11 ms·

Demands on Lavabit violated Fourth Amendment, lawyers say

201 points by Libertatea 13y ago

mjn 13y ago
Fwiw, law prof Orin Kerr doesn't think this is a strong appeal: http://www.volokh.com/2013/10/11/lavabit-challenges-contempt-order/ http://www.volokh.com/2013/10/11/lavabit-challenges-contempt...
- caf 13y ago
  In regards to the subpoena power, a point that Kerr doesn't address is that the subpoena power is to compel the production of evidence (as his US v Calandra quote illustrates). In this case, the SSL private key is not itself evidence - it is merely an artifact that the investigators require in order to look for evidence. Is it the equivalent to using a subpoena to force a third party to produce the physical key to a safe in which the investigating authority believes evidence will be found.
  - rainsford 13y ago
    I am not a lawyer, but I have a hard time imagining that subpoena power couldn't be used to obtain a physical key necessary to obtain evidence in a physical safe. As long as the goal is production of evidence, even if it's not necessarily directly obtained, it seems like a valid use of a subpoena. A subpoena would be pretty toothless otherwise since it would be relatively easy to avoid, something I doubt the courts would show much support for.
    - talmand 13y ago
      I would imagine it could be found in past cases where such containers requiring a physical key that couldn't/wouldn't be produced were confiscated and opened by whatever other means necessary. If the law is certain the needed evidence is within the container, the lack of a physical key would not stop the attempt to collect that evidence. I'm curious if there are cases of the police requiring a physical key that is in effect a skeleton key. Say, for instance, an apartment manager's master key that opens every door in the building. Having possession of that would mean the police would have access to every apartment in the building regardless of whether the search warrant allows for that or not. That would be similar to having the SSL key in this case, the authorities would have access to everything. Now, in that case, imagine the police department had recently been shown to not be trustworthy enough to have access to a key that opens every door in the building. I think you could see the dilemma here.
      - tedunangst 13y ago
        The police still need a warrant even if your front door is completely unlocked.
        talmand 13y ago
        That's true, but the rules are different for your home versus a box with a lock on it.
  - bradleyjg 13y ago
    FTA: The key itself is not evidence, contraband, fruits, or instrumentalities of crime, Lavabit argues, but is merely a way to get to evidence, contraband, fruits, or instrumentalities of crime. This is a clever argument pressing an undeveloped aspect of Fourth Amendment law, but I don’t think it ultimately works. It’s pretty standard for computer warrants to authorize the seizure of passwords, encryption codes, operating manuals, “and other information necessary to access the computer equipment, storage devices or data.” I haven’t seen a Fourth Amendment challenge to such provisions, but I would think they are okay because they involve instrumentalities of crime. That is, the password or encryption key is part of the tool used to commit the crime, so it is part of the instrumentality of crime and can properly be obtained in a search warrant.
    - lambda 13y ago
      I'm not sure you could reasonably claim that Lavabit's private key is an instrumentality of crime, since Lavabit's private key is in the control of and used by Lavabit, the service provider, not the alleged criminal. This would be like claiming you could seize the entire phone network because someone somewhere used it to commit a crime. Now, you may be able to demand that Lavibit hand over the user's password or encryption keys, if it is able to do so. Those could likely be considered instrumentalities of crime. But handing over Lavabit's own private keys goes beyond that, to something that Lavabit merely uses to keep it's communications private with all of its customers, the people under investigation and everyone else. Asking for Lavabit's private key is like asking for the master key to let you into any room the building, when only one tenant is actually under investigation. It goes beyond what is necessary to investigate the actual case in question.
      - bradleyjg 13y ago
        If the landlord uses identical locks on all the apartment doors, he can't turn around and complain that turning over the key to the apartment being investigated would open all the doors. As for the instrumentality of the crime, even though it's Lavabit's SSL key the government's contention is that Snowden made use of it in his alleged crimes (by for example encrypting leaked data with the public half of the key for transmission to lavabit's web to email gateway, where it would ultimately be decrypted by lavabit using the private key, and then emailed to the a recipient.) Suppose a criminal rented a car and used it as a getaway vehicle and then returned it. The police could get access to the car for forensic evidence from the rental company, notwithstanding the fact that the car belonged to the rental company who was not accused of any crime.
