Feds Threaten To Arrest Lavabit Founder For Shutting Down His Service

from the either-you-help-us-spy-on-people-or-you're-a-criminal dept

The saga of Lavabit founder Ladar Levison is getting even more ridiculous, as he explains that the government has threatened him with criminal charges for his decision to shut down the business, rather than agree to some mysterious court order. The feds are apparently arguing that the act of shutting down the business, itself, was a violation of the order:

... a source familiar with the matter told NBC News that James Trump, a senior litigation counsel in the U.S. attorney’s office in Alexandria, Va., sent an email to Levison's lawyer last Thursday – the day Lavabit was shuttered -- stating that Levison may have "violated the court order," a statement that was interpreted as a possible threat to charge Levison with contempt of court.

That same article suggests that the decision to shut down Lavabit was over something much bigger than just looking at one individual's information -- since it appears that Lavabit has cooperated in the past on such cases. Instead, the suggestion now is that the government was seeking a tap on all accounts:

Levison stressed that he has complied with "upwards of two dozen court orders" for information in the past that were targeted at "specific users" and that "I never had a problem with that." But without disclosing details, he suggested that the order he received more recently was markedly different, requiring him to cooperate in broadly based surveillance that would scoop up information about all the users of his service. He likened the demands to a requirement to install a tap on his telephone.

It sounds like the feds were asking for a full on backdoor on the system, not unlike some previous reports of ISPs who have received surprise visits from the NSA.

Filed Under: criminal charges, doj, email, ladar levison, nsa, nsa surveillance
Companies: lavabit

Press Suckered By Anti-Google Group's Bogus Claim That Gmail Users Can't Expect Privacy

from the no-expectation-of-accuracy dept

Okay, so as a bunch of folks have been sending over today, there's been a bit of a furor over a press release pushed out by Consumer Watchdog, a hilariously ridiculous group that has decided that Google is 100% pure evil. The "story" claims that Google has admitted in court that there is no expectation of privacy over Gmail. This is not actually true -- but we'll get to that. This story is a bit complex because the claims in most of the news coverage about this are simply wrong -- but I still think Google made a big mistake in making this particular filing. So, first, let's explain why the coverage is completely bogus trumped up bullshit from Consumer Watchdog, and then we'll explain why Google still shouldn't have made this filing.

First off, you may recall Consumer Watchdog from previous stunts such as a putting together a hilariously misleading and almost 100% factually inaccurate video portrayal of Eric Schmidt, which was all really part of an effort to sell more copies of its founder's book (something the group flat out admitted to us in an email). They're not a consumer watchdog site -- they're a group that makes completely hogwash claims to try to generate attention on a campaign to attack Google.

The press release from Consumer Watchdog fits along its typical approach to these things: take something totally out of context, put some hysterical and inaccurate phrasing around it, dump an attention-grabbing headline on it and send it off to the press. In this case, it claimed that Google had said in a court filing that you have no expectation of privacy with Gmail. That got a bunch of folks in the press to bite with wildly inaccurate headlines:

• CNET: Google filing says Gmail users have no expectation of privacy
• Time: Google Says Gmail Users Have ‘No Legitimate Expectation of Privacy’
• The Guardian: Google: Gmail users shouldn't expect email privacy
• Gizmodo: Google: Non-Gmail Users Have No Legitimate Expectation of Privacy
• Huffington Post: Google: Email Users Can't Legitimately Expect Privacy When Emailing Someone On Gmail
• Business Insider: GOOGLE: If You Send To Gmail, You Have 'No Legitimate Expectation Of Privacy'

The first three of those headlines are simply flat-out factually incorrect. I mean, not even close, and it's fairly incredible that those come from the three more "established" or "mainstream" news publications. The last three are slightly more correct, but still completely miss the point. The best debunking of these claims so far comes from Nilay Patel at the Verge who breaks down the details. The filing, which is from over a month ago, is a response to an absolutely, monumentally bogus class action lawsuit filed against Google, arguing, hilariously, that it's a violation of wiretap laws to put ads next to emails based on the text of those emails. No, seriously.

