Snowden's Favorite Email Service Returns, With 'Trustful,' 'Cautious,' And 'Paranoid' Modes

from the can-a-phoenix-be-composed-of-lava-(and,-um,-bits-I-guess)? dept

A little more than three years after it shut down to avoid complying with federal prosecutors' demands for its encryption key, Lavabit is returning to life. The secure email system, whose most famous user was Edward Snowden, fought the US government in court over demands to produce the key that would unlock access not only Snowden's emails, but those of every user. Not only did it shut down, but it also memorably delivered a 4-point middle finger to the feds in the middle of the legal battle.

With its users' privacy secured -- along with its legacy (Snowden-approved, man-sticking-it-to-itiveness) -- the Lavabit team gave the code to the public and started working on a newer, more secure email platform. As Kim Zetter reports for The Intercept, Lavabit's successor is now live.

[Ladar Levinson is] relaunching Lavabit with a new architecture that fixes the SSL problem and includes other privacy-enhancing features as well, such as one that obscures the metadata on emails to prevent government agencies like the NSA and FBI from being able to find out with whom Lavabit users communicate. He’s also announcing plans to roll out end-to-end encryption later this year, which would give users an even more secure way to send email.

The "SSL problem" was the weak link the government sought -- the key that would unlock all users' accounts, rather than just the one targeted. With this eliminated, Lavabit's new basic option should be far more resistant to government demands than its earlier version.

With the new architecture, Lavabit will no longer be able to hand over its SSL key, because the key is now stored in a hardware security module — a tamper-resistant device that provides a secure enclave for storing keys and performing sensitive functions, like encryption and decryption. Lavabit generates a long passphrase blindly so the company doesn’t know what it is; Lavabit then inserts the key into the device and destroys the passphrase.

But if vanilla Lavabit still feels a bit compromisable, there are a couple new tiers of increasing darkness available to users, known as "Cautious" and "Paranoid." (The vanilla tier is "Trustful," which places the security duties completely in Lavabit's hands.) "Cautious" offers end-to-end encryption, with the encryption key being stored in users' devices, but while still using Lavabit's server to transfer the key from device to device. (This will also allow users to recover keys if needed.)

"Paranoid" goes even further.

Some people who want more security — like activists, journalists, and whistleblowers — might balk at having their key stored on a third-party server. That’s where Paranoid mode comes in. The key for doing end-to-end encryption remains on the user’s device and never goes to Lavabit’s server. But to use another device, the user has to manually move the key to it. And there’s no way to recover the key if the user loses it or deletes it.

In all three cases, it will be difficult-to-impossible for governments to demand access to users' communications. Additionally, Lavabit's service will deliberately mangle metadata, making it mostly useless to surveillance agencies engaging in passive collection, as well as to government agencies seeking to obtain these so-called "third party records." This is utilized in all three tiers and is based on Tor's origin/destination obfuscation tactics. The most that can be gleaned from the metadata is the domain sending or receiving the email -- but not both on any single record.

Unsurprisingly, Lavabit had little to say on its "responsiveness" to government demands for users' communications, letting the end products speak for themselves. If the internet perceives censorship as damage and routes around it, communications platforms are more frequently coming to the conclusion that government surveillance is just more wreckage to avoided.

Filed Under: ed snowden, email, encryption, ladar levison, privacy
Companies: lavabit

Post Gag Order, Lavabit Founder Reveals Non-Secret That Feds Were After Ed Snowden's Emails

from the the-least-surprising-news-ever dept

Want some unsurprising news? Apparently a three year gag order has just lapsed, allowing Ladar Levison, the founder and former operator of Lavabit, the secure email service Ed Snowden famously used, to finally say that yes, the feds asked him to turn over his encryption key in order to access Ed Snowden's emails.

Lavabit founder Ladar Levison can finally confirm that Edward Snowden was the target of the 2013 investigation, which led to the shutdown of the Lavabit email service. The original case concerned law enforcement’s authority to compel the disclosure of an SSL/TLS private key, which belonged to Lavabit, and was used to protect the communications of all 410,000 customers, when only one of those customers was the subject of a criminal investigation. After three years, and five separate attempts, the federal judge overseeing the case has granted Mr. Levison permission to speak freely about investigation. The recently delivered court decision unseals the vast majority of the court filings, and releases Mr. Levison from the gag order, which has limited his ability to discuss the proceedings until now.