  - deleted 13y ago
    [deleted]
interstitial 13y ago
What a quiet, unassuming hero Ladar Levison has turned out to be. This guy had a calling, and stuck to it. Without this incident the majority of us would not have known how deeply principled and committed to freedom he is. Our society is better because of him, I wonder how many more Ladars are out there? I'm sad to say, I'm not sure I would have endured so much duress for so little reward.
- bebna 13y ago
  Yeah, it would be so much better if we wouldn't need Ladar and co in the first place.
  - reginaldjcooper 13y ago
    We'll always need people to fight for freedom. It would be so much better if the masses were half as impressed with him as we are. They don't even care enough to opt-out of airport scanners, though.
    - erichocean 13y ago
      In the last week I've read 1984 and Brave New World, and what struck me most about both was the strict segmentation of people groups. I've heard people say, as you do, that "the masses" will never do such and such, and I agree. But in the past, I haven't really been willing to separate "the masses" into their own group. Instead, I've considered myself, and you, and others on HN, as part of "the masses". Anyway, I wonder now if I'm wrong. Maybe we should think of the masses as if they are proles (85% of the population in 1984)? Are "the masses" actually just a large group of people who are—literally—no help whatsoever is securing and protecting a just and free society for themselves and others? And worse, completely unaware that they are no help? Perhaps the masses should be ignored, since their opinions—when they have any—are politically powerless.
      - reginaldjcooper 13y ago
        I think they don't like the situation but not enough to turn off their TVs? Maybe they feel powerless. Maybe they feel like the government is the good guys and the ends justify the means. Nobody they know personally has been waterboarded. In my ideal society the majority has more respect for education and rationality and ergo they would have thought, "hm, maybe this PATRIOT Act and increased surveillance is exactly in line with the goals expressed by the terrorists." Or they'd at least think, "what's going on with these congressional districts, some sort of Uzumaki?" But what seems to be happening is that nobody is angry enough to even vote differently. So I'll probably move to Canada or something.
sdoering 13y ago
> " [...] a move he said would have compromised the personal details of all his 40,000 clients [...]" Funny, as the number is 10 times higher, als stated by the guardian itself in the linked post. Not that it matters, 40.000 would be just as bad.
- clhodapp 13y ago
  :%s/als/than/g I was confused until I remembered my high school German class.
  - sdoering 13y ago
    Thanks for pointing that out ;-)
- tehwalrus 13y ago
  I thought that - I wondered if that was only the number who were paying? In fairness though, the SSL cert would compromise even those who weren't..so I guess you're right.
- pja 13y ago
  IIRC, Lavabit had 400,000 users, out of whom ~40,000 had paid for the service.
- davorak 13y ago
  There is considerable more value in running a world premier service then the amount of money it brings in as well.
- alexkus 13y ago
  The Guardian[1] is notorious for typos and other little inaccuracies (mostly back from the non-digital printing days, but they proudly keep the tradition going even with modern presses.) 1. a.k.a. The Grauniad. www.grauniad.co.uk redirects to theguardian.com
- notdonspaulding 13y ago
  If the number is "1 of his other clients" it is just as bad. This is the educational problem we face ('we' being people who have the particular libertarian bent that Ladar is showing with his actions here). The masses, on all sides of the political spectrum, do not understand just how truly special our constitution is, and how offended they should be that the current holders of office are trampling it underfoot in so many ways. The 4th amendment could be paraphrased as "if officers of the state don't have good reason to think you're guilty, they have no right to invade your person in any way". If we were talking about a fluke whereby the FBI, in the process of intercepting Snowden's communications, mistakenly saw the SMTP traffic of an innocent user of lavabit, OK, mistakes happen. But that's not what's going on here. The FBI requested, and was granted by a federal judge, the ability to search people for whom it had no probable cause of criminal action. Ladar's side brings this up in hopes that the judge will understand that more narrow measures would be just as useful to the FBI, without violating anyone's 4th amendment rights (including Snowden's since he did break the law) and without destroying the core of his business. At least for citizens of the US, if the government isn't prepared to arrest you and press charges against you, it's supposed to leave you the heck alone.
pfortuny 13y ago
