Hacker News Reader

Comment by thrownaway2424 | Hacker News Reader

Jump to conclusions often? The MUCH simpler, obviously far more likely sequence of events, is:

1) June 28th: FBI/DoJ obtains lawful court order for a pen register trace on Snowden's email account. 2) June 28th-July 9th: Lavabit fails to comply. 3) July 9th: Lavabit held in contempt, which is clearly appropriate as they did not respond to a lawful court order. 4) July 9 - August 1: FBI obtains search warrant for Snowden's email. Lavabit challenges warrant on the irrelevant technical grounds that they encrypt all users' email with same key. 5) August 8: Lavabit shuts down, because it turns out that hosting email for the criminal class carries real risks and isn't terribly lucrative.

You can't wave off court orders just because you think the Internet is some kind of libertarian cyber-paradise where mortal laws do not apply. Court orders and search warrants are lawful means of investigation. Lavabit's business was not compatible with US laws or probably the laws of any country more developed than Zimbabwe.

View on HN

You sound awfully authoritarian. Just because its lawful doesn't mean it's morally right and that it should be blindly followed no questions asked.

In Nazi Germany it was lawful and mandatory to report on Jews, communists and minorities and the inability to do so or aiding them in any way would often end in the death of the person involved.

You can't throw out common sense and basic decency just because something is "the law".

I would agree with you, but the netiquette rule is: "whoever mentioned the Nazis has automatically lost whatever argument was in progress"

No, the "Internet Law" is that as an Internet discussion approaches a length of infinity, the likelihood that someone mentions the Nazis approaches 1.

It doesn't necessarily mean the mention was unwarranted or inappropriate.

This was humour.

That caused me to lose 4 points of karma.

Seriously ????

So you're saying that complying with a pen register order in a federal case is the same as reporting jews to the ss? I ask because there's another guy in this thread who equated pen registers with anti-interracial marriage laws. You guys should get together.

I see no suggestion of equivalency in either post, unless you think such examples represent the lower-bound of how out of line the law must be before you can reject it. Surely you don't think that...

These examples establish that there is a limit to blindly pinning morality and the law. These examples to not make statements about where that limit is, nor do these examples serve to equate any of the governments' actions.

> I see no suggestion of equivalency

Well, there were zero mentions of Nazis before we started. Then you brought Nazis into the picture. I can imagine, based on how you've brought up a completely unrelated topic, you must be drawing some sort of comparison. Otherwise why mention them?

Even if you're not saying they're identical, they aren't even on the same order of magnitude. Compare this to Soviet surveillance, or some other oppressive regime if you must. Don't bring the murder of millions of innocent people into the discussion just to prove a point. It trivializes a horrible event.

> Then you brought Nazis into the picture.

I think you need to spend less time writing accusational posts and more time reading the posts that other people have written here.

Seriously; take a deep breath, relax, and read.

Soviet surveillance directly and/or indirectly involved the murder of millions of innocent people though.

I would argue that actively avoiding to mention a horrible event will cause it to be forgotten and wouldn't help prevent a similar event from happening again.

(side note: it was VexXtreme, not jlgreco, that first mentioned Nazis)

Both of the posts indirectly imply that complying with this specific pen register order would have been evil on the hitler/mlkjr scale, because they are both made in the context of this article. It would be pointless to say "One must not comply with evil laws, but this law isn't evil, so cool, nevermind what I was saying about evil."

A comment that implies this specific court order was evil, or even moderately wrong, needs to be accompanied by supporting rhetoric about _why_ it was wrong, some indictment of our system of due process. Without such supporting arguments the comments are just disposable invocations of Godwin.

> "Both of the posts indirectly imply that complying with this specific pen register order would have been evil on the hitler/mlkjr scale"

That is an implication you invented. The person who quoted MLK has in fact already very explicitly and painfully clearly stated that he thinks no such thing[1]. If you continue to think that he was implying that, then you are the one that's got an issue.

This "mock offense at historical allusions" shit has no place on HN. It is transparent as hell and does nothing but gum up the discussion.

[1] https://news.ycombinator.com/item?id=6486091

Yeah, but he didn't clarify what he actually meant by invoking the MLK quote. As I said, it was a disposable invocation of a historical quote.

