Lavabit Challenges Contempt Order: An Analysis of Its Arguments

http://www.volokh.com/2013/10/11/lavabit-challenges-contempt-order/

by CWuestefeld • 13 years ago

69 51 13 years ago

trothoun• 13 years ago

If you s/anti-government/anti-government surveillance/ then I think the article would be considerably improved. Was Lavabit explicitly anti-government?

eli3• 13 years ago

I think that's probably a fair point.... Doesn't seem like it changes any of the legal analysis though.

You can't disobey a search warrant because it would be bad for business or because you want to protect the target.

spydum• 13 years ago

I think the primary concern is protecting the other folks who are not the target. Handing over keys allows for the government agency the opportunity to violate other users 4th amendment rights.

rainsford• 13 years ago

I'm not sure it makes much of a legal difference, although maybe it might be a more accurate description of Lavabit's viewpoint. But as the article points out, a business model or ideology isn't a basis to challenge court orders or subpoena power...regardless of what it might be.

brymaster• 13 years ago

Levinson deserves more support than the paltry $90K (https://rally.org/lavabit) he's raised so far for his legal defense war chest. I hope he can continue to fight this as he goes up the court of appeals ladder.

thinkcomp• 13 years ago

Fourth Circuit Court of Appeals docket and documents here:

http://www.plainsite.org/flashlight/case.html?id=2524335

coldcode• 13 years ago

There is no hope for us if nothing we hold to be ours is available to any government agent who demands it. A request for a single person is one thing, it only affects that one person. Once the request affects a huge number of unrelated people just to grab that one person it becomes unreasonable. It's like arresting an entire city to catch a single criminal. At some point you have to draw a line. But I wouldn't want to try that argument in front of a Federal Judge much less the Supremes. I doubt this will work.

rayiner5• 13 years ago

Isn't it a technical problem with the service, rather than a legal problem, if the host can't give access to one email account without compromising all users?

thecodeore9• 13 years ago

The email encryption was not in play here, from what I understand the end user was the only person with the key to the email "inbox" encryption

What is in play here was the SSL Key that is used to encrypt the browser traffic between LB and the user. No differant than the SSL Cert used when you make an online purchase

It technologically impossible/impractical to have a separate SSL cert for each user, that is just not how the HTTPS protocall was designed

This is not Lavabits doing, that is the work of the Internet Engineering Task Force (IETF)

rayiner5• 13 years ago

Argument #1 is really the damning thing for Lavabit. The scope of the subpoena power isn't some new invention of the surveillance state. The quote from U.S. v. Calandra ("the public is entitled to every man's evidence") dates to 1742: http://supreme.justia.com/cases/federal/us/317/424/case.html.... It wasn't a new concept then either. The idea of e-mail accounts the government can't access with an appropriate court order is deeply incompatible with how Anglo-American law conceives of the powers of courts.

There's a comment by "Jessica Darko" on the linked-to blog that I think warrants addressing. There is a big difference between a "search" for the purposes of the 4th amendment and a subpoena of a third party. Say the government is investigating Bob for tax fraud. It's a "search" subject to 4th amendment protections for the government to break into Bob's house and go through his drawers. It's not a "search" for the government to subpoena his accountant for any relevant financial records. It's a "search" for the government to break into the accountant's office to get those records, but the accountant can't hold up the 4th amendment as a shield against turning over those records pursuant to a court order.

cperciva• 13 years ago

The problem I see with subpoenaing SSL keys is that they are not, in fact, evidence.

Amadou3• 13 years ago

I was hoping to see more discussion on this point.

Are there other cases where subpoenas have been issued for tools that enable the gathering of evidence? Has that sort of thing always required a warrant?

Is it moot that a warrant was eventually issued? Or was the warrant only issued punitively because Lavabit didn't comply with the subpoena without regard to the validity of the subpoena in the first place?

nullc• 13 years ago

Should the government be able to order you to give a blood sample so they can pop out a clone of you, which they can then use to impersonate you towards _anyone_, say, your spouse, in order to potentially perform arbitrarily broad collection whos scope they'll hide under the guise of national security?

