9 ms·
Lavabit Proceedings Unsealed [pdf]
- linuxhansl 13y agoForm my past posts you'll know that I am critical of government spying and overreaching authority in the bogus name of fighting terrorism. In this case, though, didn't the process work? There is no blanket spying, no action by the executive branch alone. This a court order for a specific case in an ongoing criminal investigation, reviewed and signed by a judge. Isn't that how the system is supposed to work? The executive branch needs to request court order in order to commence surveillance... All checks and balances are in place. If anything, this is good. The government could and did not spy on the user at issue here.
- meowface 13y agoThe problem in this case isn't the request ("we need email records of X user"), the problem is that they requested the private encryption key for the whole website, which would allow them to read the emails of every user.
- res0nat0r 13y agoJust because the more specific requests for individual records were not complied with, and the government resorted to broader mechanisms in its subpoena to get the data it wanted, does not make it illegal.
- MWil 13y agoWhat is the "it" you are referring to? The requests/subpoena? Those can't be illegal, although they can result in illegal actions being taken.
- res0nat0r 13y agoThe gov't asked for specific access to specific account(s), those were not complied with, so they requested that the ssl certs be handed over so that they could get access to the specific individuals they needed. None of this is illegal.
- MWil 13y agoThe govts request was akin to asking for your hidden phone number in a phone book full of hidden phone numbers. On its face it was specific but it could not actually be carried out without generally applying to 400k people.
- res0nat0r 13y agoAgain, a broad request like this is not illegal...
- retrogradeorbit 13y agoThis is true, of course. The dominant power never legislates against its own self interest. And so many of the darkest parts of human history were done legally. The real issue here goes deeper than the law. The thing is, not many people believe a word the government says any-more. This is the government that doesn't "collect" any information on their citizens, doesn't "torture" anyone and so on. The government can make any promises it wants, with no intention of fulfilling them, then claim that the meanings of the words are not what you think they are, but the real meanings are secret, and why they're secret, is secret, and no one can ever know the true meaning lest we all be killed by terrorists. And isn't it funny that the government can't seem to bring itself to find this pen-register information development fee, but there seems to be an infinite line of deficit spending for all kinds of corporate subsidies, bank bailouts, spying equipment and wedding killing drones. The lawyers may argue and the courts may rule, but at the end of the day the core of this apple is rotten. And there's worms in it. Take a bite. It tastes like "freedom".
- malandrew 13y agoI can't understand why it is not illegal by way of being unconstitutional since it clearly tramples on the 4th amendment rights of all the other subscribers. Absent clear mechanisms for watching the watchmen to make sure they not only respecting the 4th amendment rights of the other subscribers, but technically incapable of doing so (in order to mitigate rogue actors that want to impress their superiors via fishing expeditions), I can't see why we should have any reason to believe this information will not be abused. The government, especially the NSA and the FBI (by way of parallel construction), have proven to be outright liars. This alone should be enough for a judge to rule against the right of the government to make such broad requests. The government has be proven guilty of lying here. The burden is now on them to show that they are no longer guilty.
- rayiner 13y agoThe problem was that the site was designed in such a way that there wasn't a key per user.
- MWil 13y agoThe problem with describing that as a problem is that there's no mandated way to operate a business (other than lawfully) Levison didn't design it to make it harder for the govt specifically, he designed it that way to make it stronger for his users as against the rest of the world and would then make exceptions for the govt (which they turned down when he offered to custom-tailor a solution)
- infinity0 13y agoThe problem was that the site was designed in such a way that the user didn't have their own keys. I don't even understand how it got to this stage. Would you rent a house where the landlord had your keys, and you had to call them up for access?
- MagicWishMonkey 13y agoThat is how SSL is meant to work. Do you have your own SSL keys to your banks website? Of course not.
- alexwright 13y agoYou can have a client side key BTW. It's a complete dick to setup and each UA is different so it's really not viable for a product for the unwashed masses. But for something like Lavabit I don't think would be unreasonable.
- MagicWishMonkey 13y agoLadar had a hard enough time making ends meet with the service as it was, adding something like that to the mix would have alienated a huge portion of his userbase. You would think his users would be pretty savvy but he spent lots of time and money walking people through simple tasks like configuring Outlook or Thunderbird to check their email. I'm pretty sure support was his biggest operating expense.
- wmf 13y agoArguably asking for the SSL key is overbroad since it would effect all Lavabit users. But the government only asked for it after Lavabit refused to implement targeted mechanisms in a reasonable way.
- mattkrea 13y agoIf you read in the arguments he is willing to comply with the pen register but the FBI argues that the SSL keys are required for this to function. Based upon my understanding this would mean that the pen register would use the keys and essentially pull a MITM attack on all traffic or the FBI just really doesn't understand that the mail wasn't encrypted once it hit the server and if their pen register functioned after the SSL termination they could get what they wanted without the keys.
