4 ms·

I'm not sure you could reasonably claim that Lavabit's private key is an instrumentality of crime, since Lavabit's private key is in the control of and used by

by lambda 13y ago

I'm not sure you could reasonably claim that Lavabit's private key is an instrumentality of crime, since Lavabit's private key is in the control of and used by Lavabit, the service provider, not the alleged criminal. This would be like claiming you could seize the entire phone network because someone somewhere used it to commit a crime. Now, you may be able to demand that Lavibit hand over the user's password or encryption keys, if it is able to do so. Those could likely be considered instrumentalities of crime. But handing over Lavabit's own private keys goes beyond that, to something that Lavabit merely uses to keep it's communications private with all of its customers, the people under investigation and everyone else. Asking for Lavabit's private key is like asking for the master key to let you into any room the building, when only one tenant is actually under investigation. It goes beyond what is necessary to investigate the actual case in question.

bradleyjg 13y ago
If the landlord uses identical locks on all the apartment doors, he can't turn around and complain that turning over the key to the apartment being investigated would open all the doors. As for the instrumentality of the crime, even though it's Lavabit's SSL key the government's contention is that Snowden made use of it in his alleged crimes (by for example encrypting leaked data with the public half of the key for transmission to lavabit's web to email gateway, where it would ultimately be decrypted by lavabit using the private key, and then emailed to the a recipient.) Suppose a criminal rented a car and used it as a getaway vehicle and then returned it. The police could get access to the car for forensic evidence from the rental company, notwithstanding the fact that the car belonged to the rental company who was not accused of any crime.
- lambda 13y ago
  But it's not a matter of using identical locks. He has offered to turn over particular pieces of evidence about particular suspects; but he refused to hand over his private key which would allow the feds to snoop on everything. It's like asking for the master key, when only the key to one particular room (or one particular car) would be sufficient for the investigation.
  - bradleyjg 13y ago
    Analogies extended too far can be unhelpful, but I'll risk it one more time. His offer, made rather late in the game, was the equivilent of the super telling the police they couldn't enter the apartment, but that he (the super) would search it for them and pick up whatever they were asking for, if they were willing to pay him some money for his time. That might be a reasonable offer, but I don't think there's anything in fourth amendment law, or the statutes, that require the police to take him up on it, rather than just insisting that they do the search themselves. In my own reading of the case, the area of the government's actions that seemed the weakest was the applicability of the rationale for the probable-cause-less pen-trap and stored communication act requests (i.e. the third party doctrine from Smith v. Maryland) to email headers and usage logs from a service that held itself as not being able to access these things. In that circumstance it looks to me like the user does have a reasonable expectation of privacy in those (meta)data, and so a warrant issued upon probable cause should be necessary. However, this case also involved a grand jury subpoena. That's a whole other (troublesome) kettle of fish, one that frankly I'm not too familiar with.
- raganwald 13y ago
  If the landlord uses identical locks on all the apartment doors, he can't turn around and complain that turning over the key to the apartment being investigated would open all the doors. Why? When setting up a business, are you required to organize it in such a way that in the future, the government can come along and perform a certain kind of search/and/or seizure? It that your obligation, failing which all of your customers must suffer? It's one thing to have a law that states the government can ask for things. But I haven't heard anybody argue that the law requires you to organize your affairs in such a way that you can comply with requests like this "cleanly."
  - bradleyjg 13y ago
    >It that your obligation, failing which all of your customers must suffer? > It's one thing to have a law that states the government can ask for things. But I haven't heard anybody argue that the law requires you to organize your affairs in such a way that you can comply with requests like this "cleanly." Generally you don't have to set up your business in such a way as to comply with requests cleanly, though there are exceptions for certain telecom providers (not applicable here). But by the same token your inability to comply cleanly doesn't absolve you of the responsibility to comply. So our landlord hypothetical the landlord certainly is allowed to use the same lock on every door, but he still has to turn over the key when it is demanded. As for the collateral consequences to third parties the court will not assume that the government is going to abuse their access to search more than they are authorized to. That seems to be the biggest disconnect. The judge didn't think that the ability to decrpyt all the traffic was a pertinent harm because his order didn't allow the agents to look at it. Whether or not that's a reasonable assumption as a matter of fact is an empirical question, but it is certainly a reasonable, perhaps even compelled, one from a legal standpoint.
    - raganwald 13y ago
      One of the reasons I Am Not A Lawyer is this: If the business is allowed to send its customers a form letter telling them that hey has given the master key to the government, I would understand the position that the interests of the other customers were reasonably safeguarded. If, for example, one of them was discussing some business and then suspicious trading occurred, she might ask whether a government employee abused the master key and was doing some insider trading on the side. But if the business is not allowed to tell the customers that their privacy has been compromised, I would not want to give the government the "benefit of the doubt" about their use or abuse of a master key. Trust, but verify, as they say. How does one verify when these security letters are handed out like candy?
- 59nadir 13y ago
  He certainly should be able to complain about them requesting a master key even if there are keys that open individual doors.

