7 ms·

Form my past posts you'll know that I am critical of government spying and overreaching authority in the bogus name of fighting terrorism. In this case, though

Form my past posts you'll know that I am critical of government spying and overreaching authority in the bogus name of fighting terrorism. In this case, though, didn't the process work? There is no blanket spying, no action by the executive branch alone. This a court order for a specific case in an ongoing criminal investigation, reviewed and signed by a judge. Isn't that how the system is supposed to work? The executive branch needs to request court order in order to commence surveillance... All checks and balances are in place. If anything, this is good. The government could and did not spy on the user at issue here.

meowface 13y ago
The problem in this case isn't the request ("we need email records of X user"), the problem is that they requested the private encryption key for the whole website, which would allow them to read the emails of every user.
- res0nat0r 13y ago
  Just because the more specific requests for individual records were not complied with, and the government resorted to broader mechanisms in its subpoena to get the data it wanted, does not make it illegal.
  - MWil 13y ago
    What is the "it" you are referring to? The requests/subpoena? Those can't be illegal, although they can result in illegal actions being taken.
    - res0nat0r 13y ago
      The gov't asked for specific access to specific account(s), those were not complied with, so they requested that the ssl certs be handed over so that they could get access to the specific individuals they needed. None of this is illegal.
      - MWil 13y ago
        The govts request was akin to asking for your hidden phone number in a phone book full of hidden phone numbers. On its face it was specific but it could not actually be carried out without generally applying to 400k people.
        res0nat0r 13y ago
        Again, a broad request like this is not illegal...
        retrogradeorbit 13y ago
        This is true, of course. The dominant power never legislates against its own self interest. And so many of the darkest parts of human history were done legally. The real issue here goes deeper than the law. The thing is, not many people believe a word the government says any-more. This is the government that doesn't "collect" any information on their citizens, doesn't "torture" anyone and so on. The government can make any promises it wants, with no intention of fulfilling them, then claim that the meanings of the words are not what you think they are, but the real meanings are secret, and why they're secret, is secret, and no one can ever know the true meaning lest we all be killed by terrorists. And isn't it funny that the government can't seem to bring itself to find this pen-register information development fee, but there seems to be an infinite line of deficit spending for all kinds of corporate subsidies, bank bailouts, spying equipment and wedding killing drones. The lawyers may argue and the courts may rule, but at the end of the day the core of this apple is rotten. And there's worms in it. Take a bite. It tastes like "freedom".
        malandrew 13y ago
        I can't understand why it is not illegal by way of being unconstitutional since it clearly tramples on the 4th amendment rights of all the other subscribers. Absent clear mechanisms for watching the watchmen to make sure they not only respecting the 4th amendment rights of the other subscribers, but technically incapable of doing so (in order to mitigate rogue actors that want to impress their superiors via fishing expeditions), I can't see why we should have any reason to believe this information will not be abused. The government, especially the NSA and the FBI (by way of parallel construction), have proven to be outright liars. This alone should be enough for a judge to rule against the right of the government to make such broad requests. The government has be proven guilty of lying here. The burden is now on them to show that they are no longer guilty.
- rayiner 13y ago
  The problem was that the site was designed in such a way that there wasn't a key per user.
  - MWil 13y ago
    The problem with describing that as a problem is that there's no mandated way to operate a business (other than lawfully) Levison didn't design it to make it harder for the govt specifically, he designed it that way to make it stronger for his users as against the rest of the world and would then make exceptions for the govt (which they turned down when he offered to custom-tailor a solution)
  - infinity0 13y ago
    The problem was that the site was designed in such a way that the user didn't have their own keys. I don't even understand how it got to this stage. Would you rent a house where the landlord had your keys, and you had to call them up for access?
    - MagicWishMonkey 13y ago
      That is how SSL is meant to work. Do you have your own SSL keys to your banks website? Of course not.
      - alexwright 13y ago
        You can have a client side key BTW. It's a complete dick to setup and each UA is different so it's really not viable for a product for the unwashed masses. But for something like Lavabit I don't think would be unreasonable.
        MagicWishMonkey 13y ago
        Ladar had a hard enough time making ends meet with the service as it was, adding something like that to the mix would have alienated a huge portion of his userbase. You would think his users would be pretty savvy but he spent lots of time and money walking people through simple tasks like configuring Outlook or Thunderbird to check their email. I'm pretty sure support was his biggest operating expense.
wmf 13y ago
Arguably asking for the SSL key is overbroad since it would effect all Lavabit users. But the government only asked for it after Lavabit refused to implement targeted mechanisms in a reasonable way.
- mattkrea 13y ago
  If you read in the arguments he is willing to comply with the pen register but the FBI argues that the SSL keys are required for this to function. Based upon my understanding this would mean that the pen register would use the keys and essentially pull a MITM attack on all traffic or the FBI just really doesn't understand that the mail wasn't encrypted once it hit the server and if their pen register functioned after the SSL termination they could get what they wanted without the keys.
MWil 13y ago
To echo what someone else said, the problem here is when presented with the following scenarios: 1) Levison saying "absolutely, you are entitled to Snowden's contact/header details and I will give it to you within 60 days (or more frequently for more compensation)" vs. 2) The govt saying "not good enough, give us the keys to everything real-time and we promise we won't get his communications content plus we will ignore the other 399,999 subscribers we will have access to". Arguments on pg. 76 describe how this discretion should not be allowed. Also, the govt said it required real-time access which I'm not sure is true - although certainly they would like it. That's why I think they should have compromised with Levison and they would have been granted what they wanted.

