Why I was forced to shut down Lavabit
theguardian.com
theguardian.com
http://www.theguardian.com/commentisfree/2014/may/20/why-did...
Can you be more specific?
Does he write "according to news reports" for legal reasons? Obviously he should know, I think.
> The government argued that, since the "inspection" of the data was to be carried out by a machine, they were exempt from the normal search-and-seizure protections of the Fourth Amendment.
That's insane.
> That's insane.
It's also immaterial. In this case DOJ got an Article III warrant (if not several), which was specific in what was to be seized. This is the system that Snowden claimed to be trying to defend by revealing "warrantless wiretapping" working exactly as designed.
DOJ got a warrant for the exact thing they wanted, and all of sudden Constitutional separation of powers became inconvenient to Levison (even though he complied with such warrants before, and eventually offered to comply in this case for cash).
Levison might still be gagged from disclosing certain information he knows personally or which was disclosed by government requests for data. In which case, pointing to an external source of verification could provide him with legal cover.
Consider it the equivalent, if you will, of parallel construction. Knowledge acquired via one route cannot be disclosed unless you can point to an independent path to coming by that information. Though the nondisclosable means might inform your search for unencumbered sources.
Either way i find then entire paradigm infuriating and undermining to our supposed liberties.
Don't market it as a secure system then. Sell it as something that gives moderate privacy to people who are not accused of breaking laws.
The public needs better understanding of risk assessment and people selling insecure products as super secure does not help anyone.
https://s3.amazonaws.com/s3.documentcloud.org/documents/1114...
In short: Levison claims that the DOJ demanded access to the content of all his users messages, and implies that after he complied with that order, they escalated to demand his TLS keys.
But that doesn't seem to be what happened. A fuller timeline of Lavabit might (please correct me) look like this:
t-n..t: Levison complies with numerous court orders demanding information about users of Lavabit.
t: Levison is served with a court order demanding the metadata associated with Snowden. It is unclear whether this demand is actuated by a device that DOJ mandates installation of, but what is clear is that there was a debate between Levison and the DOJ about Levison's capabilities w/r/t/ furnishing the DOJ with information about Snowden's account.
t+1: Levison refuses to comply with the DOJ order, while indicating that he has the technical capacity to comply with at least some of it.
t+2: DOJ escalates with a magistrate court order requiring that Lavabit use its technical capabilities to defeat its encryption of Snowden's information --- a capability that Levison acknowledges having, that is obvious from the design of Lavabit, and that has a precedent in other "secure" email providers.
t+2..t+13: Levison spends 11 days stonewalling DOJ, refusing not only to comply with the order but also to meet with the DOJ. Per the 4th Circuit: "As each day passed, the Government lost forever the ability to collect the target-related data for that day.". Levison is playing chicken, and DOJ is now furious.
t+13: DOJ arranges to compel Levison to appear at a district court hearing, while reiterating that it requires only the metadata information surrounding Snowden's account.
t+14..t+17: Levison delays 4 more days.
t+17: Levison, via his attorneys, replies to the DOJ's order with a counterproposal that involves billing DOJ for his time, collecting a limited set of information, and furnishing it to DOJ only at the conclusion of the entire collection period.
t+20: DOJ, furious and contending that they've lost all reasonable faith in Levison's cooperation with their investigation, demands the TLS keys for Lavabit in order that they can control the collection of the data they need from Lavabit.
Again: please correct details here where I'm wrong.
Most readers of this thread will have enormous sympathy for Levison and his efforts to stymie the DOJ's investigation of Snowden through his account on Lavabit.
However, a jaundiced, cynical, or purely pragmatic reader might also find grave flaws in Levison's response to this situation. His position on the matter does not appear to have been content-neutral: he complied with previous orders. More importantly, when an order came in for an account he had a personal interest in, he escalated matters so that DOJ would end up compromising everyone's information, by playing a game of chicken he was sure to lose.
I personally think he did remarkably well.
Providing the key in 4 point font was yet another childish response that predictably did not help with resolving the situation.
If he disagreed with the nature of the government's request, there are a variety of ways to voice and display that disagreement: locking your doors and closing the curtains in the hope the DoJ stops knocking is not one of them. But given he had a history of complying with this nature of request, I'm curious why he suddenly changed his mind.
Do you mean preparing your defense?
Sure is easy for the DOJ to prepare their case ahead of time with seemingly unlimited assets and then demand a response to an unknowing and single party.
If the government isn't playing by its own rules, I see no reason to play by them. If stonewalling - which I do NOT concede that he did - helped Snowden get away, that's a victory for the people.
Also "Defender Of Freedom And Goodness," really? He gave up more than most of us for a cause that is equally important to all. Whether intentional or not, you're coming off as a pompous, condescending ass.
Printing out the key on 4pt font, delaying to "[help] Snowden get away", and presenting them with absurd terms did not advance any cause, they were just ways to piss of the DoJ.
If he's given up more than us, I wish he'd at least taken actions that had a modest chance of leading to changes in the law or the application of it.
It's pretty common in a court battle for one side to ask for the moon with the full expectation that the other side will counter. If you don't make "absurd terms" then your "reasonable terms" might not happen either.
Personal attacks are not allowed on Hacker News.
So, erm, seems reasonable, actually.
Additionally, it does very much make sense to use that word (repugnant meanings and all!) to underscore the powerlessness of those going up against the State in our modern legal system. Hell, if you end up in the pen because of the aforementioned proceedings, you may end up using the original word anyways.
Doesn't that require proper representation, which he had trouble getting? Moreover, doesn't that only apply in specific cases, which as a third-party to this whole mess didn't necessarily apply to him?
