Lavabit founder Ladar Levison's promised big announcement
facebook.com
facebook.com
"During an investigation into several Lavabit user accounts, the federal government demanded both unfettered access to all user communications and a copy of the Lavabit encryption keys used to secure web, instant message and email traffic."
Note that the initial court order although appearing to target the specific user demanded explicitly that Lavabit "shall furnish agents from the Federal Bureau of Investigation, forthwith, all information, facilities, and technical assistance necessary to accomplish the installation and use of the pen/trap device." (http://s3.documentcloud.org/documents/801182/redacted-pleadi...)
Then defying the initial order was definitely not Lavabit protecting one (famous) person as some wanted to present this case, as the goal of FBI as stated in this announcement was unfettered "access to the Lavabit network without (Lavabit) being able to audit the information being collected."
For the first time in history the general public can actually see the most of the documents related to such kind of orders. Up to now the people receiving such orders weren't allow to tell anybody even that they received them.
This is unprecedented.
And quite frightening. It makes you think how many more companies are out there where the owners just decided to give in and allow them access and have remained quiet.
In such a case, the order commands the operator to destroy the basis of his business. This is a "taking" without compensation in direct violation of the 5th amendment. It takes all the goodwill the business has built up and the ability to continue in the line of business, removing all the value the owner has invested in.
I recall though, in the past that Earthlink was the only ISP who refused to install a Carnivore device on their network... but that was only because the Church of Scientology, who owned/started Earthlink, was already monitoring all traffic.
This is sufficient to monitor all the users if the connection is unencrypted, or if the Feds can MITM it with help from a CA. If PFS or a private cert setup is in use, then such an interception device cannot get any plaintext unless the spies also obtain the secret keys from the server owner. That is what the FBI demanded from Leveson.
(3) the term “pen register” means a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, provided, however, that such information shall not include the contents of any communication, [...]
(4) the term “trap and trace device” means a device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing, and signaling information reasonably likely to identify the source of a wire or electronic communication, provided, however, that such information shall not include the contents of any communication;
Clarification: point being the language of the law doesn't permit the FBI to give you a hard drive. They have to call it a pen register, then they can give it to you.
From page 104 of http://s3.documentcloud.org/documents/801182/redacted-pleadi...:
"In this case, the SSL keys are 'information ... necessary to accomplish the installation and use of the [pen-trap]' because all other options for installing the pen-trap have failed. In a typical case, a provider is capable of implementing a pen-trap by using its own software or device, or by using a technical solution provided by the investigating agency; when such a solution is possible, a provider need not disclose its key."
Regardless of the legal rationale, the FBI was demanding measures that would have given them access to everything, and they intended to use it.
So, given that the whole rationale for Lavabit's service was protection against this kind of wholesale intrusion, the answer to your question is "no".
Oddly... I'm not even sure how I got into this HN topic. I replied to a comment in another topic and ended up here. Thinking I was in the other topic about a different story, I commented based on that story. I have no idea where this FBI admission is. I didn't see it.
In fact the FBI agents even admitted their intention to collect passwords in transit so they could access emails protected by Lavabit’s encrypted storage feature. This was in stark contrast the DOJ attornies who maintained that only the metadata authorized by the court order would be collected.
Levison was running a business. A privacy business. After years of peaceful co-operation with federal authorities, the FBI suddenly told him he was about to not be in the privacy business anymore, that the business he'd poured ten years of his life into would now shamble forward as a living lie, a thrall of the surveillance state it was conceived to oppose in the first place.
And the motive for this dramatic move? An attempt to find the guy who broke the news about how much spying the government's been doing.
That is, the FBI's instinct about how to handle a scandal about unprecedented levels of domestic surveillance was to increase their level of domestic surveillance.
So basically, due to design decisions, the only way for the government to get access to the data they are entitled to, was to hand over the master private key. If lavabit had designed in such a way as to have one key per customer, then the government would have only been legally able to request the single key for that customer.
I'm not saying that lavabit should have had an SSL cert per customer, just that the designed in a way which didn't mesh well with US law and they paid the price.
Yes it was. Access to everything _for that user_. Which they are explicitly allowed to request with a warrant (which they had) under US law. Just because Lavabit could not provide the information for that user without giving away everyone eles's information does not mean that the government can't have the information for that one user.
