Why I was forced to shut down Lavabit

http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email

by cottonseed • 12 years ago

806 226 12 years ago

theguardian.com

microtonal• 12 years ago

Link to the actual article:

http://www.theguardian.com/commentisfree/2014/may/20/why-did...

redthrowaway• 12 years ago

The original article, which was likely buried due to having 'Snowden' in the title:

http://www.theguardian.com/commentisfree/2014/may/20/why-did...

dang2• 12 years ago

Thanks to you and danieldk. We changed the url from http://boingboing.net/2014/05/20/kafka-meet-orwell-lavabits.....

sumedh• 12 years ago

which was likely buried due to having 'Snowden' in the title

Can you be more specific?

mnem• 12 years ago

Perhaps a reference to articles with certain keywords being apparently penalized in the HN rankings: http://www.righto.com/2013/11/how-hacker-news-ranking-really...

AaronBBrown• 12 years ago

I was half expecting this to be about Apache Kafka.

auston• 12 years ago

So what can we do about this as Americans?

dublinben4• 12 years ago

Use GPG-encrypted email and decentralized services that won't put people like Levison in jeopardy on behalf of one of their users.

deelowe• 12 years ago

I'm really at a loss. I would say we could vote, but I seriously have visions of the first day of office where tapes of the kennedy assassination are shown in smoke filled rooms or something like that. So few keep their word when they take office, it seems impossible to pick the right candidate.

davidw• 12 years ago

Here are a few things:

* Call - don't email - call your representatives and express, politely, the fact that this kind of thing is Not OK. Writing a letter on paper is good too, apparently. Stop reading and do this now.

* Donate money to groups like the EFF.

* Volunteer with groups like the EFF.

* Use and support stuff like GPG.

* Don't bitch and moan about "woe is us, it's impossible". That only makes it easier for those who would deny us our rights.

* This will be a difficult, and quite likely drawn-out struggle. Don't give up. Keep working at it.

akerl_8• 12 years ago

What would I be calling to tell them? That the government shouldn't be able to, through proper channels, obtain a warrant requesting specific named information regarding an investigation of a specific individual for things that violate US law?

If we disagree with the laws, ok: protest for legal reform. If we disagree with the things revealed by Snowden, ok: protest that. But what happened to Lavabit was the government behaving properly: they obtained a narrow warrant for specifically the data they needed as part of their investigation, they tried to work with Levison to fulfill the warrant, and only after days of being stonewalled did they escalate to ensure compliance.

Theodores• 12 years ago

I don't think that getting agitated about the NSA spying is really going to help.

I think that there is a bigger problem with our democracy and, with so many people not voting anyway, it is about time that the people of people of the U.S. decided to not actually bother to vote, to not endorse the system and to effectively deliver a government that has no legitimacy.

Obviously this will let the 'bad guys in', but, with no popular mandate, will they be able to govern any better than someone like Ceausescu?

During the peak Bush years when the alternative was some hideous warmonger in the making like John Kerry, scores of do-gooding actors and celebrities were doing their hardest to get people to vote. As if voting and democracy would change anything. In America you need a compelling 'vote for RON' (re-open nominations) or a 'vote for nobody' type of campaign rather than these 'vote because your great-great-great-great-grandmother fought for your right to do so' schemes that actors etc. come up with. Clearly the people behind a successful 'vote for RON' campaign can have a political platform, a network and such like, so, if an illegitimate government exists then candidates can be found.

Start up mentality. Can it be applied to the problem in hand?

liquidise• 12 years ago

This article, which simply confirms what many speculated took place with Lavabit, makes my blood boil. I don't know what is worse: this specific technology instance, or the idea that similar instances have existed for some time.

Either way i find then entire paradigm infuriating and undermining to our supposed liberties.

saraid2165• 12 years ago

I'm unclear what new information was presented in this article? Hasn't Levison said all of this before?

aroch• 12 years ago

He's never laid out the timeline of events or why/how he was found in contempt.

S_A_P• 12 years ago

This is truly maddening stuff. I applaud the guardian for running this...

biotech• 12 years ago

Is there an open-source, decentralized service that can be used for encrypted email? Something like that could be much more difficult to compromise.

jordigh• 12 years ago

Bitcoin is one such thing. Well, not the bitcoin protocol directly, but the basic idea of a block chain can be used for many interesting things, such as decentralised encrypted communication.

aliakbarkhan• 12 years ago

Why trust it to a service? Encrypt it yourself.

cortesoft• 12 years ago

You will need your recipients to also decrypt it themselves, then. And handle your own key-exchanging. Not trivial, if you want to be able to email lots of people.

ixwt• 12 years ago

Like Bitmessage? https://bitmessage.org/wiki/Main_Page

nhayden• 12 years ago

Bitmessage is a beautiful concept but I've read many people having concerns over several aspects of how secure it really is. I hope the entire web one day works on a similar model.

rakoo• 12 years ago

Any email provider (even yourself !) can be used with GPG to encrypt the content of your emails and have good privacy. Try Thunderbird with Enigmail.

