
Why I was forced to shut down Lavabit - cottonseed
http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email
======
redthrowaway
The original article, which was likely buried due to having 'Snowden' in the
title:

[http://www.theguardian.com/commentisfree/2014/may/20/why-
did...](http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-
shut-down-snowden-email)

~~~
sumedh
> which was likely buried due to having 'Snowden' in the title

Can you be more specific?

~~~
mnem
Perhaps a reference to articles with certain keywords being apparently
penalized in the HN rankings: [http://www.righto.com/2013/11/how-hacker-news-
ranking-really...](http://www.righto.com/2013/11/how-hacker-news-ranking-
really-works.html)

------
pdknsk
> My company, Lavabit, provided email services to 410,000 people – including
> Edward Snowden, according to news reports – [...].

Does he write "according to news reports" for legal reasons? Obviously he
should know, I think.

> The government argued that, since the "inspection" of the data was to be
> carried out by a machine, they were exempt from the normal search-and-
> seizure protections of the Fourth Amendment.

That's insane.

~~~
mpyne
> > The government argued that, since the "inspection" of the data was to be
> carried out by a machine, they were exempt from the normal search-and-
> seizure protections of the Fourth Amendment.

> That's insane.

It's also immaterial. In this case DOJ _got_ an Article III warrant (if not
several), which was specific in what was to be seized. This is the system that
Snowden claimed to be trying to defend by revealing "warrantless wiretapping"
working exactly as designed.

DOJ got a warrant for the exact thing they wanted, and all of sudden
Constitutional separation of powers became inconvenient to Levison (even
though he complied with such warrants before, and eventually offered to comply
in this case for cash).

~~~
higherpurpose
Still interesting to see how they think about it.

------
liquidise
This article, which simply confirms what many speculated took place with
Lavabit, makes my blood boil. I don't know what is worse: this specific
technology instance, or the idea that similar instances have existed for some
time.

Either way i find then entire paradigm infuriating and undermining to our
supposed liberties.

~~~
saraid216
I'm unclear what new information was presented in this article? Hasn't Levison
said all of this before?

~~~
aroch
He's never laid out the timeline of events or why/how he was found in
contempt.

------
primitivesuave
I applaud Ladar for making the right choice on this one. On one hand, there's
a lot of skepticism about an email service whose security breaks as soon as
the private keys are stolen. On the other hand, assuming Ladar is a smart
individual who knows how to securely store the keys (he is), he couldn't
possibly have foreseen that the government would embroil him in a cat-and-
mouse game.

~~~
akerl_
Storing the private keys that decrypt the emails you're telling your users
cannot be decrypted doesn't seem very secure. The whole sales pitch Lavabit
used was provably false, and for him to not foresee private key compromise on
his servers would be remarkably shortsighted.

