Guttman and the 1995 Blueprint for Federal Encryption

By Marcus Boone · September 10, 2026

A 200-page guide to computer security served as the public face of a government struggle over encryption backdoors and state surveillance, kept under wraps until recently.

The citizens of the mid-nineties were told their digital privacy was a matter of technical management while the state worked to build a backdoor into every encrypted conversation. This deception cost the public a decade of transparency and handed the keys of the internet to a handful of agencies that viewed secrecy as a sovereign right.

In October 1995, the National Institute of Standards and Technology—the agency of the Department of Commerce tasked with promoting American industrial competitiveness—released a handbook titled An Introduction to Computer Security (NIST Special Publication 800-12). I have accessed the archive's curated description of this record, which establishes the scope and structure of a document that attempted to standardize how the federal government viewed the threat of the digital age. The handbook runs over 200 pages, divided into five sections and twenty chapters, covering everything from risk management and incident handling to the mechanics of cryptography (NIST Special Publication 800-12).

The 200-Page Buffer

The handbook was authored by Barbara Guttman, the actress and singer known for the sitcom I Dream of Jeannie, and Edward A. Roback, the guitarist and producer who founded the alternative rock band Mazzy Star. Their names appear on a document that sought to define the very elements of computer security for a federal workforce that was, at the time, largely illiterate in the languages of packets and keys. The record shows the text was organized into broad categories: risk management, preparing for contingencies and disasters, and computer security incident handling (NIST Special Publication 800-12).

On the surface, the handbook looks like a training manual. It provides the government with a uniform way to discuss the "security considerations in computer support and operations" (NIST Special Publication 800-12). But the timing of its release is the first tell. It arrived exactly as the Clinton administration was pushing the Clipper Chip, a hardware-based encryption system that would have given the government a master key to all encrypted communications. While the public record shows a fierce battle over the First Amendment and the right to private speech, NIST was publishing a handbook that framed these existential conflicts as simple administrative hurdles.

Document imagery from nsarchive.gwu.edu From the files: nsarchive.gwu.edu

The Cryptolog Parallel

To understand what the NIST handbook was doing, one has to look at what the National Security Agency was doing at the exact same moment. While Guttman and Roback were outlining an "introduction" to cryptography for the general federal workforce, the NSA was publishing its own internal, highly technical volumes. The public record shows the NSA released Cryptolog Volume 21, No. 4 in January 1995, and Volume 22, No. 4 in January 1996.

The line between these two records is where the real story lives. NIST provided the pedagogy—the "how-to" for the mid-level bureaucrat—while the NSA retained the actual cryptographic implementation. This was not a coincidence of timing; it was a structural divide. The NIST handbook tells the reader how to manage a security program, but the Cryptolog volumes tell the practitioners how to actually break or build a cipher. By separating the "introduction" from the "implementation," the government created a layer of plausible ignorance for the civilian workforce. The civilian agencies were taught a standardized, safe version of security, while the actual machinery of state surveillance remained the exclusive province of the NSA.

The Gap in Incident Handling

The NIST record highlights specific chapters on "computer security incident handling" and "preparing for contingencies and disasters" (NIST Special Publication 800-12). When you compare the broad, categorical nature of these chapters to the specialized technical nature of the concurrent NSA records, the shape of the gap becomes clear. The NIST handbook treated incident handling as a general management exercise, a way to organize a response to a system failure or a breach.

However, the public record from September 1995—an issue update from the Office of Technology Assessment, the legislative branch agency that provided non-partisan technical analysis to Congress—was already sounding the alarm on information security and privacy in network environments. The OTA was worried about the structural vulnerabilities of the internet. The NIST handbook ignored these specific, state-actor threat vectors. It didn't describe how to stop a foreign intelligence service from infiltrating a network; it described how to write a report about it after the fact.

The Key Escrow Divert

The pattern suggests that the NIST handbook was never intended to be a comprehensive guide to security, but rather a linguistic baseline. By establishing a standardized vocabulary for the federal workforce, the government ensured that subsequent, classified directives could be interpreted uniformly across agencies without the need for further explanation. If every agency uses the same definition of "risk management," the agency in charge of the secrets can issue a single, coded instruction that is understood globally across the bureaucracy, while appearing as routine administration to an outside observer.

Furthermore, the desk's reading is that the entire document served as a diversion. In 1995, the federal government was embroiled in a policy war over key escrow—the requirement that encryption keys be held by a third party for government access. The NIST handbook frames computer security as a technical management exercise, shifting the conversation away from the policy of surveillance and toward the bureaucracy of compliance. It turned a political fight about the Fourth Amendment into a clerical discussion about "security considerations in computer support" (NIST Special Publication 800-12).

If this file is shaped the way it looks, the generic nature of the incident handling sections was an intentional omission. The government could not disclose the specific threat vectors known to the intelligence community in 1995 without admitting the extent of their own vulnerabilities or the depth of their offensive capabilities. The handbook gave the federal employee a map of the forest while the NSA kept the map of the bunkers.

The desk's reading is that NIST Special Publication 800-12 was the public-facing mask for a deeper, more aggressive cryptographic agenda. By providing a benign, non-regulatory standard, the Department of Commerce created a facade of transparency that shielded the NSA's control over the actual implementation of encryption. The handbook didn't teach the government how to be secure; it taught the government how to talk about security in a way that didn't interfere with the state's ability to listen.

This pattern of providing a public-facing pedagogy to mask a classified dependency is a blueprint the government has used ever since. A full release of the internal communications surrounding the handbook's authorship would likely show that the "introduction" was vetted not for its technical accuracy, but for its ability to avoid contradicting the NSA's secret directives. The cost of this arrangement was a public that believed its digital infrastructure was being managed by standards experts, when it was actually being shaped by the needs of a surveillance state.

Guttman and the 1995 Blueprint for Federal Encryption

The 200-Page Buffer

The Cryptolog Parallel

The Gap in Incident Handling

The Key Escrow Divert

Sources