Mr. Levison has consistently relied on the First Amendment in his court filings, which sought to remove the gag orders entered against him. He argued that such orders are an unconstitutional restraint against speech, and an afront to the democratic process. He plans to use his newfound freedom to discuss the case during a planned presentation on Compelled Decryption at DEF CON 24 in Las Vegas, NV.

Of course, the fact that the feds were after Snowden isn't exactly news. First off, it's what everyone assumed the second the site shut itself down. But, more importantly, earlier this year, a redaction failure revealed it directly: Still, it's good that the gag order has finally been lifted, and it's great that Levison is now going to talk about these issues more widely. He also notes plans to create a legal defense foundation to help with similar cases:

In order to continue the fight, Mr. Levison is forming the Lavabit Legal Defense Foundation (or “LavaLegal”), a non-profit organization founded to, among other things, protect service providers from becoming complicit in unconstitutional activities, and fight secret attempts aimed circumventing digital privacy or impinging upon the right of those involved to speak of the experience. The foundation will be funded by donations from people and organizations all over the world that want to help protect digital privacy and bolster our collective defense against government overreach.

Filed Under: doj, ed snowden, encryption, first amendment, gag order, keys, ladar levison, service providers
Companies: lavabit

Ladar Levison Explains How The US Legal System Was Stacked Against Lavabit

from the because-secrecy-for-the-government-triumphs-all dept

Last month, after Lavabit lost its appeal, we noted that the court avoided the major constitutional issues, focusing on how the company and its founder Ladar Levison mucked up procedural stuff early on, effectively barring him from raising the more serious constitutional issues on appeal. We pointed out that this was unfortunate on many levels, but also noted that this shows how important it is to get a good lawyer early on, rather than trying to handle things yourself. Levison has now written a more thorough explanation over at the Guardian, in which he seeks to explain why gag orders and other issues made it almost impossible for him to get good legal help, leading to the procedural issues later on:

In the first two weeks, I was served legal papers a total of seven times and was in contact with the FBI every other day. (This was the period a prosecutor would later characterize as my "period of silence".) It took a week for me to identify an attorney who could adequately represent me, given the complex technological and legal issues involved – and we were in contact for less than a day when agents served me with a summons ordering me to appear in a Virginia courtroom, over 1,000 miles from my home. Two days later, I was served the first subpoena for the encryption keys.

With such short notice, my first attorney was unable to appear alongside me in court. Because the whole case was under seal, I couldn't even admit to anyone who wasn't an attorney that I needed a lawyer, let alone why. In the days before my appearance, I would spend hours repeating the facts of the case to a dozen attorneys, as I sought someone else that was qualified to represent me. I also discovered that as a third party in a federal criminal indictment, I had no right to counsel. After all, only my property was in jeopardy – not my liberty. Finally, I was forced to choose between appearing alone or facing a bench warrant for my arrest.

In Virginia, the government replaced its encryption key subpoena with a search warrant and a new court date. I retained a small, local law firm before I went back to my home state, which was then forced to assemble a legal strategy and file briefs in just a few short days. The court barred them from consulting outside experts about either the statutes or the technology involved in the case. The court didn't even deliver transcripts of my first appearance to my own lawyers for two months, and forced them to proceed without access to the information they needed.

Then, a federal judge entered an order of contempt against me – without even so much as a hearing.

This is, without a doubt, problematic, and shows the kind of massive imbalance that is set up in these situations. The government has the power to force companies to do what it wants, and companies have little ability to push back, especially when they're left scrambling under gag orders and with limited information.

That said, Levison still should shoulder some of the blame. Yes, he had to scramble to find lawyers, but if you're setting up a "private" and "secure" email service, in which you're making certain promises to users that you must know the government won't like, you need to have ready and competent legal help on call from the beginning. In the last year or so, there has been an explosion of new startups and services promising more private and secure messaging. I hope that all of them are reading what happened here and that they all have competent legal representation who understands the underlying issues ready to go now, rather than waiting until the DOJ knocks on their doors. There will still be some issues, depending on the specifics of the request and jurisdiction, but from what Levison is saying, he was starting from scratch at a point when he should have been much more prepared.

