15 ms·

Why I was forced to shut down Lavabit

806 points by cottonseed 12y ago

danieldk 12y ago
Link to the actual article: http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email http://www.theguardian.com/commentisfree/2014/may/20/why-did...
redthrowaway 12y ago
The original article, which was likely buried due to having 'Snowden' in the title: http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email http://www.theguardian.com/commentisfree/2014/may/20/why-did...
- dang 12y ago
  Thanks to you and danieldk. We changed the url from http://boingboing.net/2014/05/20/kafka-meet-orwell-lavabits.html http://boingboing.net/2014/05/20/kafka-meet-orwell-lavabits.....
- sumedh 12y ago
  > which was likely buried due to having 'Snowden' in the title Can you be more specific?
  - mnem 12y ago
    Perhaps a reference to articles with certain keywords being apparently penalized in the HN rankings: http://www.righto.com/2013/11/how-hacker-news-ranking-really-works.html http://www.righto.com/2013/11/how-hacker-news-ranking-really...
AaronBBrown 12y ago
I was half expecting this to be about Apache Kafka.
auston 12y ago
So what can we do about this as Americans?
- dublinben 12y ago
  Use GPG-encrypted email and decentralized services that won't put people like Levison in jeopardy on behalf of one of their users.
- deelowe 12y ago
  I'm really at a loss. I would say we could vote, but I seriously have visions of the first day of office where tapes of the kennedy assassination are shown in smoke filled rooms or something like that. So few keep their word when they take office, it seems impossible to pick the right candidate.
- davidw 12y ago
  Here are a few things: * Call - don't email - call your representatives and express, politely, the fact that this kind of thing is Not OK. Writing a letter on paper is good too, apparently. Stop reading and do this now. * Donate money to groups like the EFF. * Volunteer with groups like the EFF. * Use and support stuff like GPG. * Don't bitch and moan about "woe is us, it's impossible". That only makes it easier for those who would deny us our rights. * This will be a difficult, and quite likely drawn-out struggle. Don't give up. Keep working at it.
  - akerl_ 12y ago
    What would I be calling to tell them? That the government shouldn't be able to, through proper channels, obtain a warrant requesting specific named information regarding an investigation of a specific individual for things that violate US law? If we disagree with the laws, ok: protest for legal reform. If we disagree with the things revealed by Snowden, ok: protest that. But what happened to Lavabit was the government behaving properly: they obtained a narrow warrant for specifically the data they needed as part of their investigation, they tried to work with Levison to fulfill the warrant, and only after days of being stonewalled did they escalate to ensure compliance.
liquidise 12y ago
This article, which simply confirms what many speculated took place with Lavabit, makes my blood boil. I don't know what is worse: this specific technology instance, or the idea that similar instances have existed for some time. Either way i find then entire paradigm infuriating and undermining to our supposed liberties.
- saraid216 12y ago
  I'm unclear what new information was presented in this article? Hasn't Levison said all of this before?
  - aroch 12y ago
    He's never laid out the timeline of events or why/how he was found in contempt.
S_A_P 12y ago
This is truly maddening stuff. I applaud the guardian for running this...
deleted 12y ago
[deleted]
biotech 12y ago
Is there an open-source, decentralized service that can be used for encrypted email? Something like that could be much more difficult to compromise.
- jordigh 12y ago
  Bitcoin is one such thing. Well, not the bitcoin protocol directly, but the basic idea of a block chain can be used for many interesting things, such as decentralised encrypted communication.
- aliakbarkhan 12y ago
  Why trust it to a service? Encrypt it yourself.
  - cortesoft 12y ago
    You will need your recipients to also decrypt it themselves, then. And handle your own key-exchanging. Not trivial, if you want to be able to email lots of people.
- ixwt 12y ago
  Like Bitmessage? https://bitmessage.org/wiki/Main_Page https://bitmessage.org/wiki/Main_Page
  - nhayden 12y ago
    Bitmessage is a beautiful concept but I've read many people having concerns over several aspects of how secure it really is. I hope the entire web one day works on a similar model.
- rakoo 12y ago
  Any email provider (even yourself !) can be used with GPG to encrypt the content of your emails and have good privacy. Try Thunderbird with Enigmail. This is notoriously known for not encrypting metadata, though, which is impossible because this very metadata is used to make email actually work.
pdknsk 12y ago
> My company, Lavabit, provided email services to 410,000 people – including Edward Snowden, according to news reports – [...]. Does he write "according to news reports" for legal reasons? Obviously he should know, I think. > The government argued that, since the "inspection" of the data was to be carried out by a machine, they were exempt from the normal search-and-seizure protections of the Fourth Amendment. That's insane.
- innoying 12y ago
  Plausible deniability.
- mpyne 12y ago
  > > The government argued that, since the "inspection" of the data was to be carried out by a machine, they were exempt from the normal search-and-seizure protections of the Fourth Amendment. > That's insane. It's also immaterial. In this case DOJ got an Article III warrant (if not several), which was specific in what was to be seized. This is the system that Snowden claimed to be trying to defend by revealing "warrantless wiretapping" working exactly as designed. DOJ got a warrant for the exact thing they wanted, and all of sudden Constitutional separation of powers became inconvenient to Levison (even though he complied with such warrants before, and eventually offered to comply in this case for cash).
  - higherpurpose 12y ago
    Still interesting to see how they think about it.
- dredmorbius 12y ago