As Patel points out, first, if you put the argument back into context, it's not even about Gmail users -- as the top three headlines above falsely state. Google is arguing that non-Gmail users are consenting to the fact that when they send an email, the ISPs who receive the email will automatically process them. This should not be controversial. At all. Without that concept email doesn't work. As the filing states (which the folks hyping this ignore):

Non-Gmail users who send emails to Gmail recipients must expect that their emails will be subjected to Google's normal processes as the [email] provider for their intended recipients.

In other words, there's no "there" there. All Google was arguing was that courts have held that if you are using a communication service, there's a perfectly reasonable (in fact, expected) recognition that the service provider will have the right to process some information about that communication. In the context of the case that Google cites, the infamous Smith v. Maryland, the argument is that the business provider is reasonably expected to be able to track the user's activity. That's not controversial. The controversial step that Smith v. Maryland then makes is to argue that because the service provider has a right to that basic information it means that the end user has no expectation of privacy with regards to the government getting access to the same info. That's the problem with Smith v. Maryland -- the failure to recognize that massive difference between me (1) consenting to let my phone company record who I make phone calls to in exchange for the ability to make calls and (2) the expectation that it's okay for the government to collect that very same info without a warrant.

Google's citation of Smith v. Maryland is to make the first half of that argument -- showing that courts recognize the obvious: that when you use a communication service, there are certain aspects of information that you know the service provider is going to have access to. Without that you don't have email, or (realistically speaking) the internet.

So, this is all much ado about nothing.

Except... I still think it was a mistake for Google to use this legal argument, and I'm somewhat surprised Google's legal team let this go through in place. First, Google does not need this citation to make this point. There are other cases that can make this point effectively without touching on the government spying aspect. But, the real reason why this is a mistake is that Google has given fairly strong indications in recent statements that it's willing to fight back against certain government requests for user info (and that it's done so in the past). In those cases, the government is absolutely going to cite Smith v. Maryland as its evidence that users have no expectation of privacy in their communications and now they'll also point out that Google cited the case approvingly. Google will want to argue that Smith v. Maryland is outdated law and was decided wrongly and/or in a different time under a different technology ecosystem. And this is a very, very strong argument that has a good chance of winning. But the ability of the government to point out that Google has, in other cases, cited the Smith precedent approvingly -- even if it was really only part of the Smith precedent -- could undermine their arguments against Smith in future cases down the road.

Either way: the freakout here is totally manufactured by a bogus, laughable group that is spreading ideas that would do massive harm to the internet based on a near total ignorance of how things work. Yes, people are on edge given the NSA revelations, but this "gotcha" is no "gotcha" at all. It's just more evidence of the sheer duplicity of Consumer Watchdog. That said, it was still short-sighted for Google to make this claim in a filing. They didn't need the citation, and while it may help them win this ridiculous class action lawsuit, it may come back to bite them down the road in more important cases.

Filed Under: 3rd party doctrine, consumer watchdog, email, fearmongering, government, hype, journalism, privacy, smith v. maryland, surveillance
Companies: consumer watchdog, google

Feds Hit Lavabit With A Warrant Back In April, But Shutdown Likely Over Something Much Bigger

from the not-your-everyday-search-warrant dept

Last week we wrote about a security-focused email service known as Lavabit shutting down in response to some sort of court order (the details of which Lavabit's founder, Ladar Levison, is barred from talking about). While most of the speculation has been about the claims that Ed Snowden has used a Lavabit email address, a reader points out to us that the government took an interest in Lavabit a few months before the whole Snowden affair started, issuing a search warrant concerning a Lavabit email account, Joey006@lavabit.com, back in March of this year, to be executed by April 11. From the affidavit supplied with the warrant, this involved an FBI investigation into child porn. It appears that Levison handed over a DVD in response to the warrant -- though the details of this were only filed with the court on June 10th (on a document signed on June 7th, two days after the first of the Snowden documents had been revealed, but before Snowden's name was revealed).

Either way, given the timing of all of this, it's possible that the shutdown may have not involved Snowden or anything related to the NSA surveillance at all, but is the result of a totally unrelated case. Obviously, at this point, only the government and Levison actually know the details, but it does seem worth noting that the government has targeted Lavabit email addresses in the past. However, according to Levison himself, it seems clear that what they were asking for that made him shut down was quite a bit more involved than an ordinary search warrant. In an interview with Forbes, Levison stated that he's cooperated in the past with government requests, noting that there have been about two dozen over the past decade.