This is notoriously known for not encrypting metadata, though, which is impossible because this very metadata is used to make email actually work.

pdknsk• 12 years ago

My company, Lavabit, provided email services to 410,000 people – including Edward Snowden, according to news reports – [...].

Does he write "according to news reports" for legal reasons? Obviously he should know, I think.

The government argued that, since the "inspection" of the data was to be carried out by a machine, they were exempt from the normal search-and-seizure protections of the Fourth Amendment.

That's insane.

innoying• 12 years ago

Plausible deniability.

mpyne7• 12 years ago

> The government argued that, since the "inspection" of the data was to be carried out by a machine, they were exempt from the normal search-and-seizure protections of the Fourth Amendment.
That's insane.

It's also immaterial. In this case DOJ got an Article III warrant (if not several), which was specific in what was to be seized. This is the system that Snowden claimed to be trying to defend by revealing "warrantless wiretapping" working exactly as designed.

DOJ got a warrant for the exact thing they wanted, and all of sudden Constitutional separation of powers became inconvenient to Levison (even though he complied with such warrants before, and eventually offered to comply in this case for cash).

higherpurpose• 12 years ago

Still interesting to see how they think about it.

dredmorbius2• 12 years ago

He may not have known. It's quite possible for a company to provide services to customers it can't explicitly identify. Rather common, in fact.

Levison might still be gagged from disclosing certain information he knows personally or which was disclosed by government requests for data. In which case, pointing to an external source of verification could provide him with legal cover.

Consider it the equivalent, if you will, of parallel construction. Knowledge acquired via one route cannot be disclosed unless you can point to an independent path to coming by that information. Though the nondisclosable means might inform your search for unencumbered sources.

rrggrr• 12 years ago

I just donated $25 to the EFF. I hope everyone else will do the same or more.

ommunist3• 12 years ago

This will not return Lavabit back to business, I am afraid. But it will definitely help to raise awareness among users about their rights. Unfortunately, the topic article shows very well, that US government can easily seize your actual rights, despite your high awareness.

pekk• 12 years ago

This again? Lavabit was forced to shut because of the way it was implemented, and its proprietor has been cashing in on that design flaw ever since. There is no reason why complying with one search warrant should EVER require disclosure of the SSL cert for the whole domain, or any other disclosure sufficient to read data from customers other than the one covered by the warrant. But this is just what everyone claimed when Lavabit was closing.

If you build a business on selling security to people and you make such a mistake in the design of your software, you failed to deliver what you promised to your customers and you deserve to fail.

And not get bailed out because you thumped your chest about having to service search warrants when you chose to set up in US jurisdiction. If you don't want to be obligated to comply with lawful US requests like search warrants then don't set up in the US.

lifeisstillgood4• 12 years ago

It seems a little much to blame lavabit for sitting in the USA with its constitutional protections of free speech and privacy, and suggest it should set up in say a offshore banking haven, few of which have constitutions and a couple have dictatorial-like powers.

Additionally can you explain how he got the architecture "wrong"?

Edit: Précis of the architecture of Lavabit from http://www.thoughtcrime.org/blog/lavabit-critique/

Lavabit kept your private key on their server, but encrypted it with your plaintext password which you sent them if you wanted to read your mail. That's pretty rubbish in many ways as the article rather even handey points out. A sentiment I am agreeing with - we applaud him for standing up, not for being perfect.

sandstrom• 12 years ago

While I agree with your comment, one could note that there are non-US alternatives that are not offshore banking havens.

I'd guess that Switzerland, Sweden and Germany would (probably) all have provided a better judicial environment.

cynwoody• 12 years ago

Additionally can you explain how he got the architecture "wrong"?

See Moxie Marlinspike's post from last November:

http://www.thoughtcrime.org/blog/lavabit-critique/

You can't entrust a server with encryption / decryption, nor with supplying the tools to do it locally, e.g., via JS downloaded as part of a web interaction. Service providers can be subpoenaed, threatened, infiltrated, bribed, or hacked. Or they can just turn evil.

All crypto must take place on the client, using carefully vetted tools.

pera• 12 years ago

With this reasoning we can also blame Cisco for not delivering routers inside safes...

dublinben4• 12 years ago

They should at least be delivering routers inside tamper-evident packaging. It would cost a few cents in special tape for each box.

tptacek18• 12 years ago

This summary is probably misleading. A different perspective on the facts of this case is on display in the 4th Circuit ruling on Levison's contempt charges:

https://s3.amazonaws.com/s3.documentcloud.org/documents/1114...

