Its celebrated encryption software is only the
first serving of Zero-Knowledge's privacy solutions
for a wired planet. But is the market unanimous on
the importance of being anonymous?
By
Konrad Yakabuski
Report
on Business Magazine
September 2000
The perks of working at Zero-Knowledge Systems Inc. include the games room with a foosball table and the latest in arcade gadgetry, the gym and personal trainer, the laundry service, cappuccino bar, free massages and nap room. The perks are just one of the reasons these pampered employees call their workplace the Promised Land. Yet, of all the advantages dangled to lure some of the globe's brightest computer minds to the company's sprawling new digs on downtown Montreal's eastern fringe, the personal trainer may be the most superfluous. After all, the computer geeks who toil 100-hour weeks here are notoriously sedentary. And, anyway, the mostly twentysomethings who fill these offices have a decade or two to go before gravity begins to take its toll. But when you're one of Canada's most talked-about technology start-ups, with venture capitalists knocking on your door, you can afford the odd indulgence.
Most of what has the VCs so keen still lies within the minds of Zero-Knowledge co-founders Austin Hill, 27, and Hamnett Hill Jr., 29. Their company has garnered worldwide attention for its Freedom software, an innovation that allows users to surf the Web with complete anonymity. But Freedom is really just a foretaste of what the duo is planning to counter Big Brother's ever more pervasive presence in the Internet era. They aim to turn Zero-Knowledge into the global leader in providing privacy solutions for consumers and businesses. "We're kind of pioneers in the idea that you can market privacy," offers Austin Hill.
There are few voices on Bay Street to contradict him. "This is a company with a lot of potential," confides a corporate finance employee at one Toronto underwriter that would happily take Zero-Knowledge public. The brothers have all sorts of projects in the works, from developing a form of anonymous digital cash to creating systems that block the location tracking devices of the latest cellphones. But perhaps the most potentially lucrative component of their plan involves selling "privacy infrastructures" to businesses. In some cases, this is just fancy language for simple consulting. In others, it involves turn-key systems that companies use to manage the personal information they collect on their customers in a manner that respects personal privacy and complies with increasingly strict industry standards. Bringing these initiatives to fruition requires a lot of brainpower: The Hills' three-year-old firm now employs 240, and they expect the payroll to grow to at least 300 by year-end.
Still, the Hills won't have this market to themselves. Dozens of firms specializing in computer privacy have popped up in North America in the past couple of years. Most are tiny mom-and-pop consultants. But a handful aspire to the same world-beating proportions as Zero-Knowledge, including Broomfield, Colo.-based Persona, Inc., and Privada, Inc. of San Jose, Calif. And then there are the doubts expressed in some circles about the true potential of the market Zero-Knowledge is pursuing. The skeptics don't buy the Hills' promotional and preachy rants about privacy as the issue of the new millennium, destined to mark the 21st century as the civil-rights movement marked the last. The skeptics suggest privacy is more flavour-of-the-month than millennial obsession.
Tell this to the Hills and you're in for an earful. Were they movie directors, the brothers--both burly fellows with bouncer physiques and egos to match--might rival the Coens or Farrellys. They show the same marks of brilliance couched in impudence as the famous brotherly pairings that cooked up, respectively, Fargo and There's Something About Mary. But the Hills, creators with a sense of humour in their own right, are interested not in storming Hollywood but in reforming cyberspace.
Their crusade on behalf of the individual's right to privacy has its origins in the brothers' political bent, which might be best described as soft libertarianism. They're unapologetic fans of Ayn Rand, the Russian-born American writer whose two best-known novels, The Fountainhead and Atlas Shrugged, have become anthems for self-made men everywhere. Altruism was anathema to Rand. Self-interest--and its concomitant values of individual responsibility and personal freedom--ruled. Rand's ideal man, as depicted by the philosophical school she founded, objectivism, is a laissez-faire capitalist guided only by the twin rudders of ambition and reason.
Invasions of her protagonists' privacy loom large in Rand's novels. Were she alive today, Rand, who died in 1982, would no doubt back the Hills. For man to control his destiny, she'd argue, he must control what Web-site operators know about him. That is becoming increasingly difficult in our wired world. Web sites routinely track surfers' habits--in most cases, unbeknownest to users--enabling them to gather personal information, sell it to marketers and bombard surfers with targeted pop-up ads. Supposedly personal e-mail messages and on-line chats can be, and often are, permanently stored on computer servers, leaving them vulnerable to the prying eyes of countless peeping Toms for time immemorial. And fully traceable Internet Protocol addresses make it a snap for any hacker or zealous private investigator to find you--or at least your computer.