Levison isn’t an privacy absolutist. He has cooperated in the past with government investigations. He says he’s received “two dozen” requests over the last ten years, and in cases where he had information, he would turn over what he had. Sometimes he had nothing; messages deleted from his service are deleted permanently.

“I’m not trying to protect people from law enforcement,” he said. “If information is unencrypted and law enforcement has a court order, I hand it over.”

In this case, it is the government’s method that bothers him. “The methods being used to conduct those investigations should not be secret,” he said.

That certainly suggests that what the government was asking for here wasn't a mere search warrant for existing information associated with an account, but something more involved -- such as a proactive wiretap on all future messages, something that you'd imagine the feds would be interested in on an account of someone such as Snowden.

Filed Under: email, ladar levison, search warrants
Companies: lavabit

Another Secure Email Service Shuts Down To Avoid Having To Do So Later

from the us-government-destroying-american-businesses dept

When Lavabit announced its sudden decision to shut down yesterday, many of its customers were actually fairly perturbed that they were given no notice, and no way to retrieve their mail before it went away. While I can certainly understand that emotional response to losing your email account like that, it seems rather obvious that there was no real choice here. If Lavabit had alerted customers that they had a day or a week or whatever before the service shut down, it seems quite likely from the hints given that the government would have stepped in with an order to preserve the information it was clearly seeking access to.

Given that, it's noteworthy that another secure email provider, Silent Circle, chose to announce its own plans to close down its secure email service hours later. Silent Circle isn't facing the same hidden court orders/government demands, but it recognized that it would likely come some day soon -- and thus it was better to shut down ahead of time, before the government forced it to make the same decision. I'm somewhat surprised that Silent Circle didn't at least give its customers a day or whatever to close out their email, but rather the company flat out destroyed its servers, noting:

"Gone. Can't get it back. Nobody can."

The company is still offering other secure tools that feature end-to-end encryption such that there's nothing they can hand over to the government.

In discussing this, I saw some people point out that another service, CryptoCloud, has actually had it as a part of its privacy policy for over five years that it would shut down rather than let the government get direct access to accounts:

If a court orders us to allow them to secretly place surveillance "sniffers" on a specific account, we will fight this order to the highest judicial authority possible. If we lose, we will shut down the business and call it a day. End of story.

Still, this kind of thing is showing how these ridiculous surveillance policies from the US government are doing massive harm to US businesses, basically making them either lie to their customers and violate their privacy, or to shut down completely. It's going to drive many, many users to overseas services. Is that really worth it?

Filed Under: email, secure email, shutting down, surveillance
Companies: lavabit, silent circle

Ed Snowden's Email Provider, Lavabit, Shuts Down To Fight US Gov't Intrusion

from the standing-on-principles dept

Early on in the Snowden leaks, it was revealed that Snowden himself was using email services from an operation called Lavabit, which offered extremely secure email. However, today Lavabit's owner, Ladar Levison, shut down the service, claiming it was necessary to do so to avoid becoming "complicit in crimes against the American people." Not much more information is given, other than announced plans to fight against the government in court. Reading between the lines, it seems rather obvious that Lavabit has been ordered to either disclose private information or grant access to its secure email accounts, and the company is taking a stand and shutting down the service while continuing the legal fight. It's also clear that the court has a gag order on Levison, limiting what can be said.

My Fellow Users,

I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit. After significant soul searching, I have decided to suspend operations. I wish that I could legally share with you the events that led to my decision. I cannot. I feel you deserve to know what’s going on--the first amendment is supposed to guarantee me the freedom to speak out in situations like this. Unfortunately, Congress has passed laws that say otherwise. As things currently stand, I cannot share my experiences over the last six weeks, even though I have twice made the appropriate requests.

What’s going to happen now? We’ve already started preparing the paperwork needed to continue to fight for the Constitution in the Fourth Circuit Court of Appeals. A favorable decision would allow me resurrect Lavabit as an American company.

This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States.

Sincerely,
Ladar Levison
Owner and Operator, Lavabit LLC

Apparently there were just over 400,000 email accounts on Lavabit at the time they shut down -- victims of the US government trying to spy on certain email accounts.

