Lavabit Case Unsealed: FBI Demands Companies Secretly Turn Over Crypto Keys 527
jest3r writes "Lavabit won a victory in court and were able to get the secret court order [which led to the site's closure] unsealed. The ACLU's Chris Soghoian called it the nuclear option: The court order revealed the FBI demanded Lavabit turn over their root SSL certificate, something that would allow them to monitor the traffic of every user of the service. Lavabit offered an alternative method to tap into the single user in question but the FBI wasn't interested. Lavabit could either comply or shut down. As such, no U.S. company that relies on SSL encryption can be trusted with sensitive data. Everything from Google to Facebook to Skype to your bank account is only encrypted by SSL keys, and if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone."
https (Score:5, Funny)
Luckily I browse my favourite sites like /. using http so I'm not affected by this.
Re:https (Score:5, Interesting)
Your favorite site also bans random TOR exit nodes from browsing it. I can understand banning posting to prevent spam and such, but browsing ? That's just moronic. It also craps when the IP of the user changes during editing/posting.
Slashdot, please get on with the times, you are probably the legal site most visited by TOR users. You need to add HTTPS and improve TOR support.
Re:https (Score:5, Funny)
I'm sure the beta will fix this.
It's one of the areas they're working on.
Re:https (Score:5, Funny)
Wait for your turn!
They are still trying to figure out these non-ASCII char sets.
Re: (Score:3)
Why would they need to add https? To encrypt the text you are posting publicly? What is the impact of a MITM attack for a /. user?
Not very much, is anything.
Re: (Score:3)
If it is encrypted they can't see what page you are browsing, or trivially associate your IP address/subscriber details with your Slashdot UID. Of course they could do all that stuff with some effort anyway, but we need to make it as hard and computationally intensive as possible. That's one of the best ways to thwart mass surveillance.
Re:https (Score:5, Insightful)
Because I'd prefer my employer not to know my /. UID?
Never ask "why do you want privacy"; that's always a stupid question. Privacy is simply an integral part of the two prime human goals: liberty and dignity.
This is a fundamental mindset change that's needed in developers! We've learned to write software that uses the least possible privilege, as the core of security. We need to learn to write software that offers the most possible privacy, as the core of human rights.
Read-only vs. complete ban (Score:5, Insightful)
Nothing left to do (Score:5, Insightful)
Understandable that he shut down.
The USA is ruled by evil bastards that have no respect for the citizens.
Time to revolt is now.
Re:Nothing left to do (Score:5, Funny)
You already ARE revolting!
Re:Nothing left to do (Score:5, Funny)
Re:Nothing left to do (Score:4, Insightful)
You mean the time is now for others to revolt while you sit in the basement playing armchair general. Who about you actually di something rather than just make empty threats?
Re:Nothing left to do (Score:5, Funny)
You mean the time is now for others to revolt while you sit in the basement playing armchair general. Who about you actually di something rather than just make empty threats?
Surely you're not suggesting that this AC is some sort of...coward...are you?
Re:Nothing left to do (Score:5, Funny)
*facepalm* on my part.
*facepalm* on your face like everyone else. Dirty boy.
Re:Nothing left to do (Score:5, Interesting)
And if you get one of these national security letters or other absurd warrant from the feds, publish it. The right of the press to publish otherwise classified material was affirmed in the 1971 case New York Times Co. v. United States, although that was a pretty weak ruling. But unless you've agreed to keep something secret, you're theoretically free to do with it as you like. Also, I'm not a lawyer and you shouldn't take your legal advice from the internet.
Re:Nothing left to do (Score:4, Interesting)
Yes, the U.S. has the equivalent to parliamentary privilege, and it's been used in living memory rather famously. During the Vietnam War era, Mike Gravel, a Senator from Alaska, included the Pentagon Papers [wikipedia.org] into the Congressional Record, meaning they were then publicly available. He was protected by Article I, Section 6 of the Constitution, which among other things says about members of Congress that "for any Speech or Debate in either House, they shall not be questioned in any other Place." ("Speech" includes inclusions into the Congressional Record.)