Enter the Hills. True to their libertarian leanings, the brothers are hardly out there demanding legislated state controls or an outright prohibition on the use of personal information by Web-site operators, Internet Service Providers (ISPs) or e-tailers. Indeed, their company is founded on the premise that the market is the best guarantor of consumers' privacy in the face of the increasing threat posed by the Internet. They are crusaders with an eye squarely on the bottom line. "There is a business opportunity in protecting people's privacy," insists Hamnett Hill. Most people just don't know it yet. Consumers, Hamnett continues, need to wake up to the fact that it is in their economic interest to protect their privacy against, for instance, unscrupulous insurance adjusters who pry into their surfing history for any evidence to deny a claim. Businesses, similarly, need to realize they risk losing customers by indiscriminately compiling personal information for marketing purposes. Many privacy advocates seek government intervention to deal with abuses. Not the Hills. In fact, they're the first to point the finger at government as the source of some of the biggest privacy abuses around. "Without the economic [rationale for privacy]," Hamnett adds, "we don't believe that you can make the kind of social change we'd like to see happen."
Growing up as self-proclaimed "hellcats for our parents," the Hills have never been big on institutions of any sort. Austin was halfway through Grade 10 back in Calgary when he was suspended for "lipping off" to a teacher. That event, barely a decade ago, marked the end of his formal education. Hamnett dropped out in Grade 9, but actually made it to university after writing a high school equivalency test in California. He ended up there in the early 1990s while following the Grateful Dead around on tour. "It was youthful indiscretion," Hamnett says now of his wayward years. "There are things you think you want to do because they sound fun. Then comes maturity and the realization that you don't always get to live in never-never land." Today, the Hill brothers' reality involves bombing around their adopted city, Montreal--Austin in his Porsche, Hamnett on one of his two Harleys. They're rich, eligible and rapidly chasing fame.
The wealth came three years ago. That's when the Hills sold their stake in the Montreal-based ISP Austin had founded in 1994--with $50,000 in start-up cash from their father and Austin's former computer-store boss --and later merged with a cross-town rival. Austin, Hamnett and their dad, Hammie, then CFO of Calgary-based retailer Forzani Group, ended up with a chunk of stock in BCE Inc. unit BCE Emergis, which bought their ISP. The stock was issued at $2.85. It peaked at something like $180 by the time the Hills cashed out. "It was a very good deal for us," Austin says modestly. "Hammie made more from his investment [in the ISP] than he ever did working at Forzani," Hamnett adds matter-of-factly. The brothers had no intention of retiring in their mid-20s, though they admit they could have. "Part of the reason we asked to leave [the ISP]..." Austin begins, "...was because we wanted to do something else," Hamnett adds.
The brothers, the oldest of seven children, have a habit of interrupting each other's sentences in a manner that occasionally deteriorates into the cacophony of rapid-fire debating. They're clearly soulmates, albeit loud ones, bonded by their eclectic and somewhat esoteric interests. "Hamnett and I really didn't like each other for the longest time, and it was only through reading and exchanging books that we became friends," Austin notes. "We would just pick a topic and read everything on it--positive and negative. Whatever." Their eagerness for learning led them down the list of ancient religions and modern philosophies and, eventually, to Ayn Rand and objectivism.
Objectivist values are common in the cyberworld, where early success has infused many young computer geeks with a sense of personal empowerment and, all too often, gargantuan egos. Former Wired writer Paulina Borsook provides an unflattering portrait of the phenomenon in her recent book, Cyberselfish: A Critical Romp Through the Terribly Libertarian Culture of High Tech. The Hills say they're far too worldly to be ideologues, and they admit to "having a lot of problems" with some of Rand's ideas. "But her gist about individual ownership, man's ability to drive himself, is very important. Ultimately, individual responsibility solves a lot of problems," Hamnett insists. Austin nods: "I don't think any [philosophy] is perfect...but I lean more strongly toward libertarianism and objectivism. I believe in a very small government."