It's not difficult to make an educated guess as to what happened. The Feds went to Lavabit demanding access to Ed Snowden's email. Lavabit refused. The feds went to (secret) court and the (secret) court said (in secret) that Lavabit had to turn over the information. And Lavabit's response is noble: it is shutting down and fighting in court, rather than becoming a pawn in this and compromising the trust and reputation its built up over the years. Lavabit also includes a link on their site for a legal defense fund.

Filed Under: 1st amendment, 4th amendment, ed snowden, email, free speech, gag orders, privacy, security
Companies: lavabit

NY Times Reveals NSA Searches All Emails In & Out Of The US; Will It Offer Up Its Source For Prosecution?

from the just-wondering dept

This morning, the NY Times' Charlie Savage broke yet another story concerning the NSA domestic surveillance efforts, revealing that... the NSA does a scan of every email going in or out of the US:

The National Security Agency is searching the contents of vast amounts of Americans’ e-mail and text communications into and out of the country, hunting for people who mention information about foreigners under surveillance, according to intelligence officials.

The N.S.A. is not just intercepting the communications of Americans who are in direct contact with foreigners targeted overseas, a practice that government officials have openly acknowledged. It is also casting a far wider net for people who cite information linked to those foreigners, like a little used e-mail address, according to a senior intelligence official.

Again this is the kind of thing that many people had assumed was going on, but it hadn't been confirmed until now. Of course, the NSA's response was not to talk about whether or not this was true, but to claim, yet again, that everything it's doing is "authorized," which is a way of deflecting the fact that it's almost certainly unconstitutional. In this case, the claim is that the NSA isn't storing these emails, but rather: "temporarily copying and then sifting through the contents of what is apparently most e-mails and other text-based communications that cross the border," and the whole process only takes "a small number of seconds" before the records are deleted.

This report raises a whole bunch of issues, but let's focus on two of them:

1. Right, so remember that last post, where Barack Obama claimed that there is no domestic spying program? Yeah, so about that... Here's a bit more evidence of just what a lie that is.
2. Here's the bigger one, though. Just yesterday, the NY Times published an astounding editorial that suggests that the US should punish Russia for not sending Ed Snowden back. It is effectively calling for the prosecution of a key whistleblower concerning NSA surveillance.
   
   So, I'm wondering, does the NY Times editorial board believe that Charlie Savage's source -- who is revealing information not unlike that which Snowden revealed -- shouldn't be protected, should be revealed and should be prosecuted? Because I would imagine that both Savage and that source would find that very uncomfortable. At this point, if you're a government whistleblower, why would you ever go to a reporter at the NY Times when they're supportive of prosecuting sources and whistleblowers?

This latest revelation is important, and it's great that Savage was able to get the information and reveal it -- but why would his own employers so undermine his ability to do that kind of reporting by supporting the prosecution of other whistleblowers and leakers?

Filed Under: charlie savage, email, nsa, nsa surveillance, searches, sources, whitleblowers
Companies: ny times

Court Gives Chevron Access To Nine Years Of Americans' Email Metadata

from the seems-a-bit-extreme dept

For a few years now, we've been following a rather troubling legal fight between people in Ecuador and Chevron -- the oil giant that has been in a long-term legal battle with people in Ecuador over some of its actions in that country. A few years ago, we wrote about how Chevron was ordering a documentary filmmaker to turn over cut footage, claiming that it might exonerate the company (the filmmaker tried to hold it back, claiming it was protected under journalist shield rules). However, last fall, we noted something perhaps even more troubling. Chevron had issued subpoenas seeking various email info from Google, Yahoo and Microsoft going back years. As we noted at the time, they weren't seeking the content of the email, but the were seeking what many more people are now familiar with as "metadata." But, metadata can be quite revealing.

When we wrote about this case a year ago, it was under the context of one person, Kevin Heller, whose data was sought, and him successfully fighting back (with some help from the ACLU) getting Chevron to drop the request for his info. But, as for everyone else's info? Mother Jones alerts us to the news that a judge in NY recently said it was okay for Chevron to get all that metadata, in some cases going back nine years.