Re:Nothing left to do (Score:4, Insightful)
Understandable that he shut down.
The USA is ruled by evil bastards that have no respect for the citizens.
Time to revolt is now.
It's basically your fault there will be no revolution because you decided not to put an exclamation point which, very appropriately,sums up the attitude of most Americans about anything other than sports, shitty beer and big tits.
Ok, get on that then (Score:4, Insightful)
Go start your revolution. Do whatever you think that entails.
Or, if you aren't willing to do that, because revolutions are messy and often as not end up worse than what you had, kindly shut the fuck up.
I will not be joining you because while I feel the US has not been moving in a positive direction as of late, I feel that the solution to fixing it involves using the democratic process, not violent revolution, since I understand how nasty those are and also have a perspective on how good the US has it overall.
I get really tired of whiny, usually anonymous, basement dwellers playing toughguy on the net, decrying the US and saying we need to "revolt" or "rise up" or some BS. You aren't going to do that and you know it. So you are just being a douchebag, whining and complaining, suggesting that others should do the dirty work.
So put up or shut up. If revolution is really what you think is needed, get on that then. Though you might want to research a little as to what often happens to revolutionaries, and to countries after. If you don't, then STFU about it. Less whine, more action.
In fact, you will probably find that if you and other like you spent less time whining and more time working to affect actual change in the country within the system we have, things might start getting better.
Re: (Score:3, Insightful)
Land of the cowards, home of the slaves.
Where else in the world can people be so cowed while simulatenously bragging about their right to go armed?
Re: Nothing left to do (Score:4, Insightful)
It's almost like there's more than one person wandering around.
Re: (Score:3)
We have this system of "checks and balances": as long as the government checks come every month, people are satisfied with the balance.
Re:The USA is ruled (Score:5, Insightful)
the US gets the press, but every country is doing as much as they can (and are able to) with the money and network taps they have in place.
this is human nature. the dark side of human nature.
at least its out in the open, now. what we do with it, as a species, is up to us. do we put our data thieves (ie, the government) behind bars or do we just say 'I have nothing to hide!' and let them continue along with their abuse and theft of our privacy?
there is no country that won't do this, no matter what they say. so stop thinking its the big bad old USA. its everyone, everywhere, who CAN do it. companies includes (your corp firewall and your corp provided laptop probably has built-in certs from the company)
Re:The USA is ruled (Score:5, Insightful)
there is no country that won't do this, no matter what they say. so stop thinking its the big bad old USA. its everyone, everywhere, who CAN do it.
Qualitatively, yes you're probably right. Quantitatively, not so much. It's like the military. Every country, or almost, has one. But only the USofA spends about as much on "defense" as the rest of the planet put together.
PS Capitals, used with some restraint, go a long way to making heads and tails out of a sentence.
Re:The USA is ruled (Score:5, Insightful)
I live in Ireland. I can pretty much guarantee you of three things.
1) The state lacks the expertise to snoop on any communications.
2) The state lacks the legal clout to force anyone to turn over their encryption keys.
3) The government would likely not survive the closure of an IT SME such as Lavabit -- and loss of associated jobs -- which resulted from direct government interference in that company's ability to operate in Ireland.
The rules that apply to the US government do not apply to every government. Some governments lack the skills, laws, and nerve to pull off what the White House/NSA is doing to US internet companies right now. More governments simply lack the money to pay for so extensive a network of surveillance and control.
That can includes more than simply being ABLE to do it. It includes being EMPOWERED to do it, being PERMITTED by the people to do it, and to being able to AFFORD to do it. Right now the US government is able, empowered, but only just about permitted and certainly not able to afford to continue to finance a spying program of this magnitude.
The Soviet Union exhausted both its finances and legitimacy in trying to keep its populace under control. Hopefully the US will not have to go through as painful a breakup in order to reverse its present trend.