I've read every comment in this thread and I don't see anybody making even a semi-cogent argument about how due process was violated in this case. Remember, the US Constitution does not guarantee your privacy. It guarantees that you won't be deprived of it without due process of law. That process appears to have been followed here, by the government at least. People like the Lavabit founder who refuse to comply with the results of due process are as guilty of undermining our system of laws as any corrupt law enforcement agency.

He could not have possibly given you a more exact and clear response to your request for clarification.

I was previously giving you the benefit of the doubt and leaving myself open to the possibility that you simply had not seen it (since it is technically in response to himself) but if you really did read his response, then continued to misrepresent his comment that way, then you are doing nothing but shitposting.

All he did was provide an example to debunk your notion that something should be obeyed simply because it's the law. I have no idea how you arrived at such an extreme conclusion that he's implying that both laws are equally evil.

He's attacking the metaphor because his actual argument is too piss-weak to continue.

I feel sick when I see people taking analogies as equations, because I like doing analogies myself. Analogies are intentionally exaggerated (but still being logically valid) to make the point stand out. I thought Hacker News readers were better than that.

You can't wave off court orders just because you think the Internet is some kind of libertarian cyber-paradise where mortal laws do not apply.

The story we've heard so far is that Lavabit had routinely complied with warrants and cooperated with targeted investigations against specific individuals. There are court records documenting at least some of these cases.

The details given here are beyond sketchy. Your characterization is hyperbolic and as far as I can see, unwarranted.

> The filings show that Lavabit was served on June 28 with a so-called “pen register” order requiring it to record, and provide the government with, the connection information on one of its users every time that user logged in to check his e-mail.

How is that different than previous warrants? How is that sketchy?

Let's not dance around on this.

That warrant was different because it was for Edward Snowden.

Lavabit clearly feels he is a legitimate whistleblower. There is a reasonable argument that protecting a whistleblower from surveillance is morally valid (especially when his opposition to surveillance is the core of ).

Whether or not one thinks Lavabit should have done this probably depends on one's views on what Snowden did.

No it was not different because it was for Edward Snowden, but because even if Snowden was named in the order, the FBI wanted the access to everything by installing their own device on the point where nothing is encrypted: https://news.ycombinator.com/item?id=6487778

Here's the thing. Whistleblowers do get protection... but mostly protection from retaliation for their whistleblowing. But if a proper investigation is obstructed, how are we to be certain they are a legitimate whistleblower (there are rules that need to be followed) and not just some guy spilling classified info? I would maintain that it was not Lavabit's place to render a verdict of not guilty and defy the court order. If the cops show up at my house with a search warrant for my wife's closet, I don't get to just tell them I don't think she did it and close the door on them.

I guess the question is "at what point is it morally correct to resist government powers, even if those powers are legally granted?".

All would agree it comes at some point (insert references to morally repugnant dictatorships etc).

Even democratically elected governments cross the line (insert historical references to 1930's Europe).

Even "good" governments cross the line (insert reference to numerous examples of legal persecutions of minority groups in most democracies).

Sometimes civil disobedience is a the morally correct thing to do. Was it in this case? Personally, I'm not sure either way.

While I agree 100% that Lavabit's actions were unlawful, just saying "there are rules" isn't enough to convince me that those same actions were "wrong".

I think a better question is "at what point does anyone get to tell anyone else that their morals must match?"

I'm glad we can agree that Lavabit's action were unlawful... but please don't quote me out of context. "There are rules" was with regard to there being certain rules that need to be followed in order to qualify as a legitimate whistleblower. If you would like to argue that those rules need not be followed then I'll respectfully decline.

Yes, lets trust the organization that the whistleblower whistled against to define who is a legitimate whistleblower.

Yes. Lets. Oh... we already do. Why not this time? Should we let 4chan or Reddit define it? Who then? Not every single person in every single department in every single 3-letter org is a corrupt asshole just waiting for their chance to stick it to some innocent.

Of course they are not. That is not how tyranny works. It works by everyone doing there part, asshole or not. The tyranny is ingrained in the system itself so its seems just normal.

And we can all see what is normal in the US today.

Here's the thing. Whistleblowers do get protection... but mostly protection from retaliation for their whistleblowing.

Yeah, that didn't play out so cleanly for Thomas Drake.

I'm not certain that lavabit should be unilaterally deciding who the good guys and bad guys are. That's something that happens later.

Well, if everyone decided that "happens later" he'd most likely be dead or in Guantanamo Bay right now, so... Someone has to make a decision based on their own values at some point.