There is some irony in the fact that the Alberta-bred brothers have chosen to live in Montreal, in a province where libertarianism and small government go against the collective grain. But they're at home here in Montreal's alternative scene. And they've picked up an impressive amount of French, enabling them to converse with their franco pals at any one of the Boulevard Saint-Laurent hangouts they like to frequent. Austin discovered Montreal when he joined his father, who had temporarily been transferred to the city in 1994. When Hammie returned to Calgary, Austin stayed, soon persuading Hamnett to abandon his business administration and accounting studies at the University of Montana and help run his newly launched ISP, Infobahn Online Services.
When they sold the firm's successor, TotalNet, in 1997, their philosophical views and computer savvy collided and led them to embrace the cause of Internet privacy. They sought out cryptographer Ian Goldberg, a Canadian "cypher-punk" working on a PhD at the University of California at Berkeley. Zero-Knowledge (the name is derived from the term designating a mathematical proof that can be verified without being revealed) was formed the same year. Goldberg, who first gained worldwide attention in 1995 when he and a Berkeley pal exposed a security breach in Netscape's Navigator browser software, signed on in 1998 as chief scientist. A year later, a Zero-Knowledge systems programmer unearthed a flaw in the privacy guards of the Intel Pentium III processor, showing how easy it was for a hacker to steal Pentium III-user serial numbers.
The technology media made hay of Zero-Knowledge's coup, fuelling market anticipation in the run-up to the December, 1999, launch of Freedom, the software that is the fruit of Goldberg's cryptography genius and the Hills' entrepreneurial and promotional flare. Freedom is based on Zero-Knowledge's unique application of public key cryptography techniques first developed in the 1970s, which scramble data (such as e-mail contents) and render it unreadable to anyone except the intended recipient, or key holder. Freedom uses public keys of up to 4,096 bits: In theory, it would take the fastest computer countless billions of years to come up with the code for a key that long. In fact, Zero-Knowledge is so confident that it is beginning to make part of its source code public, defying competitors to find holes in it.
A few other products provide strong e-mail encryption. One of the oldest and best-known is Pretty Good Privacy, a freely available, but hard-to-use, software. San Diego-based Anonymizer.com has also launched commercial e-mail encryption services; Toronto-based JAWS Technology Inc. is set to follow suit. Zero-Knowledge maintains Freedom has several unique advantages over competitors' products. Only one party to an e-mail exchange needs to use Freedom for it to work. In addition to ensuring privacy, the software also provides for completely anonymous messaging and Web browsing. It does so by routing users' e-mails through the Freedom Network, a series of servers placed around the globe, encrypting data along the way so as to make it impossible to trace either the origin or destination of the communication. Similarly, a Web-site operator is only able to determine the Internet Protocol address of the last server through which a visitor using Freedom has entered their site, not the user's actual IP address.
After downloading Freedom for free, users pay $49.95 (U.S.) for tokens that they exchange for five pseudonyms, or "nyms." The nyms allow them to surf the Net, join in on-line discussions or exchange e-mails using any of their five, untraceable identities. The use of tokens to purchase digital identities ensures that even Zero-Knowledge does not know the actual person behind each nym. The nyms are renewable each year; additional nyms are available for $10 each.
Needless to say, law enforcement officials wince at the idea of child pornographers, malicious gossipers or sophisticated criminals availing themselves of Freedom's identity-concealing benefits. The potential for abuse is limitless. Popular on-line auction site eBay found that out this year when it discovered that one individual had apparently used multiple identities to make it look as if several bidders were raising the stakes for a single item he was selling. Strong encryption has long raised the hackles of agencies such as the FBI, which has supported a U.S. ban on the export of strong cryptography and any software that does not offer a "back door" for authorities to access encrypted messages. (The U.S. export ban, which was recently relaxed, is one reason Canadian firms such as Zero-Knowledge have taken a lead in developing encryption technology.) Some Freedom users were reportedly blocked from entering the FBI's public Web site in July, although the agency denied it. Conspiracy theorists suggested this meant the FBI didn't want people visiting its site if it couldn't identify or track them. The incident, whether true or not, amounted to another publicity coup for Zero-Knowledge in that it essentially authenticated the firm's claims that even the FBI could not crack its code.