Why? (Score:5, Insightful)
Re:Why? (Score:5, Informative)
I don't see why they would want the SSL key, when presumably they have easy access to the data on the servers under the laughable "due process" already in place. Why would they want to intercept the traffic when they could just read it off the server?
Because presumably the whole point of Lavabit is that the stored email was encrypted based on a key that only the user had, so in-transit is the only place they could see it.
Re:Why? (Score:5, Informative)
The summary is wrong.
The FBI originally wanted access to just Snowden's account and Lavabit refused. In order to get it, they demanded SSL keys to feed into their snoop machine so they could filter out just Snowden's info.
At that point, Lavabit AGREED to provide a tap on just Snowden. The FBI basically said "too late, we don't trust you to do it properly".
Not that they should get what they tried to -- the SSL private keys -- but the summary makes it out to be something different than what happened.
Re:Why? (Score:5, Informative)
In 1979 the SCOTUS ruled that pen registers didn't require warrants.
http://en.wikipedia.org/wiki/Pen_register#Background [wikipedia.org]
Re:Why? (Score:5, Informative)
Why would they want to intercept the traffic when they could just read it off the server?
from TFA: ....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.
Re: (Score:3, Informative)
Why would they want to intercept the traffic when they could just read it off the server?
from TFA: ....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.
The message contents, yes. But the header information they did have access to, as it's necessary for delivery. And that information is what the FBI wanted, and that information is what was all protected by a single SSL cert.
Re: (Score:3)
from TFA: ....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.
If this is true, then how could Lavabit also have done the following?
Lavabit offered an alternative method to tap into the single user in question but ...
Either they could access the data or they couldn't.
Re:Why? (Score:5, Interesting)
Actually, they did not have access to the site (that would have been overly broad and unconstitutional), but lavabit was forced by the court to install a packet dumper. So FBI had the full encrypted streams of all user sessions. FBI then requested the SSL key that would unlock all stored streams. The court reasoned that because the site uses a single SSL key for all users, that's lavabit's fault and agreed that the request is not overly broad.
Luckily there's a simple technical fix for this: perfect forward secrecy in HTTPS, using RSA DiffieHellman or ECDH key exchange. The encryption key is ephemeral and the SSL private key cannot be used to perform a passive attack on the sniffed. FBI/NSA is forced to perform a MIM on the very sessions they target; if done on the scale of the whole internet, this would be easily detected.
All HTTPS servers should ship with this cypher suite as the default.
Re: (Score:3)
Luckily there's a simple technical fix for this: perfect forward secrecy in HTTPS, using RSA DiffieHellman or ECDH key exchange.
Did you know that ECDH stands for Elliptic Curve Diffie-Hellman? Yeah it would solve the problem of the NSA's request alright...
Re: (Score:3)
PFS would not help in this case. The FBI asserted that a pen register (which is not a warrant and merely requires the government to assert "relevance") is sufficient to obtain the SSL keys for an entire service, because they choose to implement it via an SSL interceptor. LavaBit argued the pen register does not grant such broad power, so then they went and got a search warrant for it instead.
Obviously if the FBI has the SSL key, they can impersonate LavaBit and intercept everything at that point. It helps o
Re:Why? (Score:5, Interesting)
The best part is they said here that they wanted the "Root Certificate", which would allow them to sign new keys. Caveat: that's just a trust model, allowing them to replace LavaBit's SSL key. What they wanted was LavaBit's site SSL private key.
Let's say that the NSA got the Verisign Root Certificate and started using it to sign Verisign CSRs. A CSR includes the public key (certificate), but not the private key. The public key is already known. The NSA gains ... nothing.
Now if they get the Google Gmail SSL private key, they can decrypt the SSL session handshake and key exchange. The key exchange exchanges a symmetric encryption key for AES or RC4 (yes RC4 is secure; yes I know it's used in WEP, which uses a new NONCE for every packet, and in their implementation they generate insecure NONCE/IV pairs and you can collect millions of these and crack it. Not applicable here). With Gmail's SSL private key, the NSA can decrypt the symmetric session key exchange and use that key to decrypt your session and read your e-mail.