Pity is, 'lawyers' say that, we all agree on it BUT, and this is the big BUT, as longs as the secret 'court' thinks otherwise, we are completely helpless. If (another big IF) this case goes to the SCOTUS and they (after quite a bit of money) they support Ladar and all of us, then you can take it for granted that a new 'decision' will take place in a secret 'court' which 'reinterprets' the facts.
- option_greek 13y ago
  In this whole episode the judge came out as a complete loon when it comes to technology with power to trash any privacy expectations. I don't understand why he was so eager to do what he did (fining $5k per day ? what kind of a joke is that..).
- danielweber 13y ago
  It's really depressing how people on HN keep on bringing up "secret 'court'" in cases where it is 100% irrelevant. It's like the facts don't matter, only feelings.
- davorak 13y ago
  Ok what do you do after that secret court? Is there another higher secret court or would the next step be the supreme court?
- csandreasen 13y ago
  There is no secret court involved in this case. The initial case was overseen by the US District Court for the Eastern District of Virginia and is currently in appeals at the 4th Circuit Court of Appeals [1]. The Foreign Intelligence Surveillance Court has no part in this decision. [1] http://www.wired.com/threatlevel/2013/10/lavabit_unsealed/ http://www.wired.com/threatlevel/2013/10/lavabit_unsealed/
  - deleted 13y ago
    [deleted]
- twoodfin 13y ago
pflats 13y ago
The more I think on this, the more I actually start to side with the government's argument. I hate it, but I think they're justified. Lavabit intentionally structured their service such that there were only two ways to get at a criminal's email: obtain a copy of the suspect's private key or compromise the entire service. Lavabit was capable of reading the suspect's email, but only by slurping from the firehouse and reading everyone's email. What Lavabit set up to be their greatest strength ("Nobody can read your email unless they somehow have our SSL key") turned into a terrible systemic weakness ("If the government want to exercise its legal right to obtain a warrant and read a suspect's email, then the only way it can do that is to get the key to everyone's email"). My personal real-world analogy is a safe deposit box that opens either with a key the suspect has or with a master key that opens everyone's lockbox. The bank would defintely be required to turn over the master key. The fact that the only key that opens the suspect's lockbox also opens every other customer's lockbox is a fault of the bank's own devising. (Of course, who the suspect is in the investigation is irrelevant to everything else.)
- 3pt14159 13y ago
  The government shouldn't have the right to COMPEL someone to hand over data. They should have the right to ASK and they should have the right to complain publicly that AT&T or Google isn't cooperating with a specific case, but as communications get more international it is silly to suggest that they have the ability to intercept every communication. This way there is some actual balance to this madness. If Google refuses to help track down Osama, then the government can announce this, and people will be outraged at Google. Snowden is a different matter, many people don't believe he did anything wrong, so it is hard to take the government's side of things.
  - mikeyouse 13y ago
    The US Government absolutely has the right (under court order) to compel a US-based company to hand over data about a US citizen. Do you really think that if Google had access to OBL's whereabouts and wouldn't comply with court orders to provide the information, that the acceptable outcome would be the CIA whining about Google on TV? If Google refuses to help track down Osama, then the government can announce this, and people will be outraged at Google. Snowden is a different matter, many people don't believe he did anything wrong, so it is hard to take the government's side of things. Are you really suggesting that our laws should be based on public opinion?
dlitz 13y ago
One fact that people seem to be ignoring is that SSL private keys are used for authentication. Having an SSL private key doesn't automatically give you access to a user's data; it gives you the ability to impersonate a trusted person/site, which can have the effect of fooling users into handing over their data. Has anyone analyzed whether the government has the authority to compel you to help them impersonate you? From what I can tell, that's central to the private key issue. [Edit: Yes, you can passively eavesdrop if you're not negotiating a TLS ciphersuite with forward secrecy. Added "automatically" to clarify.]
- dec0dedab0de 13y ago
  They would also be able to decrypt intercepted traffic.
ffrryuu 13y ago
We are all Texans now.
MrZongle2 13y ago
Sorry fellow Americans, you don't have Fourth Amendment rights anymore. You've got Fourth-Amendment-As-Defined-By-A-Government-Lawyer-In-A-Secret-Court rights. They're similar, except that Federal agencies can snoop the hell out of whatever you're doing. You know, to keep our children safe from terrorists.

