6 ms·

Admitting to the behavior you've described would no doubt destroy his career, so it's not surprise he's twisting the story around. He does have the victim card

by _broody 12y ago

Admitting to the behavior you've described would no doubt destroy his career, so it's not surprise he's twisting the story around. He does have the victim card to play, though, and he's going to keep milking it for all it's worth, quite rightfully. The government effectively killed his business the second they first coerced him into undermining his clients. The only choice for him in that position was to give up on his business or give up on his principles. If he indeed wound up failing on both counts, well, at the point someone is put under this sort of duress, is there any point in being so judgemental of him?

tptacek 12y ago
I think a lot of people who read my comments on these stories think I'm bringing these points up because I'm on DOJ's side on this issue. It's true that I'm more on their side than the average HN reader, but I share most of HN's perspective on the actual disclosures in the Snowden documents. But that's neither here nor there, because my issue in this case isn't that Levison was on the wrong side of a controversy with DOJ. My issue is that Levison never should have been running this particular service. Like many other short-sighted developers, Levison built a site that made expansive claims about its security capabilities which anyone familiar with the actual technology could see were preposterous. The framing of the "debate", such as it is, about Lavabit seems to take as a given that DOJ or NSA can compromise secure messaging services, and that our only reasonable response is outrage directed at the USG (or "Five Eyes" or whoever) in the hopes of effecting policy changes. No. It is more than possible to build services that thwart the kinds of orders Levison received. It's not even difficult to do that. Levison could have built a service that would not have provided him the capability of furnishing the FBI with Snowden metadata. Levison didn't not build that system because that was hard to execute technically. I think he did it because it was hard to execute as a business. Users want communications tools that work like the ones they already have, and, in particular, they want tools that interoperate with Internet email. Like virtually everyone on HN, Levison probably understands that such a tool is virtually impossible to implement as a web application. But Levison also knows that building native applications is expensive, and getting users to install things is more expensive still. So instead of building something that protected his users, he appears to have built something that didn't, and then pretended that it did. He may have "gotten away with it" so long as the court orders he apparently quietly complied with didn't pertain to the highest-profile target on the Internet. But once that happened, the game was up. If all of that's true, I'm not sure from where I'm supposed to find sympathy for people who play those kinds of games with people's secrets.
- enlashok 12y ago
  > It is more than possible to build services that thwart the kinds of orders Levison received. Perhaps, but unless there is appropriate and firm pushback against further legislative creep, mass surveillance, and abuses of process, etc then those other services are at risk of getting stamped out as well. Levison is not a saint, but he doesn't have to be.
  - tptacek 12y ago
    If Levison was the only person doing this, my complaint might be less relevant. But he's not; he's at the vanguard of a trend, and is our best cautionary tale about what happens when people chase that trend.
    - jacquesm 12y ago
      Maybe that's where you hit the wrong note then. Most of your writing here seems to be directed at Levinson particularly, not in the general sense as a cautionary tale aimed at the potential users of such a service.
      - tptacek 12y ago
        I don't understand. Levison did something objectionable. Who am I supposed to direct my complaint at? Are you suggesting that I should instead reserve my complaints for the users of these services? That empirically does not work; there are millions of users, and none of them research the tools they use to communicate privately.
        jacquesm 12y ago
        Levinson did something stupid (possibly maliciously stupid, I'm not qualified to judge), the users did not do due diligence on the claims made by the service and from the looks of it Levinson is paying a price. But that ship has sailed. He fucked up, he tried hard to limit the damage and as far as I can see he's been punished just about enough. So if you're upfront about using this as a cautionary tale then that would start with either educating users of such services or with pointing out similarities between Levinson's flawed approach and other offers of services like that. Further dumping on Levison is pointless, it's like kicking a guy that is already down. Compare this with Karin Spaink taking on scientology knowing full well that that would bring down a lot of trouble, but doing society a great service in warning people of the dangers of that particular organization. For users of Lavabit any kind of warning is a bit late and I think they have learned their lesson (or at least, I would hope they did). Snake oil peddlers have been making money for years, the farmaceuticals or the broken-crypto ones look all the same from where I'm standing, they are playing with people's lives. But the ones that get caught are as far as I'm concerned neutralized, it's the ones that remain that deserve our attention, and their users as well.
rayiner 12y ago
> The government effectively killed his business the second they first coerced him into undermining his clients. The problem is, in the U.S. and I'd imagine most other countries, your business cannot be built on refusing to follow court orders to protect your clients. Specifically, refusing to furnish relevant information despite being able to do so without excessive burden. We're not talking about some new erosion of civil rights. The power of courts to compel witnesses to provide relevant evidence and testimony dates back to the origins of jury trials in the middle ages: http://en.wikipedia.org/wiki/Subpoena_ad_testificandum http://en.wikipedia.org/wiki/Subpoena_ad_testificandum.
- SilasX 12y ago
  >The problem is, in the U.S. and I'd imagine most other countries, your business cannot be built on refusing to follow court orders to protect your clients. What about churches offering confessional services? I know, that's a case where the law specifically protects the (priest/penitent) relationship. (Nor are they "businesses" in the conventional sense of the term.) Nevertheless, they are open about how they're willing to violate a court order asking them to (in their judgment) break the confessional seal. Third caveat: if all you meant was that the "confession protector" can still expect to go to jail for this, that's still not a counterexample to what you said. But the point is that, unlike with Lavabit, the court would not shut down the entire church when priests violate such court orders, no matter how systematically they do it.
  - danielweber 12y ago
    There are a number of explicitly allowed privileges, like with lawyers. Society sees value in letting people be able to discuss very personal matters with people, and the conversations would not be happening without the explicitly granted privilege. Can't be compelled to testify against your spouse, for that matter (that's by Constitution, not by statute). (Even then, priests and lawyers have rules about when to break confidentiality. If someone said they committed a murder, nope. If someone said they are going to commit a murder tonight, then yes.) If you want a new kind of privilege, you should lobby your legislators, not try to start a for-profit business.

