Slashdot Mirror


Lavabit Loses Contempt Appeal

After being forced to turn over encryption keys (being held in contempt of court for several weeks after initially refusing to comply), secure mail provider Lavabit halted all operations last year. With the assistance of the EFF, an appeal was mounted. Today, the appeals court affirmed the district court decision and rejected the appeal. From Techdirt: "The ruling does a decent job explaining the history of the case, which also details some of the (many, many) procedural mistakes that Lavabit made along the way, which made it a lot less likely it would succeed here. ... The procedural oddities effectively preclude the court even bothering with the much bigger and important question of whether or not a basic pen register demand requires a company to give up its private keys. The hail mary attempt in the case was to argue that because the underlying issues are of 'immense public concern' (and they are) that the court should ignore the procedural mistakes. The court flatly rejects that notion: 'exhuming forfeited arguments when they involve matters of “public concern” would present practical difficulties. For one thing, identifying cases of a “public concern” and “non-public concern” –- divorced from any other consideration –- is a tricky task governed by no objective standards..... For another thing, if an issue is of public concern, that concern is likely more reason to avoid deciding it from a less-than-fully litigated record....'"

33 of 128 comments (clear)

  1. All it takes is one criminal now? by brainboyz · · Score: 4, Informative

    One potential suspect on a network and the cops suddenly want the capability to spy on the whole network unimpeded? That sounds like a GREAT idea. Oh, wait...

    1. Re:All it takes is one criminal now? by cold+fjord · · Score: 2, Insightful

      That isn't how this started. Lavabit had apparently complied with much more limited surveillance demands in the past, but then decided they weren't going to do that any more. Since they wouldn't comply with the narrow demand things escalated, Lavabit didn't comply, and things escalated again. Eventually Lavabit was hit with contempt and produced this outcome. This one rests on Lavabit. It appears likely they defied the law to help Snowden, and they are their customers lost out.

      --
      much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
    2. Re:All it takes is one criminal now? by Anonymous Coward · · Score: 3, Informative

      Did you bother to read the article? I'm assuming not. The feds wanted targeted information, they requested targeted information, they got a court order for targeted information. Lavabit decided they didn't need to bother following the court order, and then the feds got broader because he was messing around. So...

      What it takes is one criminal, and a network admin who thinks that it's more important to give the government and the courts the finger rather than protecting his network. In this case, after months of games and just flat-out refusal to follow the court's orders, the government basically said to the court "Look, at this point, even if he started complying with the Court's orders we wouldn't trust anything he gave us. The only way to do things now is to break open the network."

      You know what? When my kids eff around and lie to me in the same ways, I react the same way the government/courts did. You can't play stupid 4-year-old games then expect not to get treated like a 4-year-old.

    3. Re:All it takes is one criminal now? by fustakrakich · · Score: 3, Insightful

      Lavabit had apparently complied with much more limited surveillance demands in the past, but then decided they weren't going to do that any more... This one rests on Lavabit.

      This is true. Once you sell your soul, it's pretty tricky business trying to buy it back.

      --
      “He’s not deformed, he’s just drunk!”
    4. Re:All it takes is one criminal now? by SpankiMonki · · Score: 2

      Did you bother to read the article? I'm assuming not...

      In this case, after months of games and just flat-out refusal to follow the court's orders...

      6/28 - Judge issues pen register order
      7/9 - Judge issues summons to Lavabit to show cause for non-compliance with said order
      7/10 - Government/Lavabit conference call where government demands SSL keys
      7/16 - Government obtains search warrant for data encryption keys and SSL keys
      8/7 - Levison ultimately complies with court

      That's 40 days, not "months". And 40 days is probably par for the course for those challenging government surveillance orders.

      Since pen register orders don't require probable cause, I applaud Levison's actions to protect his customers. After all, they used his service specifically for it's privacy.

    5. Re:All it takes is one criminal now? by fustakrakich · · Score: 2

      Don't start with me, mother... you had your chance

      --
      “He’s not deformed, he’s just drunk!”
    6. Re:All it takes is one criminal now? by parkinglot777 · · Score: 4, Informative

      Number of day does NOT matter. From TFA, the case is MORE complicated than it looks because there are tit for tat and politic all over the place from both sides. I tried to summarize the background of the case below.

