15 ms·
Lavabit Defied FBI Demands to Turn Over Crypto Keys, Documents Show
- eksith 13y agoTheresa Buchanan is the same judge who ordered Twitter to turn over info on WikiLeaks http://www.salon.com/2011/01/08/twitter_2 http://www.salon.com/2011/01/08/twitter_2
- adamnemecek 13y agoThe title made me think that they managed to get what they wanted.
- wellboy 13y agoThis is pure evil.
- warmwaffles 13y agoThis is "freedom"(tm)
- baddox 13y agoDon't forget who the ruling class is and how they behave the next time a relevant issue comes around.
- wellboy 13y agoI don't think it matters since the mass data surveillance thing was started by the Bush Administration...
- barry-cotter 13y agoThe NSA is older than most voters. When talking about the Stasi there is no meaningful difference between the Republicans and Democrats, Labour and Conservatives, etc. They're all politicians and they're all the same.
- shmerl 13y agoI guess Lavabit figured that giving access to the data of one user in the requested way could compromise other users' privacy/security so that would be equal to warrantless wiretapping. Otherwise, what was the problem with following that?
- waqf 13y agoThe problem was that following it would be a violation of the privacy of Edward Snowden (well, of the user whom we presume to be Snowden) and of the trust which he had placed in Lavabit.
- pyrocat 13y agoAnd a violation of the very basis of their business.
- shmerl 13y agoViolation of his privacy under warrant is what the law would expect in that case. Violating privacy without a warrant (and probable cause and etc.), that what is unconstitutional. Or you are saying that there can be no investigation at all? Lavabit even admitted, they already assisted investigators in the past for investigation on a specific user. Apparently that request was legal in the view of the Lavabit owner, so there should be something different here.
- deleted 13y ago[deleted]
- dak1 13y agoFrom the article: > With the SSL keys, and a wiretap, the FBI could have decrypted all web sessions between Lavabit users and the site. It sounds like he was incurring some significant fines as well, so he was left with the choice of undermining his entire business model, or closing down.
- shmerl 13y ago
- invalidOrTaken 13y agoLavabit are freaking heroes.
- mildtrepidation 13y agoWithout taking a stance on this statement, I think it's important to realize how alarming it is that simply trying not to betray the trust of your users has become such a difficult, dangerous, and unusual task as to be called heroism. The intelligence community has put us in such a bad spot that anyone who actually tries not to do something unethical, which should really be the default, is now exceptional and lauded. Lavabit stood up, and that's admirable. That it's this admirable is a really bad sign.
- kiba 13y agoWe cannot to run this nation based on heroic self-sacrifice.
- asperous 13y agoWell the founder pretty much had to throw away his livelihood as well as part his dream to do something that could land him in jail, for someone he had never met. He could have easily quietly given them the key (if he had it?), and then live the rest of his life with success and guilt. Very, very few people would throw themselves in front of a bus the size of the US government to save an honest stranger. Those people are worthy of calling heroes.
- mildtrepidation 13y agoVery, very few people would through themselves in front of a bus the size of the US government to save an honest stranger. That's exactly my point. This is not a situation he should have been in. In our current political environment, absolutely, his actions were heroic. But all he did was what he should have done. That the potential consequences for that are so horrifying is what makes this entire situation incredibly wrong.
- eps 13y agoWhat's the source of this info? Does anyone know?
- droopybuns 13y agoI wish Paulson explained where he got this information. Did Lavabit just leak NSL data?
- EthanHeilman 13y ago"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." http://en.wikipedia.org/wiki/Fourth_Amendment_to_the_United_States_Constitution http://en.wikipedia.org/wiki/Fourth_Amendment_to_the_United_... "particularly describing the place to be searched, and the persons or things to be seized" Clearly this is a violation of the 4th Amendment as such a key would give them the ability to conduct unfettered and "unparticular" searches. A more targeted, and constitutionally legal, approach would have been to order lavabit to use, but not disclose, the private key to decrypt specific emails from specific people. Given that the police know the public key, they could verify that lavabit had supplied correct decryptions.
- Karunamon 13y agoHmm.. the FBI had probable cause to believe Snowden's email contained incriminating data. Furthermore, targeted pen registers/trace orders aren't exactly unconstitutional, but combine the way Lavabit is architected with the scope of the search, and you've essentially given them the keys to the kingdom. Are there any older physical parallels to this? What happens if the police, in the process of securing a lawful warrant, require access to a physical master key or combination or etc. which would open a great deal more than access to the suspect's belongings?