Again: if you are offering private or secure services, you need to have a competent and knowledgeable lawyer on call who can pick up your case immediately.

In the end, while the ruling against Lavabit was disappointing, perhaps it's a blessing in disguise. Hopefully, the next time this issue comes up, it comes up with a company that's much more legally prepared to deal with it, and can present a much stronger case.

Filed Under: doj, email, fbi, ladar levison, privacy
Companies: lavabit

Lavabit Loses Its Appeal For Mucking Up Basic Procedural Issues Early On

from the unfortunate-but-messy dept

This won't come as a huge surprise, but Ladar Levison and Lavabit have now lost their appeal on whether or not they were in contempt for failing to compromise the security of every one of Lavabit's customers in complying with the DOJ's demands to get access to who Ed Snowden had been emailing. The ruling does a decent job explaining the history of the case, which also details some of the (many, many) procedural mistakes that Lavabit made along the way, which made it a lot less likely it would succeed here. Let this be a massive reminder that, if you're dealing with this kind of stuff, getting a good lawyer on your side immediately is important. Unfortunately, the procedural oddities effectively preclude the court even bothering with the much bigger and important question of whether or not a basic pen register demand requires a company to give up its private keys. As the court details, the problem seems to be how Lavabit went about the legal process here:

In the district court, Lavabit failed to challenge the statutory authority for the Pen/Trap Order, or the order itself, in any way. Yet on appeal, Lavabit suggests that the district court’s demand for the encryption keys required more assistance from it than the Pen/Trap Statute requires. Lavabit never mentioned or alluded to the Pen/Trap Statute below, much less the district court’s authority to act under that statute. In fact, with the possible exception of an undue burden argument directed at the seizure warrant, Lavabit never challenged the district court’s authority to act under either the Pen/Trap Statute or the SCA.

The court basically says that because Lavabit mucked up the process, the appeal is going to fail. It further rejects the claim that Lavabit did, in fact, challenge the Pen/Trap order when Levison objected to turning over his keys. The court notes that such a claim is a stretch.

In making his statement against turning over the encryption keys to the Government, Levison offered only a one-sentence remark: “I have only ever objected to turning over the SSL keys because that would compromise all of the secure communications in and out of my network, including my own administrative traffic.” (J.A. 42.) This statement -- which we recite here verbatim -- constituted the sum total of the only objection that Lavabit ever raised to the turnover of the keys under the Pen/Trap Order. We cannot refashion this vague statement of personal preference into anything remotely close to the argument that Lavabit now raises on appeal: a statutory-text-based challenge to the district court’s fundamental authority under the Pen/Trap Statute. Levison’s statement to the district court simply reflected his personal angst over complying with the Pen/Trap Order, not his present appellate argument that questions whether the district court possessed the authority to act at all.

Levison represented himself pro se at the beginning of the case (adding to the mess of procedural problems), and while his legal team tries to use that as a reason why the court should forgive some of the procedural mistakes, the court rejects that as well (even noting that, as a limited liability company, Lavabit shouldn't have been allowed to proceed pro se in the first place).

The hail mary attempt in the case was to argue that because the underlying issues are of "immense public concern" (and they are) that the court should ignore the procedural mistakes. The court flatly rejects that notion:

Finally, Lavabit proposes that we hear its challenge to the Pen/Trap Order because Lavabit views the case as a matter of “immense public concern.” (Reply Br. 6.) Yet there exists a perhaps greater “public interest in bringing litigation to an end after fair opportunity has been afforded to present all issues of law and fact.” United States v. Atkinson, 297 U.S. 157, 159 (1936). And exhuming forfeited arguments when they involve matters of “public concern” would present practical difficulties. For one thing, identifying cases of a “public concern” and “non-public concern” –- divorced from any other consideration –- is a tricky task governed by no objective standards..... For another thing, if an issue is of public concern, that concern is likely more reason to avoid deciding it from a less-than-fully litigated record....

Accordingly, we decline to hear Lavabit’s new arguments merely because Lavabit believes them to be important.

This is unfortunate on many levels, because it's not just Lavabit that believes these issues to be of immense public concern. Either way, this mess of a case should be a reminder that, especially when dealing with the government, it's important to get good lawyers on your side from the very beginning.