      1) June 28, 2013 - Government obtained pen/trap order to install pen/trap device to the email system in order to capture all non-content data (both from header & not from header but not email content) in "real-time" basis, and any technical assistant to use the device, from a targeted email account for 60 days.
      2) On the same day, Lavison met with an FBI agent and refused to comply because the account has enable encryption services.
      3) The same order on June 28 was reissued (after the meeting) with additional request that Lavabit must provide unencrypted data (non-content data which is still not the email content).
      4) During this time, Larvison ignored contacts from the FBI.
      5) July 9, 2013 - Government obtained show cause order to get reasons/explanations of why Lavison failed to comply.
      6) July 10, 2013 - Lavison, his counsel, and representative from Government were on conference call for the show cause. The conference discussed on permission on data collection but not sure whether Lavison would allow the Government to install pen/trap device. The Government also asked for the keys for decrypting any encrypted content.
      7) July 13, 2013 - Lavison contacted the Government proposing that he could capture the data and sent it to the Government. Furthermore, he requested $2,000 for the services. If the Government wanted daily updates, he asked for $1,500 more. The Government refused because the data is not done in real-time, so it cannot be trusted. Lavison argued the order did not require "real-time" access.
      8) July 16, 2013 - it is the show cause hearing day. The Government had obtained a seizure warrant to get "all information necessary to decrypt communications sent to or from the targeted email including encryption keys and SSL keys" and also decrypted data associated with the targeted account.
      9) Lavison refused to turn over the keys for a reason that it would compromise all other accounts; besides, there was no explicit request for them before.
      10) The court agreed with the Government because of the search warrant which an implication for encryption keys request.
      11) Lavison allowed the Government to install a pen/trap device on the system. The court did not ask for the keys but issued another hearing on July 26 to confirm Lavison compliance.
      12) Even though the device was installed, the data obtained from the device could not be used because it was encrypted and the Government did not have the keys.
      13) Right before the compliance hearing, Lavison tried to void the seizure warrant given, but the Government responded that Lavison's objection ignored the order on June 28.
      14) August 1, 2013 - the court agreed that the Government that it is lawful for the Government to get the encryption keys because the Government would not look at other unrelated information but only the targeted. The court ordered Lavison to turn over the keys by 5pm on August 2, 2013.
      15) Lavison gave (and claimed to be) encryption keys in an 11-page print out with 4-point font to the FBI right before 5pm. The Government told Lavison to give it in standard (digital) format by August 5.
      16) August 5, 2013 - the Government moved the case for sanction and sought a fine of $5,000 a day.
      17) August 7, 2013 - Lavison gave the keys to the Government, but the Government had lost 6 weeks of potential data so they pressed charge on Lavison.

      You see, first Lavison wanted money for what he was going to do -- bad move. Then the Government knew the loop hole and obtained the seizure warrant to help the case. Then Lavison retaliated by not giving the key and the Government could not decrypt any data they obtained. After failing to void the warrant, he then retaliated furthermore by giving an unreadable version of the encrypted keys. After the Government pushed him e

    7. Re:All it takes is one criminal now? by spire3661 · · Score: 4, Insightful

      We are not the Government's children, we are citizens. You completely lose all credibility with that line. Defiance is not always a legitimate excuse to swing the hammer of the state harder.

      --
      Good-bye
  2. Procedural Rules? by TechyImmigrant · · Score: 4, Insightful

    That's what's great about the legal system. Procedural rules trump right and wrong.

    --
    I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    1. Re:Procedural Rules? by jratcliffe · · Score: 4, Insightful

      You want right and wrong? Talk to a priest/rabbi/pastachef. The law, and the courts, are all about rules, and the interpretation of them, and they should be. Otherwise, we'd be making decisions like "yeah, he was illegally wiretapped, but he was a bad man, so we're going to convict him anyway."

    2. Re:Procedural Rules? by TechyImmigrant · · Score: 2, Insightful

      And bouncing a person into court before they can get a lawyer to represent them that they couldn't afford anyway, so they can dismiss their appeal on procedural rules he wasn't qualified to navigate. Yay! A win for justice!