- MWil 13y agoTo echo what someone else said, the problem here is when presented with the following scenarios: 1) Levison saying "absolutely, you are entitled to Snowden's contact/header details and I will give it to you within 60 days (or more frequently for more compensation)" vs. 2) The govt saying "not good enough, give us the keys to everything real-time and we promise we won't get his communications content plus we will ignore the other 399,999 subscribers we will have access to". Arguments on pg. 76 describe how this discretion should not be allowed. Also, the govt said it required real-time access which I'm not sure is true - although certainly they would like it. That's why I think they should have compromised with Levison and they would have been granted what they wanted.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- clamprecht 13y agoIt takes a lot of balls to stand up to the US government, under the threat of jail time and huge fines. Full respect to Ladar Levison.
- sneak 13y agoSometimes it's intelligence and perception over and above balls; for many, it is a choice between basic liberty or death. Jail doesn't factor into it. (See weev's sentencing transcript for an example of that to which I refer.)
- malandrew 13y agoI hope weev has access to plenty computing books in prison. I can't imagine being very involved in technology and then be separated from its progress for several years.
- function_seven 13y agoDo you have a link to that transcript? My Googling is failing me at the moment.
- MWil 13y agoIt's only 147 pages. Is this Vol I and II?
- neur0mancer 13y agoscribd link seems to be broken
- popey 13y agoThe cryptome link works. http://cryptome.org/2013/12/lavabit-027.pdf http://cryptome.org/2013/12/lavabit-027.pdf
- goronbjorn 13y agohere's a working alternative: https://view-api.box.com/view/ada33341d065424b9082b629e81a7cdb https://view-api.box.com/view/ada33341d065424b9082b629e81a7c...
- sveiss 13y agoGood catch, thank you! I've just deployed a fix for this.
- MWil 13y ago(commenting as I read along) pg. 11 - Certification of Business Records Thought he was being asked to install trap/trace/whatever by the govt alongside his equipment - might explain why this wasn't filled out/signed. It's not part of his regular business to record all such information.
- MWil 13y agopg. 76 contains the best argument IMO - no discretion being left to the FBI to ONLY retain header/contact details for Snowden's email and not take the keys to the kingdom
- MWil 13y agoSure enough, trap/trace was ordered 18 days after the govt's initial application was approved by the Court
- MWil 13y agoHistorical note: Same federal magistrate that approved trap/trace approved subpoena for Twitter records in Wikileaks investigation in '11
- MWil 13y agoRelated to the Lavabit case (but more generally) I've been working on researching warrant canaries. Order contains language "minimum interference to the services that are accorded persons with respect to whom the installation and use is to take place." Possible canary-busting language as well as NSL-like "shall not disclose trap/trace or investigation" language
- MWil 13y agopg. 30 contains what sounds like a much too broad request for any and all public and private keys for ALL lavabit users including HTTPS sessions and SMTP communications, not just Snowden Actual search warrant is much more narrow to just Snowden, although missing the date before which the warrant must be executed Served in TX on a Thursday to show up for court the next Tuesday AM in VA - gotta love that prep time!
- r00tbeer 13y agoSending the SSL keys to the FBI as a multi-page printout in 4-point font when the government doesn't specify what format it wants is pretty funny. (Page 127 - 137.)
- hdevalence 13y agoWell, except that as I recall, Lavabit didn't use SSL with PFS, so giving the FBI their SSL keys means that all previously-captured ciphertext is decodable.
- MWil 13y agoAlso said "I'm not showing up to court unless you pay me to" - pg. 41 Grand jury subpoena guarantees he would be paid for travel but that subpoena was later withdrawn
- crystaln 13y agoCertainly the FBI could have used some simple OCR to import the key...
- jahfer 13y agoI might be misunderstanding here, but going through the court transcript (p. 49–50), but it sounds like the gov't was entitled to installing a pen register[0] since (replace phone with email/internet): "that because you knowingly expose phone numbers to the phone company when you dial them (you are voluntarily handing over the number so the phone company will connect you, and you know that the numbers you call may be monitored for billing purposes), the Fourth Amendment doesn't protect the privacy of those numbers against pen/trap surveillance by the government." Since all of the network communication happens over SSL though, they are unable to read any of the data going into or out of the network without the encryption keys. Shouldn't they only be able to access what's exposed to the outside network, or are they actually entitled to the unencrypted text, even if that's not available without being inside the connection? Forgive my lack of technical/legal understanding here. [0] https://ssd.eff.org/wire/govt/pen-registers https://ssd.eff.org/wire/govt/pen-registers
- MWil 13y agoThat's a great observation and it depends on how you define "exposed." Since it's technically feasible to capture the information, perhaps even retroactively, it's certainly been sent to a third party (Lavabit) for retention but they have just chosen to voluntarily put blinders on when it comes to that information. So the question is whether it requires actual exposure or exposure in the regular course of business.
- chacham15 13y agoThe problem is that the email is still sent to the address in an unencrypted format. Lavabit, upon receiving an email, then encrypted it. Therefore, Lavabit itself was provided with an unencrypted version of the email. That means that the expectation of privacy does not exist and the government has a right to the information. Or at least, that is the argument that the government puts forth.
- XorNot 13y agoThey're not entitled to the contents of the email because the service can operate without the contents. The service can not operate without the origin and destination details however. That's what pen register metadata is - it's not email contents.
