The Fall of DES
A few days after the release of Android 95, numerous reporters descended upon the Android Division headquarters in Redmond. They had come after hearing about the press conference Kevin Johnson had announced under Yoo Jae-won's direct instructions. Given the gravity of the matter, most belonged to IT publications or economic outlets covering investment news. This time, however, a new group joined them: webzine journalists.
Webzines were exactly what the name suggested—magazines published on the web. The term itself was a neologism born from combining "web" with "magazine." As the name implied, they were internet-based publications, a rapidly growing sector. Some had begun as print magazines moving online, while others now produced content exclusively for the web without any paper edition. Naturally, relations between traditional journalists from newspapers and broadcasters and these webzine reporters were far from cordial. The established reporters, who had endured rigorous education to earn their positions, tended to lump webzine writers—who needed no special qualifications beyond wanting to write—together under the same dismissive label. The webzine crowd's frequent predictions that print media would vanish in the twenty-first century only made matters worse. Whenever the two groups gathered, subtle tensions simmered beneath the surface. Yet today, the stakes were too high for petty rivalries.
The federal government's single directive had wiped out 3.75 billion dollars in market capitalization. When the resulting delays to the next Android product launch and the cascading stock collapses across numerous IT companies were factored in, the total losses grew far larger still. Amid swirling debates over whether the government's hasty action had been reckless or a necessary security measure, Yoo Jae-won himself was about to outline his future countermeasures. No one had time for internal squabbles.
"Everything is ready, sir."
"Is that so?"
At Kim Dae-seok's report, Yoo Jae-won saved his ongoing projects and rose from his seat. Every member of Alpha Team turned toward him. They were still inside the Alpha Team office, where Yoo Jae-won's workstation had been set up. Even on the verge of a major announcement, he had continued programming as usual, leaving the team members wearing uncertain expressions, unsure whether they should offer encouragement. Yoo Jae-won simply waved them off, signaling they should return to their work. His face showed not a trace of tension.
Leaving the Alpha Team office, Yoo Jae-won followed Kim Dae-seok to the press conference hall—the grand auditorium of the Redmond headquarters. It could seat hundreds, featured high-resolution projectors, and was equipped with flawless stage facilities. The moment Yoo Jae-won entered, the reporters erupted in camera flashes. The conference began with that signal.
Stepping onto the stage, Yoo Jae-won first bowed politely to the assembled journalists, then delivered his prepared statement before opening the floor to questions.
"I am deeply disappointed by the federal government's recent measure. I believe it stems from an insufficient understanding of the internet as a new frontier."
Yoo Jae-won spoke without any diplomatic hedging, laying out his honest thoughts. He had deliberately stripped away ambiguous phrasing so the gravity of the situation would be unmistakable. The statement had undergone review by General Counsel Alan, who had expressed genuine concern that clashing with the government would bring nothing good. Yoo Jae-won had acknowledged the warning yet chosen to proceed, convinced that the federal government's—more precisely, the National Security Agency's—misstep had been too severe to ignore. Failing to push back now would only invite greater interference later. Consequently, the legal team had limited its edits to softening a few overly strong expressions.
"The internet is a collection of interconnected systems. When one system is breached, the repercussions spread like an infection. Especially now, with broadband connections, that infection travels at unimaginable speed."
As Yoo Jae-won spoke, a presentation slide appeared on the screen, illustrating how the encryption strength of the Secure Area was directly tied to Android's overall security. Reporters immediately captured the material on camera. Using visual aids alongside announcements was Yoo Jae-won's trademark, and many organizations had begun copying the practice—though none matched the polish of the originals he prepared.
"That is why the next version of the Android operating system will feature a significantly strengthened security system: the Secure Area. It is Android's unique solution—maximizing user convenience while preserving robust security."
Yoo Jae-won did not neglect to highlight his own technology while criticizing the government. Yet there was no empty boasting; the Secure Area was genuinely impressive.
"The problem lies in the DES encryption technology the federal government is mandating. Developed by IBM in 1975, DES was powerful—at the time."
—So you're saying it's a problem now?
A particularly impatient reporter raised his hand without waiting to be called. All eyes turned toward him, most of them cold. As a webzine journalist, he already faced unfavorable prejudice; this only intensified it. Still, the man met Yoo Jae-won's gaze without flinching.
"That is correct. Computer performance has advanced beyond comparison since 1975."
Another slide appeared, showing performance benchmarks for the recently released Intel Pentium III and AMD Athlon against the 8086 processor from 1976. The gap spanned thousands of times. On the bar graph, the 8086 appeared as a single thin line, while the Pentium III and Athlon stretched across the entire width of the chart. Notably, the performance difference between the Pentium III and Athlon was also displayed—Intel held the edge, though AMD offered lower prices.
"My own analysis concludes that any DES-encrypted data can be decrypted within three years using a computer equipped with either a Pentium III or an AMD Athlon."