That's the difference.
Re: (Score:3)
The public key is already known.
I don't know about you, but I don't get any warning telling me that "The stored public key for secure.site.com does not match the one received. Continue to site?" Maybe I need to upgrade my browser.
So for most, a MITM attack would be completely undetected.
Re: (Score:3)
Maybe I need to upgrade my browser.
You need the Certificate Patrol [mozilla.org] plugin, which warns you when a site's certificate changes unexpectedly, even when the new certificate has a "valid" signature.
Unfortunately, this doesn't work with Google's servers, who rotate among a gazillion certificates "legitimately", and thus drown the user in false positives. But given Google's cooperation with Prism, maybe this effect is wanted?
They wanted a man-in-the-middle box (Score:5, Informative)
Firstly they wanted *all* meta data on every Lavabit user, not just Snowden. It was a blanket demand to get all of the data.
They also wanted man-in-the-middle box. A device which would have the root certificate under control of the government and would sit in Lavabits network able to man-in-the-middle attack emails (i.e. speech) of Lavabit users not connected to Snowden.
Lavabit are guardians of the customers data, how can they guard if a black-box is on their network? It can do anything, the judge has no way of telling, Lavabit has no way of telling. Google apparently refused these boxes and with good reason. There is no trust here, the Judge is not supposed to trust the FBI & NSA to do only what it says. He's supposed to be the guardian of the law, just as Lavabit are the guardians of the data.
An example, if I had such a box, I could spoof email convincingly in a way that would pass forensics. I could create fake evidence. I could spread disinformation (propaganda) again untraceably.
They also asserted that it filters out only the data they were allowed to have and throws away the rest. We know this has been proven to be false in many many leaks, even the President now pretends the data goes into a 'lockbox'. A lockbox isn't a lockbox if the NSA has the key and no judicial oversight stops them turning that key at will.
It seems, once again, the judicial branch has simply become a fawning sidekick to the executive branch.
Comment removed (Score:5, Interesting)
Re: (Score:3)
When you say the FBI "asked" for real time metadata, did they have a warrant?
Regardless, the jump from "you're not doing what we ask" to "we get to install a black box on your network and spoof as you, trust us not to abuse this" seems excessive if not absurd as lavabit's core business is centered around privacy. It would be like a safe company being required to issue a key to every safe they've ever made to the FBI because they wouldn't hand over a single purchaser's account information.
Re:Why? (Score:5, Insightful)
if the US gov asked a huge mega-corp to break its whole business model and trust, essentially going out of business (think big auto makers or sony or some huge corp like that) do you think it would happen? would the gov push around a huge company and try to ruin them, just to get some (cough) meta-data?
small guys who can be made to look 'dodgy': yes
big co's who donate to the election campains: certainly not!
"business as usual" ;( might makes right. time and time again, the larger the government gets, the more power it gets and the more corrupt it gets until its main goal is just to keep itself going along the same trajectory. ethics and fair treatment be damned.
Re:Why? (Score:5, Insightful)
Lavabit wasn't as principled as claimed by Glenn Greenwald et al. They did actually plan (or told the courts and the FBI they would anyway) to release the records relating to $PROBABLY_SNOWDEN to the FBI. At best you can argue they were lying, but how's that showing integrity?
Once they were given a proper warrant, complying is the principled thing to do. That's proper due process. The point is to prevent the government from gaining access to information while skipping said due process. So no, at best I can argue they were telling the truth, and doing the right thing.
Lavabit made a number of elementary legal mistakes from the beginning, even avoiding using a lawyer in the first hearing. These mistakes made it easy for the FBI to argue that they couldn't trust Lavabit to do what Lavabit was offering to do. Lavabit should have contacted the FBI immediately, made it clear their concerns
Assuming the facts are correct, agreed.
and not made a clearly bad-faith offer to provide something useless to the FBI
I don't think that's what they did. The first offer of providing the information on a monthly basis seems both useful and better targeted than the initial FBI request. Why is this a bad-faith offer?