- deleted 13y ago[deleted]
- pyre 13y agoPresumably, the holder of the master key uses it to unlock <storage_medium> and doesn't hand it over to the police?
- anologwintermut 13y agoIt appears that the FBI's original request was narrowly targeted to Snowden and completely above board, warrant and all. It didn't give them the keys to the Kingdom. When lavabit refused to comply,the FBI got more aggressive. Which seems like exactly what would happen. Think about it. What if the FBI subpoenaed financial records from a Bank who refuses to open the safe they were in. Well, the US Marshals are going to show up at the bank with a court order,break open the vault, and get access to all the records and take the one they want. It's not an unreasonable search provided there are checks that they only get the one record they are looking. In fact, arguably the Bank breached it's duty to it's customers by forcing the US Marshals to go through all their records rather than the Bank doing it self. Obviously, it's not so clear in this case since Lavabit apparently finally did offer to hand over some data, but it is along those lines.
- deleted 13y ago[deleted]
- kcorbitt 13y agoAwesome decision. It's easy to say it was the right call from the sidelines but it's also easy to underestimate the personal cost that must have been involved with walking away from his company, especially with the gag orders making it impossible to discuss his reasons.
- dingaling 13y agoThere was more than a personal cost. The staff of Lavabit had no idea what was happening as the servers were being shut-down, until they were told to go home. http://www.emaildiscussions.com/showpost.php?p=558661&postcount=93 http://www.emaildiscussions.com/showpost.php?p=558661&postco... I apologize; it was not my intent to mislead (though it appears that I did so inadvertently). I was told that the outage was related to maintenance regarding the storage system from one of the Lavabit admins.
- drivebyacct2 13y agoYeah, I'm going to need a bitcoin address for Lavar pretty much right now.
- ateevchopra 13y agoThis act will be remembered as a "legend".And Lavabit is THE HERO.Standing behind its customers, almost killing itelf.You are my hero !
- wmf 13y agoEverybody note that the SSL key demand came only after Lavabit declined to turn over information on one user. I can understand the logic of this from the feds' perspective; they tried to do it the "right" way but Lavabit refused to cooperate so then the feds starting trying progressively more aggressive approaches to get the data.
- Glyptodon 13y agoThe problem is that in order to get that information the first way Lavabit would have had to write code that made all of their business claims a lie.
- jauer 13y agoExcept that per the article they already had that code written so they couldn't credibly claim that they weren't able to do it: "The representative of Lavabit indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to 'defeat [its] own system,'" the government complained.
- Glyptodon 13y ago"Technical ability" means that yes, it's doable if someone does work. It's doesn't mean that they 'already had the ability' other than in a theoretical sense. And even so, it still doesn't change the fact that it would have turned all their business claims into giant lies, possibly even exposing them to suits for false advertising, etc.
- kartikkumar 13y agoI think you're reading the sentence incorrectly. The way I read it, it's not saying that they "technically had the ability", which is what you're suggesting as having the ability in a theoretical sense. It's stating that they "had the technical ability", i.e., they had the technical prowess, knowledge, etc.
- betterunix 13y ago
- wnevets 13y agoDoes this mean SSL is secure?
- adamnemecek 13y agoMaybe the gov't just does not want to reveal all the aces up their sleeves.
- VMG 13y agoHard to tell - the government would still try other methods first before showing their hand.
- McGlockenshire 13y agoIt just means that at least in some possible cases, the way that SSL is broken is by demanding the private keys and installing a transparent proxy or tap outside of the network. So while it might not be broken in the way we usually expect crypto to be broken, it continues to be broken from a trustability point of view.
- fennecfoxen 13y agoI dunno. That's exactly the way you should expect crypto to be broken: "don't attack the encryption, attack how it's used"
- gred 13y agohttp://xkcd.com/538/ http://xkcd.com/538/ (in this case the wrench is metaphorical)
- adamnemecek 13y agoIf you want to support the Lavabit defense fund, you can do so here https://rally.org/lavabit https://rally.org/lavabit EDIT: Since I posted the link 30 minutes ago, there is roughly $1200 more in fund and I'm guessing that it's mostly from HN. So keep it up.
- welder 13y agoThanks for sharing this link. I just donated $$ $29,341 Raised of the $40,000 goal.
- 3pt14159 13y agoHow many of us want to help, but are afraid of the consequences?
