Lavabit founder turned over the private SSL keys as an 11 page printout
thenextweb.com
thenextweb.com
Moreover, each of the five encryption keys contains 512 individual characters - or a total of 2560 characters. To make use of these keys, the FBI would have to manually input all 2560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data."
They would probably have to OCR the thing.
Or are they "non-essential" employees ?
Obviously it would be possible to apply OCR, but it would take a few days/weeks to train the algorithm. An out of the box solution would not work.
OCR only works decent in combination with a dictionary.
My reaction to that was "oh boo hoo".
When people my age were kids (get off my lawn) we used to type pages of raw hexadecimal from the back of magazines into a machine prompt. We didn't cry about it, we were just careful.
I can't find a hexadecimal example at the moment, but look at some of these TRS-80 programs (pp. 110-111, 143) which have multiple pages of data/digits to transcribe:
http://archive.org/stream/80-programs-for-the-trs-80-1979jim...
Btw, the originals were often bad photocopies. So maybe not 4 point font, but certainly ambiguity in some bits.
If young, interested kids can do it, I'd hope that a nation state could figure it out.
Link: http://upload.wikimedia.org/wikipedia/en/a/a5/ComputesGazett...
Yeah, in the grand scheme of things it's easier to get a few people to type that in (it's parallelizable, after all) than to wait for another court order. Though I'd still have brought it to the judge's attention as this is like the dictionary definition of "contempt of court". If someone tried to be GPL-compliant in this fashion they'd be laughed off the mailing list.
[1] Great stuff at the time; precursor to Zork.
Voilà, information is transported reliably over a noisey medium! error correcting codes in practice 101
EDIT: voilà typo fixed :p
(Well, not "only", but I guess you can see my point.)
There should be a standard virus-laden ISO image specifically designed for "compliance" with court orders.
If you gave them a rar, tar.gz, zip or anything, the Man can hold you for contempt if he really wants to.
Has the FBI never heard of OCR, or were these printed as CAPTCHAs?
When a judge orders you to do something, you have to comply with the substance of the order, not evade it by sort-of technically complying while actually avoiding it.
I have all the respect in the world for Levison, he did the right thing and it takes guts. But trying to "hack" a judge's order is just silly.
It's easy to call the right game plays from your armchair.
Consider it from another perspective - people often request data from governments or large corporations and, when ordered or pressured into providing it they often do so in the least helpful format available. They are rarely punished for this because the law doesn't really have a position on whether CSV is a better document format than PDFs of scanned printouts, or whether a 50-page printout is more useful than a CD-ROM or USB stick. Why should the rules be any different for someone like Levison?
Just like the parent said, while he kind of technically complied. But, again, it's more than obvious to everyone that it's not what was expected/demanded from him.
>>Why should the rules be any different for someone like Levison?
Because it's related to Snowden. Again, it's quite obvious to everyone, that it's a hot issue and the government might go far to solve it.
Like it was said above, while I really support and respect Levison, it's not something you should be trying to fool - it's not a computer program...
So that he cannot be said to have not obeyed the mandate and at the same time making it clear that he did not want to comply.
Against the Leviathan the only possible defense is foolishness. This gives you publicity (in a '''''free''''' society and the conscience of your own freedom).
Government and judicial institutions do this all the time, so to anyone with a common sense, it's more than obvious to everyone that it's exactly what was expected/demanded from him.
No, it really isn't. This is precisely why interactions between the law and technology are often quite confusing, because there's a mismatch between what the law says and the technological reality. It wasn't obvious what the law was demanding of him because such demands are rare and judges haven't figured out a boilerplate form of words to ask for the surrender of PGP keys or SSL certificates in particular file formats yet, and so they ask in general terms for 'encryption keys', leaving much open to interpretation. The existence of such ambiguities is why lawyers earn as much money as they do.
Levison wasn't 'fooling' the law at any point - he complied with the request as presented to him. The FBI wasn't happy with that response and went back to the judge for a more tightly-worded request, backed up by a threat of fines. At no point was the legal process subverted, 'hacked' or 'fooled'.
My point is that this is how the law works. If a judge wants you to do something then it is incumbent upon the judge to specify clearly what that is. You can't refuse without facing legal sanctions, but if the judge is vague or imprecise then you have at least some freedom to interpret the judge's instructions yourself. As I said earlier, corporate and government lawyers are experts in finding the most favourable interpretation of judicial rulings for their clients, and many legal cases revolve around reaching an interpretation of the law that is unambiguous enough to be enforceable.
Because it's related to Snowden. Again, it's quite obvious to everyone, that it's a hot issue and the government might go far to solve it.