In short: Levison claims that the DOJ demanded access to the content of all his users messages, and implies that after he complied with that order, they escalated to demand his TLS keys.

But that doesn't seem to be what happened. A fuller timeline of Lavabit might (please correct me) look like this:

t-n..t: Levison complies with numerous court orders demanding information about users of Lavabit.

t: Levison is served with a court order demanding the metadata associated with Snowden. It is unclear whether this demand is actuated by a device that DOJ mandates installation of, but what is clear is that there was a debate between Levison and the DOJ about Levison's capabilities w/r/t/ furnishing the DOJ with information about Snowden's account.

t+1: Levison refuses to comply with the DOJ order, while indicating that he has the technical capacity to comply with at least some of it.

t+2: DOJ escalates with a magistrate court order requiring that Lavabit use its technical capabilities to defeat its encryption of Snowden's information --- a capability that Levison acknowledges having, that is obvious from the design of Lavabit, and that has a precedent in other "secure" email providers.

t+2..t+13: Levison spends 11 days stonewalling DOJ, refusing not only to comply with the order but also to meet with the DOJ. Per the 4th Circuit: "As each day passed, the Government lost forever the ability to collect the target-related data for that day.". Levison is playing chicken, and DOJ is now furious.

t+13: DOJ arranges to compel Levison to appear at a district court hearing, while reiterating that it requires only the metadata information surrounding Snowden's account.

t+14..t+17: Levison delays 4 more days.

t+17: Levison, via his attorneys, replies to the DOJ's order with a counterproposal that involves billing DOJ for his time, collecting a limited set of information, and furnishing it to DOJ only at the conclusion of the entire collection period.

t+20: DOJ, furious and contending that they've lost all reasonable faith in Levison's cooperation with their investigation, demands the TLS keys for Lavabit in order that they can control the collection of the data they need from Lavabit.

Again: please correct details here where I'm wrong.

Most readers of this thread will have enormous sympathy for Levison and his efforts to stymie the DOJ's investigation of Snowden through his account on Lavabit.

However, a jaundiced, cynical, or purely pragmatic reader might also find grave flaws in Levison's response to this situation. His position on the matter does not appear to have been content-neutral: he complied with previous orders. More importantly, when an order came in for an account he had a personal interest in, he escalated matters so that DOJ would end up compromising everyone's information, by playing a game of chicken he was sure to lose.

DavideNL• 12 years ago

Well one could argue that when 'an ordinary guy' running a startup gets threatened and raped by the biggest (evil) 3 letter agencies, it might be quite normal to have 'flaws in your response'.

I personally think he did remarkably well.

akerl_8• 12 years ago

Stonewalling the DoJ when they're serving you a legal request is pretty much the opposite of handling things well, and as noted it ensured things went poorly for pretty much every party except Levison, who has been enjoying a media field day ever since as a Defender Of Freedom And Goodness.

Providing the key in 4 point font was yet another childish response that predictably did not help with resolving the situation.

If he disagreed with the nature of the government's request, there are a variety of ways to voice and display that disagreement: locking your doors and closing the curtains in the hope the DoJ stops knocking is not one of them. But given he had a history of complying with this nature of request, I'm curious why he suddenly changed his mind.

jackowayed• 12 years ago

Let's save the word rape for literal rape.

mikecb7• 12 years ago

Levison eventually complies by printing out key in 4 point font. I'm surprised he didn't mention that in his defense.

daurnimator• 12 years ago

This is understandable and IMO excusable if framed as an attempt to buy time to mount a proper defense

lifeisstillgood4• 12 years ago

But I fear that we are waiting for the perfect opportunity - we are seeing these rights erode, and waiting for a unsullied cause, before we spring into action.

Yes Levison had mixed or uncertain motives. Yes he complied at first, then played a strange game. But at some point he did say "no" to any further requests that to him seemed unconstitutional / illegal / against his conscience.

For that I (a whiskey priest) applaud him.

akerl_8• 12 years ago

Worth noting: he did not say no. He stopped talking, then tried to throw down some ridiculous rules regarding payment and delivery of the information, then he complied.

saraid2165• 12 years ago

But I fear that we are waiting for the perfect opportunity - we are seeing these rights erode, and waiting for a unsullied cause, before we spring into action.

Not really. What's going on is that a lot of people are participating in impotent outrage rather than actually risking their livelihoods as they lionize Levison and Snowden for doing.

At the same time, do you really want to fight for a cause under the banner of a lie? Ignore for a moment the opinions of others on the subject; if someone told you that God is real and that He wants you to defend privacy, would that motivate you to finally "spring into action"?

josefresco5• 12 years ago

I take issue with your referencing the DOJ's emotional state. Assuming you can even determine how "they" were feeling, I don't believe it matters at all to the case. Why not note Levison's emotional state upon receiving the initial court orders?

tptacek18• 12 years ago

I disagree, for two reasons.

