Lavabit Challenges Contempt Order: An Analysis of Its Arguments
volokh.com
volokh.com
There's a comment by "Jessica Darko" on the linked-to blog that I think warrants addressing. There is a big difference between a "search" for the purposes of the 4th amendment and a subpoena of a third party. Say the government is investigating Bob for tax fraud. It's a "search" subject to 4th amendment protections for the government to break into Bob's house and go through his drawers. It's not a "search" for the government to subpoena his accountant for any relevant financial records. It's a "search" for the government to break into the accountant's office to get those records, but the accountant can't hold up the 4th amendment as a shield against turning over those records pursuant to a court order.
Are there other cases where subpoenas have been issued for tools that enable the gathering of evidence? Has that sort of thing always required a warrant?
Is it moot that a warrant was eventually issued? Or was the warrant only issued punitively because Lavabit didn't comply with the subpoena without regard to the validity of the subpoena in the first place?
They're not asking for evidence, they order the operator of the service to be complicit in aiding the government in impersonating the service towards all of its users.
I'm all for going after the bad guys but sometimes law enforcement agencies don't make themselves likable, especially when they can force someone to comply with what they want.
"You can't throw the ball like that. Hand ball! 87 just knocked 12 over. Red card, red card! This ref is an idiot; he doesn't know any of the rules!"
What is in play here was the SSL Key that is used to encrypt the browser traffic between LB and the user. No differant than the SSL Cert used when you make an online purchase
It technologically impossible/impractical to have a separate SSL cert for each user, that is just not how the HTTPS protocall was designed
This is not Lavabits doing, that is the work of the Internet Engineering Task Force (IETF)
By turning over the SSL Key the FBI using the Pen Trap Device would capture in real time all data of all users and be decrypting it in real time.
Turning over a Master Key to a building would not give the FBI instant access to all apartments simultaneously, nor would they have the ability to go back in time to look at previous data, nor thousands of other problems with this analogy
People are attempting to conflate physical keys with encryption keys simply because years ago the mathematicians used the word "keys" as analog to explain things to the general public. This does not mean there is, in reality, any analogous relationship between encryption keys and physical keys
Also the legal speak above states I believe that even that the FBI clould technically access other user data, this does not somehow disallow this from happening because is not ideal. It is more a fault of Lava it than anything else.
SSL is a standard secure communication protocol of the internet, it is not lavabits design and it is impossible for Lavabit to modify while still keep interoperability.
You do not seem understand the underlying problem, as many people are misinformed as to which key the government was requesting., They WERE NOT asking for the key of the private inbox data, they were asking for the GoDaddy Signed SSL key that encrypts the web browser session from the Lavabit User to the Lavabit server, not the user level key for the encrypted mail box stored on LB servers
This is the same protocol that HN uses for this very site, Amazon, Gmail, and thousands of other sites use every day to secure communications between public servers and the users of those servers
Correct. If Lavabit wanted to be 100% immune from these type of subpoenas, then they would have designed the system to never have been accessible this way. I'm guessing (just like Hushmail) that having a proper end-to-end type encryption, like forcing the users to use some sort of PGP on their end would reduce uptake, thus preventing them from having a viable business model, so they compromised in this way.
Just because SSL is a standard etc is irrelevant. The government is going to use its subpoena power to get to the information they have reasonable suspicion is being sheltered by Lavabit. If the least intrusive method unfortunately exposes everyones data, well that really is what they call "tough luck."
Hushmail would have the exact same problem, Hushmail is not all that different from Lavabit.
When you load a message from your hushmail encrypted inbox it is DECRYPTED on the server side using the password you provided at login, then the HTML representing the email contained in your inbox it is then ENCRYPTED by the web server using SSL and Signed Certificate that is recognized by a web browser, in Hushmails case that CA is thawte, in LB case the CA was GoDaddy and sent to you.
ALL HUSHMAIL USERS share the same SSL Encryption from the Hushmail server to their Browser, this is how the web works. There is no changing at least not by a single company.
The only way around that would be to not use HTTP, or web browsers. But then you could create an entire new messaging system like BitMessage, but LavaBit was attempting to give people private EMAIL, not create a new messaging protocol
This has no bearing again whatsoever on what the government can subpoena. Just because it "sucks" that you've designed your system that if the feds need access to one account you've configured it such that one must grant access to everyones account when you have to comply is par for the course.
You could say that the blame for Lavabit being shuttered is actually due to the technical design of the site and the compromises made for connivence. You should blame the site creator for that, not the USG for exploiting it.
