6 ms·

Lavabit Challenges Contempt Order: An Analysis of Its Arguments

69 points by CWuestefeld 13y ago

trothoun 13y ago
If you s/anti-government/anti-government surveillance/ then I think the article would be considerably improved. Was Lavabit explicitly anti-government?
- eli 13y ago
  I think that's probably a fair point.... Doesn't seem like it changes any of the legal analysis though. You can't disobey a search warrant because it would be bad for business or because you want to protect the target.
  - spydum 13y ago
    I think the primary concern is protecting the other folks who are not the target. Handing over keys allows for the government agency the opportunity to violate other users 4th amendment rights.
    - eli 13y ago
      Sure, I get it, but I don't think you can ignore a subpoena just because you don't trust the government not to abuse it.
      - ganeumann 13y ago
        Well certainly you can, because he did. I think perhaps that's the main point here.
- rainsford 13y ago
  I'm not sure it makes much of a legal difference, although maybe it might be a more accurate description of Lavabit's viewpoint. But as the article points out, a business model or ideology isn't a basis to challenge court orders or subpoena power...regardless of what it might be.
brymaster 13y ago
Levinson deserves more support than the paltry $90K (https://rally.org/lavabit https://rally.org/lavabit) he's raised so far for his legal defense war chest. I hope he can continue to fight this as he goes up the court of appeals ladder.
thinkcomp 13y ago
Fourth Circuit Court of Appeals docket and documents here: http://www.plainsite.org/flashlight/case.html?id=2524335 http://www.plainsite.org/flashlight/case.html?id=2524335
coldcode 13y ago
There is no hope for us if nothing we hold to be ours is available to any government agent who demands it. A request for a single person is one thing, it only affects that one person. Once the request affects a huge number of unrelated people just to grab that one person it becomes unreasonable. It's like arresting an entire city to catch a single criminal. At some point you have to draw a line. But I wouldn't want to try that argument in front of a Federal Judge much less the Supremes. I doubt this will work.
- rayiner 13y ago
  Isn't it a technical problem with the service, rather than a legal problem, if the host can't give access to one email account without compromising all users?
  - thecodeore 13y ago
    The email encryption was not in play here, from what I understand the end user was the only person with the key to the email "inbox" encryption What is in play here was the SSL Key that is used to encrypt the browser traffic between LB and the user. No differant than the SSL Cert used when you make an online purchase It technologically impossible/impractical to have a separate SSL cert for each user, that is just not how the HTTPS protocall was designed This is not Lavabits doing, that is the work of the Internet Engineering Task Force (IETF)
    - eli 13y ago
      If your landlord only had a master key to all apartments they could use that as a reason to refuse to turn it over for access to one apartment?
      - thecodeore 13y ago
        That is a poor analogy. By turning over the SSL Key the FBI using the Pen Trap Device would capture in real time all data of all users and be decrypting it in real time. Turning over a Master Key to a building would not give the FBI instant access to all apartments simultaneously, nor would they have the ability to go back in time to look at previous data, nor thousands of other problems with this analogy People are attempting to conflate physical keys with encryption keys simply because years ago the mathematicians used the word "keys" as analog to explain things to the general public. This does not mean there is, in reality, any analogous relationship between encryption keys and physical keys
rayiner 13y ago
Argument #1 is really the damning thing for Lavabit. The scope of the subpoena power isn't some new invention of the surveillance state. The quote from U.S. v. Calandra ("the public is entitled to every man's evidence") dates to 1742: http://supreme.justia.com/cases/federal/us/317/424/case.html#F2/1 http://supreme.justia.com/cases/federal/us/317/424/case.html.... It wasn't a new concept then either. The idea of e-mail accounts the government can't access with an appropriate court order is deeply incompatible with how Anglo-American law conceives of the powers of courts. There's a comment by "Jessica Darko" on the linked-to blog that I think warrants addressing. There is a big difference between a "search" for the purposes of the 4th amendment and a subpoena of a third party. Say the government is investigating Bob for tax fraud. It's a "search" subject to 4th amendment protections for the government to break into Bob's house and go through his drawers. It's not a "search" for the government to subpoena his accountant for any relevant financial records. It's a "search" for the government to break into the accountant's office to get those records, but the accountant can't hold up the 4th amendment as a shield against turning over those records pursuant to a court order.
- cperciva 13y ago
  The problem I see with subpoenaing SSL keys is that they are not, in fact, evidence.
  - Amadou 13y ago
    I was hoping to see more discussion on this point. Are there other cases where subpoenas have been issued for tools that enable the gathering of evidence? Has that sort of thing always required a warrant? Is it moot that a warrant was eventually issued? Or was the warrant only issued punitively because Lavabit didn't comply with the subpoena without regard to the validity of the subpoena in the first place?
- nullc 13y ago
  Should the government be able to order you to give a blood sample so they can pop out a clone of you, which they can then use to impersonate you towards _anyone_, say, your spouse, in order to potentially perform arbitrarily broad collection whos scope they'll hide under the guise of national security? They're not asking for evidence, they order the operator of the service to be complicit in aiding the government in impersonating the service towards all of its users.
RexRollman 13y ago
It was well written. I expect the government will respond with a sad combination of flag waving and fear mongering.
hawkharris 13y ago
Excellent analysis. It's refreshing to see someone dive into the legal issues instead of spewing personal opinions about what the parties should - or should not - have done. I hope that those who critique the author's post will take the same amount of care in researching the law.
thecodeore 13y ago
I believe it is very telling that a pro-privacy company, a company that has integrity and wants to honor the commitments it has made to their customers, is now a "anti-government" company... I see a lot of comments about how "good" this analysis is, to me it seems very weak, and only "good" if you believe the government should be allowed to violate the 4th amendment, should be allowed to obtain any information from anyone at any time, and should be allowed to get SSL Keys from service providers, without disclosing this to the Certificate Authorities and violation of all security agreements with said CA's. If you're very much a "pro" government person then I can see how this "analysis" would meet with your approval. To me it looks like pro-government biased drivel
- Amadou 13y ago
  My impression, as someone who is not a lawyer, is that much of what gets posted to the volokh conspiracy is "pro-process." I think it is entirely reasonable to analyze the situation from the perspective of the law, but it seems like underlying their analysis is that the law is more than just a tool, that it is itself not subject to question. I can understand that from a functional perspective. Challenging the law itself, especially long established law (even if it is being applied to new situations) is a very hard task. But too often (at least for my taste) the writers there seem to bleed that over into the law having some sort of unstated moral stature beyond its utilitarian nature.
  - rayiner 13y ago
    Volokh is not a philosophy site for people to opine about morality. It's a site about law, courts, and lawsuits. These things are all about process. Even when applied to new situations, the job of courts is to implement solutions consisting with existing law and legal norms, not to stray from the law to implement what they see as the more "moral" outcome.
    - thecodeore 13y ago
      If that is their job then they fail miserably
brownbat 13y ago
Footnote, Prof. Kerr literally wrote the book on Computer Crime Law: http://www.amazon.com/Computer-Crime-Law-American-Casebook/dp/0314204547 http://www.amazon.com/Computer-Crime-Law-American-Casebook/d... Not that you should accept his argument without scrutiny, but he's read a few of the cases here.
trauco 13y ago
A lesson of all of this is that encryption without control of the encryption key is, in this brave new world, useless.
segacontroller 13y ago
The SSL key is only for the transport correct? My assumption is that the data in storage would still be encrypted by the customer's private keys. The USG could then obtain the private keys of the customer by watching the decrypted SSL traffic, and is also why the gag order would be very important to the case. I think this is a pretty big misunderstanding by the author of the article.