Filed Under: 4th amendment, appeals process, doj, ladar levison, pen register orders, pen/trap, private keys
Companies: lavabit

Lavabit To Release Code As Open Source, As It Creates Dark Mail Alliance To Create Even More Secure Email

from the it's-needed dept

This whole morning, while all these stories of the NSA hacking directly into Google and Yahoo's network have been popping up, I've been at the Inbox Love conference, all about the future of email. The "keynote" that just concluded, was Ladar Levison from Lavabit (with an assist from Mike Janke from Silent Circle), talking about the just announced Dark Mail Alliance, between Lavabit and Silent Circle -- the other "security" focused communications company who shut down its email offering after Lavabit was forced to shut down. Levison joked that they went with "Dark Mail" because "Black Mail" might have negative connotations. Perhaps just as interesting, Levison is going to be releasing the Lavabit source code (and doing a Kickstarter project to support this), with the hope that many others can set up their own secure email using Lavabit's code, combined with the new Dark Mail Alliance secure technology which will be available next year.

As noted, the Alliance is working on trying to create truly secure and surveillance-proof email. Of course, nothing is ever 100% surveillance proof -- and both members of the alliance have previously claimed that it was almost impossible to do surveillance-proof email. However, they're claiming they've had a "breakthrough" that will help.

The newly developed technology has been designed to look just like ordinary email, with an interface that includes all the usual folders—inbox, sent mail, and drafts. But where it differs is that it will automatically deploy peer-to-peer encryption, so that users of the Dark Mail technology will be able to communicate securely. The encryption, based on a Silent Circle instant messaging protocol called SCIMP, will apply to both content and metadata of the message and attachments. And the secret keys generated to encrypt the communications will be ephemeral, meaning they are deleted after each exchange of messages.

For the NSA and similar surveillance agencies across the world, it will sound like a nightmare. The technology will thwart attempts to sift emails directly from Internet cables as part of so-called “upstream” collection programs and limit the ability to collect messages directly from Internet companies through court orders. Covertly monitoring encrypted Dark Mail emails would likely have to be done by deploying Trojan spyware on a targeted user. If every email provider in the world adopted this technology for all their users, it would render dragnet interception of email messages and email metadata virtually impossible.

Importantly, they're not asking everyone to just trust them to be secure -- even though both companies have the right pedigree to deserve some level of trust. Instead, they're going to release the source code for public scrutiny and audits, and they're hoping that other email providers will join the alliance.

At the conference, Levison recounted much of what's happened over the last few months (with quite a bit of humor), joking about how he tried to be "nice" in giving the feds Lavabit's private keys printed out, by noting that he included line numbers to help (leaving unsaid that this would make OCR'ing the keys even more difficult). He also admitted that giving them the paper version was really just a way to buy time to shut down Lavabit.

Janke came up on stage to talk about the importance of changing the 40-year-old architecture of email, because it's just not designed for secure communications. The hope is that as many other email providers as possible will join the Alliance and that this new setup becomes the de facto standard for end-to-end secure email, which is where Levison's open sourcing of his code gets more interesting. In theory, if it all works out, it could be a lot easier for lots of companies to set up their own "dark mail" email providers.

Either way, I would imagine that this development can't make the NSA all that happy.

Filed Under: dark mail, dark mail alliance, email, ladar levison, mark janke, nsa, nsa surveillance, open source, security, surveillance
Companies: dark mail alliance, lavabit, silent circle

Lavabit Tried Giving The Feds Its SSL Key In 11 Pages Of 4-Point Type; Feds Complained That It Was Illegible

from the kudos-to-ladar dept

We already wrote about the basics of Lavabit's Ladar Levison standing up to the feds, however, the full filing has now been released, and (on top of that), Kevin Poulsen has updated his story with more details, so it's worth digging in a bit. Lavabit was hit with an initial pen register, which it refused, leading to the order to hand over the SSL keys. The new details show that Lavabit explained to the judge that giving up Lavabit's SSL keys wouldn't just let the feds spy on Snowden, but all of Lavabit's customers, and for obvious reasons, the company had a huge problem with that:

“The privacy of … Lavabit’s users are at stake,” Lavabit attorney Jesse Binnall told Hilton. “We’re not simply speaking of the target of this investigation. We’re talking about over 400,000 individuals and entities that are users of Lavabit who use this service because they believe their communications are secure. By handing over the keys, the encryption keys in this case, they necessarily become less secure.”