While software such as Freedom may make it harder for law enforcement authorities to do their jobs, the suggestion that it encourages criminal activity is unfair. Indeed, Zero-Knowledge makes it clear to prospective users that it will "respond to known illegal activity on the Freedom Network by co-operating with law enforcement by shutting down the accounts of nyms known to be abusing the system or using it for criminal activity." The company says it has already suspended "a small number" of accounts for abusing the service, although it won't provide details.
Still, the basis of the Hills' crusade remains intact; they maintain the individual's fundamental right to privacy extends to the Internet. Just as all citizens can lock their doors, close their blinds, and pay in untraceable cash, so, too, should they be able to do all those things, metaphorically speaking, on the Web. Whether you agree with them or not, you have to admit the idea has seductive marketing potential. And the Hills have milked their image as Big Brother-busters to the utmost. Austin is fast becoming a fixture on the speakers' circuit, captivating audiences with astonishing statistics--"90% of London is covered by cameras with facial recognition"--and even more astonishing admonitions about the dangers of Big Brother running amok--"In the Second World War, the internment of the Japanese was aided by census data. Ditto for Hitler and the Jews."
The Hills' crusade has been popular with the technology media and right-wing press, gaining them profiles in The Industry Standard, Wired and Business 2.0, and rah-rah coverage from the National Post. How popular their movement proves to be with consumers is another matter.
In May, the U.S. Federal Trade Commission found that only 20% of Web sites respected the four key privacy principles espoused by the commission: informing consumers about what they do with the data they collect, enabling consumers to choose how their personal information is used, allowing consumers to review their files, and ensuring the security of personal data collected. Surveys unanimously show that U.S. and Canadian consumers alike are uneasy about disclosing personal information when they surf the Web. Yet, it is far from clear whether most of them would be willing to pay to protect their on-line privacy. This raises a serious challenge for a company like Zero-Knowledge, whose very business model is predicated on popularizing demand for on-line privacy protection. "There is a need for Zero-Knowledge. But are people going to use their software? Probably not," says Canadian Internet consultant Jim Carroll. "I'm the perfect example of the challenge they face. I talk a lot about privacy, but do I surf the Web anonymously? Nope."
Faced with a choice, adds Keith Pieper, a consultant based in Boulder, Colo., most consumers will almost always opt for convenience over privacy. While so-called cookies enable Web-site operators to compile data, direct "spam" and target pop-up ads, they also enhance surfers' Web experience by "remembering" their preferences and interests. (Cookies are text files that Web-site operators save on surfers' hard drives the first time they visit a site. They allow the operators to determine how often a surfer visits, and his browsing habits. When sites require visitors to register, cookies store the visitor's name and password, and accelerate future access to the site.) "There is probably a small number of consumers actively interested enough in privacy to purchase software like Freedom," predicts Pieper, whose firm, KeithPieper.com, recently surveyed 9,339 Americans on privacy issues. "But the conclusion I came to was that, while consumers want privacy protection, they also want personalized content and customized user experience. In short, if you ask them, I think they would say the benefits of cookies far outweigh the drawbacks."
Freedom faces another threat. Microsoft Corp. announced in June that it would include privacy-enabling technologies based on the so-called P3P specification in the upcoming version of its ubiquitous Windows operating system and Internet Explorer browser. P3P, or the Platform for Privacy Preferences Project, will equip Windows users with the tools to define exactly what kind of personal information they are willing to disclose to Web sites. Built-in P3P software will alert surfers if a site is seeking more information (through cookies, or otherwise) and tell them what the site plans to do with the information. For the software to function, of course, Web sites must be P3P-compliant, but many big-name corporations such as America Online, AT&T, IBM, Microsoft, Procter & Gamble and Hewlett-Packard have already adopted--in whole or part--the P3P protocol, a move that is likely to be widely followed by competitors. Pieper believes the spread of P3P could go far enough to assuage consumers' concerns so as to undercut the potential market for the Zero-Knowledge product.