201 points by Libertatea 13y ago

mjn 13y ago

Fwiw, law prof Orin Kerr doesn't think this is a strong appeal: http://www.volokh.com/2013/10/11/lavabit-challenges-contempt-order/ http://www.volokh.com/2013/10/11/lavabit-challenges-contempt...

caf 13y ago
In regards to the subpoena power, a point that Kerr doesn't address is that the subpoena power is to compel the production of evidence (as his US v Calandra quote illustrates). In this case, the SSL private key is not itself evidence - it is merely an artifact that the investigators require in order to look for evidence. Is it the equivalent to using a subpoena to force a third party to produce the physical key to a safe in which the investigating authority believes evidence will be found.
- rainsford 13y ago
  I am not a lawyer, but I have a hard time imagining that subpoena power couldn't be used to obtain a physical key necessary to obtain evidence in a physical safe. As long as the goal is production of evidence, even if it's not necessarily directly obtained, it seems like a valid use of a subpoena. A subpoena would be pretty toothless otherwise since it would be relatively easy to avoid, something I doubt the courts would show much support for.
  - talmand 13y ago
    I would imagine it could be found in past cases where such containers requiring a physical key that couldn't/wouldn't be produced were confiscated and opened by whatever other means necessary. If the law is certain the needed evidence is within the container, the lack of a physical key would not stop the attempt to collect that evidence. I'm curious if there are cases of the police requiring a physical key that is in effect a skeleton key. Say, for instance, an apartment manager's master key that opens every door in the building. Having possession of that would mean the police would have access to every apartment in the building regardless of whether the search warrant allows for that or not. That would be similar to having the SSL key in this case, the authorities would have access to everything. Now, in that case, imagine the police department had recently been shown to not be trustworthy enough to have access to a key that opens every door in the building. I think you could see the dilemma here.
    - tedunangst 13y ago
      The police still need a warrant even if your front door is completely unlocked.
      - talmand 13y ago
        That's true, but the rules are different for your home versus a box with a lock on it.
- bradleyjg 13y ago
  FTA: The key itself is not evidence, contraband, fruits, or instrumentalities of crime, Lavabit argues, but is merely a way to get to evidence, contraband, fruits, or instrumentalities of crime. This is a clever argument pressing an undeveloped aspect of Fourth Amendment law, but I don’t think it ultimately works. It’s pretty standard for computer warrants to authorize the seizure of passwords, encryption codes, operating manuals, “and other information necessary to access the computer equipment, storage devices or data.” I haven’t seen a Fourth Amendment challenge to such provisions, but I would think they are okay because they involve instrumentalities of crime. That is, the password or encryption key is part of the tool used to commit the crime, so it is part of the instrumentality of crime and can properly be obtained in a search warrant.
  - lambda 13y ago
    I'm not sure you could reasonably claim that Lavabit's private key is an instrumentality of crime, since Lavabit's private key is in the control of and used by Lavabit, the service provider, not the alleged criminal. This would be like claiming you could seize the entire phone network because someone somewhere used it to commit a crime. Now, you may be able to demand that Lavibit hand over the user's password or encryption keys, if it is able to do so. Those could likely be considered instrumentalities of crime. But handing over Lavabit's own private keys goes beyond that, to something that Lavabit merely uses to keep it's communications private with all of its customers, the people under investigation and everyone else. Asking for Lavabit's private key is like asking for the master key to let you into any room the building, when only one tenant is actually under investigation. It goes beyond what is necessary to investigate the actual case in question.
    - bradleyjg 13y ago
      If the landlord uses identical locks on all the apartment doors, he can't turn around and complain that turning over the key to the apartment being investigated would open all the doors. As for the instrumentality of the crime, even though it's Lavabit's SSL key the government's contention is that Snowden made use of it in his alleged crimes (by for example encrypting leaked data with the public half of the key for transmission to lavabit's web to email gateway, where it would ultimately be decrypted by lavabit using the private key, and then emailed to the a recipient.) Suppose a criminal rented a car and used it as a getaway vehicle and then returned it. The police could get access to the car for forensic evidence from the rental company, notwithstanding the fact that the car belonged to the rental company who was not accused of any crime.
- deleted 13y ago
  [deleted]

interstitial 13y ago

What a quiet, unassuming hero Ladar Levison has turned out to be. This guy had a calling, and stuck to it. Without this incident the majority of us would not have known how deeply principled and committed to freedom he is. Our society is better because of him, I wonder how many more Ladars are out there? I'm sad to say, I'm not sure I would have endured so much duress for so little reward.