Not everyone completely lacks conviction and ideals, you know.

When was the last time somebody was shipped off to Guantanamo Bay? And seriously, dead? The first warrant the FBI requested was dated June 28th. Snowden was already in Moscow. How would Lavabit cooperating with the warrant have resulted in dead?

It could mean ill things for any of the people who are holding his insurance policies.

Yes, instead let the US government do that unilaterally. Clearly better.

I don't know. Maybe if we knew all the details of this case and the previous cases, we could say. Maybe it has something to do with the architecture of the service. Maybe Levison felt that turning Lavabit into a real-time tracking device crossed a line he hadn't crossed before.

I just don't think it's right to call Levison rude names and all but convict him on these vague reports.

On the other hand, it seems like a poor idea to say he is a hero. It certainly seems like he decided that in this case of a legitimate court order(Snowden, right wrong or otherwise, did break a bunch of US laws) he wasn't going to comply --- though by his own admission he could comply for just one account --- and is using the fact that there is a gag order to in fact make his actions seem nobler than they were.

> It certainly seems like he decided that in this case of a legitimate court order(Snowden, right wrong or otherwise, did break a bunch of US laws) he wasn't going to comply --- though by his own admission he could comply for just one account

Why do you think that makes it a bad idea to call him a hero? Far from being a reason not to appreciate him, it seems to me that what you describe is the very action that people are describing as heroic.

Im reasonably sure they are saying he is heroic for standing up to warrantless surveillance, not refusing to hand over data pursuant to a legitimate and specific warrant that he objected to. He's certainly made it sound like that. So first, I'd say he is being very dishonest (if the article is accurate)

Second, a critical point in arguing against warrantless surveillance is that there are legitimate legal channels through which to get the necessary information when it's really needed and that those same channels make the NSA's conduct completely and totally illegal. Failing to abide by those mechanisms makes it hard to make that argument.

It's like having the EFF sticker that says "come back with a warrant" and then a "Fuck the police" sticker next to it.

> "Im reasonable sure they are saying he is heroic for standing up to warrantless surveillance, not refusing to hand over data pursuant to a legitimate and specific warrant that he objected to."

I cannot speak for anybody else, but feel free to consider me among those who consider the later to be heroic. He stuck his neck out for people that he doesn't know, but for whom he feels an obligation to protect. He gave up his business to do it.

Legalities never play a role in my considerations of heroism (except in cases where something being illegal actually serves to make it more heroic, due to the personal sacrifice that typically implies).

Do you really think that the SSL private keys turned over for this legitimate and specific warrant wouldn't have found their way into the warrantless wiretapping program?

No I don't at all, not at least without serious oversight by a federal judge and even then I'd prefer not to have to rely on that. But according to the article, they didn't originally ask for SSL private keys. They asked for Lavabit to give them Snowden's password the next time he logged in. They only resorted to that after they decided Lavabit couldn't be trusted for delaying and refusing to comply with the original court order.

Suppose Lavabit was a bank who got a court order to hand over the contents of a safety deposit box belonging to Snowden and refuses. The FBI demands Lavabit now open the safe that contains all the safety deposit boxs so they can go throw and find Snowden's box and open it. <Edit> and you just have to "trust" them they won't open everything</edit>. This is roughly what happened.

Lavabit is basically claiming that the FBI started out with the break open everything tactic. They are, if the article is true, lying.

No I don't at all, not at least without serious oversight by a federal judge and even then I'd prefer not to have to rely on that

If the data is being acquired under EO 12333, they don't have to report anything to the FISC nor Congress. Where do you see "serious" oversight occurring?

http://www.emptywheel.net/2013/10/02/james-clapper-proves-in...

http://www.techlawjournal.com/topstories/2008/20080731.asp

WRONG.

It would be the equivalent of opening ALL the safety deposit boxes.

Using a hammer to thread a needle

Lavabit had already defied court orders BEFORE they were asked for SSL keys. So it is kind of a moot point. Had they complied with the initial order, SSL keys likely would not have been requested.