[1] I have no evidence of this, but I suspect the reason he had trouble finding counsel is that he was asking them to play games with the court, which a smart lawyer will refuse to do.
Yes Levison had mixed or uncertain motives. Yes he complied at first, then played a strange game. But at some point he did say "no" to any further requests that to him seemed unconstitutional / illegal / against his conscience.
For that I (a whiskey priest) applaud him.
And under no circumstances would DOJ have had any way to verify the data they were given; they would have to trust that Levison would provide all the data they were looking for. Levison's complete knowledge of his own system might have furnished him with plenty of opportunities to employ technicalities to drastically curtail the information he provided to DOJ. And he had already established himself as an opponent of the investigation.
The terms Levison proposed were reaching. They were coupled with a monetary demand. Levison clearly didn't require the money to comply with the order; given Lavabit's architecture, it was straightforward for him to generate the information DOJ wanted. He asked for the money not because DOJ's demands financially jeopardized his service, but instead to stick a fork in DOJ's eye.
Where has this been covered? Also, is straightforward here being used interchangeably with "easy"?
And a critique of the design from Moxie Marlinspike: http://www.thoughtcrime.org/blog/lavabit-critique/
The critique provides details about how relatively easily the server could obtain any information about an account and its contents.
In the end, I feel very very unconfortable with the direction we are being taken by our governments.
Edit - that was coming over waaaay more aggressive than I meant -
He could have complied with the Article III specific warrant issued in accordance with Constitutional guidelines, just as he did for earlier warrants, instead of electing himself President of the United States and acting like he was above the law.
If the government wants to make me work, to be their mole, should I not be compensated for it? And shouldn't the expectations of that work be clearly defined?
This seems like business/compliance 101 stuff, the easiest detail to rationalize away, and gets a lot more ink than it deserves.
I apologize for not being clear in my earlier comment: if he'd just asked for the monetary compensation, I expect he would have gotten it.
Not really. What's going on is that a lot of people are participating in impotent outrage rather than actually risking their livelihoods as they lionize Levison and Snowden for doing.
At the same time, do you really want to fight for a cause under the banner of a lie? Ignore for a moment the opinions of others on the subject; if someone told you that God is real and that He wants you to defend privacy, would that motivate you to finally "spring into action"?
First & simplest: DOJ/FBI is made up of people, not of automatons. When you piss people off, you alter their behavior. Levison found himself in a situation where the welfare of his users depended in large part on how DOJ opted to behave. In order to make the most powerful statement he could about his dislike of DOJ's investigation, he deliberately provoked DOJ, spending his users welfare for his own PR ends.
Secondly, and I think equally importantly: Levison's actions made it easy for DOJ to demonstrate that he was untrustworthy. Their original demand was for metadata about a specific account, and the court record indicates that they were willing to spend time finding ways to cooperate with Levison, whose responses appear to have been inconsistent with his previous actions w/r/t/ court orders for Lavabit. By the end, no show of cooperation from Levison was needed, because Levison had made it clear to the court that DOJ had grounds to demand enough information for them to control the collection of the data they were after.
Yes, people with great responsibility, that should understand that someone may want to fight, deny or defend against legal actions taken by the DOJ. The fact that they're "human" is a flaw, as their actions should not be swayed by swings in emotion. The burden should be placed on them to act professionally and legally despite counteractions taken by those charged/targeted.
"Levison's actions made it easy for DOJ to demonstrate that he was untrustworthy"
Is Levison's character on trial here? Who give's a crap if he's untrustworthy, the only thing that should matter is the law. Sure in the court of public approval his character matters, but as with the first point it should not play a part in legal proceedings.
Ladies and gentlemen, behold! Eight words -- eight syllables -- laying bare why so many engineers tend to have such a hard time dealing with politics and people, on every scale from the picayune to the planetary. I've never seen it put so succinctly.
I'm still baffled as to why it's such a common problem, though. The essence of our shared discipline is to bridge the gap between a perfect idea and an imperfect world. This being the case, in our professional lives we must either be capable of recognizing and accepting such imperfection, or be incompetent; there is no third way.
So why is it that, in the interpersonal realm, so many of us prefer to demand impossible perfection than to exercise the same capacity that serves us so well in the technical work of our field? There's no sensible way of understanding how the imperfect human world works, save to begin by redressing ignorance through observation. Instead, many of us (some days, I think, most of us) flee into any number of idiosyncratic political fantasies -- just-so stories about how that world should work -- and refuse outright even to consider the possible value of discovering how that world does work.
Such refusal hampers us in any number of ways, professionally and otherwise; three of the former sort, right off the top of my head, are office politics, client interaction, and user interface design. Engineers are, of course, famously incompetent in all these areas, and unlike a lot of stereotypes, this one I've observed to be much more often accurate than otherwise. But I'm still struggling toward a conception of how this unhappy state of affairs comes to be.
When it comes to the DoJ and FBI, these institutions are immensely powerful compared to individuals, they should have MORE restrictions on an individual agent/employee taking retaliatory actions based on their emotional state.
The DOJ's emotional state has nothing to do with their ability to order Levison to hand over the keys because the order didn't come from them, it came from the Court.
But once he realized that there was going to be real trouble for an individual whose data was entrusted to him he did as far as I can see what he could and he risked becoming the lightning rod.
What other course of action would you suggest he should have taken?
I concede that that's a reasonable position to take. I think it's probably true that DOJ was unlikely to declare a field day on all of Lavabit, slurping every conceivable secret they could obtain from the service.