~~~
gknoy
Imagine what we'd have said if the keys had been compromised with Heartbleed.

~~~
floody-berry
He probably would've been called dishonest and accused of peddling snake oil.
That whole conversation was, fortunately for him, buried under the "government
is going crazy with power!!" story; he's a nerd hero who is sticking it to the
man instead of just another crypto shyster.

------
tptacek
This summary is probably misleading. A different perspective on the facts of
this case is on display in the 4th Circuit ruling on Levison's contempt
charges:

[https://s3.amazonaws.com/s3.documentcloud.org/documents/1114...](https://s3.amazonaws.com/s3.documentcloud.org/documents/1114251/lavabit-
usca4-op.pdf)

In short: Levison claims that the DOJ demanded access to the content of all
his users messages, and implies that after he complied with that order, they
escalated to demand his TLS keys.

But that doesn't seem to be what happened. A fuller timeline of Lavabit might
(please correct me) look like this:

 _t-n..t_ : Levison complies with numerous court orders demanding information
about users of Lavabit.

 _t_ : Levison is served with a court order demanding the metadata associated
with Snowden. It is unclear whether this demand is actuated by a device that
DOJ mandates installation of, but what is clear is that there was a debate
between Levison and the DOJ about Levison's capabilities w/r/t/ furnishing the
DOJ with information about Snowden's account.

 _t+1_ : Levison refuses to comply with the DOJ order, while indicating that
he has the technical capacity to comply with at least some of it.

 _t+2_ : DOJ escalates with a magistrate court order requiring that Lavabit
use its technical capabilities to defeat its encryption of Snowden's
information --- a capability that Levison acknowledges having, that is obvious
from the design of Lavabit, and that has a precedent in other "secure" email
providers.

 _t+2..t+13_ : Levison spends 11 days stonewalling DOJ, refusing not only to
comply with the order but also to meet with the DOJ. Per the 4th Circuit: "As
each day passed, the Government lost forever the ability to collect the
target-related data for that day.". Levison is playing chicken, and DOJ is now
furious.

 _t+13_ : DOJ arranges to compel Levison to appear at a district court
hearing, while reiterating that it requires only the metadata information
surrounding Snowden's account.

 _t+14..t+17_ : Levison delays 4 more days.

 _t+17_ : Levison, via his attorneys, replies to the DOJ's order with a
counterproposal that involves billing DOJ for his time, collecting a limited
set of information, and furnishing it to DOJ only at the conclusion of the
entire collection period.

 _t+20_ : DOJ, furious and contending that they've lost all reasonable faith
in Levison's cooperation with their investigation, demands the TLS keys for
Lavabit in order that they can control the collection of the data they need
from Lavabit.

Again: please correct details here where I'm wrong.

Most readers of this thread will have enormous sympathy for Levison and his
efforts to stymie the DOJ's investigation of Snowden through his account on
Lavabit.

However, a jaundiced, cynical, or purely pragmatic reader might also find
grave flaws in Levison's response to this situation. His position on the
matter does not appear to have been content-neutral: he complied with previous
orders. More importantly, when an order came in for an account he had a
personal interest in, he escalated matters so that DOJ would end up
compromising _everyone 's_ information, by playing a game of chicken he was
sure to lose.

~~~
claudiusd
You're missing the point that Levison makes his last paragraph: "courts must
not be allowed to consider matters of great importance under the shroud of
secrecy, lest we find ourselves summarily deprived of meaningful due process".

His argument was that he could not find appropriate legal representation
because of the gag order, and that the DOJ would not cooperate in kind with
his legal team once assembled. Do you think his delays were too long given
these constraints and the fact that he has a company to run?

If I have sympathy for Levison it's because he was intimidated into laying
aside his moral beliefs. It could happen to any of us.

~~~
danielweber
_His argument was that he could not find appropriate legal representation
because of the gag order_

If true this would be, by itself, a really really big deal. But the article
doesn't seem to say that. It says he couldn't find a lawyer willing to take on
his case, but he talked with "a dozen." Lawyers are the best people to ask for
recommendations to other lawyers.

~~~
mreiland
As a software developer, I become "that computer guy" to everyone in my
family. Which means I know everything about everything wrt computers.

Is this true in your experience? Do you think it's a good idea to have your
run of the mill web developer creating device drivers for your embedded
device?

Why then, do you think it was enough for him to simply speak with "dozens of
lawyers" rather than finding one that had both knowledge and experience
dealing with the specific area of the law dealing with this issue?

~~~
danielweber
Lawyers are how you find references to other lawyers.

------
danieldk
Link to the actual article:

[http://www.theguardian.com/commentisfree/2014/may/20/why-
did...](http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-
shut-down-snowden-email)

------
auston
So what can we do about this as Americans?

~~~
davidw
Here are a few things:

* Call - don't email - call your representatives and express, politely, the fact that this kind of thing is Not OK. Writing a letter on paper is good too, apparently. Stop reading and do this now.

* Donate money to groups like the EFF.

* Volunteer with groups like the EFF.

* Use and support stuff like GPG.

* Don't bitch and moan about "woe is us, it's impossible". That only makes it easier for those who would deny us our rights.

* This will be a difficult, and quite likely drawn-out struggle. Don't give up. Keep working at it.

~~~
akerl_
What would I be calling to tell them? That the government shouldn't be able
to, through proper channels, obtain a warrant requesting specific named
information regarding an investigation of a specific individual for things
that violate US law?

If we disagree with the laws, ok: protest for legal reform. If we disagree
with the things revealed by Snowden, ok: protest that. But what happened to
Lavabit was the government behaving properly: they obtained a narrow warrant
for specifically the data they needed as part of their investigation, they
tried to work with Levison to fulfill the warrant, and only after days of
being stonewalled did they escalate to ensure compliance.