Where do you read that "only one user"? https://news.ycombinator.com/item?id=6487852

Uh... in the document you linked to. Exhibit 2 (bottom of page 1, top of page 2) says this, exactly:

> IT IS ORDERED, pursuant to 18 U.S.C. § 3123, that a pet/trap device may be installed and used by Lavabit and the Federal Bureau of Investigation to capture all non-content dialing, routing, addressing, and signaling information (as described and limited in the Application), sent from or sent to the SUBJECT ELECTRONIC MAIL ACCOUNT, to record the date and time of the initiation and receipt of such transmissions, to record the duration of the transmissions, and to record user log-in data (date, time, duration, and Internet Protocol address of all log-ins) on the SUBJECT, ELECTRONIC MAIL ACCOUNT, all for a period of sixty (60) days from the date of such Order or the date the monitoring equipment becomes operational, whichever occurs later;

For the record, Lavabit routinely complied with search warrants, including one just months before this incident [1].

So what was different about this one?

1. https://www.docketalarm.com/cases/Maryland_District_Court/1-...

The difference is that FBI this time wanted to install their own equipment inside of his facilities (at the point where everything of every user is decrypted):

http://s3.documentcloud.org/documents/801182/redacted-pleadi...

"shall furnish agents from the Federal Bureau of Investigation, forthwith , all information, facilities, and technical assistance necessary to accomplish the installation and use of the pen/trap device."

Before, they would really demand only the information of the user named in the court order. This time it was "just let us install this thing inside and don't ask."

It would have enabled to government to listen in to everyone using the service, not just get the information of the intended target.

Is that true? As I understood it, the original request was for pen/trap on Snowden alone; when that was refused and Levison threatened with contempt, he relented, only to be rebuked by DOJ with a new demand for blanket surveillance.

But as I understand it, Levison could have complied with the earlier demand for surveillance narrowly targeting Snowden.

Yes it is true, it would have enabled FBI to listen in to everyone using the service. https://news.ycombinator.com/item?id=6487778

Your understanding is not accurate from my read of the court docs. They wanted their black box (you know the ones), called a pen/trap device in the documents, to be installed on the network. It won't work without the SSL keys, so they wanted those. He offered to modify his software to intercept a single user's email, but they said no.

>> You can't wave off court orders just because you think the Internet is some kind of libertarian cyber-paradise where mortal laws do not apply

“One has a moral responsibility to disobey unjust laws.” — Martin Luther King Jr.

>> Are you saying that the Pen Register Act is on par, morally, with Jim Crow?

No.

Yes. It's a multiplier of bad laws like Jim Crow. If these capabilities had existed at the time of Jim Crow, the damage that this would have done compared to what was done would have been far worse.

TBH, the fact that black people at the time were poor and had less access to ubiquitous communication probably protected them greatly.

I hate to invoke Godwin's law, but also imagine if communications for everyday conversations and the surveillance thereof had existed in 1939.

Are you saying that the Pen Register Act is on par, morally, with Jim Crow?

That quote would have read “One has a moral responsibility to disobey unjust laws so long as those laws are of equal or greater unjustness than Jim Crow.”

References to prior controversies should not be interpreted as implying a moral equivalence with current controversies.

In essence yes at least in the context of this case, as it is essentially segregating those who wish to expose the illegal activity of the government, and those that wish to turn a blind eye. Remember, the NSA lied to congress, which is not only illegal but immoral in itself. Think about it, you get to sleep in your bed tonight, Snowden who knows where ?

When it's used to attack whistleblowers, yes.

>> You can't wave off court orders just because you think ...

Some people like to operate by the motto, "Do no evil". So yes, he can wave off a court order. And millions of informed people will have his back.

Well, yeah, he can do whatever he wants. He coulda put out a hit on the agents investigating him and significantly delayed the proceedings. In terms of free will, possible. In terms of practicality, a really bad idea.

And sure, millions of people could have his back, but unfortunately those aren't the people with the guns or militaries, they're the people who tend to stay home posting comments on the internet.

>> He coulda put out a hit on the agents investigating him and significantly delayed the proceedings.

That's terrible, I can't believe you would suggest that.

>> And sure, millions of people could have his back

You are sounding pretty out there. Not many people would support your violent suggestion.

>That's terrible, I can't believe you would suggest that.

Yeah, FSM forbid we actually think arguments through to their logical conclusions. How dare I!

I am pointing out the absurdity and irrelevance of your argument with respect to the discussion at hand. You offered the laser-sharp insight that hey, people can ignore the rule of law, so don't say they can't! It's a semantic distinction and I am taking it to the extreme where while it is still valid, it is ridiculous. Anyone can put out a hit on Federal agents, there are no physical laws to prevent one from doing so. However anyone who values continued survival within civilized society functionally cannot.