  He may not have known. It's quite possible for a company to provide services to customers it can't explicitly identify. Rather common, in fact. Levison might still be gagged from disclosing certain information he knows personally or which was disclosed by government requests for data. In which case, pointing to an external source of verification could provide him with legal cover. Consider it the equivalent, if you will, of parallel construction. Knowledge acquired via one route cannot be disclosed unless you can point to an independent path to coming by that information. Though the nondisclosable means might inform your search for unencumbered sources.
rrggrr 12y ago
I just donated $25 to the EFF. I hope everyone else will do the same or more.
- ommunist 12y ago
  This will not return Lavabit back to business, I am afraid. But it will definitely help to raise awareness among users about their rights. Unfortunately, the topic article shows very well, that US government can easily seize your actual rights, despite your high awareness.
pekk 12y ago
This again? Lavabit was forced to shut because of the way it was implemented, and its proprietor has been cashing in on that design flaw ever since. There is no reason why complying with one search warrant should EVER require disclosure of the SSL cert for the whole domain, or any other disclosure sufficient to read data from customers other than the one covered by the warrant. But this is just what everyone claimed when Lavabit was closing. If you build a business on selling security to people and you make such a mistake in the design of your software, you failed to deliver what you promised to your customers and you deserve to fail. And not get bailed out because you thumped your chest about having to service search warrants when you chose to set up in US jurisdiction. If you don't want to be obligated to comply with lawful US requests like search warrants then don't set up in the US.
- lifeisstillgood 12y ago
  It seems a little much to blame lavabit for sitting in the USA with its constitutional protections of free speech and privacy, and suggest it should set up in say a offshore banking haven, few of which have constitutions and a couple have dictatorial-like powers. Additionally can you explain how he got the architecture "wrong"? Edit: Précis of the architecture of Lavabit from http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/ Lavabit kept your private key on their server, but encrypted it with your plaintext password which you sent them if you wanted to read your mail. That's pretty rubbish in many ways as the article rather even handey points out. A sentiment I am agreeing with - we applaud him for standing up, not for being perfect.
  - sandstrom 12y ago
    While I agree with your comment, one could note that there are non-US alternatives that are not offshore banking havens. I'd guess that Switzerland, Sweden and Germany would (probably) all have provided a better judicial environment.
    - ceejayoz 12y ago
      > I'd guess that Switzerland, Sweden and Germany would (probably) all have provided a better judicial environment. The downside, though, is the NSA having freer reign there.
tptacek 12y ago
This summary is probably misleading. A different perspective on the facts of this case is on display in the 4th Circuit ruling on Levison's contempt charges: https://s3.amazonaws.com/s3.documentcloud.org/documents/1114251/lavabit-usca4-op.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/1114... In short: Levison claims that the DOJ demanded access to the content of all his users messages, and implies that after he complied with that order, they escalated to demand his TLS keys. But that doesn't seem to be what happened. A fuller timeline of Lavabit might (please correct me) look like this: t-n..t: Levison complies with numerous court orders demanding information about users of Lavabit. t: Levison is served with a court order demanding the metadata associated with Snowden. It is unclear whether this demand is actuated by a device that DOJ mandates installation of, but what is clear is that there was a debate between Levison and the DOJ about Levison's capabilities w/r/t/ furnishing the DOJ with information about Snowden's account. t+1: Levison refuses to comply with the DOJ order, while indicating that he has the technical capacity to comply with at least some of it. t+2: DOJ escalates with a magistrate court order requiring that Lavabit use its technical capabilities to defeat its encryption of Snowden's information --- a capability that Levison acknowledges having, that is obvious from the design of Lavabit, and that has a precedent in other "secure" email providers. t+2..t+13: Levison spends 11 days stonewalling DOJ, refusing not only to comply with the order but also to meet with the DOJ. Per the 4th Circuit: "As each day passed, the Government lost forever the ability to collect the target-related data for that day.". Levison is playing chicken, and DOJ is now furious. t+13: DOJ arranges to compel Levison to appear at a district court hearing, while reiterating that it requires only the metadata information surrounding Snowden's account. t+14..t+17: Levison delays 4 more days. t+17: Levison, via his attorneys, replies to the DOJ's order with a counterproposal that involves billing DOJ for his time, collecting a limited set of information, and furnishing it to DOJ only at the conclusion of the entire collection period. t+20: DOJ, furious and contending that they've lost all reasonable faith in Levison's cooperation with their investigation, demands the TLS keys for Lavabit in order that they can control the collection of the data they need from Lavabit. Again: please correct details here where I'm wrong. Most readers of this thread will have enormous sympathy for Levison and his efforts to stymie the DOJ's investigation of Snowden through his account on Lavabit. However, a jaundiced, cynical, or purely pragmatic reader might also find grave flaws in Levison's response to this situation. His position on the matter does not appear to have been content-neutral: he complied with previous orders. More importantly, when an order came in for an account he had a personal interest in, he escalated matters so that DOJ would end up compromising everyone's information, by playing a game of chicken he was sure to lose.