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    3. Re:Procedural Rules? by LordLimecat · · Score: 2

      Gideon makes such an outcome improbable, and if it happens will end up in an appeals court with the case being overturned due to lack of qualified representation.

      What are they teaching kids in schools these days? Back in my day Gideon's Trumpet was in the curriculum and we went over all the key / formative SCOTUS rulings over the US's history.

    4. Re:Procedural Rules? by Zontar_Thing_From_Ve · · Score: 5, Interesting

      That's what's great about the legal system. Procedural rules trump right and wrong.

      My best friend is an attorney and he has explained a lot about the US legal system to me. Basically judges don't like ambiguity. If people don't do things according to procedure and they get away with it, it opens the door for others to try it. For example, suppose someone is facing the death penalty in a US state that has it. A defendant could represent himself and if he loses the case (he probably will) then he can appeal that he had "incompetent legal representation" and try to get a new trial and role the dice again on the outcome. In fact, every time you lose you could just argue that no matter who the lawyer is and try to get a new trial until you win. There actually were a few cases more or less like this years ago and courts quickly realized that this was going to get out of hand so when defendants try to represent themselves, they are advised against it and warned that trying to argue on appeal that they didn't have proper legal representation won't work. So Lavabit blew it and tried a Hail Mary by gambling that the judge might feel sorry for them and overlook the procedural mistakes. It wasn't likely to work, but the US is a large country with a lot of judges and there probably is a judge somewhere who would have bought it, it's just that most won't because they don't like the potential outcome of allowing this, namely that other cases could have lawyers deliberately make procedural mistakes so if they lose the case, they can make that the basis of an appeal. Lots of people have incompetent lawyers work for them. It's not just death penalty cases. I have a friend who got cleaned out financially in a divorce case because he hired a bottom dollar lawyer and he got bottom dollar representation in court. The few cases where they have been punishingly large judgements in favor of the RIAA for "music sharing" have all involved shockingly inept legal representation for the defendant.

    5. Re:Procedural Rules? by StevenMaurer · · Score: 2

      Before they can get a lawyer to represent them? This wasn't an arrest. It was a subpoena.There was plenty of time to lawyer-up.

      Seriously guy, all you're doing is making stuff up.

      Oh, and while we're on the topic, this is not "warrantless wiretapping". It was a narrowly tailored subpoena issued because the Federal prosecutors convinced the court that there was reasonable cause to believe a crime was committed. This is exactly the way the system is supposed to work. And if you think that people who commit fraud, engage in money laundering, and a host of other schemes that hurt people, should all have an absolute right to keep their crimes secret, well sorry - you live in a first world country.

    6. Re:Procedural Rules? by Anonymous Coward · · Score: 2, Informative

      So what I read here is that justice is only for rich people. The system is set up so that only lawyers who understand all the "procedures" and tricks can represent you. If your "opponent" (be it a person, corporation or the goverment) can afford to pay more than you for a top dollars lawyer, you are out of luck getting justice even if you are right and they are wrong.

    7. Re:Procedural Rules? by TechyImmigrant · · Score: 2

      Read TFA. It suggests otherwise.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    8. Re:Procedural Rules? by tirefire · · Score: 2

      What are they teaching kids in schools these days? Back in my day Gideon's Trumpet was in the curriculum and we went over all the key / formative SCOTUS rulings over the US's history.

      I totally don't know. I took civics class in high school in 2008, and a couple weeks were devoted to students researching and presenting information about landmark court cases to the class. I was home sick the day everyone picked their court cases, so I got stuck with a court case I had never heard of and that I knew nobody else wanted: Gideon v. Wainwright.

      What luck! I got to watch Gideon's Trumpet during school hours, I read and learned way more about the public defender system than I had time to present, and I was actually just playing hooky the day I stayed home! While everyone else was bitching and moaning about how much they were procrastinating on their presentation, I was lost in this story of a poor old drifter without much book-learnin' showing supreme court justices how shit should get done in America.