However we look at the situation, though, it seems unreasonable to accept deceptive statements from Levison about how it actually played out. His narrative doesn't square with the court's. What factual claim in the 4th Circuit ruling do you contend is false?
I'm not smart enough to set up a secure email service, but I would hope that if I did and I would be put under this kind of pressure that I'd be able to stall long enough that my users data would be as safe as circumstances still allowed and that the one the heat was applied to would be me. That's a damn sight better than rolling over at the first knock on the door and handing over all the data.
For sure he must have realized something important was up, who knows, he may have even read over Snowdens shoulder. I don't care either way, the man did his best. What happens after this is just silly vengeance, it will cost some money, a bunch of time, ruin one or more people's lives and the world will move on.
If there is one lesson to be learned here then it is that you should set up a service like this in such a way that it auto-destructs if you don't hit it periodically with some kind of signal that is not easy to fake without being you and that you advertise that fact and set the thing up in such a way that even you can't decode the data (and then you still have to hope that the NSA can't either in case they get a drive and/or a readout of your memory).
I don't see the logical connection between these two sentences. Could you expand?
The fact that Thomas raises the emotion flag in the top post in this thread makes the human element in the DOJ shine through quite a bit, to me that is a total-loss, if anything justice should be meted out with restraint and compassion. Not anger, revenge and furiousness. Those have no place in the justice department of a well organized society. Sure it is all people, but those people have a lot of power and should act accordingly.
Good luck with that. The US Government has its own firewall against control of this form, by its people.
Or, is there some reality TV show about Guantanamo and other associated criminal operations of the US around the world that I've missed?
In an environment where the government can remove the truth at will (with its formidable NSL weaponry), the battle is no longer about fair and equal society. Its a battle for justice, instead - and when all legal means of obtaining justice have been tied down by the "OMG! Terrorism!" crowd, the gloves need to come off. Citizens need to reign in their out of control government - otherwise they will become the (rightful) targets of the enemies that government is making ..
> Those have no place in the justice department of a well organized society.
I'm not really sure what a "well organized society" means in this case. I don't get a general sense that we are a well-organized society, but I never have, so maybe that's just me.
While I agree that "revenge and furiousness" are wrong, I also see much less problem in anger. Anger has to be tempered by reason, sure, but that's what procedure is for, why good judges don't watch the news.
His argument was that he could not find appropriate legal representation because of the gag order, and that the DOJ would not cooperate in kind with his legal team once assembled. Do you think his delays were too long given these constraints and the fact that he has a company to run?
If I have sympathy for Levison it's because he was intimidated into laying aside his moral beliefs. It could happen to any of us.
That's his opinion, and nothing more.
As it turns out there are many great reasons for allowing courts to consider things under a shroud of secrecy.
E.g. deliberations about a warrant to search the home of an accused pedophile. The accused is innocent until proven guilty so the court would have a strong interest in not making such a warrant public (and in fact we screw this up too much already with sex-related cases IMHO).
Or in embezzlement cases, having a completely public deliberation about warrants would tip off the crooks ripping off the taxpayers into avoiding the very means of communication intended to be wiretapped.
Where in any of those gag orders was Levison forbidden from obtaining an attorney, or telling people he was retaining an attorney?
In the case of sex offence cases, it's common for the accused to get name suppression, so that only those present in court are aware of their identity. It's still a public trial, involving a jury of citizens.
A FISA-type court /could/ operate in a way where a jury made up of members of the public were involved in making the decisions, while being bound by the normal rules of secrecy that require them to not talk about the case outside of the court.
If true this would be, by itself, a really really big deal. But the article doesn't seem to say that. It says he couldn't find a lawyer willing to take on his case, but he talked with "a dozen." Lawyers are the best people to ask for recommendations to other lawyers.
Is this true in your experience? Do you think it's a good idea to have your run of the mill web developer creating device drivers for your embedded device?
Why then, do you think it was enough for him to simply speak with "dozens of lawyers" rather than finding one that had both knowledge and experience dealing with the specific area of the law dealing with this issue?
He does have the victim card to play, though, and he's going to keep milking it for all it's worth, quite rightfully. The government effectively killed his business the second they first coerced him into undermining his clients. The only choice for him in that position was to give up on his business or give up on his principles. If he indeed wound up failing on both counts, well, at the point someone is put under this sort of duress, is there any point in being so judgemental of him?
But that's neither here nor there, because my issue in this case isn't that Levison was on the wrong side of a controversy with DOJ.
My issue is that Levison never should have been running this particular service. Like many other short-sighted developers, Levison built a site that made expansive claims about its security capabilities which anyone familiar with the actual technology could see were preposterous.
The framing of the "debate", such as it is, about Lavabit seems to take as a given that DOJ or NSA can compromise secure messaging services, and that our only reasonable response is outrage directed at the USG (or "Five Eyes" or whoever) in the hopes of effecting policy changes. No. It is more than possible to build services that thwart the kinds of orders Levison received. It's not even difficult to do that. Levison could have built a service that would not have provided him the capability of furnishing the FBI with Snowden metadata.
Levison didn't not build that system because that was hard to execute technically. I think he did it because it was hard to execute as a business. Users want communications tools that work like the ones they already have, and, in particular, they want tools that interoperate with Internet email. Like virtually everyone on HN, Levison probably understands that such a tool is virtually impossible to implement as a web application. But Levison also knows that building native applications is expensive, and getting users to install things is more expensive still.
So instead of building something that protected his users, he appears to have built something that didn't, and then pretended that it did. He may have "gotten away with it" so long as the court orders he apparently quietly complied with didn't pertain to the highest-profile target on the Internet. But once that happened, the game was up.