They're not asking for evidence, they order the operator of the service to be complicit in aiding the government in impersonating the service towards all of its users.

rayiner5• 13 years ago

No, but unlike a blood sample, an encryption key is "just information."

walid• 13 years ago

Actually I was surprised that the article doesn't see the harm in "The Subpoena Argument" which although not overly burdensome, is both abusive and oppressive. The abuse and oppression is happening to the business and to the clients of that business. Lavabit was willing to provide the records for the account in question so the issue of providing SSL keys is moot. Add to that the Feds wanted live surveillance so Lavabit offered to do some coding for a fee of 3500 and the Feds refused. All in all Lavabit was compliant with the letter of the law. The ruling against Lavabit seems to have been expected to silence the owner but it backfired against the Feds.

I'm all for going after the bad guys but sometimes law enforcement agencies don't make themselves likable, especially when they can force someone to comply with what they want.

tedunangst4• 13 years ago

I think it's becoming clear the legal system imagined by nerds is not the actual legal system. It's like watching somebody at an American football game who thinks they're at a soccer match.

"You can't throw the ball like that. Hand ball! 87 just knocked 12 over. Red card, red card! This ref is an idiot; he doesn't know any of the rules!"

nitrogen• 13 years ago

Intellectual technologists may simply disagree with the premise of a law, rather than fail to understand it. You can't create new technologies with a mindset that sees only how things are, not how they could be better.

RexRollman• 13 years ago

It was well written. I expect the government will respond with a sad combination of flag waving and fear mongering.

hawkharris• 13 years ago

Excellent analysis. It's refreshing to see someone dive into the legal issues instead of spewing personal opinions about what the parties should - or should not - have done. I hope that those who critique the author's post will take the same amount of care in researching the law.

thecodeore9• 13 years ago

I believe it is very telling that a pro-privacy company, a company that has integrity and wants to honor the commitments it has made to their customers, is now a "anti-government" company...

I see a lot of comments about how "good" this analysis is, to me it seems very weak, and only "good" if you believe the government should be allowed to violate the 4th amendment, should be allowed to obtain any information from anyone at any time, and should be allowed to get SSL Keys from service providers, without disclosing this to the Certificate Authorities and violation of all security agreements with said CA's.

If you're very much a "pro" government person then I can see how this "analysis" would meet with your approval. To me it looks like pro-government biased drivel

Amadou3• 13 years ago

My impression, as someone who is not a lawyer, is that much of what gets posted to the volokh conspiracy is "pro-process."

I think it is entirely reasonable to analyze the situation from the perspective of the law, but it seems like underlying their analysis is that the law is more than just a tool, that it is itself not subject to question. I can understand that from a functional perspective. Challenging the law itself, especially long established law (even if it is being applied to new situations) is a very hard task. But too often (at least for my taste) the writers there seem to bleed that over into the law having some sort of unstated moral stature beyond its utilitarian nature.

rayiner5• 13 years ago

Volokh is not a philosophy site for people to opine about morality. It's a site about law, courts, and lawsuits. These things are all about process. Even when applied to new situations, the job of courts is to implement solutions consisting with existing law and legal norms, not to stray from the law to implement what they see as the more "moral" outcome.

trauco2• 13 years ago

I think you are missing the point. The analysis just says that you can't get an exception from the subpoena power by just claiming "but the whole point of my business is providing protection from it!".

A legal analysis like this is not too concerned with the specifics of a case because otherwise you couldn't have broad judicial principles at play.

That is to say, even if you think the government request was outrageous, Kerr's analysis simply says that yes, there's a long history of the right of the 'people' (here represented by the grand jury) to ask for information even if in the process the dignity or business of the person/institution the government is requesting the information from is damaged.

Lavabit needs to make a good case within those legal boundaries (which Kerr says is difficult) or try to change those boundaries.

brownbat• 13 years ago

Footnote, Prof. Kerr literally wrote the book on Computer Crime Law: http://www.amazon.com/Computer-Crime-Law-American-Casebook/d...

Not that you should accept his argument without scrutiny, but he's read a few of the cases here.

trauco2• 13 years ago

A lesson of all of this is that encryption without control of the encryption key is, in this brave new world, useless.

segacontroller• 13 years ago

The SSL key is only for the transport correct? My assumption is that the data in storage would still be encrypted by the customer's private keys. The USG could then obtain the private keys of the customer by watching the decrypted SSL traffic, and is also why the gag order would be very important to the case.

I think this is a pretty big misunderstanding by the author of the article.

Lavabit Challenges Contempt Order: An Analysis of Its Arguments

Related Stories