bebna 13y ago
Yeah, it would be so much better if we wouldn't need Ladar and co in the first place.
- reginaldjcooper 13y ago
  We'll always need people to fight for freedom. It would be so much better if the masses were half as impressed with him as we are. They don't even care enough to opt-out of airport scanners, though.
  - erichocean 13y ago
    In the last week I've read 1984 and Brave New World, and what struck me most about both was the strict segmentation of people groups. I've heard people say, as you do, that "the masses" will never do such and such, and I agree. But in the past, I haven't really been willing to separate "the masses" into their own group. Instead, I've considered myself, and you, and others on HN, as part of "the masses". Anyway, I wonder now if I'm wrong. Maybe we should think of the masses as if they are proles (85% of the population in 1984)? Are "the masses" actually just a large group of people who are—literally—no help whatsoever is securing and protecting a just and free society for themselves and others? And worse, completely unaware that they are no help? Perhaps the masses should be ignored, since their opinions—when they have any—are politically powerless.
    - reginaldjcooper 13y ago
      I think they don't like the situation but not enough to turn off their TVs? Maybe they feel powerless. Maybe they feel like the government is the good guys and the ends justify the means. Nobody they know personally has been waterboarded. In my ideal society the majority has more respect for education and rationality and ergo they would have thought, "hm, maybe this PATRIOT Act and increased surveillance is exactly in line with the goals expressed by the terrorists." Or they'd at least think, "what's going on with these congressional districts, some sort of Uzumaki?" But what seems to be happening is that nobody is angry enough to even vote differently. So I'll probably move to Canada or something.

sdoering 13y ago

> " [...] a move he said would have compromised the personal details of all his 40,000 clients [...]" Funny, as the number is 10 times higher, als stated by the guardian itself in the linked post. Not that it matters, 40.000 would be just as bad.

clhodapp 13y ago
:%s/als/than/g I was confused until I remembered my high school German class.
- sdoering 13y ago
  Thanks for pointing that out ;-)
tehwalrus 13y ago
I thought that - I wondered if that was only the number who were paying? In fairness though, the SSL cert would compromise even those who weren't..so I guess you're right.
pja 13y ago
IIRC, Lavabit had 400,000 users, out of whom ~40,000 had paid for the service.
davorak 13y ago
There is considerable more value in running a world premier service then the amount of money it brings in as well.
alexkus 13y ago
The Guardian[1] is notorious for typos and other little inaccuracies (mostly back from the non-digital printing days, but they proudly keep the tradition going even with modern presses.) 1. a.k.a. The Grauniad. www.grauniad.co.uk redirects to theguardian.com
notdonspaulding 13y ago
If the number is "1 of his other clients" it is just as bad. This is the educational problem we face ('we' being people who have the particular libertarian bent that Ladar is showing with his actions here). The masses, on all sides of the political spectrum, do not understand just how truly special our constitution is, and how offended they should be that the current holders of office are trampling it underfoot in so many ways. The 4th amendment could be paraphrased as "if officers of the state don't have good reason to think you're guilty, they have no right to invade your person in any way". If we were talking about a fluke whereby the FBI, in the process of intercepting Snowden's communications, mistakenly saw the SMTP traffic of an innocent user of lavabit, OK, mistakes happen. But that's not what's going on here. The FBI requested, and was granted by a federal judge, the ability to search people for whom it had no probable cause of criminal action. Ladar's side brings this up in hopes that the judge will understand that more narrow measures would be just as useful to the FBI, without violating anyone's 4th amendment rights (including Snowden's since he did break the law) and without destroying the core of his business. At least for citizens of the US, if the government isn't prepared to arrest you and press charges against you, it's supposed to leave you the heck alone.