First & simplest: DOJ/FBI is made up of people, not of automatons. When you piss people off, you alter their behavior. Levison found himself in a situation where the welfare of his users depended in large part on how DOJ opted to behave. In order to make the most powerful statement he could about his dislike of DOJ's investigation, he deliberately provoked DOJ, spending his users welfare for his own PR ends.

Secondly, and I think equally importantly: Levison's actions made it easy for DOJ to demonstrate that he was untrustworthy. Their original demand was for metadata about a specific account, and the court record indicates that they were willing to spend time finding ways to cooperate with Levison, whose responses appear to have been inconsistent with his previous actions w/r/t/ court orders for Lavabit. By the end, no show of cooperation from Levison was needed, because Levison had made it clear to the court that DOJ had grounds to demand enough information for them to control the collection of the data they were after.

jacquesm11• 12 years ago

It looks like a superbly executed retreat with maximum damage inflicted on the other party to me. Can't blame him for trying to get out of this with as little damage to himself either, he's effectively still at it. Kudos to him and let's hope that anybody that finds themselves in a similar situation in the future will act just as courageously. Sure he messed up on one of the key elements in setting up a secure email facility (that key should have never existed in the first place, or it should have been stored in a way that even he could not get at it if so compelled depending on the technical details).

But once he realized that there was going to be real trouble for an individual whose data was entrusted to him he did as far as I can see what he could and he risked becoming the lightning rod.

What other course of action would you suggest he should have taken?

tptacek18• 12 years ago

The way you arrive at that conclusion is to trust that no other Lavabit user was actually jeopardized by DOJ during their efforts to investigate Snowden's account. If you believe otherwise, then Levison's "retreat" imperils those users, presumably without their consent, in the service of Levison's own political objective.

I concede that that's a reasonable position to take. I think it's probably true that DOJ was unlikely to declare a field day on all of Lavabit, slurping every conceivable secret they could obtain from the service.

However we look at the situation, though, it seems unreasonable to accept deceptive statements from Levison about how it actually played out. His narrative doesn't square with the court's. What factual claim in the 4th Circuit ruling do you contend is false?

claudiusd• 12 years ago

You're missing the point that Levison makes his last paragraph: "courts must not be allowed to consider matters of great importance under the shroud of secrecy, lest we find ourselves summarily deprived of meaningful due process".

His argument was that he could not find appropriate legal representation because of the gag order, and that the DOJ would not cooperate in kind with his legal team once assembled. Do you think his delays were too long given these constraints and the fact that he has a company to run?

If I have sympathy for Levison it's because he was intimidated into laying aside his moral beliefs. It could happen to any of us.

mpyne7• 12 years ago

courts must not be allowed to consider matters of great importance under the shroud of secrecy

That's his opinion, and nothing more.

As it turns out there are many great reasons for allowing courts to consider things under a shroud of secrecy.

E.g. deliberations about a warrant to search the home of an accused pedophile. The accused is innocent until proven guilty so the court would have a strong interest in not making such a warrant public (and in fact we screw this up too much already with sex-related cases IMHO).

Or in embezzlement cases, having a completely public deliberation about warrants would tip off the crooks ripping off the taxpayers into avoiding the very means of communication intended to be wiretapped.

danielweber7• 12 years ago

His argument was that he could not find appropriate legal representation because of the gag order

If true this would be, by itself, a really really big deal. But the article doesn't seem to say that. It says he couldn't find a lawyer willing to take on his case, but he talked with "a dozen." Lawyers are the best people to ask for recommendations to other lawyers.

_broody• 12 years ago

Admitting to the behavior you've described would no doubt destroy his career, so it's not surprise he's twisting the story around.

He does have the victim card to play, though, and he's going to keep milking it for all it's worth, quite rightfully. The government effectively killed his business the second they first coerced him into undermining his clients. The only choice for him in that position was to give up on his business or give up on his principles. If he indeed wound up failing on both counts, well, at the point someone is put under this sort of duress, is there any point in being so judgemental of him?

tptacek18• 12 years ago

I think a lot of people who read my comments on these stories think I'm bringing these points up because I'm on DOJ's side on this issue. It's true that I'm more on their side than the average HN reader, but I share most of HN's perspective on the actual disclosures in the Snowden documents.

But that's neither here nor there, because my issue in this case isn't that Levison was on the wrong side of a controversy with DOJ.

My issue is that Levison never should have been running this particular service. Like many other short-sighted developers, Levison built a site that made expansive claims about its security capabilities which anyone familiar with the actual technology could see were preposterous.