- jlgaddis 13y agoFor a moment, I thought about what might happen if I donated. Then, I thought about what might happen if I don't.
- deleted 13y ago[deleted]
- welder 13y agoIf everyone thinks like you then there might be consequences. But, if everyone donates without regard of consequences then there will be none. So just donate!
- jrockway 13y agoI want to help, and am not afraid of the consequences. The government is not going to go after an individual for funding another's defense fund, and if they do, I guess I used my life for the right reasons.
- smtddr 13y agoYay! That's the jrockway I remember! Just because of this comment, I'm tossing in $50.
- danso 13y agoI'm not taking sides against Lavabit here, but it's worth considering the situation here without the Snowden context. A search warrant was signed by a court for federal agents to retrieve/collect evidence for a specific target. How is what the FBI (and prosecutors) demanded different than a normal wiretap? edit: If the FBI's order could not be completed in a way that would NOT compromise ALL users, then of course Lavabit should have resisted. My question is based on the assumed validity of this statement in the OP: > The July 16 order came after Texas-based Lavabit refused to circumvent its own security systems to comply with earlier orders intended to trace the Internet IP address of a particular Lavabit user.
- Karunamon 13y agoBecause of what handing over the data would necessarily entail. (If I understand corectly.. someone please correct me if I have this wrong). The data the FBI wanted wouldn't have just unearthed Snowden's emails, but everything by every Lavabit user. And if you believe that information wouldn't have made its way to certain other 3 letter agencies...
- shmerl 13y agoSee https://news.ycombinator.com/item?id=6485616 https://news.ycombinator.com/item?id=6485616
- deepinsand 13y agoA service that used a separate subdomain and SSL certificate per user could have avoided such a situation. Though this is an unreasonable burden for a service provider to bear for operating in the US.
- jlgaddis 13y agoHuh? You'd still have a private key per certificate. You might have one key for all of them or one key per cert, but you'd still have a private key for each of those certs. Unless I'm missing something?
- deepinsand 13y agoIf I read the article correctly, the Lavabit founder was unwilling to give up the private key because it would compromise all users, not just Snowden.
- jrockway 13y agoAnd giving up the SSL key for Snowden wouldn't give them anything useful, since he's probably not checking his US-based email anymore. (And SSL should be in perfect forward secrecy mode, so the private key can't be used to decrypt past sessions.)
- cbhl 13y agoThen the US could have simply moved up to asking for the private key to the wildcard certificate or certificate authority to do the requisite MITM.
- deepinsand 13y agoTrue, but presumably that would have been unconstitutional. As it was implemented, the only option they had was to demand Lavabit's private key, since they use the same SSL cert per user.
- siculars 13y agoBalls of steel. What a hero.
- deleted 13y ago[deleted]
- thrownaway2424 13y agoJump to conclusions often? The MUCH simpler, obviously far more likely sequence of events, is: 1) June 28th: FBI/DoJ obtains lawful court order for a pen register trace on Snowden's email account. 2) June 28th-July 9th: Lavabit fails to comply. 3) July 9th: Lavabit held in contempt, which is clearly appropriate as they did not respond to a lawful court order. 4) July 9 - August 1: FBI obtains search warrant for Snowden's email. Lavabit challenges warrant on the irrelevant technical grounds that they encrypt all users' email with same key. 5) August 8: Lavabit shuts down, because it turns out that hosting email for the criminal class carries real risks and isn't terribly lucrative. You can't wave off court orders just because you think the Internet is some kind of libertarian cyber-paradise where mortal laws do not apply. Court orders and search warrants are lawful means of investigation. Lavabit's business was not compatible with US laws or probably the laws of any country more developed than Zimbabwe.
- Numberwang 13y agoWould have been great with a bit more transparency on the chain of events. Most countries more developed than Zimbabwe would have provided that as a service to its citizens.
- thrownaway2424 13y agoYou mean by unsealing the court records, such as the unsealed court records which form the basis of this article?
- Numberwang 13y agoWhy would court records be sealed at all, and why would there be any speculation about the chain of events if you were given the very basic information about a case? Throwaway accounts usually mean throwaway opinions. Do something more important with your life.
- ZoFreX 13y ago> In a work-around, Levison complied the next day by turning over the private SSL keys as an 11 page printout in 4-point type. The government called the printout “illegible” and the court ordered Levison to provide a more useful electronic copy. How illegible? I'm really curious about this part.