69 points by CWuestefeld 13y ago

If you s/anti-government/anti-government surveillance/ then I think the article would be considerably improved. Was Lavabit explicitly anti-government?

eli 13y ago
I think that's probably a fair point.... Doesn't seem like it changes any of the legal analysis though. You can't disobey a search warrant because it would be bad for business or because you want to protect the target.
- spydum 13y ago
  I think the primary concern is protecting the other folks who are not the target. Handing over keys allows for the government agency the opportunity to violate other users 4th amendment rights.
  - eli 13y ago
    Sure, I get it, but I don't think you can ignore a subpoena just because you don't trust the government not to abuse it.
    - ganeumann 13y ago
      Well certainly you can, because he did. I think perhaps that's the main point here.
rainsford 13y ago
I'm not sure it makes much of a legal difference, although maybe it might be a more accurate description of Lavabit's viewpoint. But as the article points out, a business model or ideology isn't a basis to challenge court orders or subpoena power...regardless of what it might be.

brymaster 13y ago

Levinson deserves more support than the paltry $90K (https://rally.org/lavabit https://rally.org/lavabit) he's raised so far for his legal defense war chest. I hope he can continue to fight this as he goes up the court of appeals ladder.

thinkcomp 13y ago

Fourth Circuit Court of Appeals docket and documents here: http://www.plainsite.org/flashlight/case.html?id=2524335 http://www.plainsite.org/flashlight/case.html?id=2524335

coldcode 13y ago

There is no hope for us if nothing we hold to be ours is available to any government agent who demands it. A request for a single person is one thing, it only affects that one person. Once the request affects a huge number of unrelated people just to grab that one person it becomes unreasonable. It's like arresting an entire city to catch a single criminal. At some point you have to draw a line. But I wouldn't want to try that argument in front of a Federal Judge much less the Supremes. I doubt this will work.