primitivesuave 12y ago
I applaud Ladar for making the right choice on this one. On one hand, there's a lot of skepticism about an email service whose security breaks as soon as the private keys are stolen. On the other hand, assuming Ladar is a smart individual who knows how to securely store the keys (he is), he couldn't possibly have foreseen that the government would embroil him in a cat-and-mouse game.
- akerl_ 12y ago
  Storing the private keys that decrypt the emails you're telling your users cannot be decrypted doesn't seem very secure. The whole sales pitch Lavabit used was provably false, and for him to not foresee private key compromise on his servers would be remarkably shortsighted.
  - gknoy 12y ago
    Imagine what we'd have said if the keys had been compromised with Heartbleed.
    - floody-berry 12y ago
      He probably would've been called dishonest and accused of peddling snake oil. That whole conversation was, fortunately for him, buried under the "government is going crazy with power!!" story; he's a nerd hero who is sticking it to the man instead of just another crypto shyster.
- DanBC 12y ago
  > he couldn't possibly have foreseen that the government would embroil him in a cat-and-mouse game. Don't market it as a secure system then. Sell it as something that gives moderate privacy to people who are not accused of breaking laws. The public needs better understanding of risk assessment and people selling insecure products as super secure does not help anyone.
deleted 12y ago
[deleted]
3327 12y ago
This is fucked up. This type of court due process is not America. That being said Snowden is a Russian pawn and traitor but thats another matter. Regardless of what might be the case even if its sealed there needs to be a process that allows fairness. "search" needs to be well defined its pretty general when it comes to software and tech and can be interpreted any way you want. Perhaps time for some digital legislation?
- jacquesm 12y ago
  I highly doubt Snowden would be in Russia Today (pun intended) if he had had confidence in the American legal system not being out to enact revenge rather than punishment. Snowden is in most of the rest of the world and good part of the United States considered to be more of a hero than a traitor, and he only became a temporary resident of Russia after the fact. If not for some political manoeuvring he would likely be somewhere else, such as Latin America.
  - ommunist 12y ago
    Russia Today is enemy to America Tomorrow (and vice versa). What is unique to current Cold War 2.0 situation is that Russians like me can communicate to Westerners like you not being afraid of punishment. By the way I doubt Snowden receives any permanent residency in Russia. In fact he legally cannot do that, except asking for political asylum. He was only granted 1-year temporary asylum in Russia and will be extradited from Russia in August this year.
    - jacquesm 12y ago
      I wouldn't put it past our esteemed politicians to make backroom deals about stuff like this. Something along the lines of 'we need a new enemy, this terrorism thing is running out, how about a cold-war light?', 'let me get on the horn with Putin and see what he thinks about it...'. I like Russians, have some Ukrainian friends and have spent a good part of my life behind where the former iron curtain used to be. So my perspective is probably quite warped. Putin and his band of cronies are effectively still doing exactly what the communist fat cats were doing, now you have he mafia to worry about instead of the authorities (that may be a couple of years out of date). It's funny how everything changes and yet, the basics are still the same. Real change takes a long time.
room271 12y ago
I submitted this link 6 hours before the OP but it didn't gain much traction. I though Hacker News had a way to prevent double submissions? https://news.ycombinator.com/item?id=7772074 https://news.ycombinator.com/item?id=7772074
- kristianp 12y ago
  Normally you'll find that the urls are slightly different, but in this case they are exactly the same, which is strange.
- gus_massa 12y ago
  Someone send a blog post about the article and later dang changed the link to the original article: https://news.ycombinator.com/item?id=7774398 https://news.ycombinator.com/item?id=7774398
- randac 12y ago
  You shouldn't have put 'Snowden' in the title. Which is pretty retarded but hey, HN.
agarwaltejas 12y ago
One doubt which I have is what if the servers are moved outside the United States to any other country? Would the agents still have rights to get access to it?
- dredmorbius 12y ago
  Not via the US legal system. The US might be able to influence processes elsewhere. However agents wouldn't be restricted by US laws and regulations either: they could simply operate to obtain the access they felt necessary to acquire the information they sought. One of the scariest things about state surveillance actors isn't their capabilities (though in the case of the NSA and a few similar agencies elsewhere this is no doubt substantial), but their impunity. In the US, under very, very broad provisions of the so-called USA-PATRIOT Act, access to tremendous amounts of data on virtually the entire population is provided, with full legal cover. Outside the US, legal cover is reduced, but so are legal restrictions. Agents can operate with reasonably little personal risk via electronic means to gain access, or interdict and retool equipment if sufficient backdoors don't already exist.
superduper33 12y ago
Careface. If you don't like the laws here, GTFO of the country.
- neurobro 12y ago
  I presume you're directing this at all of the domestic enemies of the Constitution working for various levels of government, who treat the highest law of the land as an inconvenience that must be circumvented and eroded away.
  - aaronem 12y ago
