Red in Tooth and Claw

“Crypto-anarchy in the real world will be messy, ‘nature red in tooth and claw’, not all nice and clean like it says in the math books.” –Nick Szabo

Crypto anarchists in the real world are messy, not all nice and clean like they are in their code. Tim May was a supreme example — a brilliant engineer, and a bastard. “Nothing can be done about who uses strong crypto,” he forewarned in his Cyphernomicon.

If reputation systems work the way the cryptosphere envisions, users will think long and hard about the forking paths they choose through cyberspace, and whether relegating themselves to the Voats, Gabs, Hatreons, and 8chans of the Web is worthing losing touch with everyone else.

Remember, this is what the Internet looks like:

r/place — Reddit’s social experiment from April 1, 2017 (Source: Gurkengewuerz)

NSA tools get rehashed by Cypherpunks. Swastikas flare up, then morph into logos that the majority wants. The American flag burns, then heals itself. The Void looms, always.

We can’t wait, Szabo wrote to the Cypherpunks, “until the Perfect System comes along.” Tim May refused to wait. And so the Internet has become a patchworked monument to him, and to the many unnamed and pseudonamed who left us the materials to build a safer and hopefully more noble passage through cyberspace.