rayiner 13y ago
Isn't it a technical problem with the service, rather than a legal problem, if the host can't give access to one email account without compromising all users?
- thecodeore 13y ago
  The email encryption was not in play here, from what I understand the end user was the only person with the key to the email "inbox" encryption What is in play here was the SSL Key that is used to encrypt the browser traffic between LB and the user. No differant than the SSL Cert used when you make an online purchase It technologically impossible/impractical to have a separate SSL cert for each user, that is just not how the HTTPS protocall was designed This is not Lavabits doing, that is the work of the Internet Engineering Task Force (IETF)
  - eli 13y ago
    If your landlord only had a master key to all apartments they could use that as a reason to refuse to turn it over for access to one apartment?
    - thecodeore 13y ago
      That is a poor analogy. By turning over the SSL Key the FBI using the Pen Trap Device would capture in real time all data of all users and be decrypting it in real time. Turning over a Master Key to a building would not give the FBI instant access to all apartments simultaneously, nor would they have the ability to go back in time to look at previous data, nor thousands of other problems with this analogy People are attempting to conflate physical keys with encryption keys simply because years ago the mathematicians used the word "keys" as analog to explain things to the general public. This does not mean there is, in reality, any analogous relationship between encryption keys and physical keys

rayiner 13y ago

Argument #1 is really the damning thing for Lavabit. The scope of the subpoena power isn't some new invention of the surveillance state. The quote from U.S. v. Calandra ("the public is entitled to every man's evidence") dates to 1742: http://supreme.justia.com/cases/federal/us/317/424/case.html#F2/1 http://supreme.justia.com/cases/federal/us/317/424/case.html.... It wasn't a new concept then either. The idea of e-mail accounts the government can't access with an appropriate court order is deeply incompatible with how Anglo-American law conceives of the powers of courts. There's a comment by "Jessica Darko" on the linked-to blog that I think warrants addressing. There is a big difference between a "search" for the purposes of the 4th amendment and a subpoena of a third party. Say the government is investigating Bob for tax fraud. It's a "search" subject to 4th amendment protections for the government to break into Bob's house and go through his drawers. It's not a "search" for the government to subpoena his accountant for any relevant financial records. It's a "search" for the government to break into the accountant's office to get those records, but the accountant can't hold up the 4th amendment as a shield against turning over those records pursuant to a court order.

cperciva 13y ago
The problem I see with subpoenaing SSL keys is that they are not, in fact, evidence.
- Amadou 13y ago
  I was hoping to see more discussion on this point. Are there other cases where subpoenas have been issued for tools that enable the gathering of evidence? Has that sort of thing always required a warrant? Is it moot that a warrant was eventually issued? Or was the warrant only issued punitively because Lavabit didn't comply with the subpoena without regard to the validity of the subpoena in the first place?
nullc 13y ago
Should the government be able to order you to give a blood sample so they can pop out a clone of you, which they can then use to impersonate you towards _anyone_, say, your spouse, in order to potentially perform arbitrarily broad collection whos scope they'll hide under the guise of national security? They're not asking for evidence, they order the operator of the service to be complicit in aiding the government in impersonating the service towards all of its users.

RexRollman 13y ago

It was well written. I expect the government will respond with a sad combination of flag waving and fear mongering.

hawkharris 13y ago

Excellent analysis. It's refreshing to see someone dive into the legal issues instead of spewing personal opinions about what the parties should - or should not - have done. I hope that those who critique the author's post will take the same amount of care in researching the law.

thecodeore 13y ago

I believe it is very telling that a pro-privacy company, a company that has integrity and wants to honor the commitments it has made to their customers, is now a "anti-government" company... I see a lot of comments about how "good" this analysis is, to me it seems very weak, and only "good" if you believe the government should be allowed to violate the 4th amendment, should be allowed to obtain any information from anyone at any time, and should be allowed to get SSL Keys from service providers, without disclosing this to the Certificate Authorities and violation of all security agreements with said CA's. If you're very much a "pro" government person then I can see how this "analysis" would meet with your approval. To me it looks like pro-government biased drivel

Amadou 13y ago
My impression, as someone who is not a lawyer, is that much of what gets posted to the volokh conspiracy is "pro-process." I think it is entirely reasonable to analyze the situation from the perspective of the law, but it seems like underlying their analysis is that the law is more than just a tool, that it is itself not subject to question. I can understand that from a functional perspective. Challenging the law itself, especially long established law (even if it is being applied to new situations) is a very hard task. But too often (at least for my taste) the writers there seem to bleed that over into the law having some sort of unstated moral stature beyond its utilitarian nature.
- rayiner 13y ago
  Volokh is not a philosophy site for people to opine about morality. It's a site about law, courts, and lawsuits. These things are all about process. Even when applied to new situations, the job of courts is to implement solutions consisting with existing law and legal norms, not to stray from the law to implement what they see as the more "moral" outcome.
  - thecodeore 13y ago
    If that is their job then they fail miserably

brownbat 13y ago

Footnote, Prof. Kerr literally wrote the book on Computer Crime Law: http://www.amazon.com/Computer-Crime-Law-American-Casebook/dp/0314204547 http://www.amazon.com/Computer-Crime-Law-American-Casebook/d... Not that you should accept his argument without scrutiny, but he's read a few of the cases here.

trauco 13y ago

A lesson of all of this is that encryption without control of the encryption key is, in this brave new world, useless.

segacontroller 13y ago

The SSL key is only for the transport correct? My assumption is that the data in storage would still be encrypted by the customer's private keys. The USG could then obtain the private keys of the customer by watching the decrypted SSL traffic, and is also why the gag order would be very important to the case. I think this is a pretty big misunderstanding by the author of the article.