    To regard the Constitution as "the highest law of the land" is, at this point in the history of the United States, somewhere between naïve and just plain silly. The actual highest law of the land is that made by Supreme Court fiat, when they rule on the cases which they choose to hear, and whose rulings no man may practicably gainsay. Below that there are many levels of law, arranged in the sort of untidy and inter-referential tangle which any software engineer might expect out of a system that's been being patched and extended for two centuries straight; if we take the increasingly vestigial federal/state/local distinction as our demarcation, Congress occupies much of the lower half of the upper third. And, of course, at every level, and just as at all other times and places throughout the entire broad span of human history, the basic rule is that what's legal is what you get away with. Is this how the matter ought to be? Perhaps, and perhaps not; I've seen arguments both ways. But, either way, this is how the matter is.
arcolife 12y ago
For all those looking for an encrypted email service, take a look at https://protonmail.ch/ https://protonmail.ch/
listic 12y ago
So, the encrypted email is illegal in the USA. Is accessing the Internet over VPN legal? Pardon my ignorance, I am new to the issues of encryption and privacy. Always assumed I can worry about it later, but the time has come at last. About time, when my native country is enforcing the laws that permit internet censorship an increasingly wide scale. http://en.wikipedia.org/wiki/Russian_Internet_blacklist http://en.wikipedia.org/wiki/Russian_Internet_blacklist
- ds9 12y ago
  It's not exactly illegal, and the new secret-orders tactics are the government's workaround. In the 1990s there was a series of political/legal conflicts over encryption, which was about to go mainstream (the whole episode is now referred to as the "clipper chip" controversy). The USG wanted strong encryption without backdoors banned, and everyone to use instead a set of encryption protocols which would have provided keys for the government (the "key escrow" idea), and the USG would promise not to abuse the power to decrypt everyone's communications. Some heroic technical people worked around that and actually exported what eventually became PGP/GPG on paper to take advantage of a loophole in the ban. The controversy faded and the civilian right to non-backdoored, strong encryption became the nominal law and policy. Since then the USG has been working to undo and reverse this situation by any means it can find. What it's come up with is (a) the NSA mass-wiretapping regime (actually a continuation Echelon and several other prior, longstanding mass-surveillance schemes) and (b) the set of legal tools applied to Lavabit. And they've mostly succeeded. Secure communication is theoretically legal, but if the government can coerce encryption keys, secure communication is defacto subject to being stopped anytime the government takes an interest in someone. And while providing secure comms as a service is technically still legal, if the feds can demand a combination of trojaning the service and concealment of the subversion from users, then they have effectively banned secure communications in practice, while maintaining the written law as-is.
tom_jones 12y ago
It reads like a an unbelievable chapter from Orwell's 1984, and it occurred in the United States of America, the oft stated bastion of democracy. At every possible opportunity resistance was stymied, with the presumption that the will to resist would eventually collapse. They lost because they never once contemplated the possibility of you being willing to shut down your business because of your principles, something they couldn't fathom or conceive of, since such a concept is anathema to their wholly illegal and unconstitutional activities.
roma1n 12y ago
I wonder if the Lavabit author would be amenable to e.g. a kickstarted with the goals of - open-sourcing lavabit - making it ready for instant deployment e.g. using Docker A kind of "just add a VPS" platform...
jokoon 12y ago
what would have happened if he just decided to delete snowden's mails and account to save his company ?
- ds9 12y ago
  Deleting the emails would have put Levison/Lavabit in violation of long-established law (destruction of evidence is a crime). Note that with PFS (if I recall correctly, Lavabit did not use PFS), preserving past emails does not help the adversary. Deleting the account, however, seems much more viable for similar situations. Forcing a company (like Lavabit) to provide service to an individual might be supportable, based in part on past precedents to do with race discrimination and general regulation-of-business principles, but would be unprecedented in regard to a non-commercial entity. Arguably it would run afoul of the 13th Amendment in the US. Of course, written law has little bearing on what the government can do in practice in today's USA.
retrogradeorbit 12y ago
Kafka's parable of the law: https://www.youtube.com/watch?v=rfkxKkrPZPQ https://www.youtube.com/watch?v=rfkxKkrPZPQ
h1karu 12y ago
Why would any privacy related service provider operate within the United States of America ? It's one of the worst jurisdictions for that kind of thing. To me that makes no sense whatsoever, so this start-up was doomed from the very onset.
gdonelli 12y ago
Respect!
hellbreakslose 12y ago
May the force be with us!
ommunist 12y ago
Following guelo. I agree - Levinson is a hero. I am almost sure he is the last American hero. Once the US citizens loose their right to privacy, they will not be able to produce such heroes anymore as a nation, and will transform to something like complacent Russians (who lost their rights to privacy much, much earlier).
eyeareque 12y ago
This sounds like something you'd hear about in a communist country. We are in a lot of troue if we don't do so drying about what our government is trying to do. Eric Snowden and Lavabit are two examples of people who will be seen as heroes in the future.
- Eye_of_Mordor 12y ago
  China already sees the US as a place with less respect for human rights than they do, so in some ways, the US is worse than a communist country.
erjjones 12y ago
Open Source your code and the community will help you see it a reality
snambi 12y ago
Overall this is not good. Sure, the govt can do what they want. But what useful information they got from these emails? Did it make the country safer? Did it make the world a better place? Using the law is one thing. Using the law for the intended purpose is a different thing. Not sure whether the law is really used for the right purpose.