The framing of the "debate", such as it is, about Lavabit seems to take as a given that DOJ or NSA can compromise secure messaging services, and that our only reasonable response is outrage directed at the USG (or "Five Eyes" or whoever) in the hopes of effecting policy changes. No. It is more than possible to build services that thwart the kinds of orders Levison received. It's not even difficult to do that. Levison could have built a service that would not have provided him the capability of furnishing the FBI with Snowden metadata.

Levison didn't not build that system because that was hard to execute technically. I think he did it because it was hard to execute as a business. Users want communications tools that work like the ones they already have, and, in particular, they want tools that interoperate with Internet email. Like virtually everyone on HN, Levison probably understands that such a tool is virtually impossible to implement as a web application. But Levison also knows that building native applications is expensive, and getting users to install things is more expensive still.

So instead of building something that protected his users, he appears to have built something that didn't, and then pretended that it did. He may have "gotten away with it" so long as the court orders he apparently quietly complied with didn't pertain to the highest-profile target on the Internet. But once that happened, the game was up.

If all of that's true, I'm not sure from where I'm supposed to find sympathy for people who play those kinds of games with people's secrets.

rayiner2• 12 years ago

The government effectively killed his business the second they first coerced him into undermining his clients.

The problem is, in the U.S. and I'd imagine most other countries, your business cannot be built on refusing to follow court orders to protect your clients. Specifically, refusing to furnish relevant information despite being able to do so without excessive burden.

We're not talking about some new erosion of civil rights. The power of courts to compel witnesses to provide relevant evidence and testimony dates back to the origins of jury trials in the middle ages: http://en.wikipedia.org/wiki/Subpoena_ad_testificandum.

guelo2• 12 years ago

Levinson is a hero. He went to bat for his users, sacrificed his livelihood and his resources to defend the principles he, and many of us, believe in. Yes, the government has repulsive legal tools like the Stored Communications Act on their side. Civil rights are not going to be won by fighting head-on on those legalistic grounds, that field has been corrupted and is under complete control of the autocrats.

tptacek18• 12 years ago

Levison ran a for-profit service that made security claims to its users that the system couldn't possibly back up. Other people, like Moxie Marlinspike, the OpenPGP team, and the OTR developers build systems that can provide meaningful security for their users. Perhaps they don't end up in the news because their services actually work; regrettably, this means they may never become "heroes" the way Levison did.

ChuckMcM• 12 years ago

I suspect this is reasonably close to the timeline. A common misconception is that while an individual has a right to privacy (4th, 5th, and 14th amendments) there isn't a right for others to protect that person's privacy. So you are asked to testify about someone charged with a crime, you are compelled to do so. That is the argument here. Had Snowden or anyone else for that matter maintained their email account on their own private server and ideally at their own residence, it would be more difficult to get the kinds of access that can be compelled through a third party.

tptacek18• 12 years ago

The public, as they say, is entitled to every man's evidence; that's a principle that apparently goes back to common law.

But once again: regardless of what the public is entitled to, the developers of GnuPG can't furnish any evidence about what its users are saying, nor can the developers of libotr. Levison can't reasonably make the same claim, but he tried to, much to everyone's detriment.

couchand• 12 years ago

This certainly is the standard, but it seems quaintly out of date these days. The standard was developed at a time when putting a letter in an envelope constituted a reasonable expectation of privacy. Now the primary mode of communication is essentially assumed to be bugged.

Suggesting that the solution is to have every individual maintain their own private e-mail server, while certainly pragmatic, ignores the realities of modern communications.

srj• 12 years ago

I agree that Levison left out important details from his timeline but I feel you have done the same. Consider his issues in finding legal counsel, the short timeline, and inability to discuss the issue with experts. Consider the distant court venue and his inability to obtain court transcripts for months even while the proceedings hurry along.

How is an ordinary citizen supposed to understand the legal issues at play or alternatively be able to obtain specialty counsel in a matter of days? If one should only speak to the FBI in the presence of legal counsel isn't it understandable that he was quiet while searching for a lawyer?

Also, why is it so wrong of him to stage a legal challenge to an order that contradicts his own moral/political beliefs? Your point is that the end-game was always clear but to a legal layperson I don't think that's true.

hyperion2010• 12 years ago

The distant court venue really irks me. Levison is a 3rd party and thus not protected under Article 3 of the Constitution (venue), but how is being called to court 1000 miles from your residence not a gross abuse of power?

jpdus2• 12 years ago

Mostly I agree with your comments but this time you missed the most important fact: Levision HAD a choice and could have complied with everything like many others have done before - but he did not choose the easy way and instead jeopardized his professional and personal future by shutting down his company and commenting publicly.

Yes, there are good reasons for the authorities to demand personal information of criminals from service providers. But there is no reason at all that secret courts decide about these demands without anyone knowing or having the chance to question the legality and scale of data sniffing.

Ironically, without Snowden we all would have no idea what is going on behind the curtain.