I do not believe the USG has the right to the SSL keys, period
But it is clear you believe that the USG should have unlimited power with free reign to do whatever it wants.
Then do you believe that power extends to forcing a business or indivual to commit fraud? Lavabit had an agreement with both its customers and its business partner GoDaddy to NOT reveal the SSL Keys to a 3rd party, the second it was forced to do so, it had an obligation to disclose those keys were compromised, failure to do so is fraud.
Do you believe the USG should or does have the power to force people to commit said fraud
THe laws allowing for Pen Trap's are very clear that the pen trap must not cause undue hardship on the business in question, and there are simliar limits on all of the powers of government
The idea that the government has, or should have, unlimited power to destroy businesses and individuals in the pursuit of "justice" is not only ridiculous but very dangerous
Not impossible; each paying user[0] could be granted their own subdomain based on username and then an SSL cert issued specific to that domain.
What really stands out from reading the unsealed documents is that there was no separation of data and control within Lavabit; Mr Levison argues at one point that handing-over the SSL certs will also expose his administrative commands. Well, tough. Control and data should never flow in the same channel, particularly when handling data for which you have already received and processed warrants in the past.
[0] there were only 10,000 users paying for the high-security service. The other 400,000 were on the standard offering, without at-rest encryption.
You can't disobey a search warrant because it would be bad for business or because you want to protect the target.
I see a lot of comments about how "good" this analysis is, to me it seems very weak, and only "good" if you believe the government should be allowed to violate the 4th amendment, should be allowed to obtain any information from anyone at any time, and should be allowed to get SSL Keys from service providers, without disclosing this to the Certificate Authorities and violation of all security agreements with said CA's.
If you're very much a "pro" government person then I can see how this "analysis" would meet with your approval. To me it looks like pro-government biased drivel
I think it is entirely reasonable to analyze the situation from the perspective of the law, but it seems like underlying their analysis is that the law is more than just a tool, that it is itself not subject to question. I can understand that from a functional perspective. Challenging the law itself, especially long established law (even if it is being applied to new situations) is a very hard task. But too often (at least for my taste) the writers there seem to bleed that over into the law having some sort of unstated moral stature beyond its utilitarian nature.
Exactly my criticism. There is an underlying current of morality at that site and it seems to be firmly anchored in process. They need to exercise editorial control to eliminate that moralizing, just because it is subtle doesn't mean it is compatible with a site that aims for an analysis of process rather than a cheer-leading of the current process.
Reading Orin Kerr is akin to reading someone critique the actions of the principals in a waterboarding without critiquing the rightness or wrongness of waterboarding itself.
There's a creepy overtone to that kind of commentary.
You should be embarrassed to argue this way. You should want to first understand the issues that are at play, and then figure out how your principles engage with those issues. You obviously shouldn't be trying to dismiss dense sources of information that you clearly didn't already have access to by making allusions to torture. But you do anyways, as do many on HN, adding no value, no original insights, no new information, not even a meaningful criticism of someone else's insight or information --- just, "new information that doesn't fit my worldview: BAD".
I've been here long enough to know that you're getting upvoted for comments like these, hopping from thread to thread shouting down anyone who fails to scoop out their eyeballs, pick up the accursed panflute or vile drum, and dance idiotically around the formless confusion of whatever issue you think you're advocating for. Just know, the same people upvoting you for poisoning threads are also the ones upvoting the incomprehensible douchebags who snark about "getting their side project acquired next time they get a job offer". You're two sides of the same debased coin.
† You can, once in a blue moon, find a carefully considered criticism of Orin Kerr on HN, but they've uniformly come from people on HN with law degrees and are thus obviously suspicious.
You should be embarrassed for defending Orin Kerr.
> I've been here long enough to know that you're getting upvoted for comments like these
I got downvoted. Maybe you want to revisit what you think you think you know and enjoy bloviating about.
A legal analysis like this is not too concerned with the specifics of a case because otherwise you couldn't have broad judicial principles at play.
That is to say, even if you think the government request was outrageous, Kerr's analysis simply says that yes, there's a long history of the right of the 'people' (here represented by the grand jury) to ask for information even if in the process the dignity or business of the person/institution the government is requesting the information from is damaged.
Lavabit needs to make a good case within those legal boundaries (which Kerr says is difficult) or try to change those boundaries.
I think this is a pretty big misunderstanding by the author of the article.
Not that you should accept his argument without scrutiny, but he's read a few of the cases here.