806 points by cottonseed 12y ago

Link to the actual article: http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email http://www.theguardian.com/commentisfree/2014/may/20/why-did...

redthrowaway 12y ago

The original article, which was likely buried due to having 'Snowden' in the title: http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email http://www.theguardian.com/commentisfree/2014/may/20/why-did...

dang 12y ago
Thanks to you and danieldk. We changed the url from http://boingboing.net/2014/05/20/kafka-meet-orwell-lavabits.html http://boingboing.net/2014/05/20/kafka-meet-orwell-lavabits.....
sumedh 12y ago
> which was likely buried due to having 'Snowden' in the title Can you be more specific?
- mnem 12y ago
  Perhaps a reference to articles with certain keywords being apparently penalized in the HN rankings: http://www.righto.com/2013/11/how-hacker-news-ranking-really-works.html http://www.righto.com/2013/11/how-hacker-news-ranking-really...

AaronBBrown 12y ago

I was half expecting this to be about Apache Kafka.

auston 12y ago

So what can we do about this as Americans?

dublinben 12y ago
Use GPG-encrypted email and decentralized services that won't put people like Levison in jeopardy on behalf of one of their users.
deelowe 12y ago
I'm really at a loss. I would say we could vote, but I seriously have visions of the first day of office where tapes of the kennedy assassination are shown in smoke filled rooms or something like that. So few keep their word when they take office, it seems impossible to pick the right candidate.
davidw 12y ago
Here are a few things: * Call - don't email - call your representatives and express, politely, the fact that this kind of thing is Not OK. Writing a letter on paper is good too, apparently. Stop reading and do this now. * Donate money to groups like the EFF. * Volunteer with groups like the EFF. * Use and support stuff like GPG. * Don't bitch and moan about "woe is us, it's impossible". That only makes it easier for those who would deny us our rights. * This will be a difficult, and quite likely drawn-out struggle. Don't give up. Keep working at it.
- akerl_ 12y ago
  What would I be calling to tell them? That the government shouldn't be able to, through proper channels, obtain a warrant requesting specific named information regarding an investigation of a specific individual for things that violate US law? If we disagree with the laws, ok: protest for legal reform. If we disagree with the things revealed by Snowden, ok: protest that. But what happened to Lavabit was the government behaving properly: they obtained a narrow warrant for specifically the data they needed as part of their investigation, they tried to work with Levison to fulfill the warrant, and only after days of being stonewalled did they escalate to ensure compliance.

liquidise 12y ago

This article, which simply confirms what many speculated took place with Lavabit, makes my blood boil. I don't know what is worse: this specific technology instance, or the idea that similar instances have existed for some time. Either way i find then entire paradigm infuriating and undermining to our supposed liberties.

saraid216 12y ago
I'm unclear what new information was presented in this article? Hasn't Levison said all of this before?
- aroch 12y ago
  He's never laid out the timeline of events or why/how he was found in contempt.

S_A_P 12y ago

This is truly maddening stuff. I applaud the guardian for running this...

deleted 12y ago

[deleted]

biotech 12y ago

Is there an open-source, decentralized service that can be used for encrypted email? Something like that could be much more difficult to compromise.

jordigh 12y ago
Bitcoin is one such thing. Well, not the bitcoin protocol directly, but the basic idea of a block chain can be used for many interesting things, such as decentralised encrypted communication.
aliakbarkhan 12y ago
Why trust it to a service? Encrypt it yourself.
- cortesoft 12y ago
  You will need your recipients to also decrypt it themselves, then. And handle your own key-exchanging. Not trivial, if you want to be able to email lots of people.
ixwt 12y ago
Like Bitmessage? https://bitmessage.org/wiki/Main_Page https://bitmessage.org/wiki/Main_Page
- nhayden 12y ago
  Bitmessage is a beautiful concept but I've read many people having concerns over several aspects of how secure it really is. I hope the entire web one day works on a similar model.
rakoo 12y ago
Any email provider (even yourself !) can be used with GPG to encrypt the content of your emails and have good privacy. Try Thunderbird with Enigmail. This is notoriously known for not encrypting metadata, though, which is impossible because this very metadata is used to make email actually work.

pdknsk 12y ago

> My company, Lavabit, provided email services to 410,000 people – including Edward Snowden, according to news reports – [...]. Does he write "according to news reports" for legal reasons? Obviously he should know, I think. > The government argued that, since the "inspection" of the data was to be carried out by a machine, they were exempt from the normal search-and-seizure protections of the Fourth Amendment. That's insane.