Levison should be lauded for his courage (and despite all technical inaccuracies or open questions about the timeline you brought up)!

PS: I dont understand why this submission is already heavily penalized, this matters for most/all of us.

tptacek18• 12 years ago

Apart from everything else in this thread, would it not also be valid to say that Levison had a choice and could have complied with everything as he himself had done in the past? You're not disquieted by a privacy regime that works or doesn't work depending on who you are and how your politics comport with those of the people running the services you use?

pdabbadabba• 12 years ago

I don't understand. What's the secret? You were able to read the 4th Circuit opinion, weren't you? That has nothing to do with Snowden, that's just normal court procedure.

rdl• 12 years ago

I think it's absolutely fair to say he wasn't adequately represented legally -- good counsel would have warned him away from some things which ultimately screwed him, even if they respected his wishes to push the limits as much as possible.

I wouldn't be opposed to government-paid counsel for certain types of businesses facing this kind of request, or costs paid automatically attached to the request so cost-of-counsel isn't a factor.

sroerick3• 12 years ago

I'm conflicted by Levison. On one hand, I support what he's doing. I also think that he's raising awareness of a serious issue.

On the other hand, I have exactly the same issues as you. I don't think that his case holds up to serious scrutiny, and I don't think he's presenting himself in good faith.

It's been frustrating to me to try and figure out what exactly is going on at the big name tech companies. Levison's story is used to justify the assumption that essentially all tech companies are compromised, legally. Personally, I've seen an overreporting of very tenuous links such as Google being linked to In-Q-Tel, and an underreporting of things like the NSA division at Dell.

Maybe this is just a PR move on Levison's part? Trying to emulate Kim Dotcom as an "Outlaw Privacy Rights Hero"? I don't know. I'm onboard with decentralizing everything, I try not to pass judgement on individual companies. Yours' is the first and only comment I've read so far, though, so I'm curious to see the rest of HN's thoughts.

nashequilibrium• 12 years ago

"pragmatic reader" Thank you for this, this is the type of comments I miss from hackernews. People never used to take everything at face value, there was extra rational analyses and everyone debated around these issues. The whole Snowden affair has turned hackernews into an irrational and one sided debate and people often turning a blind eye to valid comments against their stance.

buro9• 12 years ago

As with most things I think the truth is somewhere between both the events you've outlined and the events Levison has outlined.

It's not mutually exclusive, nor unlikely, that it did take Levison 11 days of searching to try and find an attorney who knew this area and was available AND that the DoJ wanted a much swifter response and grew impatient as the delay put the evidence at risk and so perceived the delay as stalling.

I agree with you on your subsequent comment that I'd rather trust OpenPGP with encryption, but on the sequence of events... there's nothing to say that both sides are not true at the same time, and that all motive/reason behind the events on the timeline are open to subjective interpretation.

trhway2• 12 years ago

reasonable looking nitpicking can reduce any hero to a moronic chicken/looser. Kind of character assassination by "holier than thou" types. Heroes are humans and have their flaws too. They are heroes because they find the courage to take the stand, not because they are flawless. And these flaws are where the "holier than thou" sink their claws and teeth in. Kind of reminds about the "reasonable criticism" response HN offered to Aaron Schwarz back then.

tptacek18• 12 years ago

Reasonable criticisms of Aaron Swartz did not become unreasonable when Swartz committed suicide. What you are probably perceiving is an unwillingness to introduce new criticisms unbidden for someone who has died.

gmoore• 12 years ago

Your objectivity is suspect when you choose terms such as "stonewalling", "stymie" and "playing chicken"

irv• 12 years ago

I completely agree he shouldn't have been running this service in the first place. I also agree it's a bit late to find some principles when you've been happily complying with these requests in the past.

But! The period you describe as him stonewalling the DOJ, he claims he was talking to them every day while trying to find competent legal representation.

Now, this sounds like something I would want to do if the nature of the request were different from the previous ones. (whether it was technically different or just the fact he had a personal interest in the account as you suggest doesn't really matter, just that for whatever reason it wasn't to be handled in the previous manner)

I certainly believe it was difficult for him to find good representation when he was under a gag order.

So I have some limited sympathy here; the DOJ are forcing him to move to their timeline, and he's scrambling to find good lawyers.

I think we can say he was happy to sell out users or that he was fraudulently labelling his service as secure, while acknowledging the fact that he was trying to seek legal advice at the same time.

mreiland4• 12 years ago

The obvious counter-argument is that simply talking to them isn't enough. Sure, it's a "period of silence", but that could very well mean figurative silence rather than literal silence.

He could have spent every single conversation putting them off rather than working with them, which is what's implied by the 'literal silence' anyway.