Per the wired article, the government asserts that “The representative of Lavabit indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to ‘defeat [its] own system,’"
Itis only after Lavabit refused to just decrypt Snowden's email, that the FBI demanded everything and the judge makes that assertion.
Of course, the Wired article might be wrong. However, I cannot think of a single legitimate technical reason why Lavabit could not break their own encryption for a single use. The encryption and decryption was done server side. This means they can pull the key out of memory. Worst case, they can grab Snowden's password/key when it goes to the server.
[0] http://www.wired.com/threatlevel/2013/10/lavabit_unsealed/
This is a real opportunity to fight for user privacy and support the only company that openly defied the government's unconstitutional demands. A virtue we all longed for just a couple of months ago at the height of the NSA scandal. But here it is now and instead we see comments picking on Lavabit and questioning their moral qualities...
People just can't get past character debate. Bickering while their rights are gradually stripped off under their noses.
Lader is the kind of person you want to bring to a case before SCOTUS, not weev.
Assuming similar warrants to other companies would also come with gag orders, there is no way to know whether Google has tried to fight. The only way we would know is if Larry Page announced they was closing up shop tomorrow.
Similar arguments apply to every tech company. I am certain that {Google,Yahoo,Microsoft,Facebook,Twitter} has received similar warrants, and has filed objections, and has been given the choice of compliance or corporate death.
People like to make a lot of noise about the power of multinational corporations, but historically, when a corporation has defied a government the government usually wins. The only exception is when there is a wide disparity in power between the corporation's home country and the government it's in dispute with, and the corporation's own government backs it. (Eg. the British East India company vs. China, Google + Facebook + Twitter vs. Egypt.)
The reason for this is that business requires a stable legal system to work. Without the government's backing, a business's customers could simply run off with its goods & services and the business would have no legal recourse. It becomes impossible to conduct trade when the organization with a monopoly on physical force says "It's open season on Google." (Indeed, relations between Google and China had been frosty for several years before the shut-down because the Chinese government overtly favored Baidu, and the legal system in China is such that you can't conduct any significant business without some bureaucrat's say-so.)
Google: Page+Brin+Schmidt.
Facebook: Zuck
They aren't going to get fired.
It's like giving in to extortion, you're just delaying the long-term inevitable while damaging yourself in the short-run as well.
Yes the amount of intelligence they could gather on each of their users would undoubtedly suffer, and so their ad revenue might eventually lose a bit of growth, but life (and business) would go on for Google.
https://www.eff.org/deeplinks/2013/07/yahoo-fight-for-users-...
It's likely because his level of technical competence barely suffices to turn a computer on, but yet he gets to decide on these cases, and the gov lawyer happily aids in his ignorance by supplying factually wrong technical sounding terms (the 'metadata stream') and analogues from an analog world (a 'filter').
One reason that this was rejected, then, was that it did not fulfill the requirements of the 'trap/trace' part of the order, which require the metadata to be provided in real time or close to real time.
On the PDF's page 51, there begins a record of a court proceeding, deliberating what, exactly, the government is looking for in these proceedings. They discuss the coverage that the FBI thinks its pen register needs. Of note is that Levison was not opposed to the pen register (which, to my understanding, would provide the FBI with all encrypted traffic going through Lavabit's servers), he was opposed only to providing the encryption keys, which Levison asserts would provide the FBI the ability to decrypt all traffic, and not just the traffic of the aforementioned SUBJECT, (read: probably Snowden).
The judge appears to not be a rubber-stamp entity, which is nice, as shown on pages 58-59.
Page 60, Levison states that all the gov needed to do to install the pen register, was set up an appointment with him. But, again, he would not provide any keys.
Ha. On page 61, the court explicitly says that all requests for oversight and monitoring will be denied:
MR. LEVISON : I guess while I'm here in regards to the pen register,
would it be possible to request some sort of external audit to
ensure that your orders are followed to the letter in terms of
the information collected and preserved?
THE COURT : No. The law provides for those things, and any other
additional or extra monitoring you might want or think is
appropriate will be denied, if that's what you' re requesting.
On page 107-108, the court has this to say about a loss of trust from Lavabit's customers, in the event that Lavabit hands over its SSL keys: "Any resulting loss of customer "trust" is not an "unreasonable" burden"
Starting on page 121, there is a court discussion about "a motion to quash the requirement of Lavabit to produce its encryption keys and the motion to unseal and lift the nondisclosure requirements of Mr. Levison."