innoying 12y ago
Plausible deniability.
mpyne 12y ago
> > The government argued that, since the "inspection" of the data was to be carried out by a machine, they were exempt from the normal search-and-seizure protections of the Fourth Amendment. > That's insane. It's also immaterial. In this case DOJ got an Article III warrant (if not several), which was specific in what was to be seized. This is the system that Snowden claimed to be trying to defend by revealing "warrantless wiretapping" working exactly as designed. DOJ got a warrant for the exact thing they wanted, and all of sudden Constitutional separation of powers became inconvenient to Levison (even though he complied with such warrants before, and eventually offered to comply in this case for cash).
- higherpurpose 12y ago
  Still interesting to see how they think about it.
dredmorbius 12y ago
He may not have known. It's quite possible for a company to provide services to customers it can't explicitly identify. Rather common, in fact. Levison might still be gagged from disclosing certain information he knows personally or which was disclosed by government requests for data. In which case, pointing to an external source of verification could provide him with legal cover. Consider it the equivalent, if you will, of parallel construction. Knowledge acquired via one route cannot be disclosed unless you can point to an independent path to coming by that information. Though the nondisclosable means might inform your search for unencumbered sources.

rrggrr 12y ago

I just donated $25 to the EFF. I hope everyone else will do the same or more.

ommunist 12y ago
This will not return Lavabit back to business, I am afraid. But it will definitely help to raise awareness among users about their rights. Unfortunately, the topic article shows very well, that US government can easily seize your actual rights, despite your high awareness.

pekk 12y ago

This again? Lavabit was forced to shut because of the way it was implemented, and its proprietor has been cashing in on that design flaw ever since. There is no reason why complying with one search warrant should EVER require disclosure of the SSL cert for the whole domain, or any other disclosure sufficient to read data from customers other than the one covered by the warrant. But this is just what everyone claimed when Lavabit was closing. If you build a business on selling security to people and you make such a mistake in the design of your software, you failed to deliver what you promised to your customers and you deserve to fail. And not get bailed out because you thumped your chest about having to service search warrants when you chose to set up in US jurisdiction. If you don't want to be obligated to comply with lawful US requests like search warrants then don't set up in the US.

lifeisstillgood 12y ago
It seems a little much to blame lavabit for sitting in the USA with its constitutional protections of free speech and privacy, and suggest it should set up in say a offshore banking haven, few of which have constitutions and a couple have dictatorial-like powers. Additionally can you explain how he got the architecture "wrong"? Edit: Précis of the architecture of Lavabit from http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/ Lavabit kept your private key on their server, but encrypted it with your plaintext password which you sent them if you wanted to read your mail. That's pretty rubbish in many ways as the article rather even handey points out. A sentiment I am agreeing with - we applaud him for standing up, not for being perfect.
- sandstrom 12y ago
  While I agree with your comment, one could note that there are non-US alternatives that are not offshore banking havens. I'd guess that Switzerland, Sweden and Germany would (probably) all have provided a better judicial environment.
  - ceejayoz 12y ago
    > I'd guess that Switzerland, Sweden and Germany would (probably) all have provided a better judicial environment. The downside, though, is the NSA having freer reign there.

tptacek 12y ago

This summary is probably misleading. A different perspective on the facts of this case is on display in the 4th Circuit ruling on Levison's contempt charges: https://s3.amazonaws.com/s3.documentcloud.org/documents/1114251/lavabit-usca4-op.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/1114... In short: Levison claims that the DOJ demanded access to the content of all his users messages, and implies that after he complied with that order, they escalated to demand his TLS keys. But that doesn't seem to be what happened. A fuller timeline of Lavabit might (please correct me) look like this: t-n..t: Levison complies with numerous court orders demanding information about users of Lavabit. t: Levison is served with a court order demanding the metadata associated with Snowden. It is unclear whether this demand is actuated by a device that DOJ mandates installation of, but what is clear is that there was a debate between Levison and the DOJ about Levison's capabilities w/r/t/ furnishing the DOJ with information about Snowden's account. t+1: Levison refuses to comply with the DOJ order, while indicating that he has the technical capacity to comply with at least some of it. t+2: DOJ escalates with a magistrate court order requiring that Lavabit use its technical capabilities to defeat its encryption of Snowden's information --- a capability that Levison acknowledges having, that is obvious from the design of Lavabit, and that has a precedent in other "secure" email providers. t+2..t+13: Levison spends 11 days stonewalling DOJ, refusing not only to comply with the order but also to meet with the DOJ. Per the 4th Circuit: "As each day passed, the Government lost forever the ability to collect the target-related data for that day.". Levison is playing chicken, and DOJ is now furious. t+13: DOJ arranges to compel Levison to appear at a district court hearing, while reiterating that it requires only the metadata information surrounding Snowden's account. t+14..t+17: Levison delays 4 more days. t+17: Levison, via his attorneys, replies to the DOJ's order with a counterproposal that involves billing DOJ for his time, collecting a limited set of information, and furnishing it to DOJ only at the conclusion of the entire collection period. t+20: DOJ, furious and contending that they've lost all reasonable faith in Levison's cooperation with their investigation, demands the TLS keys for Lavabit in order that they can control the collection of the data they need from Lavabit. Again: please correct details here where I'm wrong. Most readers of this thread will have enormous sympathy for Levison and his efforts to stymie the DOJ's investigation of Snowden through his account on Lavabit. However, a jaundiced, cynical, or purely pragmatic reader might also find grave flaws in Levison's response to this situation. His position on the matter does not appear to have been content-neutral: he complied with previous orders. More importantly, when an order came in for an account he had a personal interest in, he escalated matters so that DOJ would end up compromising everyone's information, by playing a game of chicken he was sure to lose.