...a federal court granted Chevron access to nine years of email metadata—which includes names, time stamps, and detailed location data and login info, but not content—belonging to activists, lawyers, and journalists who criticized the company for drilling in Ecuador and leaving behind a trail of toxic sludge and leaky pipelines. Since 1993, when the litigation began, Chevron has lost multiple appeals and has been ordered to pay plaintiffs from native communities about $19 billion to cover the cost of environmental damage. Chevron alleges that it is the victim of a mass extortion conspiracy, which is why the company is asking Google, Yahoo, and Microsoft, which owns Hotmail, to cough up the email data. When Lewis Kaplan, a federal judge in New York, granted the Microsoft subpoena last month, he ruled it didn't violate the First Amendment because Americans weren't among the people targeted.

Leaving aside the fact that the court thinks it's okay to do this even if it's just "non-Americans" who have their privacy violated here, Mother Jones points out that this claim that it only targeted non-Americans isn't, in fact, true. Pesky details.

Now Mother Jones has learned that the targeted accounts do include Americans—a revelation that calls the validity of the subpoena into question. The First Amendment protects the right to speak anonymously, and in cases involving Americans, courts have often quashed subpoenas seeking to discover the identities and locations of anonymous internet users. Earlier this year, a different federal judge quashed Chevron's attempts to seize documents from Amazon Watch, one of the company's most vocal critics. That judge said the subpoena was a violation of the group's First Amendment rights. In this case, though, that same protection has not been extended to activists, journalists, and lawyers' email metadata.

The Electronic Frontier Foundation (EFF) represents 40 of the targeted users—some of whom are members of the legal teams who represented the plaintiffs—and Nate Cardozo, an attorney for EFF, says that of the three targeted Hotmail users, at least one is American. Cardozo says that of the Yahoo and Gmail users, "many" are American.

This seems like a pretty big problem, given the rationale of the judge initially. Beyond that, just the basic chilling effects from finding out that a giant company could get access like this to so much metadata on a large list of its critics is fairly incredible. As the article notes, while subpoenas on people who aren't actually parties to a lawsuit are "routine," they're not supposed to be mass fishing expeditions, which they appear to be in this case.

And, of course, even the whole "well they're not Americans so the First Amendment doesn't apply" thing is highly questionable -- since many of the accounts are anonymous internet users, and the First Amendment does protect online anonymity and there's no way for Chevron or the judge to know if the anonymous users are Americans or not.

Filed Under: ecuador, email, first amendment, metadata, privacy
Companies: chevron, google, microsoft, yahoo

Latest Leak: NSA Collects Bulk Email Metadata On Americans

from the so-there's-that... dept

The NSA leaks just keep on coming, and the latest one is a big one. It's concerning the NSA is about the Stellar Wind program -- which had been revealed before, and which former NSA whistleblower Bill Binney has discussed in the past -- but Binney left the NSA in 2001. The latest document is a report from the Inspector General that confirms some of the claims Binney has made in the past, showing that the NSA collected "bulk metadata" on emails of US persons. The program started as only being about non-US persons, but was later expanded by the DOJ in 2007 to cover US persons as well.

According to a top-secret draft report by the NSA's inspector general – published for the first time today by the Guardian – the agency began "collection of bulk internet metadata" involving "communications with at least one communicant outside the United States or for which no communicant was known to be a citizen of the United States".

Eventually, the NSA gained authority to "analyze communications metadata associated with United States persons and persons believed to be in the United States", according to a 2007 Justice Department memo, which is marked secret.

So, remember all that stuff the NSA and the President and various elected officials were saying about how they're not collecting internet data on Americans? And how they have minimization procedures and all of that? Yeah. So, that was -- yet again -- less than 100% accurate. Or, as Director of National Intelligence James Clapper likes to say, it was, perhaps, the "least untruthful" version of the events, meaning that it wasn't truthful.

Of course, the defenders of the program will say that this is okay because it was "just metadata," rather than the contents of email, but that's a huge cop out, since metadata can tell you an awful lot:

The internet metadata of the sort NSA collected for at least a decade details the accounts to which Americans sent emails and from which they received emails. It also details the internet protocol addresses (IP) used by people inside the United States when sending emails – information which can reflect their physical location. It did not include the content of emails.