And it becomes clear that Levison then was actually willing to abide by the initial pen register, to basically figure out a way to just tap Snowden, but at this point the government was no longer willing to stop there. The government pushed for getting the SSL key, basically promising not to abuse it:

“We can assure the court that the way that this would operate, while the metadata stream would be captured by a device, the device does not download, does not store, no one looks at it,” [Prosecutor James] Trump said. “It filters everything, and at the back end of the filter, we get what we’re required to get under the order.”

“So there’s no agents looking through the 400,000 other bits of information, customers, whatever,” Trump added. “No one looks at that, no one stores it, no one has access to it.”

“All right,” said [Judge Claude] Hilton. “Well, I think that’s reasonable.”

The judge then made a ruling that should cast a massive chill over anyone setting up private communications services:

[The government's] clearly entitled to the information that they're seeking and just because you-all have set up a system that makes that difficult, that doesn't in any way lessen the government's right to receive that information just as they could from any telephone company or any other e-mail source that could provide it easily."

Yikes. So, even if you set up a secure communication system, this judge says that you have to let the feds wiretap it.

Somewhat amusingly, Lavabit tried to comply "by turning over the private SSL keys as an 11 page printout in 4-point type." The feds complained that "the FBI would have to manually input all 2,560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data." Poor, poor FBI. The judge has no problem putting a massive burden on Lavabit, but asking the FBI to actually do some data entry is too onerous? Yup. Apparently. The court then ordered Levison to provide a more useful electronic copy, which then resulted in the $5,000/day fine for failing to live up to that, and then the closure of the site.

Filed Under: doj, ed snowden, fbi, feds, ladar levison, ssl
Companies: lavabit

Lavabit Details Unsealed: Refused To Hand Over Private SSL Key Despite Court Order & Daily Fines

from the as-expected dept

It appears that some of the details that resulted in Lavabit shutting down have been unsealed, and Kevin Poulsen, over at Wired, has the details and it's pretty much what most people suspected. The feds got a court order, demanding that Lavabit effectively hand over the keys to everyone's emails. Lavabit's Ladar Levison refused, and he was then threatened with $5,000/day fines, contempt of court charges and possibly more.

Initially, Lavabit was sent a pen register order letting the government know every time Ed Snowden logged in (Snowden's name is redacted, but it's clear that this is about him). Lavabit said that it wouldn't defeat its own encryption system, and the court quickly ordered Lavabit to comply:

By July 9, Lavabit still hadn’t defeated its security for the government, and prosecutors asked for a summons to be served for Lavabit, and founder Ladar Levison, to be held in contempt “for its disobedience and resistance to these lawful orders.”

A week later, prosecutors obtained the search warrant demanding “all information necessary to decrypt communications sent to or from the Lavabit email account [redacted] including encryption keys and SSL keys.”

Once again, Levison refused to reveal the SSL keys, leading to the $5,000 per day fine imposed by Magistrate Judge Theresa Buchanan. The fines began August 6th. Lavabit shut down on August 8th.

Again, something along those lines was what many people had assumed happened, but now it's been confirmed. Kudos to Levison for standing his ground on this. I know that people in our comments like to insist that every company should act this way, but it's not nearly as easy when its your life's work on the line, and you have the entire US government (including huge monetary fines and the possibility of jail time) coming down on you.

Filed Under: doj, ed snowden, email, encryption, fbi, ladar levison, pen register, privacy, ssl, wiretap
Companies: lavabit

Lavabit Asks Court To Unseal At Least Some Of Its Case So Others Can Submit Amici Briefs

from the open-court dept

A number of organizations and companies have expressed interest in filing amicus briefs in the lawsuit between Lavabit and the US government, concerning the government's attempt to do something (most likely install some kind of backdoors in Lavabit's "secure" email system), which resulted in Lavabit shutting down. The problem? How do you file an amicus brief when everything is filed under seal and the details are hidden. Given that, Lavabit is now asking the court to at least unseal things partly so that others can file briefs in the case. This is important, because these issues are important from a public interest standpoint. A secret court process, with everything filed under seal, is antithetical to the very basis of our judicial system. Yes, there are times when it makes sense to keep certain things under seal, but the details of this particular case are of tremendous public interest, and hopefully the court will back off from a blanket sealing of just about everything, and allow various public interest groups to weigh in as well.