primitivesuave 12y ago

I applaud Ladar for making the right choice on this one. On one hand, there's a lot of skepticism about an email service whose security breaks as soon as the private keys are stolen. On the other hand, assuming Ladar is a smart individual who knows how to securely store the keys (he is), he couldn't possibly have foreseen that the government would embroil him in a cat-and-mouse game.

akerl_ 12y ago
Storing the private keys that decrypt the emails you're telling your users cannot be decrypted doesn't seem very secure. The whole sales pitch Lavabit used was provably false, and for him to not foresee private key compromise on his servers would be remarkably shortsighted.
- gknoy 12y ago
  Imagine what we'd have said if the keys had been compromised with Heartbleed.
  - floody-berry 12y ago
    He probably would've been called dishonest and accused of peddling snake oil. That whole conversation was, fortunately for him, buried under the "government is going crazy with power!!" story; he's a nerd hero who is sticking it to the man instead of just another crypto shyster.
DanBC 12y ago
> he couldn't possibly have foreseen that the government would embroil him in a cat-and-mouse game. Don't market it as a secure system then. Sell it as something that gives moderate privacy to people who are not accused of breaking laws. The public needs better understanding of risk assessment and people selling insecure products as super secure does not help anyone.

deleted 12y ago

[deleted]

3327 12y ago

This is fucked up. This type of court due process is not America. That being said Snowden is a Russian pawn and traitor but thats another matter. Regardless of what might be the case even if its sealed there needs to be a process that allows fairness. "search" needs to be well defined its pretty general when it comes to software and tech and can be interpreted any way you want. Perhaps time for some digital legislation?

jacquesm 12y ago
I highly doubt Snowden would be in Russia Today (pun intended) if he had had confidence in the American legal system not being out to enact revenge rather than punishment. Snowden is in most of the rest of the world and good part of the United States considered to be more of a hero than a traitor, and he only became a temporary resident of Russia after the fact. If not for some political manoeuvring he would likely be somewhere else, such as Latin America.
- ommunist 12y ago
  Russia Today is enemy to America Tomorrow (and vice versa). What is unique to current Cold War 2.0 situation is that Russians like me can communicate to Westerners like you not being afraid of punishment. By the way I doubt Snowden receives any permanent residency in Russia. In fact he legally cannot do that, except asking for political asylum. He was only granted 1-year temporary asylum in Russia and will be extradited from Russia in August this year.
  - jacquesm 12y ago
    I wouldn't put it past our esteemed politicians to make backroom deals about stuff like this. Something along the lines of 'we need a new enemy, this terrorism thing is running out, how about a cold-war light?', 'let me get on the horn with Putin and see what he thinks about it...'. I like Russians, have some Ukrainian friends and have spent a good part of my life behind where the former iron curtain used to be. So my perspective is probably quite warped. Putin and his band of cronies are effectively still doing exactly what the communist fat cats were doing, now you have he mafia to worry about instead of the authorities (that may be a couple of years out of date). It's funny how everything changes and yet, the basics are still the same. Real change takes a long time.

room271 12y ago

I submitted this link 6 hours before the OP but it didn't gain much traction. I though Hacker News had a way to prevent double submissions? https://news.ycombinator.com/item?id=7772074 https://news.ycombinator.com/item?id=7772074

kristianp 12y ago
Normally you'll find that the urls are slightly different, but in this case they are exactly the same, which is strange.
gus_massa 12y ago
Someone send a blog post about the article and later dang changed the link to the original article: https://news.ycombinator.com/item?id=7774398 https://news.ycombinator.com/item?id=7774398
randac 12y ago
You shouldn't have put 'Snowden' in the title. Which is pretty retarded but hey, HN.

agarwaltejas 12y ago

One doubt which I have is what if the servers are moved outside the United States to any other country? Would the agents still have rights to get access to it?

dredmorbius 12y ago
Not via the US legal system. The US might be able to influence processes elsewhere. However agents wouldn't be restricted by US laws and regulations either: they could simply operate to obtain the access they felt necessary to acquire the information they sought. One of the scariest things about state surveillance actors isn't their capabilities (though in the case of the NSA and a few similar agencies elsewhere this is no doubt substantial), but their impunity. In the US, under very, very broad provisions of the so-called USA-PATRIOT Act, access to tremendous amounts of data on virtually the entire population is provided, with full legal cover. Outside the US, legal cover is reduced, but so are legal restrictions. Agents can operate with reasonably little personal risk via electronic means to gain access, or interdict and retool equipment if sufficient backdoors don't already exist.

superduper33 12y ago

Careface. If you don't like the laws here, GTFO of the country.