by lambda 13y ago

bradleyjg 13y ago

If the landlord uses identical locks on all the apartment doors, he can't turn around and complain that turning over the key to the apartment being investigated would open all the doors. As for the instrumentality of the crime, even though it's Lavabit's SSL key the government's contention is that Snowden made use of it in his alleged crimes (by for example encrypting leaked data with the public half of the key for transmission to lavabit's web to email gateway, where it would ultimately be decrypted by lavabit using the private key, and then emailed to the a recipient.) Suppose a criminal rented a car and used it as a getaway vehicle and then returned it. The police could get access to the car for forensic evidence from the rental company, notwithstanding the fact that the car belonged to the rental company who was not accused of any crime.

lambda 13y ago
But it's not a matter of using identical locks. He has offered to turn over particular pieces of evidence about particular suspects; but he refused to hand over his private key which would allow the feds to snoop on everything. It's like asking for the master key, when only the key to one particular room (or one particular car) would be sufficient for the investigation.
- bradleyjg 13y ago
  Analogies extended too far can be unhelpful, but I'll risk it one more time. His offer, made rather late in the game, was the equivilent of the super telling the police they couldn't enter the apartment, but that he (the super) would search it for them and pick up whatever they were asking for, if they were willing to pay him some money for his time. That might be a reasonable offer, but I don't think there's anything in fourth amendment law, or the statutes, that require the police to take him up on it, rather than just insisting that they do the search themselves. In my own reading of the case, the area of the government's actions that seemed the weakest was the applicability of the rationale for the probable-cause-less pen-trap and stored communication act requests (i.e. the third party doctrine from Smith v. Maryland) to email headers and usage logs from a service that held itself as not being able to access these things. In that circumstance it looks to me like the user does have a reasonable expectation of privacy in those (meta)data, and so a warrant issued upon probable cause should be necessary. However, this case also involved a grand jury subpoena. That's a whole other (troublesome) kettle of fish, one that frankly I'm not too familiar with.
raganwald 13y ago
If the landlord uses identical locks on all the apartment doors, he can't turn around and complain that turning over the key to the apartment being investigated would open all the doors. Why? When setting up a business, are you required to organize it in such a way that in the future, the government can come along and perform a certain kind of search/and/or seizure? It that your obligation, failing which all of your customers must suffer? It's one thing to have a law that states the government can ask for things. But I haven't heard anybody argue that the law requires you to organize your affairs in such a way that you can comply with requests like this "cleanly."
- bradleyjg 13y ago
  >It that your obligation, failing which all of your customers must suffer? > It's one thing to have a law that states the government can ask for things. But I haven't heard anybody argue that the law requires you to organize your affairs in such a way that you can comply with requests like this "cleanly." Generally you don't have to set up your business in such a way as to comply with requests cleanly, though there are exceptions for certain telecom providers (not applicable here). But by the same token your inability to comply cleanly doesn't absolve you of the responsibility to comply. So our landlord hypothetical the landlord certainly is allowed to use the same lock on every door, but he still has to turn over the key when it is demanded. As for the collateral consequences to third parties the court will not assume that the government is going to abuse their access to search more than they are authorized to. That seems to be the biggest disconnect. The judge didn't think that the ability to decrpyt all the traffic was a pertinent harm because his order didn't allow the agents to look at it. Whether or not that's a reasonable assumption as a matter of fact is an empirical question, but it is certainly a reasonable, perhaps even compelled, one from a legal standpoint.
  - raganwald 13y ago
    One of the reasons I Am Not A Lawyer is this: If the business is allowed to send its customers a form letter telling them that hey has given the master key to the government, I would understand the position that the interests of the other customers were reasonably safeguarded. If, for example, one of them was discussing some business and then suspicious trading occurred, she might ask whether a government employee abused the master key and was doing some insider trading on the side. But if the business is not allowed to tell the customers that their privacy has been compromised, I would not want to give the government the "benefit of the doubt" about their use or abuse of a master key. Trust, but verify, as they say. How does one verify when these security letters are handed out like candy?
59nadir 13y ago
He certainly should be able to complain about them requesting a master key even if there are keys that open individual doors.