      I learned some time later that on the day students picked their court cases, fully half of the class demanded to research Miller v. California ("you know, the one about PORNOGRAPHY... tee-hee!"). There was such a stalemate, I think the teacher finally had them draw straws.

  3. What are the "procedural mistakes"? by meustrus · · Score: 5, Informative

    If like me you want to know what the "procedural mistakes" were, and not read what is almost certainly someone's unnecessary diatribe about why the end result is wrong (hint: it's wrong, so, so wrong, and we all know why), let me help you find them. Use the last link in the summary, copied here:

    http://www.techdirt.com/articles/20140416/06454126931/lavabit-loses-its-appeal-mucking-up-basic-procedural-issues-early.shtml

    Summary: The case is about whether Lavabit should have been held in contempt, which hinges upon whether the court had the right to demand what it was demanding. However, Levison did not make any legal argument against the demand at the time. Therefore, it was justifiably held in contempt. The issue of whether the court had the right to demand private keys is important, but the issue needed to be raised sooner and with more force. Now it's irrelevant to further proceedings.

    I am not a lawyer and I have not actually finished reading the article yet.

    --
    I sometimes ask revealing, often ignorant-seeming questions. Maybe they're harder to answer than you think.
    1. Re:What are the "procedural mistakes"? by gnasher719 · · Score: 4, Interesting

      So roughly speaking, if a judge tells you to do something, and you think it is nonsense, and you just say "no, I won't do that", then you are in contempt. Even if you were right and what he told you was nonsense. If you tell the judge "what you are asking for is nonsense for these reasons ... so no, I won't do that", then chances are you are not in contempt.

    2. Re:What are the "procedural mistakes"? by westlake · · Score: 2

      So roughly speaking, if a judge tells you to do something, and you think it is nonsense, and you just say "no, I won't do that", then you are in contempt.

      You have to frame your objections as a proper legal argument. You have to get that argument in the record to preserve it on appeal. That simply keeps you in the game. It doesn't give you a winning hand.

  4. Way to lose an easy case... by Anonymous Coward · · Score: 5, Interesting

    Wow...

    I am an attorney, as well as a geek, and I think that there's a special level of hell for attorneys that make an argument so badly that - despite agreeing with them - I find myself siding with the opposition. That's the case here. I am horrified by a lot of things the surveillance apparatus has been doing lately, I generally side with Snowden (with specific reservations similar to the ones I have about Julian Assange) and despite all that, it's clear that the judge made the right ruling here.

    Lavabit acted like morons. They did nothing to advance the cause they ostensibly are serving, and quite a bit to hurt it. Procedure is important, ESPECIALLY when you're already in the legal system. "Levison complied the next day by turning over the private SSL keys as an 11 page printout in 4-point type." What is he, four years old? No sensible lawyer would have let him do that - that's an idiot libertarian who thinks it's more important to thumb his nose at the government than actually win his case. (Or maybe he just had the bad fortune to fail to hire a sensible lawyer. There's no shortage.)

    And after eight months of idiocy like that, he really expected any sane judge to bend the rules in his favor because his lawyer said the case is "important..." Pro tip when dealing with the legal system - if you think your case is of "immense public concern" then don't hold that shit in your back pocket thinking it's a trump card. IT IS NOT. Play it first, make it clear what the stakes are, and FOLLOW THE RULES. If you need them bent later on, a judge who sees that you are trying to obey them is much more likely to be on your side than a judge who sees you giving him the finger. And real cases don't get won by surprises at the end. (Except apparently in Tennessee, where surprise witnesses are surprisingly common.)

    A special level of hell. "A level they reserve for child molesters and people who talk at the theater."

    1. Re:Way to lose an easy case... by Anonymous Coward · · Score: 2, Insightful

      I think that level of hell is reserved for all the judges and lawyers that don't give a damn about right, wrong, just or unjust but are only concerned that the rules are followed to the dot.
      They are the ones that make the legal system into a "the richest one wins" system. That we could have without wasting all that money on having courts.

    2. Re:Way to lose an easy case... by Rich0 · · Score: 3, Insightful

      I think that level of hell is reserved for all the judges and lawyers that don't give a damn about right, wrong, just or unjust but are only concerned that the rules are followed to the dot.

