Slashdot Mirror
ACLU: Lavabit Was 'Fatally Undermined' By Demands For Encryption Keys
An anonymous reader writes "When encrypted email provider Lavabit shut down in August, it was because U.S. authorities demanded the company release encryption keys to get access to certain accounts. Lavabit's founder, Ladar Levison, is facing contempt of court charges for his refusal to acquiesce to their demands. But now the ACLU has filed a 'friend of the court' brief (PDF) in support of Levison, saying that the government's demand 'fatally undermined' the secure email service. 'Lavabit's business was predicated on offering a secure email service, and no company could possible tell its clients that it offers a secure service if its keys have been handed over to the government.' The ACLU added, 'The district court's contempt holding should be reversed, because the underlying orders requiring Lavabit to disclose its private keys imposed an unreasonable burden on the company. Although innocent third parties have a duty to assist law enforcement agents in their investigations, they also have a right not to be compelled "to render assistance without limitation regardless of the burden involved."' Lavabit is also defending itself by claiming a violation of the 4th amendment has occurred."
Fuck that! I have no such obligation
“He’s not deformed, he’s just drunk!”
The argument is that lavabit was asked to sabotage it's prime selling point.
A government cheerleader licking the government's boots? Why, who would have thought!?
when the FBI wanted access to only a few accounts. instead they blew them off and brought this on to themselves
Well, that doesn't seem very appropriate. Why is the government focusing on revenge?
Except for the fact that they couldn't do that by virtue of the site's design. As another article explained on /. explained, that design choice was good security practice because the government exploiting you is not any different technologically than any other insider attack. The problem is that the NSA got exposed, and they got pissed. The answer was to nuke the NSA from orbit. It's the only way to be sure.
This is my signature. There are many like it, but this one is mine.
Even if you encrypt your messages yourself, you must still push those messages through a service to its recipient. So, you are inevitably at risk of traffic analysis, and in Snowden's case the NSA was just as interested in who he was communicating with as what exactly was being said. So, laugh at users of Lavabit all you want, but it's not like plain e-mail with both sides PGPing their messages is any better.
Lavabit Appeal EFF Amicus Brief http://cryptome.org/2013/10/lavabit-eff-amicus-13-1024.pdf, Lavabit Appeal ACLU Amicus Brief http://cryptome.org/2013/10/lavabit-aclu-amicus-13-1024.pdf & Lavabit Appeal Empeopled Amicus Brief http://cryptome.org/2013/10/lavabit-empeopled-amicus-13-1024.pdf might offer some insight into the legal advice sought and deployed via http://cryptome.org/.
what happens if i don't know, if i forget, for instance, or my key store is set to autodestruct? what happens in a distributed system like (toad's) freenet, where the keys are unknown? and can anyone explain how this might apply in canada? also - off topic - for pity sake, why will slashdot not recognise simple linefeeds?
There is no such thing as 'access to a few accounts' in their model. And the feds weren't involved in a legitamite operation anyway. They were trying to track down someone who had exposed their crimes.
This is my signature. There are many like it, but this one is mine.
That's really grabbing at straws. Several things would have to be resolved for that to stick.
1. Is the FBI and / or the court considered "soldiers"?
2. Is an email service considered "home"?
3. Is the Supreme Court likely to make such a broad interpretation especially since they tend to take a very narrow view on just about everything?
4. And lastly, is it even likely to make it that far?
This is a sig. This is only a sig. Had this been an actual sig you would have been informed where to tune for more sigs.
In the case of Lavabit, the government demanded, and was given, a warrant for the HTTPS private key to monitor the online actions of a couple of defendants. This would allow the FBI to monitor not only the specific defendants, but all Lavabit customers.
And I want to be totally clear about this: The government asked to install a pen trap device *and* have the private keys which would have allowed it to monitor all Lavabit customers.
(Unlike phone companies, E-mail providers are under no legal obligation to make surveillance easy, or even possible, by the government.)
Third parties have a duty to assist law enforcement, but that duty does not extend "regardless of the burden involved". The ACLU argument is that giving over the private keys would have completely destroyed the Lavabit business, which was an unreasonable burden to take in assisting law enforcement.
You do when they have a warrant.
