I don't see why it's any different than a photo-editing app that applies a watermark to the free version. It's intended to let people give the software a try, and if it seems to meet their needs, they buy the actual product.

As for sharing the source code with the NSA, I think you have a better argument there. That said, it's kind of like helping someone install a secure lock on their door to keep out criminals, yet being willing to share a master key with police if it's a matter of life and death.

not the master key, the schematics to the lock maybe. Assuming no bugs, I don't see how the source code could help in any way, they may as well have downloaded the source code for openssl.

He also didn't bother to verify whether it was a matter of life or death, he just immediately assumed he was helping break into a file containing the deactivation code for a bomb or something, who knows what the NSA was actually doing.

It's not a master key, it's a blueprint of the lock with no combination or exact pin layout.

> offering most users a free version with weak encryption just so they can pay for the premium version

As long as that wasn't a hidden fact from the users, I don't see the issue.

People are stupid. Seat belts that appeared to work but didn't actually keep you safe would be illegal even if labeled.

You die if your seatbelt doesn't work and companies charge for seat belts. You don't die if your encryption is weak and you aren't paying for it.

But otherwise, super useful analogy.

> You don't die if your encryption is weak

This really depends on the business you're in.

The laws were different back then. The State Dept changed the rules a decade or more ago, I forget when, and AES 256 has been the default cipher ever since. Encryption is listed as a munition. I would have gone to jail if I put anything greater than 40-bit encryption on the shareware sites. Look what happened with Phil Z with PGP.

The law was changed a year before your story takes place.

Good security isn't based on keeping source code secret. There is plenty of the most secure encryption software that is open source. I don't really see any ethical issue in handing over the source code.

Exactly. TrueCrypt was the big open source product at the time. A great product used by many hundreds of thousands of people -- I know, because I used to track their progress.

Furthermore, if the government calls someone a criminal, their target may well be a dissident, journalist, whistleblower, etc. Things aren's so black and white any more.