EFF Has Lavabit’s Back in Contempt of Court Appeal

https://www.eff.org/press/releases/eff-has-lavabits-back-contempt-court-appeal

by DiabloD3 • 13 years ago

240 60 13 years ago

eff.org

thex86• 13 years ago

So, how does one fight a contempt of court? Is it even possible?

(PS: Great job EFF!)

rhizome• 13 years ago

I'm guessing it involves appealing (or similar) the court order that the contempt finding depends on.

alttag2• 13 years ago

Yes. Lavabit's filing [0] is to the Fourth District Court of Appeals. Page 1 of their brief (after all of the disclosures and tables of content) explains the jurisdictional stuff pretty well.

0: [pdf] http://cdn.arstechnica.net/wp-content/uploads/2013/10/gov.us...

einhverfr5• 13 years ago

Bravo, EFF.

Seriously, that is one heck of a broad warrant, namely the private key used to decrypt all business records of all customers.

dingaling• 13 years ago

The warrant was specifically for the data relating to Mr Snowden. Go and read the disclosed documents: that is the only individual on whom data was requested.

There was no warrant for the SSL keys; that was issued as a subpoena when Mr Levison stated that the data-in-transit was encrypted. The judge told him to disclose the keys that were protecting Mr Snowden's data.

That Mr Levison happened to use the same SSL certs for all paying customers isn't the fault of anyone but... him.

enry_straker• 13 years ago

Now, the courts get to decide how to run your business?

adekok2• 13 years ago

That Mr Levison happened to use the same SSL certs for all paying customers isn't the fault of anyone but... him.

Name me one large company using HTTPS, with separate SSL server certs for each user.

Just one. I'll wait.

csoghoian• 13 years ago

The government obtained a 2703(d) order for the stored non-content data of a particular user (suspected to be Snowden, but redacted from the court documents). They then obtained a pen register order, for real-time metadata about that same user. Lavabit told them they couldn't comply, so the government sought to use the 3rd party assistance language in the pen register statute to compel the company to provide its private SSL keys. The government then followed up with a grand jury subpoena and Stored Communications Act warrant specifically seeking Lavabit's private SSL keys.

So, no. The warrant the government obtained was not specifically for the data relating to Mr Snowden, but rather, was for the SSL keys.

MagicWishMonkey8• 13 years ago

That is how SSL is intended to work. You cannot have more than one SSL certificate for a given domain. That is an intentional design decision by the committee that created the SSL RFC.

Does the door to your house support multiple types of keys? Or is it designed to work with a single, specifically machined key? Can you open your front door with your car key? Why not?

darkarmani• 13 years ago

That Mr Levison happened to use the same SSL certs for all paying customers isn't the fault of anyone but... him.

I'm not sure you or the judge understands how SSL works. I would love to see them subpoena a bank for their SSL private key and see the reaction of the world.

chris_mahan• 13 years ago

And there is still doubt we live in a police state?

csense2• 13 years ago

At least the issue is being discussed in public and litigated in the courts.

pdkl95• 13 years ago

...and wouldn't it be nice, if we could actually stop this kind of problem before it became something the courts dare not touch, spoken of only with rare whispers. Those types of situations historically end up rather nasty for all involved.

It's probably a bad sign when the sane legal solution to avoid a rebellion (or worse) seems like fanciful wishful thinking.

edit: As other have said: Thank you, EFF!

einhverfr5• 13 years ago

It was litigated in the courts in the USSR too. Not so much discussed in public but I am not sure that matters.

The whole issue of making such a taboo topic is that it makes it hard for opposition to mobilize. However in the US we have other ways of doing that. Hyperpartisanship is something which has a remarkably similar effect while at the same time allowing us to say with a straight face that we are not a police state.....

res0nat0r4• 13 years ago

There is no doubt we are not living in a police state.

pekk6• 13 years ago

These days, anyone who isn't getting their way politically just asserts that it is a dictatorship calling for revolution.

csense2• 13 years ago

It's interesting that the two strongest practical arguments EFF is making (based on how people will react to an adverse decision) are also the two that probably the least persuasive from a legal standpoint (based on laws and court precedents).

I'm talking about service providers moving their operations to more privacy-friendly jurisdictions, and improving protocols with e.g. perfect forward secrecy to make this sort of attack impractical.

So everyone suffers under an adverse decision in this case:

The US economy suffers because businesses seriously concerned about privacy choose to locate elsewhere

Law enforcement suffers because those businesses are no longer reachable when they have a legitimate reason to obtain the communications of spies, terrorists, or plain old criminals, and get a narrow warrant that properly protects the privacy of innocent bystanders.

Individual liberty suffers because a precedent will make it easier for people who don't care about privacy and use domestic providers subject to these overbroad warrants to be caught up in a surveillance dragnet

That being said, Congress, not the courts, is the proper venue to address those practical arguments. Will anyone care outside of technophile bubbles like HN? Unfortunately, I think we all know the answer.

doug1001• 13 years ago

nice one, EFF--you guys are bad ass. EFF has of course also for the past decade, been a relentless warrior against Patent Trolls. i don't know, but i would be willing to bet, that the new troll-killing bill is in part due to their efforts as well.

AsymetricCom• 13 years ago

EFF is a pointless figurehead that does none of it's own work. It simply coopts ongoing legal action and puts their name on it anyway they can. This is a pointless case, like the EFF can fix https by this case? No, the cat is already out of the bag. https has been broken for some time, first by cyber criminals and businesses being stupid, and then the NSA trying to keep up with the game.

alttag2• 13 years ago

Glad the EFF is joining.

For background, Lavabit filed their appeal a few weeks ago [0]. Ars covered it [1], and it was discussed here on HN [2] as well.

0: [pdf] http://cdn.arstechnica.net/wp-content/uploads/2013/10/gov.us...

1: http://arstechnica.com/tech-policy/2013/10/lavabits-appeal-w...

2: https://news.ycombinator.com/item?id=6531814

theinterjection• 13 years ago

Why did Levison have access to their users mails in the first place? Didn't they claim that only you can see your emails? Isn't that the reason you can't reset your password?

pekk6• 13 years ago

But remember, that doesn't matter because "that's just how SSL works".

bskap• 13 years ago

Because email is an insecure protocol. The email comes in unencrypted from the sender's SMTP server.

EFF Has Lavabit’s Back in Contempt of Court Appeal

Related Stories