On top of that, defenders of the metadata collection of phone records claimed that there was no privacy in the phone numbers you called and the duration of calls, because that information was clearly on your phone bill that the company sent to you each month. But that's not the case with email metadata.

For what it's worth, the administration shutdown this particular program in 2011, but that was after it had gone on for 10 years, with the last four involving collecting bulk metadata on Americans.

"The internet metadata collection program authorized by the Fisa court was discontinued in 2011 for operational and resource reasons and has not been restarted," Shawn Turner, the Obama administration's director of communications for National Intelligence, said in a statement to the Guardian.

"The program was discontinued by the executive branch as the result of an interagency review," Turner continued. He would not elaborate further.

However, as Glenn Greenwald and Spencer Ackerman at the Guardian (who broke this story as well) have noted, they have evidence that at least a similar program continues today:

In December 2012, for example, the NSA launched one new program allowing it to analyze communications with one end inside the US, leading to a doubling of the amount of data passing through its filters.

Some of the report actually helps to confirm a Washington Post story from last week about how this bulk metadata collection was initially done under no authority, but when various DOJ officials threatened to resign, they quickly got the FISA court to pull out its trusty giant rubber stamp to allow bulk data collection on emails.

The expansion of metadata collection and analysis to cover Americans came about as the NSA insisted this would help them better find foreign threats:

Wainstein told Mukasey that giving NSA broader leeway to study Americans' online habits would give the surveillance agency, ironically, greater visibility into the online habits of foreigners – NSA's original mandate.

"NSA believes that it is over-identifying numbers and addresses that belong to United States persons and that modifying its practice to chain through all telephone numbers and addresses, including those reasonably believed to be used by a United States person," Wainstein wrote, "will yield valuable foreign intelligence information primarily concerning non-United States persons outside the United States."

Basically this pretty much confirms my earlier post about how the NSA (and the DOJ) are carefully defining "target" in their mandate. Most people believe that since the NSA can only target persons outside the US that they cannot collect data on US persons. However, if (as may be the case) they claim that the overall investigation is "targeting" non-US persons, it appears they believe they can collect and analyze data on US persons, meaning that they've effectively justified bulk spying on Americans if it might possibly bring to light a foreign threat.

One thing that is not clearly described is exactly how the NSA is getting access to this data, but from previous leaks, it appears that the data almost certainly comes from working with telcos to install systems that scoop up all data going through major ISPs/backbones. Either way, it seems abundantly clear, yet again, that the NSA surveillance, contrary to statements from the NSA and its defenders, included a ton of information on Americans.

Filed Under: doj, email, metadata, nsa, nsa surveillance, stellar wind

Massachusetts Wants To Make Surveillance Easier, While Texas Is Making It Harder

from the two-different-states,-two-different-views dept

It appears that Massachusetts and Texas are taking two rather different approaches to allowing surveillance of its citizens. Texas this week signed into law a bill that prohibits accessing emails by the government without a warrant. The bill is pretty simple: it goes beyond what the current federal law, ECPA, allows, in saying that if law enforcement wants to access someone's emails, they need a warrant (something that many of us think should be required under the 4th Amendment already). Meanwhile, it appears that Massachusetts is going in the other direction, pushing a bill that would make it much easier to wiretap anyone's phones. Specifically, the bill would do the following:

1) Remove the requirement that an electronic wiretapping warrant be connected with organized crime, or indeed with serious crimes more generally. Potentially, even minor crimes like marijuana possession could become eligible for wiretapping by state authorities.

2) Double the length of an authorized wiretap, from 15 to 30 days.

3) Legalize mass interception of communications at telecommunications switching stations, rather than through individual wiretaps on individual phone numbers.

All of them are deeply concerning, with the last one being potentially unconstitutional. But that first one may have the most immediate direct impact, since it would basically give law enforcement the ability to go after anyone they suspect of almost any offense and hit them with a wiretap. If you think that wouldn't be abused, you haven't been paying attention to how law enforcement (especially local law enforcement) has abused all sorts of powers in the past.

The EFF has put together a petition to try to get Massachusetts lawmakers to realize what an incredibly bad idea this would be.

Filed Under: email, massachusetts, surveillance, texas, wiretapping