Like it was said above, while I really support and respect Levison, it's not something you should be trying to fool - it's not a computer program...
What are you trying to say here? Sure, the government cares a lot about this case. But the judiciary and the government are not the same thing, and the law, as a matter of principle, is meant to apply equally in all cases. There are no special cases where the law should be applied differently because the case has the attention of senior government officials. You might say that I am being somewhat naive in that belief, but I think that most judges would agree that their role is as neutral arbiters of the law, not agents of the government of the day.
There is absolutely no sense in which it's possible to describe Levison's actions as incorrect. You can believe that he should have surrendered the keys in electronic format immediately, despite not being asked to do so, or you believe that he should have refused point blank to disclose them and thus disobey the judicial order, but those options are variously immoral or illegal, and the action of providing the printed copies of the keys was neither.
Perfectly compliant.
[3(a)] Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange;
It's still open to some interpretation, such as exactly what constitutes "customary media", but probably does rule out the printed on the side of a cow[2] approach taken here.
[1] from v2: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
Malicious compliance.
Having tried to get useful answers via FOIA requests, I know first hand that playing stupid is standard procedure.
Tit for tat.
If the judge wanted an electronic copy...
Yup. The persons making the policies and rulings often don't understand the technology.
Like Levison, I'm more likely than not to do something spiteful, just to rub their noses in their ignorance.
More like "two wrongs"
Resisting evil is good. It's not like he destroyed someone's business or muzzled somebody's free speech.
I support what Snowden did. Yet we must admit that it was illegal, and the feds had every justification to get a warrant for is communications. This wasn't carte blanch monitoring, this was targeted data collection.
Do you really think it was evil of the Feds to get a court order to inspect the communications of someone that was known to, without a shadow of a doubt, be leaking classified information? I do not.
I think Snowden was right to do what he did, I think the Feds were right to respond with a search warrant request to investigate him, and I think the judge was right to grant it.
Snowden is the context. Ignoring the context in rarely a good idea. And while I agree that the rightness or wrongness of his behavior is not germane to the discussion, his actual behavior is most certainly germane. If the Feds requested, and received, a court order because Snowden wrote a critical blog entry of the government that would be one thing. Requesting and having it granted because of his actual actions is another thing entirely.
> Snowden was the pretext the FBI used, but it's clear in this case that they also wanted the ability to surveil other customers of Levison's besides Snowden.
Is that absolutely clear to you? Because it isn't to me. The Feds gave Levison a chance to provide lawfully requested information on Snowden that did not require decryption and Levison refused. Okay, if they couldn't compel Levison to alter his code to provide the requested metadata, they could compel him to give up the keys to that information directly. What do you expect them to do? Give up and go home? Pout?
Levison stood up for his convictions and I applaud him for that. I'd like to think that I would have done the same thing in his shoes. That doesn't mean I vilify the Feds for doing what they did. I don't feel anyone acted unreasonably, much less evil, at least not with the information we have available to us right now.
From the "big announcement" earlier today:
During an investigation into several Lavabit user accounts, the federal government demanded both unfettered access to all user communications and a copy of the Lavabit encryption keys used to secure web, instant message and email traffic.
Like I said, I don't find that evil. From their perspective, the only way to lawfully get Snowden's data incidentally required they get the keys to all of the data.
It's clear that we have different thresholds for the concept of evil.
I truly don't see how that's pertinent. So because Lavabit designed a "secure" service and promised their customers secure communications, their customers, and by extensions Lavabit, are shielded from the judicial process of the country Lavabit resides in? Even in cases when they have the technical capability to comply? Seems a bit much.
Lavabit claimed security, not shielding from the judicial process (they complied with other warrants in the past, supposedly). And if they did claim shielding from the judicial process, then their product did a shit job of backing it up. That they could even technically comply with a warrant makes them just as vulnerable to the judicial process as every other service. How is that the government's fault?
> If you want to outlaw safe vehicles, do that in an open session of Congress. Search warrant proceedings are not the proper fora in which to legislate what sorts of online services are legal.
This statement is ridiculous. The search warrant process is authorized by Congress and issued by the judicial branch. It's no secret. Should every search warrant be run through Congress?
> It's clear that we have different thresholds for the concept of evil.
At least we can agree on that. As I've said, I'm a Snowden supporter, and I've contributed to the Lavabit defense fund. But federal agents investigating a national security leak by issuing a search warrant to a provider located in the continental US whose only means of complying is unlocking their entire service (whose fault is that?) doesn't fit the bill of "evil" for me.