If all of that's true, I'm not sure from where I'm supposed to find sympathy for people who play those kinds of games with people's secrets.
Perhaps, but unless there is appropriate and firm pushback against further legislative creep, mass surveillance, and abuses of process, etc then those other services are at risk of getting stamped out as well.
Levison is not a saint, but he doesn't have to be.
Are you suggesting that I should instead reserve my complaints for the users of these services? That empirically does not work; there are millions of users, and none of them research the tools they use to communicate privately.
But that ship has sailed. He fucked up, he tried hard to limit the damage and as far as I can see he's been punished just about enough. So if you're upfront about using this as a cautionary tale then that would start with either educating users of such services or with pointing out similarities between Levinson's flawed approach and other offers of services like that. Further dumping on Levison is pointless, it's like kicking a guy that is already down.
Compare this with Karin Spaink taking on scientology knowing full well that that would bring down a lot of trouble, but doing society a great service in warning people of the dangers of that particular organization.
For users of Lavabit any kind of warning is a bit late and I think they have learned their lesson (or at least, I would hope they did).
Snake oil peddlers have been making money for years, the farmaceuticals or the broken-crypto ones look all the same from where I'm standing, they are playing with people's lives. But the ones that get caught are as far as I'm concerned neutralized, it's the ones that remain that deserve our attention, and their users as well.
In the end, the responsibility for your life is yours and you can't outsource that. So looking over the product you buy is a minimum requirement for things that your life depends on, just going on claims absent independent verification of those claims is for want of a better word, terribly stupid.
By analogy, if you're say, some technically adept guy that decides to screw over the NSA just using a service because it claims to be secure is probably not a good idea. In cases like that you either do it yourself or you assume that you are taking a risk.
I can't really see Snowden, working for the NSA as a layperson in this context, just as I can't see a mountaineer as a layperson when it comes to evaluating mountaineering gear.
Case in point, I worked on some pretty high structures in the gray past and I've rejected multiple 'definitely good' safety harnesses and clamps simply because they did not pass my personal standard for quality of such important gear. If I had chosen to continue and used them, and something would have happened to me because of the device failing then I would have partly blamed myself.
If crypto is of life saving importance to you then you have to know at least enough to evaluate the service and if you can't do that then either you knowingly take a risk or you should probably not be doing what you plan on doing.
My personal take on anything internet related is that since I can't predict the near future (let alone the far one) I assume that anything stored on my computers will become public one day. I suppose that even the most secure implementation available to us today is only one bug away from being wide open after all. Call me pessimistic.
One last thing about lavabit, I can see at least one very obvious way in which lavabit could have been broken that would not require Levinson's cooperation at all (but would have required a lot more foresight on the part of the NSA). In a way it is reassuring that Levinson was able to do that he did, that lowers my estimate of the NSA being able to record and store at will considerably. After all, if they can't even afford to tap the ingoing and outgoing traffic of a service that offers secure email then either they are not very good in their target selection or their resources are spent on more interesting targets and so 'little fish' like Snowden can get away with their deeds. I'm pretty sure that that hole is now plugged and I would hope that the users of similar services now know that as soon as you hit 'send' your secret is no longer.
So, Levinson is wrong for doing what he did, his users are wrong for believing his claims. I note that Moxie Marlinspike's critique of Lavabit was written post-takedown, it is not proven in my opinion that Levinson acted maliciously, though it is very well possible that this is the case. Even if he was only negligent there is plenty of blame for him, and by the looks of it that's hitting home hard enough for what he has done and then some.
That still does not relieve his users from their own responsibility for their part in all this. Giving data that you wish to keep from the government to a service that you are not qualified to audit and that you did not pay some service that is qualified to audit is simply dumb. No matter what the guarantees such a service is making.
Consider for instance that such a service could be set up as a front or a honeypot.
I'm sure that in your book every claim made in advertising ever was always true but I'm a bit more cynical than that.
I suspect they got trapped up in that pesky policy requirement to not wiretap American citizens on American servers hosted in American soil. I'm sure they could have figured out the technical aspects quite easily.
Regular employers do this with impunity, for sure the NSA can do likewise. You have to be aware of the use of the service first and one reason why people a lot smarter than me suspect that that key was so important was in order to be able to decrypt past communications using the same service on captured traffic.
If it were that simple then the NSA would simply have provided that documentation to Levison, no?
Or, as I already said, simply scooped up his data going to/from Lavabit's servers anyways, if they felt they had the legal authority.
> Regular employers do this with impunity, for sure the NSA can do likewise.
Regular employers do this on their own systems, sure, just like every U.S. government IT system warns about the various (but not total) authorities they have to monitor your usage of government computers in many settings. But do regular employers subpoena a third-party email provider under the same IT use agreement expecting that email information to be turned over?
> You have to be aware of the use of the service first
The USG was obviously aware, otherwise they wouldn't have issued a specific subpoena to the operator of the Lavabit email service.
> people a lot smarter than me suspect that that key was so important was in order to be able to decrypt past communications using the same service on captured traffic.
Then maybe Levison should have complied with the first batch of specific warrants, where the topic of the SSL key didn't come up at all?
I mean, I can also give a self-deprecating comment but I don't think anyone has to be very smart to figure out that the SSL key wasn't even asked for until Levison made it impossible for the USG to perform their "good old fashioned police work" in any other way.
The problem is, in the U.S. and I'd imagine most other countries, your business cannot be built on refusing to follow court orders to protect your clients. Specifically, refusing to furnish relevant information despite being able to do so without excessive burden.