~~~
retrogradeorbit
It was at that point of escalation where they start to step outside the law
and begin to act unlawfully and unprofessionally. They demand everyone play by
the law, then the minute they find some push back, they stop playing by the
law. But then they _are_ the law and they can do whatever they want. So let's
not pretend they are anything but a bunch of unprofessional bullies who don't
like being on the receiving end of their own game-play. Yes, they can do what
they did. No, this 'justice' system is not interested in a fair trial. They
can do basically anything and get away with it. Who holds the government to
account? In the end people choose to believe the propaganda (land of the free,
justice blah blah) so they can sleep easy at night. But it's all complete
bullshit. And before and after power reigns.

------
tom_jones
It reads like a an unbelievable chapter from Orwell's 1984, and it occurred in
the United States of America, the oft stated bastion of democracy.

At every possible opportunity resistance was stymied, with the presumption
that the will to resist would eventually collapse.

They lost because they never once contemplated the possibility of you being
willing to shut down your business because of your principles, something they
couldn't fathom or conceive of, since such a concept is anathema to their
wholly illegal and unconstitutional activities.

------
room271
I submitted this link 6 hours before the OP but it didn't gain much traction.
I though Hacker News had a way to prevent double submissions?

[https://news.ycombinator.com/item?id=7772074](https://news.ycombinator.com/item?id=7772074)

~~~
gus_massa
Someone send a blog post about the article and later dang changed the link to
the original article:
[https://news.ycombinator.com/item?id=7774398](https://news.ycombinator.com/item?id=7774398)

------
pekk
This again? Lavabit was forced to shut because of the way it was implemented,
and its proprietor has been cashing in on that design flaw ever since. There
is no reason why complying with one search warrant should EVER require
disclosure of the SSL cert for the whole domain, or any other disclosure
sufficient to read data from customers other than the one covered by the
warrant. But this is just what everyone claimed when Lavabit was closing.

If you build a business on selling security to people and you make such a
mistake in the design of your software, you failed to deliver what you
promised to your customers and you deserve to fail.

And not get bailed out because you thumped your chest about having to service
search warrants when you chose to set up in US jurisdiction. If you don't want
to be obligated to comply with lawful US requests like search warrants then
don't set up in the US.

~~~
lifeisstillgood
It seems a little much to blame lavabit for sitting in the USA with its
constitutional protections of free speech and privacy, and suggest it should
set up in say a offshore banking haven, few of which have constitutions and a
couple have dictatorial-like powers.

Additionally can you explain how he got the architecture "wrong"?

Edit: Précis of the architecture of Lavabit from
[http://www.thoughtcrime.org/blog/lavabit-
critique/](http://www.thoughtcrime.org/blog/lavabit-critique/)

Lavabit kept your private key on their server, but encrypted it with your
plaintext password which you sent them if you wanted to read your mail. That's
pretty rubbish in many ways as the article rather even handey points out. A
sentiment I am agreeing with - we applaud him for standing up, not for being
perfect.

~~~
sandstrom
While I agree with your comment, one could note that there are non-US
alternatives that are not offshore banking havens.

I'd guess that Switzerland, Sweden and Germany would (probably) all have
provided a better judicial environment.

~~~
ceejayoz
> I'd guess that Switzerland, Sweden and Germany would (probably) all have
> provided a better judicial environment.

The downside, though, is the NSA having freer reign there.

------
rrggrr
I just donated $25 to the EFF. I hope everyone else will do the same or more.

~~~
ommunist
This will not return Lavabit back to business, I am afraid. But it will
definitely help to raise awareness among users about their rights.
Unfortunately, the topic article shows very well, that US government can
easily seize your actual rights, despite your high awareness.

------
h1karu
Why would any privacy related service provider operate within the United
States of America ? It's one of the worst jurisdictions for that kind of
thing.

To me that makes no sense whatsoever, so this start-up was doomed from the
very onset.

------
listic
So, the encrypted email is illegal in the USA. Is accessing the Internet over
VPN legal?

Pardon my ignorance, I am new to the issues of encryption and privacy. Always
assumed I can worry about it later, but the time has come at last. About time,
when my native country is enforcing the laws that permit internet censorship
an increasingly wide scale.
[http://en.wikipedia.org/wiki/Russian_Internet_blacklist](http://en.wikipedia.org/wiki/Russian_Internet_blacklist)

~~~
ds9
It's not exactly illegal, and the new secret-orders tactics are the
government's workaround.