- jcc80 13y agoAmazing to see what a disadvantage citizens are facing when going up against the government. Just reading the transcript you can imagine how anyone without a very experienced (and expensive) attorney would be overwhelmed and not understand what's happening since they're not in their element. Levinson seems to do better than most but it's a rigged game.
- MWil 13y agoI agree. I think he handled it very well all by himself, especially the hearing about the trap/trace that was NOT about the encryption keys where the govt wished to make it all about the keys.
- XorNot 13y agoThis is a silly comment. The same would apply to any individual going up against even a modest patent troll, let alone one of the big tech companies. Individuals are always at a disadvantage compared to any organized group.
- MWil 13y agoNot only is your statement sillier but it misunderstands the point he was trying to make. When you go up against the govt, you're going up against govt players as arbitrator, as opponents, in the govt's house, with rules the govt controls more easily than a citizen. Not even close to a "like any other organized group" comparison.
- Domenic_S 13y agoOr perhaps his comment is exactly the same, which is an even more insidious implication.
- bmelton 13y agoExcept it isn't exactly the same, really. To suggest that the corporations own the courts is for sure popular to say in this day and age, and surely, it's true that their deep pockets offer them an advantage over the average individual, but if the claim were actually true, there would never be judgements / damages / awards issued as the result of lawsuits or class actions. As we know that those types of judgements are awarded, we can easily disprove that corporations own the judicial system.
- wylie 13y agoEven though the name and email of the suspect are redacted, it says that the suspect is being investigated for 18 U.S.C. §§ 641, 793d-e, and 798(a)(3). This is exactly what Edward Snowden was charged under[0]. [0] http://news.rapgenius.com/Hon-john-f-anderson-united-states-of-america-v-edward-j-snowden-criminal-complaint-lyrics#note-1895859 http://news.rapgenius.com/Hon-john-f-anderson-united-states-...
- qoo 13y agoredact fail
- jcalvinowens 13y agoPage 84-85 of the PDF references: "websites that Alba visited" and "the to/from addresses of Alba's E-Mail" Did they forget to redact the suspects name there?
- wylie 13y agoThat looks like a reference to another case, United States vs. Forrester, where Forrester and Alba were the defendants[0]. [0]: http://caselaw.findlaw.com/us-9th-circuit/1496507.html http://caselaw.findlaw.com/us-9th-circuit/1496507.html
- jcalvinowens 13y agoAh, ok.
- deleted 13y ago[deleted]
- MWil 13y agopg. 92 - confirmation that the encryption at least partially foiled the govt attempts to trap/trace at the ISP level (the ISP of Lavabit)
- MWil 13y agopg. 94 - it seems somewhat dishonest of the govt to insist that Levison has not come up with a solution to reveal the information authorized considering Levison offered to build it and requested IMO reasonable compensation to his system to do so
- MWil 13y agopg. 98 - Govt says "just go buy a new $100 SSL cert from GoDaddy when we're done!" LOL
- MWil 13y agopg. 113 - The Court questions the design of Lavabit itself - as in, why should the govt be punished b/c they promised their users would have privacy
- MWil 13y agopg. 115 - Levison's lawyer has trouble arguing his points with the Judge He is trying to make it clear that this is not about a system that was designed to make it hard to get snowden's data in the sense that Levison is actually ever arguing that snowden's data is or should be protected or is difficult to retreive. It only becomes difficult to retreive ONLY snowden's data and that is why the govt should be restrained in its options without violating the privacy of 399k others.
- joering2 13y agoFrom Wikipedia article: Levison objected saying that the key would allow the government to access communications by all 400,000 customers of Lavabit. He also offered to add code to his servers that would provide the information required just for the target of the order. The court rejected this offer since it would require the government to trust Mr. Levison and stated that just because the government could access all customers' communication did not mean they would be legally permitted to do so. This is a CORE of what is wrong with the oppressive system US become. Note that Levison himself did not commit any crime; he simply offered the service to host emails; he was not a criminal but yet court decided that he can't be trusted. This is a core of the problem here. You can be a saint Pope yourself and the Gov will not entrust you, but yet at the same time you have government who on record murder its own people and do things after which you would have not slept for a month, and is given carte blanche type of trust from the judge.
- malandrew 13y agoThe government clearly can't be trusted either. They said they didn't collect information on millions of Americans, which was an outright lie ("least untruthful" statements are still lies). In another comment I proposed a solution where there is a shared, recorded pair programming session where the actual commands to be executed are approved by each side before execution. What I don't know is if such a session could be set up without giving exposing your keys to the system capable of handling the shared session.
- pseingatl 13y agoTo me the most disturbing part of the in camera proceedings was when Levinson asked for the ability to enlist public support and the US Attorney objected--not because it threatened the investigation, but because they didn't want Levinson getting any help. Ultimately Levinson did get help and the case attracted wide attention, but not everyone is so lucky. From a legal perspective I find all the technical "under the hood" arguments fascinating--but the courts don't care. They may care twenty years from now, but they don't care now. The judge has lived with computers since the 1980's and he's talking about phone numbers. Lord have mercy.