We're not talking about some new erosion of civil rights. The power of courts to compel witnesses to provide relevant evidence and testimony dates back to the origins of jury trials in the middle ages: http://en.wikipedia.org/wiki/Subpoena_ad_testificandum.
What about churches offering confessional services? I know, that's a case where the law specifically protects the (priest/penitent) relationship. (Nor are they "businesses" in the conventional sense of the term.) Nevertheless, they are open about how they're willing to violate a court order asking them to (in their judgment) break the confessional seal.
Third caveat: if all you meant was that the "confession protector" can still expect to go to jail for this, that's still not a counterexample to what you said. But the point is that, unlike with Lavabit, the court would not shut down the entire church when priests violate such court orders, no matter how systematically they do it.
(Even then, priests and lawyers have rules about when to break confidentiality. If someone said they committed a murder, nope. If someone said they are going to commit a murder tonight, then yes.)
If you want a new kind of privilege, you should lobby your legislators, not try to start a for-profit business.
If a church, for some insane reason, kept written records about what was said in the confessional, and a court order was somehow granted to order the church to turn over their records (ignoring privilege), they would need to turn those over.
If someone destroyed them, the DOJ would not need to shut down the church. They would charge the person who destroyed them with the appropriate crime, and then everyone would move on.
If they refused to turn them over, but the DOJ believed they were still on premises, eventually the DOJ would get the local sheriff to physically enter the building and take the records. There would be no need to shut down the church.
In that situation, ideally the records are all in individual files, and the constable only needs to take one. If the head priest said "nyah nyah, we mixed them all up, ha ha!", then all would be seized, and someone would need to go through and find the relevant information.
By keeping all the secrets of their "clients" written down, the church has put them all at risk. If one priest knew the secret only in his head, the government could compel him to testify, and that still wouldn't require shutting down the church.
The nature of computers is that they are simultaneously typewriter, gold bars, and file cabinet -- they are needed for work, they are valuable, they contain lots of information. When the government needs to seize evidence, they cannot slice out the "file cabinet" component from the other components. The fundamental rule is that the government is entitled to evidence.
EDIT, and maybe this is what I should have said instead of all the stuff above: Lavabit's only defense against seizure of its keys if a court order demanded them was to refuse to provide them. I.e., break the law. I don't know how else that can be read except as a promise to break the law on behalf of their clients.
Second edit: And fundamentally an unkeepable promise. I could, in theory, promise to not repeat the secret you told me and that I hold only in my brain, no matter how long I sit in jail. I cannot promise that the DOJ cannot seize my written record of that conversation, because they can bust down the door to get it.
In general, however, a business will not be protected by any evidentiary privilege. In order to avoid complying with a court order, they will have to violate it.
You can't dismiss the scenario by acting like a priest will never protect a confessional in violation of a court order.
edit: I think you explained this in your reply at https://news.ycombinator.com/item?id=7775232. but still, if the idea is, "you can't claim that system X protects you, because the government can compel that system to give up its keys", that would appear to apply to any encryption system. OpenPGP can't make the claim, "now you can send any message with absolutely zero chance of the government ever reading them!", one subpoena (edit again: search warrant) for your laptop and your passphrase (or a covertly installed snooping device) is all it takes.
No they can't. In general, such an act would be a breach of the Fifth Amendment protection against self-incrimination. You cannot claim similar protections for information that would get another person in trouble though. This is why Levison was risking a contempt charge by refusing to turn over evidence about someone else.
Exactly. There was a lot of back and forth about legislation in the UK that basically considered it contempt of court (or worse: impeding an investigation) to not provide encryption keys/pass phrases. Problem was, the government didn't have to prove that you actually had (access to) the keys in question -- effectively being caught with a usb key filled with random data could get you a year in prison...
If you think about it it's entirely unreasonable to demand encryption keys (to say nothing of how you would prove/disprove that the right keys have been provided, specially with stuff like hidden encryption partitions available...).
At any rate the (technical) problem with lavabit was that lavabit could technically sabotage their product in such a was as to gain/give access to user data -- a secure system would not.
The viability of both private (data) and private meta-data messaging have been debated a few times, but basically it's currently hard to beat regular email+gpg+mixmaster routing.
And as long as we don't have secure "web" crypto, the situation won't change.
It would be like refusing to open a safe even though the cops have a video recording of every point in time from you putting a bloody knife in the safe to the present time; making you open the safe isn't what proves your association with the knife as the police already have that on video.
How the courts interpret that kind of theory for computing will certainly be intriguing though.
That was true of In Re Boucher and to a similar extent US v Kirschner, but in US v. Fricosu, the agents had not seen the contents of the computer, as the defendant claimed she couldn't remember the password. Obviously PC still has to exist that the thing to be found will be found on the computer, but in Fiscosu it was.
In other words, yes this is exactly like refusing to open a safe. The only difference is that with a safe, if you no longer have the key, the law enforcement agencies can attempt other methods of opening the safe. If you lose your encryption key, nobody can prove that you actually lost it and are not just trying to hide it. In this case, it seems the judge will simply say that you are in contempt of court and will lock you up until your memory improves (as in indefinitely).
The first sentence doesn't follow from the second.
Is there a difference? A system like Lavabit is meant to provide technical defences to legal threats. It has to be; that's the entire point. It's not like Levison was providing (or claiming to provide) any defences from any non-legal threats. What Levison needed to do was design a system which did not technically allow him to comply with the subpoenas he received.