In the 1990s there was a series of political/legal conflicts over encryption,
which was about to go mainstream (the whole episode is now referred to as the
"clipper chip" controversy). The USG wanted strong encryption without
backdoors banned, and everyone to use instead a set of encryption protocols
which would have provided keys for the government (the "key escrow" idea), and
the USG would promise not to abuse the power to decrypt everyone's
communications.

Some heroic technical people worked around that and actually exported what
eventually became PGP/GPG _on paper_ to take advantage of a loophole in the
ban. The controversy faded and the civilian right to non-backdoored, strong
encryption became the nominal law and policy.

Since then the USG has been working to undo and reverse this situation by any
means it can find. What it's come up with is (a) the NSA mass-wiretapping
regime (actually a continuation Echelon and several other prior, longstanding
mass-surveillance schemes) and (b) the set of legal tools applied to Lavabit.

And they've mostly succeeded. Secure communication is theoretically legal, but
if the government can coerce encryption keys, secure communication is defacto
subject to being stopped anytime the government takes an interest in someone.
And while providing secure comms as a service is technically still legal, if
the feds can demand a combination of trojaning the service _and_ concealment
of the subversion from users, then they have effectively banned secure
communications in practice, while maintaining the written law as-is.

------
biotech
Is there an open-source, decentralized service that can be used for encrypted
email? Something like that could be much more difficult to compromise.

~~~
aliakbarkhan
Why trust it to a service? Encrypt it yourself.

~~~
cortesoft
You will need your recipients to also decrypt it themselves, then. And handle
your own key-exchanging. Not trivial, if you want to be able to email lots of
people.

------
ommunist
Following guelo. I agree - Levinson is a hero. I am almost sure he is the last
American hero. Once the US citizens loose their right to privacy, they will
not be able to produce such heroes anymore as a nation, and will transform to
something like complacent Russians (who lost their rights to privacy much,
much earlier).

------
snambi
Overall this is not good. Sure, the govt can do what they want. But what
useful information they got from these emails? Did it make the country safer?
Did it make the world a better place?

Using the law is one thing. Using the law for the intended purpose is a
different thing.

Not sure whether the law is really used for the right purpose.

------
eyeareque
This sounds like something you'd hear about in a communist country. We are in
a lot of troue if we don't do so drying about what our government is trying to
do. Eric Snowden and Lavabit are two examples of people who will be seen as
heroes in the future.

~~~
Eye_of_Mordor
China already sees the US as a place with less respect for human rights than
they do, so in some ways, the US is worse than a communist country.

------
roma1n
I wonder if the Lavabit author would be amenable to e.g. a kickstarted with
the goals of

\- open-sourcing lavabit \- making it ready for instant deployment e.g. using
Docker

A kind of "just add a VPS" platform...

------
retrogradeorbit
Kafka's parable of the law:
[https://www.youtube.com/watch?v=rfkxKkrPZPQ](https://www.youtube.com/watch?v=rfkxKkrPZPQ)

------
agarwaltejas
One doubt which I have is what if the servers are moved outside the United
States to any other country? Would the agents still have rights to get access
to it?

~~~
dredmorbius
Not via the US legal system. The US might be able to influence processes
elsewhere.

However agents wouldn't be _restricted_ by US laws and regulations either:
they could simply operate to obtain the access they felt necessary to acquire
the information they sought.

One of the scariest things about state surveillance actors isn't their
capabilities (though in the case of the NSA and a few similar agencies
elsewhere this is no doubt substantial), but their _impunity_. In the US,
under very, very broad provisions of the so-called USA-PATRIOT Act, access to
tremendous amounts of data on virtually the entire population is provided,
with full legal cover. Outside the US, legal cover is reduced, but so are
legal restrictions. Agents can operate with reasonably little personal risk
via electronic means to gain access, or interdict and retool equipment if
sufficient backdoors don't already exist.