At this point we're probably talking in circles though, so I'll leave my thoughts there.
When they determine there is no lawful or ethical way to prosecute someone, I absolutely wish they would would give up and go somewhere. Unfortunately I'm not naïve enough to expect that. (I stipulate we don't agree on the facts in this case; I intend merely to contradict the idea that LEOs and prosecutors ever have to do anything.)
When you fight on principle, you have to decide just how far you're willing to go.
The antagonists here will make the personal cost to Levison, right or wrong, for better or worse, extremely high.
Levison appears to have the cojones to take the fight all the way. For now.
The trap of fighting on their terms, which I also fell into, is that you're in the mud too. Then is a war of attrition. Absolutely exhausting.
But all fights are rock, paper, scissors.
I decided I can't win on their battle field. I stepped back, reassessed, and am now fighting a battle I think is winnable.
(My issues are election integrity and open government.)
Perhaps he knew it was silly but just wanted something to show he's trying to resist the order. It's been a very popular move with people, and probably caused people to remember who he is, increasing customers for his next business.
It's a shame he's still got so little in the legal defence fund. $20,000 is nothing for a legal case.
It takes guts, just as you say. It takes guts specifically because he's unwilling to gracefully comply. "Monkey-wrenching" usually appears silly to people who are defeatist or subservient to a particular order/agenda. I'm not saying you are. I appreciate your comment otherwise. I'm only suggesting that you reconsider your view on his tactic, if only a delaying tactic, as an act of courage rather than silliness.
Attorneys do this kind of crap all of the time. Often, when ordered to provide docs for discovery, they will print pdfs and re-scan them in (sometimes over and over again, to make them barely legible) to make opposing counsel's task that much harder. The judge in this case may not have had much appreciation for Levison's wit, but it may not be as silly as you think. Perhaps Levison knew he was at the end-game and merely needed a brief delay to tidy up some loose end, in which case his tactic worked well.
Couldn't they just scan the document?
What happens? The prosecution has to go back to the judge and demand a different format? What a terrible consequence.
See: ping google.com PING google.com (201.17.31.88) 56(84) bytes of data. 64 bytes from c9111f58.virtua.com.br (201.17.31.88): icmp_req=1 ttl=60 time=11.8 ms 64 bytes from c9111f58.virtua.com.br (201.17.31.88): icmp_req=2 ttl=60 time=12.9 ms 64 bytes from c9111f58.virtua.com.br (201.17.31.88): icmp_req=3 ttl=60 time=11.5 ms 64 bytes from c9111f58.virtua.com.br (201.17.31.88): icmp_req=4 ttl=60 time=13.1 ms
I'm in Rio de Janeiro. In 6ms travelling at the speed of ligth, I'd travel 1800km. Florida (the nearest American state) is more than 7000km far from my city.
"Dump it for them at 300 baud."
"Art! Are you sure?"
"We cleaned Rand's directory first thing. Took out everything not routine, then we added a few files. Old engineering catalogs. Maintenance schedules. Ratings of TV shows. Makes a pretty big file---" MILLIE, what is the total stored in Rand's directory?
23,567,892 BYTES
"Good Lord. Art, that will take hours to print out---"
"Yeah, that gives the cops a hobby." [1]
[1] Larry Niven and Jerry Pournelle. Oath of Fealty. New York: Pocket Books, 1981. ISBN 0-671-82802-9, pp. 287--8.
There is no prior requirement for an email provider to be CALEA compliant, so there doesn't need to be a particular LI function built into the system.
That sounds almost like a solicitation for work, and I suspect that is the way that others (Google, MS, friendface, et al) replied.
It was kind of game over once the search warrant for key came in, unless the keys were in an HSM. As long as you can prevent the search warrant from being issued, a regular pen register isn't going to be terribly onerous if it doesn't produce useful data due to everything being encrypted. If you don't have a system to do user logging, you can honestly respond "we do not have records of messages sent through our system". I don't know if they can even require you to turn logging on if it's not already on in that case; they could get a warrant for your whole system, possibly, but that's a much higher legal bar, and "fine, it's in fedex billed to USG account" might be a reasonable answer there.
(IANAL)
I assumed this stuff only applied to CALEA entities like PSTN, PSTN-interconnected-voip, and broadband ISPs; it appears it is actually patriot and means there's enough legal pretext to essentially always get keys:
1) Any non-CALEA entity probably does NOT have a system which can log every pen trap piece of data desired. If there's even a single thing which your system internally can't provide, LEA could argue that their own pen trap would be more effective, and could compel you to turn over keys to populate their device. They could compel you to generate new keys outside an HSM if you have technical controls to protect your existing keys from disclosure, too, and disguise that as "hsm failure" or something like that. It seems pretty open ended.