And at least for American's, your counter about "can't the government just grab your laptop" is incorrect; you have a privacy interest in your laptop that you do not have in a 3rd party servers. You have stronger 4th Amendment protections, plus a 5th Amendment right not to incriminate yourself. (This last point gets confused; the government does have a right to compel you to give up your keys only if they already know what's being protected. If they know that you have a child porn on your laptop from other means, you must let them access the child porn on your laptop. If they have no idea what's on it, they cannot compel you to let them access it.)
Did they just break the law by forcing you to decrypt it?
Or is it enough for the government to believe whatever they want to make you give up your encryption key?
Both. I can't speak for tptacek but can explain his comment. Lavabit may not have known about the legal possibilities, but the technical design was such that Lavabit could expose users' communications.
The technical shortcoming was that the system used the password input by the user as a key for the encryption. I may have some details mixed up, but basically they could capture the password in plaintext and unlock the user's comms with it. They made a practice and promise of not doing so, but one of the government demands was to intercept it.
Or because they willingly comply with every government request, unbeknownst to their users, which is not really news-worthy (unlike Levison standing his ground for principles in which he believes).
Or are you suggesting that they maintain a secret list of unknown vulnerabilities in their own code, just so they can help people spy on their own users?
>>How would they do this, assuming they wanted to? If they built their tools correctly
If they built their tools correctly. I think that's a big assumption. We know for a fact that the NSA has infiltrated and/or influenced various organizations to knowingly implement vulnerabilities in commonly used protocols so that systems that use those protocols can be exploited later. This was all over the news. Some experts even speculate that this may be how the Heartbleed bug originated. Considering the fact that OpenSSL has been around for a long time and no one discovered the vulnerability until very recently seriously brings to question how much faith can be placed in systems like GnuPG and OTR.
Again, consider who you are up against: the NSA has the capability to tap underwater cables, intercept shipments of routers to plant bugs on them, to force airplanes of foreign presidents to land on allied territory so they can be searched for a fugitive, and who knows what else. And that is the "who knows what else" part that should worry you. We are against an enemy of unknown power and influence, and it is silly to expect technology -- any technology -- to provide sufficient protection. Suggesting that "[GnuPG and OTR] don't end up in the news because they work" is asinine.
Before you say I'm being dramatic, consider the fact that this is a government that extra-judiciously assassinates its own citizens and then shamelessly defends it. If you think your shiny protocols are secure, you may want to rethink your entire perspective. At the end of the day, humans can be compromised, which makes all systems designed and developed by humans inherently risky regardless of implementation detail or operation. Any time the NSA really wants to gain a piece of information, the discrete log problem is at best a short delay. A minor inconvenience. A drop in the bucket in terms of the resources needed to go around it, since solving it is not necessary if the system is poorly implemented or has other, undocumented vulnerabilities.
edit: downvotes are expected. This is a techie forum and techies don't like it when someone points out that technology can't solve every problem.
If your original comment had made the point that we don't know what we don't know with respect to the NSA's capabilities, rather than impugning people like Moxie Marlinspike, you probably would have fared better.
This is neither an appropriate subject, nor an appropriate forum, for ad hominem arguments.
Moxie Marlinspike is well-liked around here, at least as far as I can see. That's enough reason for people to downvote someone who says, "Or because they willingly comply with every government request, unbeknownst to their users, which is not really news-worthy (unlike Levison standing his ground for principles in which he believes)." with nothing to back it up. Perhaps the poster just wanted to mention it as a theoretical possibility, but it comes across as an allegation, at least to me.
As for your question about trusting Marlinspike more than Lamo, I'm assuming that you mean Lamo before it was revealed that he had informed on Manning. I.e., Lamo seemed like a good guy and look what he did. I'm not sure how to respond as I don't know any of them personally. Others here could do better. I never said you should trust Marlinspike, I said people here don't like to see him attacked out of the blue, or that is what I meant, anyway.
To clarify what I was getting at, ad hominem doesn't necessarily imply that someone is being attacked or insulted. It just means that the argument, whether pro or con, should be considered without reference to a particular person. Marlinspike's involvement with a particular security software product or service has no bearing on whether I should assume it's uncompromised by the government.
Do all of the implementations, particularly on mobile, actually provide such security? If a court is willing to order TLS keys to be turned over in order to enable the government to access information, why couldn't they order the developer to release a backdoored version through the relevant App Store or other update mechanism? If the author refuses to comply, then they will demand the codesigning keys so they can backdoor it themselves.
To quote your critique of another's security proposal: "Then the only difference between hushmail and your model is exactly what the FBI will get a subpoena to have you type into your server to subvert your users. The models are equivalently insecure."
This is much different than requiring that arbitrary third-parties to be compelled to take arbitrary action to assist in a government investigation. Where they are required, it is a power granted by statute with limited scope. (Phone companies are required to assist in wiretaps via things like Communications Assistance for Law Enforcement Act; I forget that was in effect before that. And they get to bill the government for it.)
From reading the arguments in this case, it's not clear to me that the judges would have been impressed by that distinction. Their focus was on whether Lavabit had the technical capability to provide the information the government demanded. In both cases, the answer is yes. We won't know the actual answer until this has been litigated. If it has and I've missed it, I'd love to see the case in question.
But once he established that he owned the information, then it was either get it out himself, or let the DOJ go through and get the information themselves.
IANAL.
And that counsel would have advised him exactly what he could have and should have revealed, and how to comply with previous requests. His complying with prior orders surely weakened any attempt to say "but I can't get that information!"
You don't happen to have a link to either of those, do you?
The horror.
But once again: regardless of what the public is entitled to, the developers of GnuPG can't furnish any evidence about what its users are saying, nor can the developers of libotr. Levison can't reasonably make the same claim, but he tried to, much to everyone's detriment.