Notwithstanding the above, the court's refusal to allow Lavabit to talk to politicians et al about the basic principles in the case seems absurd and completely unconstitutional.
Right. The whole thing was the government throwing a fit. "Oh, you want to fight us. We'll up the ante, and ask for something completely unreasonable then.." It was very principled on their part to not fold as a result, and to shut down instead of giving them what they wanted.
Re: (Score:3)
1. Non-cooperation is neither illegal nor prejudicial to your case. You have a right, as a legal entity, to refuse to cooperate.
2. Bad-faith cooperation is neither illegal nor prejudicial to your case. You have a right, as a legal entity, to place limits on the extent of your cooperation, if any
The state can issue warrants for data, but until and unless they successfully do, they are entitled to sweet fuck-all from whoever they are requesting the data from. A court can go ahead and give a warrant for what
Re:Why? (Score:5, Insightful)
Lavabit made a number of elementary legal mistakes from the beginning, even avoiding using a lawyer in the first hearing.
You shouldn't have to use a lawyer to get justice in a free nation. It shouldn't be possible to use a defendant's naivete as a procedural trap to extort concessions and violate due process. Judges are supposed to be biased in favor of defendants to ensure this doesn't happen. The puppet FISA "judges" are so quick to lick the boots of their real master that they can't be bothered to maintain a believable charade.
Re:Why? (Score:5, Insightful)
If you read the article, they demanded the SSL key since Lavabit did not comply with the earlier order. All the Feds originally wanted was metadata for one user. Lavabit could have provided that, but refused. The prosecutors asked they be held in contempt of court, and then asked for the SSL keys. This is on Lavabit.
Yes, how dare the impudent bastards attempt to protect their customers from illegal surveillance!
Seriously, I think you just posited a digital variant of the 'skinny jeans defense' [google.com] rapists use.
Re: (Score:3)
Yes, how dare the impudent bastards attempt to protect their customers from illegal surveillance!
The problem is that the law says what the investigators wanted in this case was legal, and it appears that the Supreme Court has previously said was legal. If you want to claim that it was "illegal surveillance," you're going to have to come up with some interesting magic since it apparently was for investigation of an actual specific crime.
Re:Why? (Score:5, Insightful)
It's not magic, it's the rule of law: Per the Constitution, it is the supreme law of the land, and cannot be superseded by anything except a Constitutional Amendment. As no one has, to date, amended the Constitution to nullify the 4th Amendment, any "law" that violates the right of the People to be free from unlawful search and seizure is, in fact, not a legitimate law, no matter how many political appointees scream that it is.
If the government made a law that said it was required for every goyim to kill at least 1 Jew, and the SCOTUS supported it, would you say the murders are legitimate, legal acts?
Well, OK, maybe not you, specifically, but a person of reasonable faculties who has not already proven themselves to be an ardent licker of federal boot.
Re:Why? (Score:5, Insightful)
Lavabit being "in contempt" regarding the first request in no way justifies the second.
This is just more of this sort of post-factum argumentation that is so common everywhere lately. You even see it at the level of the SCOTUS. Some goal is declared supremely important and then the law is distorted to fit that objective rather than to actually honestly examine if that objective is even legal to begin with.
"We must do X, therefore we will ignore the law"
Same nonsense, different day.
Re:Why? (Score:4, Interesting)
In my humble and non-judgely opinion, the fact that Lavabit would have had to defeat its own security means that the original decision that allowed collection of metadata without a warrant supported by facts (Smith v. Maryland) should not apply to this case and the government should have had to articulate facts that led to reasonable suspicion in order to obtain a warrant to get metadata from Lavabit.
Re:Why? (Score:4, Insightful)
Lavabit could have provided that, but refused.
Good on them!
This is on Lavabit.
And for that, they are to be viewed as heroes.
As opposed to Fed apologists, such as yourself.