------
jokoon
what would have happened if he just decided to delete snowden's mails and
account to save his company ?

~~~
ds9
Deleting the emails would have put Levison/Lavabit in violation of long-
established law (destruction of evidence is a crime). Note that with PFS (if I
recall correctly, Lavabit did not use PFS), preserving past emails does not
help the adversary.

Deleting the account, however, seems much more viable for similar situations.
Forcing a company (like Lavabit) to provide service to an individual might be
supportable, based in part on past precedents to do with race discrimination
and general regulation-of-business principles, but would be unprecedented in
regard to a non-commercial entity. Arguably it would run afoul of the 13th
Amendment in the US.

Of course, written law has little bearing on what the government can do in
practice in today's USA.

------
S_A_P
This is truly maddening stuff. I applaud the guardian for running this...

------
erjjones
Open Source your code and the community will help you see it a reality

------
gdonelli
Respect!

------
hellbreakslose
May the force be with us!

------
superduper33
Careface. If you don't like the laws here, GTFO of the country.

~~~
neurobro
I presume you're directing this at all of the domestic enemies of the
Constitution working for various levels of government, who treat the highest
law of the land as an inconvenience that must be circumvented and eroded away.

~~~
aaronem
To regard the Constitution as "the highest law of the land" is, at this point
in the history of the United States, somewhere between naïve and just plain
silly.

The _actual_ highest law of the land is that made by Supreme Court fiat, when
they rule on the cases which they choose to hear, and whose rulings no man may
practicably gainsay. Below that there are many levels of law, arranged in the
sort of untidy and inter-referential tangle which any software engineer might
expect out of a system that's been being patched and extended for two
centuries straight; if we take the increasingly vestigial federal/state/local
distinction as our demarcation, Congress occupies much of the lower half of
the upper third. And, of course, at every level, and just as at all other
times and places throughout the entire broad span of human history, the basic
rule is that what's legal is what you get away with.

Is this how the matter ought to be? Perhaps, and perhaps not; I've seen
arguments both ways. But, either way, this is how the matter _is_.

------
AaronBBrown
I was half expecting this to be about Apache Kafka.

------
arcolife
For all those looking for an encrypted email service, take a look at
[https://protonmail.ch/](https://protonmail.ch/)

------
3327
This is fucked up. This type of court due process is not America. That being
said Snowden is a Russian pawn and traitor but thats another matter.

Regardless of what might be the case even if its sealed there needs to be a
process that allows fairness. "search" needs to be well defined its pretty
general when it comes to software and tech and can be interpreted any way you
want.

Perhaps time for some digital legislation?

~~~
jacquesm
I highly doubt Snowden would be in Russia Today (pun intended) if he had had
confidence in the American legal system not being out to enact revenge rather
than punishment. Snowden is in most of the rest of the world and good part of
the United States considered to be more of a hero than a traitor, and he only
became a temporary resident of Russia after the fact. If not for some
political manoeuvring he would likely be somewhere else, such as Latin
America.

~~~
ommunist
Russia Today is enemy to America Tomorrow (and vice versa). What is unique to
current Cold War 2.0 situation is that Russians like me can communicate to
Westerners like you not being afraid of punishment. By the way I doubt Snowden
receives any permanent residency in Russia. In fact he legally cannot do that,
except asking for political asylum. He was only granted 1-year temporary
asylum in Russia and will be extradited from Russia in August this year.

~~~
jacquesm
I wouldn't put it past our esteemed politicians to make backroom deals about
stuff like this. Something along the lines of 'we need a new enemy, this
terrorism thing is running out, how about a cold-war light?', 'let me get on
the horn with Putin and see what he thinks about it...'.

I like Russians, have some Ukrainian friends and have spent a good part of my
life behind where the former iron curtain used to be. So my perspective is
probably quite warped. Putin and his band of cronies are effectively still
doing exactly what the communist fat cats were doing, now you have he mafia to
worry about instead of the authorities (that may be a couple of years out of
date).

It's funny how everything changes and yet, the basics are still the same. Real
change takes a long time.