Suggesting that the solution is to have every individual maintain their own private e-mail server, while certainly pragmatic, ignores the realities of modern communications.
How is an ordinary citizen supposed to understand the legal issues at play or alternatively be able to obtain specialty counsel in a matter of days? If one should only speak to the FBI in the presence of legal counsel isn't it understandable that he was quiet while searching for a lawyer?
Also, why is it so wrong of him to stage a legal challenge to an order that contradicts his own moral/political beliefs? Your point is that the end-game was always clear but to a legal layperson I don't think that's true.
levison absolutely was being a dick, and I think the DOJ responded in kind by being a dick also.
Yes, there are good reasons for the authorities to demand personal information of criminals from service providers. But there is no reason at all that secret courts decide about these demands without anyone knowing or having the chance to question the legality and scale of data sniffing.
Ironically, without Snowden we all would have no idea what is going on behind the curtain.
Levison should be lauded for his courage (and despite all technical inaccuracies or open questions about the timeline you brought up)!
PS: I dont understand why this submission is already heavily penalized, this matters for most/all of us.
Justice always relies on human discretion, for better or for worse, but it reflects on us all which cases we call which.
And yes, if I had the choice I would always choose the service which is run by people who respect the law but share my values and views and are ready to fight against questionable orders from authorities on behalf of their users.
I wouldn't be opposed to government-paid counsel for certain types of businesses facing this kind of request, or costs paid automatically attached to the request so cost-of-counsel isn't a factor.
On the other hand, I have exactly the same issues as you. I don't think that his case holds up to serious scrutiny, and I don't think he's presenting himself in good faith.
It's been frustrating to me to try and figure out what exactly is going on at the big name tech companies. Levison's story is used to justify the assumption that essentially all tech companies are compromised, legally. Personally, I've seen an overreporting of very tenuous links such as Google being linked to In-Q-Tel, and an underreporting of things like the NSA division at Dell.
Maybe this is just a PR move on Levison's part? Trying to emulate Kim Dotcom as an "Outlaw Privacy Rights Hero"? I don't know. I'm onboard with decentralizing everything, I try not to pass judgement on individual companies. Yours' is the first and only comment I've read so far, though, so I'm curious to see the rest of HN's thoughts.
It's not mutually exclusive, nor unlikely, that it did take Levison 11 days of searching to try and find an attorney who knew this area and was available AND that the DoJ wanted a much swifter response and grew impatient as the delay put the evidence at risk and so perceived the delay as stalling.
I agree with you on your subsequent comment that I'd rather trust OpenPGP with encryption, but on the sequence of events... there's nothing to say that both sides are not true at the same time, and that all motive/reason behind the events on the timeline are open to subjective interpretation.
My post has no mention of reasonable criticism of Aaron Schwarz. The subject of the post was "reasonable criticism" - a completely different animal.
But! The period you describe as him stonewalling the DOJ, he claims he was talking to them every day while trying to find competent legal representation.
Now, this sounds like something I would want to do if the nature of the request were different from the previous ones. (whether it was technically different or just the fact he had a personal interest in the account as you suggest doesn't really matter, just that for whatever reason it wasn't to be handled in the previous manner)
I certainly believe it was difficult for him to find good representation when he was under a gag order.
So I have some limited sympathy here; the DOJ are forcing him to move to their timeline, and he's scrambling to find good lawyers.
I think we can say he was happy to sell out users or that he was fraudulently labelling his service as secure, while acknowledging the fact that he was trying to seek legal advice at the same time.
He could have spent every single conversation putting them off rather than working with them, which is what's implied by the 'literal silence' anyway.
We don't exactly know what was said in those conversations, so it's hard to know whether he was silent or not. What we do know is that they weren't very fruitful for the DOJ, so it's not outlandish to assume he was simply putting them off.
http://www.theguardian.com/commentisfree/2014/may/20/why-did...
* Call - don't email - call your representatives and express, politely, the fact that this kind of thing is Not OK. Writing a letter on paper is good too, apparently. Stop reading and do this now.
* Donate money to groups like the EFF.
* Volunteer with groups like the EFF.
* Use and support stuff like GPG.
* Don't bitch and moan about "woe is us, it's impossible". That only makes it easier for those who would deny us our rights.
* This will be a difficult, and quite likely drawn-out struggle. Don't give up. Keep working at it.
If we disagree with the laws, ok: protest for legal reform. If we disagree with the things revealed by Snowden, ok: protest that. But what happened to Lavabit was the government behaving properly: they obtained a narrow warrant for specifically the data they needed as part of their investigation, they tried to work with Levison to fulfill the warrant, and only after days of being stonewalled did they escalate to ensure compliance.
I think that there is a bigger problem with our democracy and, with so many people not voting anyway, it is about time that the people of people of the U.S. decided to not actually bother to vote, to not endorse the system and to effectively deliver a government that has no legitimacy.
Obviously this will let the 'bad guys in', but, with no popular mandate, will they be able to govern any better than someone like Ceausescu?
During the peak Bush years when the alternative was some hideous warmonger in the making like John Kerry, scores of do-gooding actors and celebrities were doing their hardest to get people to vote. As if voting and democracy would change anything. In America you need a compelling 'vote for RON' (re-open nominations) or a 'vote for nobody' type of campaign rather than these 'vote because your great-great-great-great-grandmother fought for your right to do so' schemes that actors etc. come up with. Clearly the people behind a successful 'vote for RON' campaign can have a political platform, a network and such like, so, if an illegitimate government exists then candidates can be found.
Start up mentality. Can it be applied to the problem in hand?
At every possible opportunity resistance was stymied, with the presumption that the will to resist would eventually collapse.