The reporters' reactions split evenly. Half considered three years acceptable; the other half looked visibly alarmed. The divide reflected their differing levels of understanding. Those unfazed lacked sufficient grasp of encryption; those shocked recognized the implications. The webzine reporter who had spoken out of turn belonged to the latter group.
"Both the Pentium III and Athlon are consumer-grade processors—personal computers anyone can purchase today. In other words, DES can be broken in three years using hardware available to ordinary individuals."
Even with the clarification, many still struggled to grasp the urgency. Three years seemed like a long time.
"I have been researching distributed processing. ID Technology's cloud server system is a prime example of this approach. Linking multiple PCs delivers greater performance at far lower cost than traditional supercomputers or mainframes. The same principle applies to breaking DES."
Only after this explanation did more reporters begin to understand.
"One PC takes three years. Two PCs halve that to eighteen months. Four PCs bring it down to nine months, eight to four months, sixteen to two months. So how long would 1,024 PCs take?"
The sudden quiz caught the press off guard.
—One day!
Fortunately, someone quick with mental math supplied the answer within seconds.
"Correct. Technically a day plus several tens of minutes, but in practice it would finish within a single day."
By this point, no reporter remained who failed to grasp the statement's meaning. With 1,024 machines, any DES-encrypted data could be cracked with ease.
"I suspect the federal officials who issued the directive may doubt my claims. If they wish, I am prepared to demonstrate the process myself. For reference, ID Technology's cloud system currently connects 25,600 PCs."
The implied threat drew audible gasps. It was also a statement only Yoo Jae-won could credibly make. Had another executive issued the same warning, questions of authenticity might have sparked further controversy. But Yoo Jae-won had built ID Group from nothing, and his earlier Security Challenges using AES encryption had already proven his unmatched security expertise—the very foundation of the company's rise. The reporters tried to imagine 25,600 cloud servers simultaneously attacking DES and quickly abandoned the mental exercise.
"By contrast, what about AES? Its robustness has already been demonstrated through two Security Challenges. Moreover, even as we speak, numerous nations are likely attacking AES with supercomputers. Yet not a single successful breach has ever been reported."
With that, Yoo Jae-won's prepared remarks concluded. Murmurs rippled through the audience. He had thoroughly dismantled DES's weaknesses before extolling AES's strengths—an argument everyone found convincing. Just as several reporters prepared to demand a live DES-breaking demonstration, the statement's conclusion took an unexpected turn. They had anticipated a direct request for the government to revise its policy, yet no such appeal appeared. Had the conference ended there, chaos would have ensued, but ID Group maintained its strict policy of always including a Q&A session. This time was no exception.
"We will now take your questions."
At Kim Dae-seok's announcement, every hand shot up. Yoo Jae-won selected a reporter seated in the front row—an early arrival representing a variety of outlets, chosen purely on personal impression rather than prior arrangement.
—Dorothy Hamilton of the Los Angeles Times. I listened carefully to your statement. What is Android's official decision? Your remarks suggest DES has reached the end of its useful life. Does this mean you intend to disregard the government's regulations?
"No. When in Rome, one follows Roman law. Since we maintain operations in the United States, we will comply with American policy."
—Does that mean the overseas versions will include DES? Then why explain its vulnerabilities at all?
The reporter fired a second question without relinquishing the microphone.
"That would be impossible. DES's effectiveness has already expired. I have no intention of endangering users in other countries by forcing it into our products."
Confusion spread among the journalists. Yoo Jae-won's claim that he would follow U.S. policy while refusing to use DES defied their expectations. The assumption that complying with the government necessarily required adopting DES had created the misunderstanding.
"Android versions outside North America will incorporate encryption systems from specialized third-party security firms. It's quite simple."
As Yoo Jae-won answered, a new slide appeared on the screen announcing that Android's Secure Area would be opened to third-party vendors.
"On the day we received the federal directive, I considered many possibilities. Even if AES remains the most secure encryption standard available, the burden of single-handedly protecting every PC user worldwide felt overwhelming. So I changed my approach. The world already has numerous security companies whose capabilities have been proven. By drawing on their expertise and resources, we can share this enormous responsibility."
AES was solid, yet unforeseen variables always existed. Should Android bear sole responsibility for global PC security, any incident—such as an inevitable source-code leak—could prove catastrophic. Opening the security field to partners would reduce profits slightly but shield the company from concentrated hacker attacks. More importantly, any future incident would distribute responsibility rather than concentrate it entirely on ID Group.
Only then did the reporters fully understand why Yoo Jae-won's statement had contained no direct criticism of the federal policy. There had been no need to voice objections when a solution existed that satisfied both the government's requirements and security imperatives.
The market reacted instantly. Android's stock, which had been falling since the federal announcement, reversed course and began climbing. An even stronger response came from security firms such as Symantec and McAfee—their share prices surged more dramatically than Android's own. Though smaller in absolute size, the gains were enormous in percentage terms.
Conversely, one organization now found itself in serious trouble: the United States National Security Agency.