Just saying "You do when they have a warrant" is no longer sufficient. There's ample evidence that judicial oversight has been compromised by the FISA court et al., and this is a particularly strong case of government overreach.
You can't take warrants at face value any more.
Then you would still have to overcome the "but in a manner to be prescribed by law." part. Since the "national security" part (I am assuming at least in the Patriot Act and / or Homeland Security Act) would satisfy that.
No, a better way would be to take back our Congress and get them to revoke those acts that allow stuff like this. Of course, that requires a ground swell against the established parties and is likely to not succeed because of the campaign financing / media control mess.
This is a sig. This is only a sig. Had this been an actual sig you would have been informed where to tune for more sigs.
The FBI was not interested unless the could get access to his private SSL key. He offered several times to help them install their pen tap and trace device but the FBI was not interested unless they could load it with his private SSL key.
He was also found in contempt of court after he provided his private SSL keys.
This was a case of the FBI picking on someone so hard they figured they had to carry guns to meetings with him when he was being cooperative.
This was the actions of an individual who honestly thought there was a mix up and once everything was explained to everyone (ie the Judge or the FBI officiers) this nonsense would have gone away. It didn't.
And do you want to live in a world where a secret court can compel any and every secret private key? It totally defeats the entire security architecture of the internet as it now stands. This is bad juju.
The entire story is given by this in-depth interview with Ladar himself. http://twit.tv/show/triangulation/125 I highly recommend this if you are interested. He also explains that he was personally cited in the warrants, so even if Lavabit gos away, Ladar himself is still liable to give up the info.
Never confuse feeling with thinking.
The government of the UK CLAIMS is has suffered enormous damage to its security. That doesn't mean they actually think that to be the case. There's this behavior known as 'lying', and government have done this in the past, especially when dirty laundry has been exposed.
This is my signature. There are many like it, but this one is mine.
As I recall, each paying Lavabit customers' email storage was encrypted using a key of the respective customers' choosing. Lavabit did not have these keys and could not, themselves, read customers' email, even if they wanted to.
So, I'm to believe that you can be charged with contempt for not providing something that you don't have?
You don't when that warrant is ethically and Constitutionally wrong ...
You are mistaken, there is nothing in the Constitution that says you can pick and choose which warrants issued by a valid court you will obey.
What you are thinking of is called "civil disobedience", and civil disobedience often has a cost. Precisely the sort of thing we are seeing with respect to the contempt charge in this case. Civil disobedience is not an end run around the law nor a get out of trouble free card. What it is is a way to preserve your personal sense of ethics and a way to draw attention to and raise public awareness of an unjust law with the goal of amending or repealing the unjust law.
You actually can to quite a bit. Nazi Germany was largely the result of the Treaty of Versailles. Pearl Harbor was the result of us not being neutral in the war, and it wasn't hard to see something along those lines coming. Most terrorist acts in the last 50 years could be tracked to US dickery of some form or another if you are willing to put in a bit of work.
They announced a change in policy. That doesn't mean there actually was a change in policy, or that it was due to changes in knowledge. At best, it was an opportunity to act upon knowledge that has now become public but was already private. How naive are you?
Perhaps, but not anywhere near as much as it needs us to stop being assholes. Not being assholes will do far more for our safety. And signals intelligence often ends up creating threats, and is used as a crutch that allows for poor human intelligence, which is already inept enough.
This is my signature. There are many like it, but this one is mine.
They don't because of terrorists. Once the USA government pulls the "terrorism trump card" all rights are null and void. Your government managed to get a few very un-American laws instated and you need to work on getting those reversed. Fighting terrorism doesn't work this way, 12 years after 9-11 none of these laws have made a significant change in USA domestic terrorism attacks but they have greatly influenced daily life. It's time to end these laws and mend the country and it's people.
I was promised a flying car. Where is my flying car?
They have more publicity than they could ever pay for in marketing and they're playing the victim. Hmmm what should they do. IT'S OBVIOUS! Relaunch with a user self-signed system or some sort of peer to peer thing where they don't hold the keys. They just relay the encrypted gibberish and some client software makes a randomized key. That's so idiotically simple, they could throw it together in a heartbeat.