neurobro 12y ago
I presume you're directing this at all of the domestic enemies of the Constitution working for various levels of government, who treat the highest law of the land as an inconvenience that must be circumvented and eroded away.
- aaronem 12y ago
  To regard the Constitution as "the highest law of the land" is, at this point in the history of the United States, somewhere between naïve and just plain silly. The actual highest law of the land is that made by Supreme Court fiat, when they rule on the cases which they choose to hear, and whose rulings no man may practicably gainsay. Below that there are many levels of law, arranged in the sort of untidy and inter-referential tangle which any software engineer might expect out of a system that's been being patched and extended for two centuries straight; if we take the increasingly vestigial federal/state/local distinction as our demarcation, Congress occupies much of the lower half of the upper third. And, of course, at every level, and just as at all other times and places throughout the entire broad span of human history, the basic rule is that what's legal is what you get away with. Is this how the matter ought to be? Perhaps, and perhaps not; I've seen arguments both ways. But, either way, this is how the matter is.

arcolife 12y ago

For all those looking for an encrypted email service, take a look at https://protonmail.ch/ https://protonmail.ch/

listic 12y ago

So, the encrypted email is illegal in the USA. Is accessing the Internet over VPN legal? Pardon my ignorance, I am new to the issues of encryption and privacy. Always assumed I can worry about it later, but the time has come at last. About time, when my native country is enforcing the laws that permit internet censorship an increasingly wide scale. http://en.wikipedia.org/wiki/Russian_Internet_blacklist http://en.wikipedia.org/wiki/Russian_Internet_blacklist

ds9 12y ago
It's not exactly illegal, and the new secret-orders tactics are the government's workaround. In the 1990s there was a series of political/legal conflicts over encryption, which was about to go mainstream (the whole episode is now referred to as the "clipper chip" controversy). The USG wanted strong encryption without backdoors banned, and everyone to use instead a set of encryption protocols which would have provided keys for the government (the "key escrow" idea), and the USG would promise not to abuse the power to decrypt everyone's communications. Some heroic technical people worked around that and actually exported what eventually became PGP/GPG on paper to take advantage of a loophole in the ban. The controversy faded and the civilian right to non-backdoored, strong encryption became the nominal law and policy. Since then the USG has been working to undo and reverse this situation by any means it can find. What it's come up with is (a) the NSA mass-wiretapping regime (actually a continuation Echelon and several other prior, longstanding mass-surveillance schemes) and (b) the set of legal tools applied to Lavabit. And they've mostly succeeded. Secure communication is theoretically legal, but if the government can coerce encryption keys, secure communication is defacto subject to being stopped anytime the government takes an interest in someone. And while providing secure comms as a service is technically still legal, if the feds can demand a combination of trojaning the service and concealment of the subversion from users, then they have effectively banned secure communications in practice, while maintaining the written law as-is.

tom_jones 12y ago

It reads like a an unbelievable chapter from Orwell's 1984, and it occurred in the United States of America, the oft stated bastion of democracy. At every possible opportunity resistance was stymied, with the presumption that the will to resist would eventually collapse. They lost because they never once contemplated the possibility of you being willing to shut down your business because of your principles, something they couldn't fathom or conceive of, since such a concept is anathema to their wholly illegal and unconstitutional activities.

roma1n 12y ago

I wonder if the Lavabit author would be amenable to e.g. a kickstarted with the goals of - open-sourcing lavabit - making it ready for instant deployment e.g. using Docker A kind of "just add a VPS" platform...

jokoon 12y ago

what would have happened if he just decided to delete snowden's mails and account to save his company ?

ds9 12y ago
Deleting the emails would have put Levison/Lavabit in violation of long-established law (destruction of evidence is a crime). Note that with PFS (if I recall correctly, Lavabit did not use PFS), preserving past emails does not help the adversary. Deleting the account, however, seems much more viable for similar situations. Forcing a company (like Lavabit) to provide service to an individual might be supportable, based in part on past precedents to do with race discrimination and general regulation-of-business principles, but would be unprecedented in regard to a non-commercial entity. Arguably it would run afoul of the 13th Amendment in the US. Of course, written law has little bearing on what the government can do in practice in today's USA.

retrogradeorbit 12y ago

Kafka's parable of the law: https://www.youtube.com/watch?v=rfkxKkrPZPQ https://www.youtube.com/watch?v=rfkxKkrPZPQ

h1karu 12y ago

Why would any privacy related service provider operate within the United States of America ? It's one of the worst jurisdictions for that kind of thing. To me that makes no sense whatsoever, so this start-up was doomed from the very onset.

gdonelli 12y ago

Respect!

hellbreakslose 12y ago

May the force be with us!

ommunist 12y ago

Following guelo. I agree - Levinson is a hero. I am almost sure he is the last American hero. Once the US citizens loose their right to privacy, they will not be able to produce such heroes anymore as a nation, and will transform to something like complacent Russians (who lost their rights to privacy much, much earlier).

eyeareque 12y ago

This sounds like something you'd hear about in a communist country. We are in a lot of troue if we don't do so drying about what our government is trying to do. Eric Snowden and Lavabit are two examples of people who will be seen as heroes in the future.

Eye_of_Mordor 12y ago
China already sees the US as a place with less respect for human rights than they do, so in some ways, the US is worse than a communist country.

erjjones 12y ago

Open Source your code and the community will help you see it a reality

snambi 12y ago

Overall this is not good. Sure, the govt can do what they want. But what useful information they got from these emails? Did it make the country safer? Did it make the world a better place? Using the law is one thing. Using the law for the intended purpose is a different thing. Not sure whether the law is really used for the right purpose.