Page 126, the court on the government's "right to information". Within the bounds of a criminal investigation, this position seems correct, but they are still requesting a key that would decrypt the communications of about 400,000 customers. Within that context, it seems like overreach.
THE COURT : I can understand why the system was set up,
but I think the government is -- government's clearly entitled
to the information that they're seeking, and just because
you-all have set up a system that makes that difficult, that
doesn't in any way lessen the government's right to receive that
information just as they would from any telephone company or any
other e-mail source that could provide it easily. Whether
it's -- in other words, the difficulty or the ease in obtaining
the information doesn't have anything to do with whether or not
the government's lawfully entitled to the information.
What appears to be the now infamous 11 page of 4-point key starts at page 145, as Attachment A. I can't actually verify, from this PDF, that it is text. With the image's resolution, it looks like lines of visual noise. Zooming in, there also appear to be visual artifacts reminiscent of JPG compression.
This is one of the reasons why I have literally no respect for the US court, USG's supposed authority. They are all corrupt, lying, authoritarian asshats.
I have to say that while I have been on HN for several years - and it is the best community online. I am farking inspired with how aware and awesomethe community on HN has revealed itself to be in light of the NSA debacle.
Even when we get into debates, like I do with TCPTACEK, the level of sober awareness of the implications of the techno-spy world we live in, the background and historical context (whereby many HNers were already aware of telco spying, Echelon, Carnivore, etc) the userbase has here is certainly terrific.
I am heartened by the fact that seemingly so many HNers are awake, aware and informed on whats really happening around us. I hope we can find a way to affect change together.
None of this is shocking: If you run a commercial communications service, it's your responsibility to comply with legitimate wiretap warrants. As the judge said, setting up your system in such as way as to make tailored compliance extremely difficult or impossible doesn't release you from that requirement.
The question I'd love to ask the heads of these various agencies. In what circumstance does the 4th amendment apply? Seems like we always ask 'is this current procedure justified' with some inevitable pretext found.
I would also note that it seems incredibly clear that Ladar Levison knew what was at stake: for himself, for Snowden, for his company, and for his users. His decision to shutter his doors was his last option to protect their 4th amendment rights and I'm absolutely amazed he made the right call here.
Kudos to a brave man.
But I understand that you wouldn't worry if your users have no privacy expectations. Your business wouldn't be affected.
When confronted with an issue about which the judge knows nothing, the court basically deferred to whatever the government suggested. I'm not reading into it, it's basically how the transcript reads.
I particularly enjoyed this Freudian slip:
MR. BINNALL: I would suggest that the
government -- I 'm sorry -- that the Court
can craft an order to say...
Wrong. You pay to have your public key signed by a commercial entity. The private key was generated by Mr. Levison.
He's not trying to protect this information. People are going to be using Facebook regardless of whether he publishes there or not. This is pure pragmatism.
When receiving the link to the rally.org campaign yesterday (through pinbord on twitter or gruber) I thought it represented the entire universe of assistance Lavar had received. On top of that, the upper limit of the rally campaign keeps changing. Originally I saw 40k, then last nigth 50k, now this morning 96k.
I'm not saying that they're trying to be misleading, but as someone who is interested in this and is considering a donation, I was disquieted by the moving target at rally.org and the lack of transparency until this morning about how much had truly been raised.
Even having a case with the copyright trolls costs around a million. You bother about the thousands and about the totals which nobody claimed. And Levison had to shut down his own company.
Perhaps I'm just nitpicking. I agree the cause is worth supporting.
What an intriguing statement. I'm not sure if I should read anything into it, but 'law-abiding' and 'citizen' seem odd in that context.
Edit: Why not just say 'everyone'? Otherwise it sounds as if Lavabit was making a decision as to whether someone was eligible or not, which I don't think is what he means.
It was just when they were asking for the ability to completely backdoor his system for all users that he started with the civil disobedience.
I'm surprised that some academic lawyers aren't helping take on this case for no cost, due to the precedent it may set and the exposure it will get.
For the first time in history the public can actually see the most of the documents related to such kind of orders. See also: https://news.ycombinator.com/item?id=6487986
If there's anything written where you've found some error you can present your arguments. Attacking persons aren't arguments.
then when it is confirmed we have "but we already knew this".
neither adds anything. but people seem to vote up world-weary comments. yay for internet points.