- jlgreco 13y agoI'd say that depends on the printer. Was it a nice laser/toner deal, or an HP 'inkjet' they found behind a dumpster 10 years ago?
- riggins 13y agothis made me chuckle.
- jack-r-abbit 13y agoThey go on to say that it was 2,560 characters. That many chars at 4pt type should not have taken 11 pages. That is roughly 233 chars per page. Even at normal point size, 1 page will hold more than 233 chars. at 4pt I would expect it to all fit on one page. Am I missing something here?
- secabeen 13y agoWe don't know how many characters per line there were. A page contains about 130 lines at 4 point font.
- jack-r-abbit 13y agoThat is what I don't get. If 4pt gives you 130 lines per page, you would only need to fit 20 chars per line to fit the entire thing on one page. With 2560 chars on 11 pages means 233 chars per page at 130 lines per page, we end up with roughly 2 chars per line. We already know he was basically giving them the middle finger by printing it AND printing it very small. He would clearly need to do something extra odd to make it do this.
- bakerconspiracy 13y agoMy favorite part: The SSL certificate was delivered as an 11 page paper in 4pt font. This is so genius.
- shavingspiders 13y agoWhy not hand in the characters in 4pt on a single page each? Make it double sided to make it a little more feasible. 233 characters per page is just about nothing at that size, I don't get why they decided to stop at 11 pages.
- generj 13y agoI think it was to avoid being too obviously non-compliant. Delivering the information this way could be construed as merely avoiding paper-costs while using formats the hide-bound government officers would be most familiar with (paper). It's somewhat facetious, but you can almost say it with a straight face, and a tech-illiterate judge might even accept it (especially if you did something just slightly more legible at 5 or 6 points). It would be impossible for anyone to claim with a straight face they complied if they did as you described. Lavabit can claim they provided the keys in a fairly digestible format, and it bought them a few days worth of time. Also, a single character at 4 pt surrounded by whitespace is much, much easier to decode. Finally, most courts would charge you for delivering that much paper. For similar reasons, paying court fees in pennies is not accepted by all jurisdictions.
- jack-r-abbit 13y agoAt first I was more on the Lavabit side on this. But it is looking more like they started the whole thing when they defied the initial court order to provide connection info for that one specific user that was the target of an FBI investigation. When served with a warrant, you can't just tell them to fuck off and expect the matter to be over. They will simply go harder... and not go home. I'm concerned that our outrage over "mass surveillance being used for fishing expeditions" has clouded our judgment when it comes to "law enforcement legitimately gathering evidence for an active case against one specific person." Once they have a person of interest, their job is to continue to find evidence to bolster their case. That evidence will take different forms and come from different sources. I have no problems with companies complying with search warrants and court orders by providing evidence regarding illegal activity of a particular suspect. This is different than providing back doors for law enforcement to go looking for suspects. A commenter on that story makes a good point: Forget for a moment that the user they were looking for was Snowden. If the FBI had been looking for info for a case against a serial killer or a child porn ring, would we still hold Lavabit as heroes for not following the court order?
- riquito 13y agoLavabit didn't know who they where protecting. This has a merit
- jack-r-abbit 13y agoBut they knew they were protecting someone under investigation for violations of the Espionage Act and theft of government property. It seems kind of shitty to not help find that person.
- generj 13y agoYeah, because in the time frame this was going down, it would have been a totally unreasonable assumption that someone matching those particular crimes described Edward Snowden. Of course they knew who they were looking for - it was necessary for that to be disclosed in order for the government to even demand the information in the first place. That's what a warrant is. For as much was wrong with the government's request, it's first request was at least reasonable: specific knowledge on Edward Snowden. The inherent architecture of Lavabit rendered this request unreasonable, and things escalated from there. Sure enough, the court documents and transcripts clearly have "target" followed by blacked out spaces just wide enough for Snowden, spoken by both lawyers and Mr. Levison. This happens dozens of times throughout the recently unsealed documents.
- DrJokepu 13y agoI wonder why didn't the FBI just use some OCR tool to scan the key?
- daemin 13y agoGiven the reported "accuracy" of HP scanners and others on the market - i.e. see recent posts on HN - I think that would be worse than typing it out by hand with a magnifying glass.