Filed Under: amicus briefs, ladar levison, lawsuit, unsealing
Companies: lavabit

Lavabit's Levison Now Avoids Email Altogether, Has Turned Into A 'Political Activist' Thanks To The NSA

from the unintended-effects dept

A couple of weeks ago, Mike reported on the extraordinary turn of events involving Edward Snowden's email supplier, Lavabit. The company's owner, Ladar Levison, preferred to shut down the service rather than hand over to the US government something that it wanted really badly -- exactly what, we don't know because of a gag order. We then learned that the mere act of shutting Lavabit down threatened to land Levison in big trouble anyway.

Reporting on comments he made recently at the Privacy Identity Innovation conference in Seattle, AllThingsD has a useful update on what he's doing currently. He says that he is still hopeful that the courts will allow him to re-start Lavabit; but until then, he is taking some rather extreme precautionary measures, avoiding email altogether:

Levison is making use of "the electronic equivalent of a methadone clinic" by messaging people through Facebook, LinkedIn, text and the new encrypted communication service Silent Circle. "I haven't needed a real and valid email address to register for something yet," he said.

"Anything that I consider sensitive, I try to talk about it to people in person, with my cellphone off, in an area where I know that nobody’s pointing a parabolic mic at me," Levison said. "If you're fighting the government that's what you need to do."

It's a little hard to reconcile that understandable concern that the NSA may be eavesdropping with his use of relative insecure services like Facebook, but presumably he knows what he is doing here. Maybe he only conducts relatively trivial conversations using them, saving more serious stuff for Silent Circle, and the really serious stuff for face-to-face meetings.

Levison's thoughts on communications and security are obviously of interest, but the key news that we learn from the AllThingsD piece is the following:

"I've had to switch from becoming a small business owner worrying about making payroll, to overnight becoming a political activist," Levison said.

The following hint of something big to come is intriguing:

Though he had suggested when he shut down Lavabit that he was at imminent risk of arrest, Levison said today he is "less worried" about that now. "What I'm more worried about is what I have planned for the future," he added ominously, then declined to elaborate.

What's significant is that the NSA's attempts to bully Levison into secret obedience have backfired badly, producing the opposite effect: in his own words, he's become a "political activist" -- one, moreover, who is technically savvy and has experience of dealing with the snoops. That makes him a hugely valuable ally for those wishing to bring some transparency and accountability to the US government's surveillance activities -- and an obvious problem for the NSA. No wonder he's worried about being spied upon.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: activism, email, ladar levison, nsa, nsa surveillance, privacy, security
Companies: lavabit

Feds Threaten To Arrest Lavabit Founder For Shutting Down His Service

from the either-you-help-us-spy-on-people-or-you're-a-criminal dept

The saga of Lavabit founder Ladar Levison is getting even more ridiculous, as he explains that the government has threatened him with criminal charges for his decision to shut down the business, rather than agree to some mysterious court order. The feds are apparently arguing that the act of shutting down the business, itself, was a violation of the order:

... a source familiar with the matter told NBC News that James Trump, a senior litigation counsel in the U.S. attorney’s office in Alexandria, Va., sent an email to Levison's lawyer last Thursday – the day Lavabit was shuttered -- stating that Levison may have "violated the court order," a statement that was interpreted as a possible threat to charge Levison with contempt of court.

That same article suggests that the decision to shut down Lavabit was over something much bigger than just looking at one individual's information -- since it appears that Lavabit has cooperated in the past on such cases. Instead, the suggestion now is that the government was seeking a tap on all accounts:

Levison stressed that he has complied with "upwards of two dozen court orders" for information in the past that were targeted at "specific users" and that "I never had a problem with that." But without disclosing details, he suggested that the order he received more recently was markedly different, requiring him to cooperate in broadly based surveillance that would scoop up information about all the users of his service. He likened the demands to a requirement to install a tap on his telephone.

It sounds like the feds were asking for a full on backdoor on the system, not unlike some previous reports of ISPs who have received surprise visits from the NSA.

Filed Under: criminal charges, doj, email, ladar levison, nsa, nsa surveillance
Companies: lavabit