pfortuny 13y ago

Pity is, 'lawyers' say that, we all agree on it BUT, and this is the big BUT, as longs as the secret 'court' thinks otherwise, we are completely helpless. If (another big IF) this case goes to the SCOTUS and they (after quite a bit of money) they support Ladar and all of us, then you can take it for granted that a new 'decision' will take place in a secret 'court' which 'reinterprets' the facts.

option_greek 13y ago
In this whole episode the judge came out as a complete loon when it comes to technology with power to trash any privacy expectations. I don't understand why he was so eager to do what he did (fining $5k per day ? what kind of a joke is that..).
danielweber 13y ago
It's really depressing how people on HN keep on bringing up "secret 'court'" in cases where it is 100% irrelevant. It's like the facts don't matter, only feelings.
davorak 13y ago
Ok what do you do after that secret court? Is there another higher secret court or would the next step be the supreme court?
csandreasen 13y ago
There is no secret court involved in this case. The initial case was overseen by the US District Court for the Eastern District of Virginia and is currently in appeals at the 4th Circuit Court of Appeals [1]. The Foreign Intelligence Surveillance Court has no part in this decision. [1] http://www.wired.com/threatlevel/2013/10/lavabit_unsealed/ http://www.wired.com/threatlevel/2013/10/lavabit_unsealed/
- deleted 13y ago
  [deleted]
twoodfin 13y ago

pflats 13y ago

The more I think on this, the more I actually start to side with the government's argument. I hate it, but I think they're justified. Lavabit intentionally structured their service such that there were only two ways to get at a criminal's email: obtain a copy of the suspect's private key or compromise the entire service. Lavabit was capable of reading the suspect's email, but only by slurping from the firehouse and reading everyone's email. What Lavabit set up to be their greatest strength ("Nobody can read your email unless they somehow have our SSL key") turned into a terrible systemic weakness ("If the government want to exercise its legal right to obtain a warrant and read a suspect's email, then the only way it can do that is to get the key to everyone's email"). My personal real-world analogy is a safe deposit box that opens either with a key the suspect has or with a master key that opens everyone's lockbox. The bank would defintely be required to turn over the master key. The fact that the only key that opens the suspect's lockbox also opens every other customer's lockbox is a fault of the bank's own devising. (Of course, who the suspect is in the investigation is irrelevant to everything else.)

3pt14159 13y ago
The government shouldn't have the right to COMPEL someone to hand over data. They should have the right to ASK and they should have the right to complain publicly that AT&T or Google isn't cooperating with a specific case, but as communications get more international it is silly to suggest that they have the ability to intercept every communication. This way there is some actual balance to this madness. If Google refuses to help track down Osama, then the government can announce this, and people will be outraged at Google. Snowden is a different matter, many people don't believe he did anything wrong, so it is hard to take the government's side of things.
- mikeyouse 13y ago
  The US Government absolutely has the right (under court order) to compel a US-based company to hand over data about a US citizen. Do you really think that if Google had access to OBL's whereabouts and wouldn't comply with court orders to provide the information, that the acceptable outcome would be the CIA whining about Google on TV? If Google refuses to help track down Osama, then the government can announce this, and people will be outraged at Google. Snowden is a different matter, many people don't believe he did anything wrong, so it is hard to take the government's side of things. Are you really suggesting that our laws should be based on public opinion?

dlitz 13y ago

One fact that people seem to be ignoring is that SSL private keys are used for authentication. Having an SSL private key doesn't automatically give you access to a user's data; it gives you the ability to impersonate a trusted person/site, which can have the effect of fooling users into handing over their data. Has anyone analyzed whether the government has the authority to compel you to help them impersonate you? From what I can tell, that's central to the private key issue. [Edit: Yes, you can passively eavesdrop if you're not negotiating a TLS ciphersuite with forward secrecy. Added "automatically" to clarify.]

dec0dedab0de 13y ago
They would also be able to decrypt intercepted traffic.

ffrryuu 13y ago

We are all Texans now.

MrZongle2 13y ago

Sorry fellow Americans, you don't have Fourth Amendment rights anymore. You've got Fourth-Amendment-As-Defined-By-A-Government-Lawyer-In-A-Secret-Court rights. They're similar, except that Federal agencies can snoop the hell out of whatever you're doing. You know, to keep our children safe from terrorists.