I'm not sure if you're being dense as a rhetorical device or what, but I can't believe I'm having to spell this out. On HN of all places. I'd expect this level of discourse from /r/eli5 or similar, not here.

> You offered the laser-sharp insight that hey, people can ignore the rule of law, so don't say they can't! It's a semantic distinction and I am taking it to the extreme where while it is still valid, it is ridiculous.

I don't know. Do remind me, how many US government officials got punished after being caught doing illegal warrantless wiretaps?

You can ignore the rule of law, as long as you are the government, that's not an issue as long as you can bleat "national security" enough times.

You're the one that's being rhetorically empty.

>people can ignore the rule of law, so don't say they can't!

I'm quoting this just to agree with it. Continued survival within civilized society depends on people ignoring the rule of law when morally necessary.

If by "millions of informed people" you meant "dozens of uninformed people" then we agree. What is evil about a court-ordered pen register?

You really should hurry up and throw this account away. All it does is crap-post.

"Lavabit shuts down, because it turns out that hosting email for the criminal class carries real risks and isn't terribly lucrative."

Perfectly summing up your bias on the matter.

> ...it turns out that hosting email for the criminal class carries real risks and isn't terribly lucrative.

That's quite an assertion. I had an email account on lavabit. From what you're saying apparently that means I'm a criminal.

Technically that does not imply that all customers are criminals.

Consider this transformation of your quote: "It turns that a bar serving beer to minors carries real risks and isn't terribly lucrative"

Now, this doesn't imply that a bar in only serves minors, though it does imply that the bar knowingly served minors (possibly among others).

(This said, the quote is obviously a rather inflammatory way to describe their business, and Snowden was plainly not a member of some sort of "criminal class" (whatever that is).)

That's not the assertion he made.

The resistance to the initial request was likely because it targeted a whistleblower attempting to expose the NSA's unconstitutional surveillance, not a member of the "criminal class" (nice framing attempt). It was a courageous act of civil disobedience.

alleged whistleblower

At the time when Lavabit defied the initial court order, had Snowden been classified as a legitimate whistleblower (by the people who actually have the authority to make such a decision)?

"it turns out that hosting email for the criminal class carries real risks and isn't terribly lucrative."

The criminal class? Do you really think that only criminals want private email? I have shocking news for you: some of us use email encryption to protect ourselves from the criminal class.

"Lavabit's business was not compatible with US laws"

Actually it was entirely compatible with US laws. There is nothing illegal about encryption of any kind in this country. The hacker and cypherpunks communities fought throughout the 80s and 90s for the public's right to use strong encryption without back doors, and we, the people, came out winners.

This wasn't strong encryption and had no privacy features whatsoever. Lavabit had the ability to track its users and decrypt their mail.

Would have been great with a bit more transparency on the chain of events. Most countries more developed than Zimbabwe would have provided that as a service to its citizens.

You mean by unsealing the court records, such as the unsealed court records which form the basis of this article?

Why would court records be sealed at all, and why would there be any speculation about the chain of events if you were given the very basic information about a case? Throwaway accounts usually mean throwaway opinions. Do something more important with your life.

Warrants in cases under investigation are often sealed because if they weren't the targets would be immediately alerted by services like Lexis/Nexis that their names have popped up in a court record.

(I will remember for the future that "throwaway" users have invalid opinions but "numberwang" is a source of erudition and, apparently, productivity.)

Oh come on, it's clearly a reference to a rather funny joke: http://www.youtube.com/watch?v=zJDu5D_IXbc

That said, I agree that throwaway users can have very valid opinions, and furthermore agree that warrants are frequently sealed.

I do have a concern of perpetually sealed warrants, and worry that in this case the government would have preferred to seal the case forever.

Also, the seal should never have prevented Lavabit from talking to Congressmen about general concerns regarding forced SSL key delivery. The documents make it clear the judge considered even mentioning the possibility of this occurrence would be a violation of the seal.

This is absurd, because being forced to give up an SSL key for a popular service is unprecedented, and he absolutely should have been able to discretely contact his representatives.

Real throwaway accounts usually are not active for 544 days with karma levels of 1100.

"because it turns out that hosting email for the criminal class carries real risks and isn't terribly lucrative."

I guess that’s the reason the Post Office is doing so bad.

I have an idea, why not tell the Post Office so send all letters via the FBI so we can check who sent them and to whom.

Reply on news.ycombinator.com