The Hills are unfazed by the skeptics. They won't say how many copies of Freedom they've sold since the product was launched last December, disclosing only that 85,000 people participated in the prelaunch beta test of the software. "We're big fans of privacy," laughs Austin. "But seriously, we're in an early start-up phase with lots of other competitors. It's to our strategic advantage for them not to know." The company still aims to persuade computer manufacturers to bundle Freedom software. It won't say how close it is to making that happen. But the Hills clearly don't think it's the end of the world if it doesn't work out. Freedom, they say, is only the first Zero-Knowledge product to make it to market; there's much more in the pipeline. "From day one, we've never suggested we'd be able to build a significant business hawking software at $50 a pop," Hamnett explains. "Certainly I don't think we would have been able to do the investment rounds we've done, or even hire some of the people we've hired, if we didn't have a broader plan."
The brothers maintain their company has outstanding offers for more than $50 million (U.S.) in capital. They've already raised $32 million--including $5 million last fall from Silicon Valley-based venture capitalists Platinum Venture Partners, Aragon Ventures and Strategic Acquisition Ventures, and $25 million in special warrants floated to institutional investors in January by Toronto-based Yorkton Securities Inc. With each financing, the Hills--Austin, Hamnett and Hammie--ceded an undisclosed minority stake in the firm to investors. The Yorkton financing was, at the time, the largest one-time private placement of capital in a Canadian Internet company. Demand was so strong, Yorkton said it could have raised as much as $100 million. Indeed, Zero-Knowledge has waived an additional $7 million promised by the same trio of Silicon Valley funds, confident it can now raise the money elsewhere on better terms. An additional round of financing is expected for this fall, but plans for an initial public offering have been put on hold. They'll resume once the company recruits a new CEO steeped in the U.S. tech market--a prerequisite, the brothers say, to negotiating the shrewdest underwriting deal south of the border--and once revenue growth consistently doubles or triples on a quarterly basis. (The brothers' father, Hammie, currently serves as chairman and CEO. Austin is president, while Hamnett serves as executive vice-president and COO.)
Much of the industry buzz about Zero-Knowledge is already shifting from Freedom to the company's other initiatives, especially its effort to develop a form of anonymous digital cash and credentials that would enable consumers to make on-line purchases without revealing personal information such as their name or credit card number. Zero-Knowledge indirectly acquired international patents for electronic cash and credentials held by Stefan Brands when it hired the Dutch mathematician as its senior cryptographer earlier this year. Digital cash and certificates are based on public key infrastructure; current models require consumers to reveal all kinds of identifiable personal data to certificate issuers. Those models, Austin Hill points out, are subject to security breaches, intentional or otherwise, potentially compromising consumers' privacy. Brands, who previously toiled for DigiCash, Inc., has developed ways of issuing certificates that allow users to disclose information in a more discriminating fashion, enabling them, for instance, to get a key that confirms their age for the purposes of visiting an adult Web site, while using a pseudonym to visit the site.
Another project in the works at Zero-Knowledge involves technology to limit the pervasive impact of global positioning system locators, which newer models of wireless phones will use to bombard users with an ad at the very moment they are physically approaching a certain fast-food joint or department store. "The next generation of wireless phones are all based on profiling--they will track where you walk, what you do with your phone, who you are. And they will resell that information [to advertisers and direct marketers]," warns Austin Hill, at once sounding like a harbinger of doom and a pitchman explaining the business opportunity this creates for his company. Zero-Knowledge is currently talking to potential partners it hopes to enlist in order to bring its digital-cash initiative and wireless privacy systems to fruition, he adds.
In the meantime, the company is courting another potentially lucrative clientele--businesses and institutions that are scrambling to conform to formal and informal privacy guidelines. Several U.S. health management organizations have sought the Hills' help to prepare for the expected implementation of new medical privacy regulations proposed by the Clinton administration. And the Federal Trade Commission's recent call for Congress to enact stronger Internet privacy laws is prompting U.S. businesses to beef up their own privacy standards in an effort to avert legislation. This is providing a golden opportunity for privacy consultants and may, says Pieper, end up being the bread and butter of companies like Zero-Knowledge, at least in the short term.
The Hills don't disagree. But true to their firm's raison d'être, they don't want to talk much about it. In fact, when it comes to the nitty-gritty stuff of the market--specifics about revenues, customers, cash flow and projections--the Hills are uncharacteristically tight-lipped. They know that will have to change. To realize their ambition, to get to the real Promised Land of durability and credibility, an IPO is a rite of passage. It remains the most efficient (i.e., cheapest) way to raise capital. But on Bay Street and Wall Street, the rule is full disclosure. Not zero knowledge.
|