They lost because they never once contemplated the possibility of you being willing to shut down your business because of your principles, something they couldn't fathom or conceive of, since such a concept is anathema to their wholly illegal and unconstitutional activities.
If you build a business on selling security to people and you make such a mistake in the design of your software, you failed to deliver what you promised to your customers and you deserve to fail.
And not get bailed out because you thumped your chest about having to service search warrants when you chose to set up in US jurisdiction. If you don't want to be obligated to comply with lawful US requests like search warrants then don't set up in the US.
Additionally can you explain how he got the architecture "wrong"?
Edit: Précis of the architecture of Lavabit from http://www.thoughtcrime.org/blog/lavabit-critique/
Lavabit kept your private key on their server, but encrypted it with your plaintext password which you sent them if you wanted to read your mail. That's pretty rubbish in many ways as the article rather even handey points out. A sentiment I am agreeing with - we applaud him for standing up, not for being perfect.
I'd guess that Switzerland, Sweden and Germany would (probably) all have provided a better judicial environment.
The downside, though, is the NSA having freer reign there.
See Moxie Marlinspike's post from last November:
http://www.thoughtcrime.org/blog/lavabit-critique/
You can't entrust a server with encryption / decryption, nor with supplying the tools to do it locally, e.g., via JS downloaded as part of a web interaction. Service providers can be subpoenaed, threatened, infiltrated, bribed, or hacked. Or they can just turn evil.
All crypto must take place on the client, using carefully vetted tools.
To me that makes no sense whatsoever, so this start-up was doomed from the very onset.
Pardon my ignorance, I am new to the issues of encryption and privacy. Always assumed I can worry about it later, but the time has come at last. About time, when my native country is enforcing the laws that permit internet censorship an increasingly wide scale. http://en.wikipedia.org/wiki/Russian_Internet_blacklist
In the 1990s there was a series of political/legal conflicts over encryption, which was about to go mainstream (the whole episode is now referred to as the "clipper chip" controversy). The USG wanted strong encryption without backdoors banned, and everyone to use instead a set of encryption protocols which would have provided keys for the government (the "key escrow" idea), and the USG would promise not to abuse the power to decrypt everyone's communications.
Some heroic technical people worked around that and actually exported what eventually became PGP/GPG on paper to take advantage of a loophole in the ban. The controversy faded and the civilian right to non-backdoored, strong encryption became the nominal law and policy.
Since then the USG has been working to undo and reverse this situation by any means it can find. What it's come up with is (a) the NSA mass-wiretapping regime (actually a continuation Echelon and several other prior, longstanding mass-surveillance schemes) and (b) the set of legal tools applied to Lavabit.
And they've mostly succeeded. Secure communication is theoretically legal, but if the government can coerce encryption keys, secure communication is defacto subject to being stopped anytime the government takes an interest in someone. And while providing secure comms as a service is technically still legal, if the feds can demand a combination of trojaning the service and concealment of the subversion from users, then they have effectively banned secure communications in practice, while maintaining the written law as-is.
This is notoriously known for not encrypting metadata, though, which is impossible because this very metadata is used to make email actually work.
Using the law is one thing. Using the law for the intended purpose is a different thing.
Not sure whether the law is really used for the right purpose.
- open-sourcing lavabit - making it ready for instant deployment e.g. using Docker
A kind of "just add a VPS" platform...
However agents wouldn't be restricted by US laws and regulations either: they could simply operate to obtain the access they felt necessary to acquire the information they sought.
One of the scariest things about state surveillance actors isn't their capabilities (though in the case of the NSA and a few similar agencies elsewhere this is no doubt substantial), but their impunity. In the US, under very, very broad provisions of the so-called USA-PATRIOT Act, access to tremendous amounts of data on virtually the entire population is provided, with full legal cover. Outside the US, legal cover is reduced, but so are legal restrictions. Agents can operate with reasonably little personal risk via electronic means to gain access, or interdict and retool equipment if sufficient backdoors don't already exist.
Deleting the account, however, seems much more viable for similar situations. Forcing a company (like Lavabit) to provide service to an individual might be supportable, based in part on past precedents to do with race discrimination and general regulation-of-business principles, but would be unprecedented in regard to a non-commercial entity. Arguably it would run afoul of the 13th Amendment in the US.
Of course, written law has little bearing on what the government can do in practice in today's USA.
The actual highest law of the land is that made by Supreme Court fiat, when they rule on the cases which they choose to hear, and whose rulings no man may practicably gainsay. Below that there are many levels of law, arranged in the sort of untidy and inter-referential tangle which any software engineer might expect out of a system that's been being patched and extended for two centuries straight; if we take the increasingly vestigial federal/state/local distinction as our demarcation, Congress occupies much of the lower half of the upper third. And, of course, at every level, and just as at all other times and places throughout the entire broad span of human history, the basic rule is that what's legal is what you get away with.
Is this how the matter ought to be? Perhaps, and perhaps not; I've seen arguments both ways. But, either way, this is how the matter is.
Regardless of what might be the case even if its sealed there needs to be a process that allows fairness. "search" needs to be well defined its pretty general when it comes to software and tech and can be interpreted any way you want.
Perhaps time for some digital legislation?
I like Russians, have some Ukrainian friends and have spent a good part of my life behind where the former iron curtain used to be. So my perspective is probably quite warped. Putin and his band of cronies are effectively still doing exactly what the communist fat cats were doing, now you have he mafia to worry about instead of the authorities (that may be a couple of years out of date).
It's funny how everything changes and yet, the basics are still the same. Real change takes a long time.