A non-charitable view of the entire Lavabit thing is that it was a roundabout way/pretext to compel key disclosure. It doesn't matter if USG uses the keys illegally for something which isn't used in a criminal prosecution; the data in Snowden's mail is of intelligence value where those rules don't apply.
2) Unless Patriot 216 is found unconstitutional, Ladar is fucked, as is the entire US IT/cloud industry. I don't believe in Lavabit's "keys are protected" argument -- the court presumes LEAs are trustworthy, and will accept just restrictions in policy on what they can do with keys. Only eliminating pen registers for "arbitrary Internet services" will work, and that probably won't happen.
(IANAL)
No, in fact, when dealing with law enforcement you should be as uncooperative as possible. It is in your best interest. The expectation that if we are polite to some adversarial authority then they'll go easier on us seems quite widespread (seems to me it has some deep bio/psychological roots). Unfortunately, it's completely false. The police doesn't care the least bit if you are cooperative, polite, prompt, not a dick... In fact, they are trained to exploit one's urge to be polite, honest and helpful against you.
If law enforcement decides to come after you (for whatever reason), no politeness in the world is going to make them turn around and say: "Gee, what a nice fellow, we're sure sorry we wasted his time." They are there to get you, not to negotiate and make good first impressions. There is absolutely nothing you can say that can help you in any way.
The classic: https://www.youtube.com/watch?v=K1p3K3sC1Ec
Some companies probably just rolled over and agreed costs directly with the agencies involved.
With Patriot 216 pen trap, they can compel full cooperation to the same standard as a CALEA covered entity, which they knew he couldn't provide as well as their own pen trap device (at least without work; they found $2k unreasonable to implement it!), so they can get a warrant for SSL keys for their pen trap. With that they can do whatever.
There may be a solution in SSL keys which can't be exported (HSMs) into the pen trap; you'd potentially be able to require a secret compatriot offshore (or via a cutout) to assist in adding a new load balancer or front end, so you'd be technically unable to comply. They could require you generate and use new keys, but users could detect that, and you could warn of this when you first set up the system.
What does this mean? Don't they have a the legal ability to force compliance?
Then Ladar delayed on the warrant in a variety of ways (trying to quash a warrant, which I didn't know could be done before executing it; trying to claim it was invalid until after the pen trap was set up without it to actually observe it failing, the "little 4 points" trick.)
o01|IO
And even one wrong character makes SSL key wrong.
You then just need a human to label each character once. With a pixel image comparison 0 looks completely different from o.
If they're using a standard font then a regular OCR (you'd only need four nines accuracy to get it 100% correct) would be fine, even with a weird font it still be easy to get that level of accuracy.
This sounds like a useful defence in general against OCR re-use of particular things you might publish. I wonder if it could be done in a manner unobtrusive to the eye, but progressively more expensive to algorithms, either in terms of memory or time. This is really a neat idea you have.
On the size, 4 pt is generous. I remember printing an allowed note index card for high school final exams in 1 pt Times New Roman on a laser printer @ 600 dpi. At arm's length, it looked like a series of lines, but up-close the text was quite readable. Under magnification, the print quality was amazing.
If they used something like Perfect Forward Secrecy, could they not legitimately have claimed to be unable to defeat their own system (as it is currently configured)?
So intrusive AND lazy :).
Plus companies shouldn't be required to beautify data for the government. They got what they asked for it-s up to them to figure out how to use it.
I know this is a bit sneaky this time but if they allow this to stand then soon companies will have to employ full time staff to beatify data for the government with pretty graphs and such because a database dump is incomprehensible.
It's like a kid asking you how to make a website and then complaining that HTML, CSS, JavaScript,etc is incomprehensible.
Take THAT!
I think that is a little better than an "attempt"...
This would have taken the FBI 20 mins...
This is the same nonsense the government pulls when they want to "technically" comply with a FOIA request, but want to make life as hard as possible for the requester.
What I'm not a fan of, however, is that Levison had claimed that he's be willing to comply with (indeed, has complied with) specific warrants. He left the impression that the FBI was asking him to ruin his security in general.
However the court filings show that the request for the SSL priv keys came only after Levison failed to comply with... a specific warrant relating to Snowden and Snowden alone. So if Levison wasn't lying, he was definitely leaving something major out of his story.
But he never told the FBI it was technically impossible, he told them that he would not (as opposed to "could not") do it.