- zmmmmm 13y ago> [The] government’s clearly entitled to the information that they’re seeking, and just because you-all have set up a system that makes that difficult, that doesn’t in any way lessen the government’s right to receive that information just as they could from any telephone company or any other e-mail source that could provide it easily I find the sense of entitlement the FBI had quite disturbing. Perhaps it is technically true, but they clearly had an attitude not just that they were legally authorized to access such information, but that nobody should be allowed to stop them having it, and any personal cost involved or moral objection is not part of the equation. For me the two do not connect that way - I am entitled to buy a house but nobody is required to help me do it, and if I don't have the money, I'm screwed. It doesn't allow me to murder the guy down the street so that I can take his money to buy the house I want. The question is, is the FBI allowed to recruit any civilian to do anything they think is necessary to get at some information they are authorised to acquire? Can they go to your grandmother and tell her to prostitute herself if that will help them? At what point does technical ability to accomplish something render you at the mercy of the state to do whatever they tell you? It is one thing to demand someone actively stop obstructing something. But to demand they actively assist goes a step further. The notion of conscientious objection has been accepted and even honoured and respected, even in times of war. I don't know where this line is. But I know I'm very uncomfortable with the attitude that law enforcement showed in this case.
- chris_mahan 13y agoThe FBI is not allowed to break the law, and the Constitution is the law. If Snowden showed that some people in government were violating the Constitution, and other people in government were trying to suppress his evidence, would that not mean that the people trying to suppress the evidence are complicit with the violators? Even if these people didn't swear an oath to protect and defend the Constitution, it is still the law, and they are still bound to obey it. So, what's the penalty for helping someone violate the US Constitution? And who enforces that?
- kamjam 13y agoYeah, but even if it was proven beyond a reasonable doubt what's the likelihood they would get anything more than a slap on the wrist when they state it was to "defend your freedom"?
- balabaster 13y agoAm I the only one busting a gut that he printed out the SSL key over 11 pages in 4pt font for them to re-key? Hahahaha that's fucking hilarious... though the kind of OCR software the FBI has access to would no doubt have made short work of this.
- lettergram 13y agoI commend him him for shutting down Lavabit instead of giving in. It was one of those epic moments where one chooses to take a principled stance on something no matter what the cost. (Reminds me of a Howard Roark moment to be honest)
- rdl 13y agoThere is no way this is not a "general warrant". If it's not overturned in appeal, the US is no longer an acceptable place to host anything or conduct any business operations for anyone (except the USG or regulated entities). I'm hopeful it will be overturned at the 4th Circuit, rather than waiting for SCOTUS. There are so many ways to challenge it. The only way we'd be fucked would be if Ladar didn't have the money to appeal, but it's a super tempting case for anyone at EFF/ACLU/etc. Funding the appeal to the max would also be in the self interest of any cloud business in the USA.
- generj 13y agoI'd be very surprised if this isn't the landmark case establishing demands for SSL certificates as being too general. Just like Jewel v. NSA was always destined to be a landmark case, and now will be, after the executive privilege crap got thrown out.
- wellboy 13y agoIs there a bug in HN right now? Why is this story which was posted 4h ago ranked #7 with 436 upvotes, when U.S. Opposes Tech Companies... is ranked #6 with 169 upvotes while it was posted 8h ago and the Google acquisition of Flutter ranked #3, also posted 4h ago, whereas it only has 96 upvotes. Did the HN ranking algorithm change or did I miss something? Here the screenshot http://imgur.com/7Yh9XB2 http://imgur.com/7Yh9XB2
- judk 13y agoThe good news here is that Lavabit only started to suffer when the feds came calling for Snowden. Another email provider "Mavabit" could provide a quality encrypted email service for a while as well, as long as we have a supply of trustworthy operators.
- PhasmaFelis 13y agoLike half a dozen people have tried to argue that, because the order was lawful and Levison had complied with previous lawful orders, he has no moral justification for refusing this one. Let's not beat around the bush. You're willfully missing the point. The lawfulness of the order is not at issue; the target of the order is. I would happily obey a lawful order to turn in a fugitive rapist hiding in my basement; I would not willingly obey a lawful order from the same authority to turn over an escaped slave, even if I lived in a slave-holding nation. If you don't think that Snowden should have broken the law to inform the public of massive, unsupervised, hidden government surveillance and lies about same, that's fine. But say so, don't go making disingenuous sidewise arguments and thinking you're sly. Yes, Levison disobeyed a lawful order. Laws should be obeyed because they are just, not because they are laws.
- acqq 13y agoNo, the difference this time is that FBI demanded to install their own equipment inside of Lavabit facilities, having access to all users' data: https://news.ycombinator.com/item?id=6487852 https://news.ycombinator.com/item?id=6487852