Comment by acqq | Hacker News Reader

Comment by acqq | Hacker News Reader

Parent Full thread

Widely unrecognized in the other discussions on HN is that:

"During an investigation into several Lavabit user accounts, the federal government demanded both unfettered access to all user communications and a copy of the Lavabit encryption keys used to secure web, instant message and email traffic."

Note that the initial court order although appearing to target the specific user demanded explicitly that Lavabit "shall furnish agents from the Federal Bureau of Investigation, forthwith, all information, facilities, and technical assistance necessary to accomplish the installation and use of the pen/trap device." (http://s3.documentcloud.org/documents/801182/redacted-pleadi...)

Then defying the initial order was definitely not Lavabit protecting one (famous) person as some wanted to present this case, as the goal of FBI as stated in this announcement was unfettered "access to the Lavabit network without (Lavabit) being able to audit the information being collected."

For the first time in history the general public can actually see the most of the documents related to such kind of orders. Up to now the people receiving such orders weren't allow to tell anybody even that they received them.

This is unprecedented.

>>>> This is unprecedented.

And quite frightening. It makes you think how many more companies are out there where the owners just decided to give in and allow them access and have remained quiet.

I think these secret (or gag) orders should be illegal. Having the ability to subpoena info with the correct court procedures and transparency is fine (and important ability to fight crime with), but these court orders needs to be completely public, and under scrutiny from watch dogs and civil liberties groups. Because power corrupts, and given such absolute power, it will surely corrupt absolutely.

I believe they go against the 1st and 4th amendments.

In the particular case where the business subject to the orders is trying to provide privacy or secure communications services, the secret orders to enable spying on all the users also violates the 5th amendment.

In such a case, the order commands the operator to destroy the basis of his business. This is a "taking" without compensation in direct violation of the 5th amendment. It takes all the goodwill the business has built up and the ability to continue in the line of business, removing all the value the owner has invested in.

All of them. Every ISP.

I recall though, in the past that Earthlink was the only ISP who refused to install a Carnivore device on their network... but that was only because the Church of Scientology, who owned/started Earthlink, was already monitoring all traffic.

Wouldn't the installation of the pen trap device be necessary to target one individual as well?

No; Lavabit had the means to provide metadata on individual users, had done so in the past, and ultimately offered the same wrt the target of the current orders (unnamed in the documents, but we all know who it is).

The device intercepts a copy of the whole datastream and then sorts thru it.

This is sufficient to monitor all the users if the connection is unencrypted, or if the Feds can MITM it with help from a CA. If PFS or a private cert setup is in use, then such an interception device cannot get any plaintext unless the spies also obtain the secret keys from the server owner. That is what the FBI demanded from Leveson.

Why should it be necessary to install their device to target just one individual?

For all I know, trap device could be FBI speak for USB hard drive. He needs to plug in the hard drive so he can copy the data on to it. (I am aware the FBI has other, much more capable network intercept devices. I suspect the term pen/trap device is standard jargon for anything that gets installed on site regardless of capability.)

Your suspicion is incorrect. "Pen/trap device" refers to a "pen register" or "trap and trace device" as defined by 18 USC §3127(3-4):

(3) the term “pen register” means a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, provided, however, that such information shall not include the contents of any communication, [...]

(4) the term “trap and trace device” means a device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing, and signaling information reasonably likely to identify the source of a wire or electronic communication, provided, however, that such information shall not include the contents of any communication;

Wouldn't a hard drive onto which addressing information is recorded be a pen register?

Clarification: point being the language of the law doesn't permit the FBI to give you a hard drive. They have to call it a pen register, then they can give it to you.

Handing someone a hard drive does not allow them to monitor continuing activity.

The initial request states "pen/trap device" not just "pen register" so your insistence on only pen part is irrelevant. The initial secret court order demanded more.

The initial order was to provide metadata for all traffic involving a single account. It was only when Lavabit said they couldn't do this without disclosing their SSL private key that the FBI asked for the key.

Wasn't the initial order to let them and help them install their device in his network? Please quote your information and source, I've quoted mine in the top comment of this thread.

The initial order was for the installation of a "pen-trap" to collect metadata on one account. According to the document, this is typically implemented by the provider without installing any FBI hardware.

From page 104 of http://s3.documentcloud.org/documents/801182/redacted-pleadi...:

"In this case, the SSL keys are 'information ... necessary to accomplish the installation and use of the [pen-trap]' because all other options for installing the pen-trap have failed. In a typical case, a provider is capable of implementing a pen-trap by using its own software or device, or by using a technical solution provided by the investigating agency; when such a solution is possible, a provider need not disclose its key."

Lavabit could install the device, but it was obviously the FBI owned and controlled device which was to have access to everything traversing the network. And he was to help them to reach that goal.

How do you go from "In a typical case, a provider is capable of implementing a pen-trap by using its own software or device" to "obviously the FBI owned and controlled device"?

You intentionally omit "by using a technical solution provided by the investigating agency." Moreover you completely ignore the initial order where they don't mention that they will accept what Lavabit can provide them but expect help in installing the device.

So did you intentionally or accidentally omit the word "or"?

EDIT: somehow I ended up in the wrong HN topic so my comment was not directly related to this topic. I have not read the press release from Lavabit that this topic links to. My bad.

And you're omitting "In fact the FBI agents even admitted their intention to collect passwords in transit so they could access emails protected by Lavabit’s encrypted storage feature."

Regardless of the legal rationale, the FBI was demanding measures that would have given them access to everything, and they intended to use it.

So, given that the whole rationale for Lavabit's service was protection against this kind of wholesale intrusion, the answer to your question is "no".

My bad. I thought we were talking about what was written in the court order that Lavabit defied. I wasn't interested in talking about admissions made after the fact.

Oddly... I'm not even sure how I got into this HN topic. I replied to a comment in another topic and ended up here. Thinking I was in the other topic about a different story, I commented based on that story. I have no idea where this FBI admission is. I didn't see it.

The device was to be controlled by FBI to select what to collect, practically at least having access to all the traffic of Lavabit.

Reply on news.ycombinator.com