Zimmermann says he can't buy back PGP for one very simple reason: "I don't have the money to buy it back."

PGP's status as Open Source has sometimes been confused. "It wasn't actually Open Source," Zimmermann says. "It was published source code, for peer review. Open Source has to do with IP. Publishing source code for peer review has to do with transparency and making sure there are no back doors."

With the source code able to be modified, it might be easy for some people to think of PGP as Open Source. "You could modify it if you wanted to, and run it on your own computer, but you could not distribute a modified version," Zimmermann explains. "That's the way it's always been, it's not some recent policy, it's right there in the PGP manual, from 10 years ago."

Douglas Hurd, Network Associates' senior product manager for Desktop Firewall and E-Business Server, says PGP products are in "maintenance mode." He adds: "We don't sell more. We look after existing customers until their licenses expire. I was responsible for the desktop crypto stuff as well before we rolled up the PGP business unit."

Hurd says there are "no plans to make it Open Source. I can't say 'never' as far as selling it off. And we still sell PGP in the form of E- Business Server (the command-line version of PGP). This is a viable offering that an Open Source policy would kill off."

Zimmermann disputes this. He explains Network Associates could open-source the software developer's kit and the GUI, "thus allowing the desktop product to be free from its prison, and omit the command-line wrapper from the OS.

"So what they could do," Zimmermann continues, "is open-source everything except the command-line wrapper. So they're selling a product that is a command-line product. Everybody likes to use the desktop product, which is the SDK and the GUI. So that's what they should open-source."

This would allow Network Associates to continue to sell and make money from the command-line version, more popular with corporate techies. "End-users don't pay money," Zimmermann says. "It's the businesses with their techies who pay money and they like to have a command-line product to run in a shell script, so that a big Web site, for example, can encrypt your credit card number. Their command-line product is for one of those raised-floor machine rooms with a bunch of servers and nobody around."

But Hurd has more questions: "Also, if we were Open Source, who do you think users would look to to maintain it? And how many of them would be willing to pay?"

Hurd believes "it is possible that there is a viable business model with regards to PGP desktop encryption technology, but we haven't found what it is. Our server-based licensing is successful, though, and we continue to sell, support, develop in this area."

But Zimmermann thinks otherwise. "First of all, I'd like to point out that they don't have any engineers to maintain the command-line product. They fired all the employees in February after their attempts to sell it failed. There's no one left to maintain it."

In addition, he says, "nobody's buying it. They haven't found a corporate buyer. And so, by sitting on it like this, and not open-sourcing it, it kind of reminds me of the wealthy Japanese tycoons who when they died were cremated along with their great works of art that they'd accumulated through their lives. It does them no good to keep it the way it is. And it does everyone else a great deal of harm."

If Zimmermann is eventually able to buy back PGP, his plan would be to "create a mechanism whereby there would be some kind of a dead man's switch on it. That way it could be published source code as it always was, but not Open Source for as long as the new company continues developing, commercializing and selling it. But, if something happens like it goes bankrupt, or gets sold to another company that doesn't continue to develop it, they would inherit the same responsibilities. As soon as it becomes discontinued, then it would have to become fully Open Source. That's what I would do, I would have an IP lawyer craft a license that would spell out those conditions.

"Now, one would have to do that in a way that would still make it attractive to investors in order for them to finance the thing to begin with ... But I'm not seeing investors lining up at the door here."

The reasons investors aren't beating a path to his door are several, he says. "One is that the tech sector has been hit pretty hard. The crash of the Nasdaq in November 2000 certainly had a huge impact on the Silicon Valley's economy, and it dried up capital. And this was before September 11. So that, probably more than anything else, has made it difficult to raise the capital to buy the product back."