We don't exactly know what was said in those conversations, so it's hard to know whether he was silent or not. What we do know is that they weren't very fruitful for the DOJ, so it's not outlandish to assume he was simply putting them off.

tptacek18• 12 years ago

The 4th Circuit disagrees, and found that Levison did not communicate with DOJ "every day while trying to find competent legal representation". See page 10-12.

primitivesuave• 12 years ago

I applaud Ladar for making the right choice on this one. On one hand, there's a lot of skepticism about an email service whose security breaks as soon as the private keys are stolen. On the other hand, assuming Ladar is a smart individual who knows how to securely store the keys (he is), he couldn't possibly have foreseen that the government would embroil him in a cat-and-mouse game.

akerl_8• 12 years ago

Storing the private keys that decrypt the emails you're telling your users cannot be decrypted doesn't seem very secure. The whole sales pitch Lavabit used was provably false, and for him to not foresee private key compromise on his servers would be remarkably shortsighted.

gknoy• 12 years ago

Imagine what we'd have said if the keys had been compromised with Heartbleed.

DanBC• 12 years ago

he couldn't possibly have foreseen that the government would embroil him in a cat-and-mouse game.

Don't market it as a secure system then. Sell it as something that gives moderate privacy to people who are not accused of breaking laws.

The public needs better understanding of risk assessment and people selling insecure products as super secure does not help anyone.

3327• 12 years ago

This is fucked up. This type of court due process is not America. That being said Snowden is a Russian pawn and traitor but thats another matter.

Regardless of what might be the case even if its sealed there needs to be a process that allows fairness. "search" needs to be well defined its pretty general when it comes to software and tech and can be interpreted any way you want.

Perhaps time for some digital legislation?

jacquesm11• 12 years ago

I highly doubt Snowden would be in Russia Today (pun intended) if he had had confidence in the American legal system not being out to enact revenge rather than punishment. Snowden is in most of the rest of the world and good part of the United States considered to be more of a hero than a traitor, and he only became a temporary resident of Russia after the fact. If not for some political manoeuvring he would likely be somewhere else, such as Latin America.

ommunist3• 12 years ago

Russia Today is enemy to America Tomorrow (and vice versa). What is unique to current Cold War 2.0 situation is that Russians like me can communicate to Westerners like you not being afraid of punishment. By the way I doubt Snowden receives any permanent residency in Russia. In fact he legally cannot do that, except asking for political asylum. He was only granted 1-year temporary asylum in Russia and will be extradited from Russia in August this year.

room271• 12 years ago

I submitted this link 6 hours before the OP but it didn't gain much traction. I though Hacker News had a way to prevent double submissions?

https://news.ycombinator.com/item?id=7772074

kristianp• 12 years ago

Normally you'll find that the urls are slightly different, but in this case they are exactly the same, which is strange.

gus_massa• 12 years ago

Someone send a blog post about the article and later dang changed the link to the original article: https://news.ycombinator.com/item?id=7774398

randac• 12 years ago

You shouldn't have put 'Snowden' in the title. Which is pretty retarded but hey, HN.

agarwaltejas• 12 years ago

One doubt which I have is what if the servers are moved outside the United States to any other country? Would the agents still have rights to get access to it?

dredmorbius2• 12 years ago

Not via the US legal system. The US might be able to influence processes elsewhere.

However agents wouldn't be restricted by US laws and regulations either: they could simply operate to obtain the access they felt necessary to acquire the information they sought.

One of the scariest things about state surveillance actors isn't their capabilities (though in the case of the NSA and a few similar agencies elsewhere this is no doubt substantial), but their impunity. In the US, under very, very broad provisions of the so-called USA-PATRIOT Act, access to tremendous amounts of data on virtually the entire population is provided, with full legal cover. Outside the US, legal cover is reduced, but so are legal restrictions. Agents can operate with reasonably little personal risk via electronic means to gain access, or interdict and retool equipment if sufficient backdoors don't already exist.

superduper33• 12 years ago

Careface. If you don't like the laws here, GTFO of the country.

neurobro• 12 years ago

I presume you're directing this at all of the domestic enemies of the Constitution working for various levels of government, who treat the highest law of the land as an inconvenience that must be circumvented and eroded away.

aaronem2• 12 years ago

To regard the Constitution as "the highest law of the land" is, at this point in the history of the United States, somewhere between naïve and just plain silly.

The actual highest law of the land is that made by Supreme Court fiat, when they rule on the cases which they choose to hear, and whose rulings no man may practicably gainsay. Below that there are many levels of law, arranged in the sort of untidy and inter-referential tangle which any software engineer might expect out of a system that's been being patched and extended for two centuries straight; if we take the increasingly vestigial federal/state/local distinction as our demarcation, Congress occupies much of the lower half of the upper third. And, of course, at every level, and just as at all other times and places throughout the entire broad span of human history, the basic rule is that what's legal is what you get away with.