meowface 13y ago

The problem in this case isn't the request ("we need email records of X user"), the problem is that they requested the private encryption key for the whole website, which would allow them to read the emails of every user.

res0nat0r 13y ago
Just because the more specific requests for individual records were not complied with, and the government resorted to broader mechanisms in its subpoena to get the data it wanted, does not make it illegal.
- MWil 13y ago
  What is the "it" you are referring to? The requests/subpoena? Those can't be illegal, although they can result in illegal actions being taken.
  - res0nat0r 13y ago
    The gov't asked for specific access to specific account(s), those were not complied with, so they requested that the ssl certs be handed over so that they could get access to the specific individuals they needed. None of this is illegal.
    - MWil 13y ago
      The govts request was akin to asking for your hidden phone number in a phone book full of hidden phone numbers. On its face it was specific but it could not actually be carried out without generally applying to 400k people.
      - res0nat0r 13y ago
        Again, a broad request like this is not illegal...
        retrogradeorbit 13y ago
        This is true, of course. The dominant power never legislates against its own self interest. And so many of the darkest parts of human history were done legally. The real issue here goes deeper than the law. The thing is, not many people believe a word the government says any-more. This is the government that doesn't "collect" any information on their citizens, doesn't "torture" anyone and so on. The government can make any promises it wants, with no intention of fulfilling them, then claim that the meanings of the words are not what you think they are, but the real meanings are secret, and why they're secret, is secret, and no one can ever know the true meaning lest we all be killed by terrorists. And isn't it funny that the government can't seem to bring itself to find this pen-register information development fee, but there seems to be an infinite line of deficit spending for all kinds of corporate subsidies, bank bailouts, spying equipment and wedding killing drones. The lawyers may argue and the courts may rule, but at the end of the day the core of this apple is rotten. And there's worms in it. Take a bite. It tastes like "freedom".
        malandrew 13y ago
        I can't understand why it is not illegal by way of being unconstitutional since it clearly tramples on the 4th amendment rights of all the other subscribers. Absent clear mechanisms for watching the watchmen to make sure they not only respecting the 4th amendment rights of the other subscribers, but technically incapable of doing so (in order to mitigate rogue actors that want to impress their superiors via fishing expeditions), I can't see why we should have any reason to believe this information will not be abused. The government, especially the NSA and the FBI (by way of parallel construction), have proven to be outright liars. This alone should be enough for a judge to rule against the right of the government to make such broad requests. The government has be proven guilty of lying here. The burden is now on them to show that they are no longer guilty.
rayiner 13y ago
The problem was that the site was designed in such a way that there wasn't a key per user.
- MWil 13y ago
  The problem with describing that as a problem is that there's no mandated way to operate a business (other than lawfully) Levison didn't design it to make it harder for the govt specifically, he designed it that way to make it stronger for his users as against the rest of the world and would then make exceptions for the govt (which they turned down when he offered to custom-tailor a solution)
- infinity0 13y ago
  The problem was that the site was designed in such a way that the user didn't have their own keys. I don't even understand how it got to this stage. Would you rent a house where the landlord had your keys, and you had to call them up for access?
  - MagicWishMonkey 13y ago
    That is how SSL is meant to work. Do you have your own SSL keys to your banks website? Of course not.
    - alexwright 13y ago
      You can have a client side key BTW. It's a complete dick to setup and each UA is different so it's really not viable for a product for the unwashed masses. But for something like Lavabit I don't think would be unreasonable.
      - MagicWishMonkey 13y ago
        Ladar had a hard enough time making ends meet with the service as it was, adding something like that to the mix would have alienated a huge portion of his userbase. You would think his users would be pretty savvy but he spent lots of time and money walking people through simple tasks like configuring Outlook or Thunderbird to check their email. I'm pretty sure support was his biggest operating expense.

wmf 13y ago

Arguably asking for the SSL key is overbroad since it would effect all Lavabit users. But the government only asked for it after Lavabit refused to implement targeted mechanisms in a reasonable way.

mattkrea 13y ago
If you read in the arguments he is willing to comply with the pen register but the FBI argues that the SSL keys are required for this to function. Based upon my understanding this would mean that the pen register would use the keys and essentially pull a MITM attack on all traffic or the FBI just really doesn't understand that the mail wasn't encrypted once it hit the server and if their pen register functioned after the SSL termination they could get what they wanted without the keys.

MWil 13y ago

To echo what someone else said, the problem here is when presented with the following scenarios: 1) Levison saying "absolutely, you are entitled to Snowden's contact/header details and I will give it to you within 60 days (or more frequently for more compensation)" vs. 2) The govt saying "not good enough, give us the keys to everything real-time and we promise we won't get his communications content plus we will ignore the other 399,999 subscribers we will have access to". Arguments on pg. 76 describe how this discretion should not be allowed. Also, the govt said it required real-time access which I'm not sure is true - although certainly they would like it. That's why I think they should have compromised with Levison and they would have been granted what they wanted.