      Think about what you just posted. Essentially you are saying that there should be a Get Out of Jail Free card at the end because you didn't cooperate during the trial but you think the case is really, really important. Not gonna happen my friend.

      No, there should be a Get Out of Jail Free card at the end because you didn't do anything wrong. People who didn't do something wrong shouldn't be in jail, period. People who are innocent shouldn't HAVE to cooperate during the trial - the court should be apologizing to them for dragging them through the trial in the first place.

    3. Re:Way to lose an easy case... by KliX · · Score: 2

      The rules being followed to the dot is the *only possible way law can work*. WTF, did you even think about the consequences of the opposite situation?

    4. Re:Way to lose an easy case... by amiga3D · · Score: 3, Insightful

      There I fully agree. In fact I lay the blame for all this crazy bullshit on Congress. They write crazy laws that are then pursued with abandon by a crazy legal system.

  5. I miss Groklaw :-( by Anonymous Coward · · Score: 5, Insightful

    All this and other recent court proceedings make me miss Groklaw more and more! PJ where are you? Wahhhhhhhhhhh!

  6. Comment removed by account_deleted · · Score: 5, Informative

    Comment removed based on user account deletion

  7. judge was clearly incompetent by Karmashock · · Score: 2

    We have judges in the first place and not robots because we need a human being to make intelligent and reasonable decisions.

    Refusing to do so means that the judge has decided to behave like a robot which means the judge has no purpose at all. We could replace this judge with a bit of computer code interacted with by clicking check boxes in an online form.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
  8. Comment removed by account_deleted · · Score: 4, Insightful

    Comment removed based on user account deletion

  9. Comment removed by account_deleted · · Score: 3, Insightful

    Comment removed based on user account deletion

  10. Comment removed by account_deleted · · Score: 2

    Comment removed based on user account deletion

  11. Re:Anyone want to buy a bridge? by coldfarnorth · · Score: 2

    Very interested in this... it will set precedents I think..

    Wrong. This was decided solely based on precedent. If you RTFA, the issue is that Lavabit attempted to raise arguments in the appeal that were not raised in the initial case (and in some cases, were directly counter to some of Lavabit's statements). ANY other decision would have broken with precedents, some of them long established. So, there's no precedent worth noting here. The judge explicitly said that the potential ramifications of the case are still unclear and need further litigation (which Lavabit has the option to do) before longstanding rules are ignored on Lavabit's behalf.

    This is Yet Another Example Of Why You Should Hire a Good Lawyer When Dealing With The Feds In Court. If Lavabit had good advice at the earlier hearings, this appeal could have been much more interesting, and might well have gone the other way.

    And for your other comments:
    1) Bullshit. It's no more your SSL key than the IP used in your cell phone is yours. In fact it was Lavabit's SSL key, (Pay attention to this next part) AND THEY USED THE SAME KEY TO ENCRYPT TRAFFIC FROM ALL USERS OF THE MAIL SERVICE - not the brightest idea, hmmmmm? And as a general note: Your ignorance of the details does not mean that the world works the way you wish it would.
    2) Contempt orders serve a valid purpose. You do not appear to know what that is. We can discuss your opinions on Contempt orders when you demonstrate otherwise.
    3) RTFA. The Gov't is not required to do more, and if they did, you'd be bitching and moaning about their use of your tax dollars, the breed of puppy used, or inflation, respectively.
    4) RTFA. The government requested the key because Lavabit was sending them encrypted data. They had the statutory authority to require Lavabit to provide all necessary help to retrieve unencrypted data, and since Lavabit was not providing it unencrypted, they asked for the appropriate key.

    For the record: Lavabit could have avoided a lot of this posturing, and risked compromising fewer people, if it had used different encryption keys for different users - but they didn't . . .

    --
    Lets start refering to The War Against Terror by it's initials. . .
  12. Re:Also Disturbing by amosh · · Score: 2

    Case and controversy clause - Article III, Section 2. http://en.wikipedia.org/wiki/Case_or_Controversy_Clause

    It's baked in.