Is this how the matter ought to be? Perhaps, and perhaps not; I've seen arguments both ways. But, either way, this is how the matter is.

arcolife• 12 years ago

For all those looking for an encrypted email service, take a look at https://protonmail.ch/

listic• 12 years ago

So, the encrypted email is illegal in the USA. Is accessing the Internet over VPN legal?

Pardon my ignorance, I am new to the issues of encryption and privacy. Always assumed I can worry about it later, but the time has come at last. About time, when my native country is enforcing the laws that permit internet censorship an increasingly wide scale. http://en.wikipedia.org/wiki/Russian_Internet_blacklist

ds93• 12 years ago

It's not exactly illegal, and the new secret-orders tactics are the government's workaround.

In the 1990s there was a series of political/legal conflicts over encryption, which was about to go mainstream (the whole episode is now referred to as the "clipper chip" controversy). The USG wanted strong encryption without backdoors banned, and everyone to use instead a set of encryption protocols which would have provided keys for the government (the "key escrow" idea), and the USG would promise not to abuse the power to decrypt everyone's communications.

Some heroic technical people worked around that and actually exported what eventually became PGP/GPG on paper to take advantage of a loophole in the ban. The controversy faded and the civilian right to non-backdoored, strong encryption became the nominal law and policy.

Since then the USG has been working to undo and reverse this situation by any means it can find. What it's come up with is (a) the NSA mass-wiretapping regime (actually a continuation Echelon and several other prior, longstanding mass-surveillance schemes) and (b) the set of legal tools applied to Lavabit.

And they've mostly succeeded. Secure communication is theoretically legal, but if the government can coerce encryption keys, secure communication is defacto subject to being stopped anytime the government takes an interest in someone. And while providing secure comms as a service is technically still legal, if the feds can demand a combination of trojaning the service and concealment of the subversion from users, then they have effectively banned secure communications in practice, while maintaining the written law as-is.

tom_jones• 12 years ago

It reads like a an unbelievable chapter from Orwell's 1984, and it occurred in the United States of America, the oft stated bastion of democracy.

At every possible opportunity resistance was stymied, with the presumption that the will to resist would eventually collapse.

They lost because they never once contemplated the possibility of you being willing to shut down your business because of your principles, something they couldn't fathom or conceive of, since such a concept is anathema to their wholly illegal and unconstitutional activities.

roma1n• 12 years ago

I wonder if the Lavabit author would be amenable to e.g. a kickstarted with the goals of

- open-sourcing lavabit - making it ready for instant deployment e.g. using Docker

A kind of "just add a VPS" platform...

jokoon• 12 years ago

what would have happened if he just decided to delete snowden's mails and account to save his company ?

ds93• 12 years ago

Deleting the emails would have put Levison/Lavabit in violation of long-established law (destruction of evidence is a crime). Note that with PFS (if I recall correctly, Lavabit did not use PFS), preserving past emails does not help the adversary.

Deleting the account, however, seems much more viable for similar situations. Forcing a company (like Lavabit) to provide service to an individual might be supportable, based in part on past precedents to do with race discrimination and general regulation-of-business principles, but would be unprecedented in regard to a non-commercial entity. Arguably it would run afoul of the 13th Amendment in the US.

Of course, written law has little bearing on what the government can do in practice in today's USA.

retrogradeorbit2• 12 years ago

Kafka's parable of the law: https://www.youtube.com/watch?v=rfkxKkrPZPQ

h1karu• 12 years ago

Why would any privacy related service provider operate within the United States of America ? It's one of the worst jurisdictions for that kind of thing.

To me that makes no sense whatsoever, so this start-up was doomed from the very onset.

gdonelli• 12 years ago

Respect!

hellbreakslose• 12 years ago

May the force be with us!

ommunist3• 12 years ago

Following guelo. I agree - Levinson is a hero. I am almost sure he is the last American hero. Once the US citizens loose their right to privacy, they will not be able to produce such heroes anymore as a nation, and will transform to something like complacent Russians (who lost their rights to privacy much, much earlier).

eyeareque• 12 years ago

This sounds like something you'd hear about in a communist country. We are in a lot of troue if we don't do so drying about what our government is trying to do. Eric Snowden and Lavabit are two examples of people who will be seen as heroes in the future.

Eye_of_Mordor• 12 years ago

China already sees the US as a place with less respect for human rights than they do, so in some ways, the US is worse than a communist country.

erjjones• 12 years ago

Open Source your code and the community will help you see it a reality

snambi• 12 years ago

Overall this is not good. Sure, the govt can do what they want. But what useful information they got from these emails? Did it make the country safer? Did it make the world a better place?

Using the law is one thing. Using the law for the intended purpose is a different thing.

Not sure whether the law is really used for the right purpose.

Why I was forced to shut down Lavabit

Related Stories