by _broody 12y ago

tptacek 12y ago

I think a lot of people who read my comments on these stories think I'm bringing these points up because I'm on DOJ's side on this issue. It's true that I'm more on their side than the average HN reader, but I share most of HN's perspective on the actual disclosures in the Snowden documents. But that's neither here nor there, because my issue in this case isn't that Levison was on the wrong side of a controversy with DOJ. My issue is that Levison never should have been running this particular service. Like many other short-sighted developers, Levison built a site that made expansive claims about its security capabilities which anyone familiar with the actual technology could see were preposterous. The framing of the "debate", such as it is, about Lavabit seems to take as a given that DOJ or NSA can compromise secure messaging services, and that our only reasonable response is outrage directed at the USG (or "Five Eyes" or whoever) in the hopes of effecting policy changes. No. It is more than possible to build services that thwart the kinds of orders Levison received. It's not even difficult to do that. Levison could have built a service that would not have provided him the capability of furnishing the FBI with Snowden metadata. Levison didn't not build that system because that was hard to execute technically. I think he did it because it was hard to execute as a business. Users want communications tools that work like the ones they already have, and, in particular, they want tools that interoperate with Internet email. Like virtually everyone on HN, Levison probably understands that such a tool is virtually impossible to implement as a web application. But Levison also knows that building native applications is expensive, and getting users to install things is more expensive still. So instead of building something that protected his users, he appears to have built something that didn't, and then pretended that it did. He may have "gotten away with it" so long as the court orders he apparently quietly complied with didn't pertain to the highest-profile target on the Internet. But once that happened, the game was up. If all of that's true, I'm not sure from where I'm supposed to find sympathy for people who play those kinds of games with people's secrets.

enlashok 12y ago
> It is more than possible to build services that thwart the kinds of orders Levison received. Perhaps, but unless there is appropriate and firm pushback against further legislative creep, mass surveillance, and abuses of process, etc then those other services are at risk of getting stamped out as well. Levison is not a saint, but he doesn't have to be.
- tptacek 12y ago
  If Levison was the only person doing this, my complaint might be less relevant. But he's not; he's at the vanguard of a trend, and is our best cautionary tale about what happens when people chase that trend.
  - jacquesm 12y ago
    Maybe that's where you hit the wrong note then. Most of your writing here seems to be directed at Levinson particularly, not in the general sense as a cautionary tale aimed at the potential users of such a service.
    - tptacek 12y ago
      I don't understand. Levison did something objectionable. Who am I supposed to direct my complaint at? Are you suggesting that I should instead reserve my complaints for the users of these services? That empirically does not work; there are millions of users, and none of them research the tools they use to communicate privately.
      - jacquesm 12y ago
        Levinson did something stupid (possibly maliciously stupid, I'm not qualified to judge), the users did not do due diligence on the claims made by the service and from the looks of it Levinson is paying a price. But that ship has sailed. He fucked up, he tried hard to limit the damage and as far as I can see he's been punished just about enough. So if you're upfront about using this as a cautionary tale then that would start with either educating users of such services or with pointing out similarities between Levinson's flawed approach and other offers of services like that. Further dumping on Levison is pointless, it's like kicking a guy that is already down. Compare this with Karin Spaink taking on scientology knowing full well that that would bring down a lot of trouble, but doing society a great service in warning people of the dangers of that particular organization. For users of Lavabit any kind of warning is a bit late and I think they have learned their lesson (or at least, I would hope they did). Snake oil peddlers have been making money for years, the farmaceuticals or the broken-crypto ones look all the same from where I'm standing, they are playing with people's lives. But the ones that get caught are as far as I'm concerned neutralized, it's the ones that remain that deserve our attention, and their users as well.

rayiner 12y ago

> The government effectively killed his business the second they first coerced him into undermining his clients. The problem is, in the U.S. and I'd imagine most other countries, your business cannot be built on refusing to follow court orders to protect your clients. Specifically, refusing to furnish relevant information despite being able to do so without excessive burden. We're not talking about some new erosion of civil rights. The power of courts to compel witnesses to provide relevant evidence and testimony dates back to the origins of jury trials in the middle ages: http://en.wikipedia.org/wiki/Subpoena_ad_testificandum http://en.wikipedia.org/wiki/Subpoena_ad_testificandum.

SilasX 12y ago
>The problem is, in the U.S. and I'd imagine most other countries, your business cannot be built on refusing to follow court orders to protect your clients. What about churches offering confessional services? I know, that's a case where the law specifically protects the (priest/penitent) relationship. (Nor are they "businesses" in the conventional sense of the term.) Nevertheless, they are open about how they're willing to violate a court order asking them to (in their judgment) break the confessional seal. Third caveat: if all you meant was that the "confession protector" can still expect to go to jail for this, that's still not a counterexample to what you said. But the point is that, unlike with Lavabit, the court would not shut down the entire church when priests violate such court orders, no matter how systematically they do it.
- danielweber 12y ago
  There are a number of explicitly allowed privileges, like with lawyers. Society sees value in letting people be able to discuss very personal matters with people, and the conversations would not be happening without the explicitly granted privilege. Can't be compelled to testify against your spouse, for that matter (that's by Constitution, not by statute). (Even then, priests and lawyers have rules about when to break confidentiality. If someone said they committed a murder, nope. If someone said they are going to commit a murder tonight, then yes.) If you want a new kind of privilege, you should lobby your legislators, not try to start a for-profit business.