Re: (Score:3)
This is on Lavabit?!? YOU are what is wrong with this country. Get the FUCK out.
Re:Why? (Score:4, Insightful)
Ah, the NSA lapdog comes in to try and weedle and twist and squirm any way he can to apologize for the NSA.
But no. You can't even do that correctly, can you? Listen, the FBI demanded something. Lavabits said no. The court said yes. Then the FBI came in with an even bigger demand.
A week later, prosecutors upped the ante and obtained the search warrant demanding “all information necessary to decrypt communications sent to or from the Lavabit e-mail account [redacted] including encryption keys and SSL keys.”
"Upping the ante" is pretty synonymous with bullying. They refused the request, and the court order, and then the FBI "ups the ante" and demands complete access to everything? That's bullying flat out. It's abuse of power. Comply with our demands or we'll throw the whole book at you and make you dance.
This is on Lavabit
You mean the blame for this shit? No. No I don't think the blame is on Lavabits. I think the FBI got miffed that their cock wasn't sucked hard enough so they decided to rape a business to death.
Hey, the FBI came back with a warrant. Ok. That's not that bad. It's actually a lot better than this bullshit warrantless "pen register order". That the warrant includes COMPLETE control over ALL communication that your entire business is specifically sold as being secure? That's bad.
Your move, NSA (Score:5, Funny)
What moron judge allowed this? (Score:5, Insightful)
How is this legal? How do you get a warrant that broad? Are fishing expeditions now allowed by law enforcement?
Re:What moron judge allowed this? (Score:5, Informative)
Things are a bit more involved than they seem from reading just the summary. The fed originally requested that LavaBit provide them with information regarding a single account (header information only, but on an ongoing basis), which they are allowed to obtain without probable cause. LavaBit refused the initial request, then stalled when given a court order to provide this information (I believe LavaBit was in the right in doing so -- I'm NOT supporting the fed's case, just providing information). The fed took LavaBit back to court, and obtained a court order requiring that LavaBit provide the SSL key, as the fed did not believe that LavaBit would comply with an order for information on a single account. The best part was when LavaBit sent them the SSL key, as a 4 point font printout :-)
In other words, when LavaBit wouldn't provide them information on a single account, the fed escalated to the nuclear option.
Re:What moron judge allowed this? (Score:5, Insightful)
Stop right there. The fact that they are allowed this without probable cause is already too much.
They should have sent it 4 point one character per page.
The fact that the judge believed the FBI would only take the info the warrant allowed makes him either an accomplice or as naive as a child.
Re:What moron judge allowed this? (Score:5, Insightful)
Like I said, I don't disagree with how LavaBit handled this. In fact, I think EVERYONE should treat federal 'requests' for information the way that Ladar Levinson has, and greatly admire the stand he has taken. I was simply saying that it was more complicated than the summary made it out to be.
That being said, in my personal opinion the fact that the fed can request envelope information with no probably cause is a travesty. I see it as no different than pulling mail out of my mailbox to see who I write letters to and who writes to me. This should be illegal search and seizure
Re:What moron judge allowed this? (Score:5, Insightful)
Stop right there. The fact that they are allowed this without probable cause is already too much.
It is interesting that the prosecutor portrayed this as a pen trap. Courts have ruled that users do not have a reasonable expectation that the numbers they dial on their phone line will remain private (basicaly because they show up on the bill) but that they do have a reasonable expectation that nobody is listening in. That is why this information can be obtained without probable cause. But if Lavabit offered specific guarantees that this information would not be recorded except in the encryted e-mail boxes, then the users had a reasonable expectation of privacy. This might make the use of a pen trap without probable cause illegal.
Re: (Score:3)
Actually, it does. The 'expectation of privacy' is not based on a particular entity, but is based on who the information is already disclosed to. For example, you have no expectation of privacy in a park because total strangers can see what you're doing and you know it.
The whole pen register deal was a bit of sophistry in the first place claiming that you already disclosed the number dialed to the phone company. Lavabit ups the ante by specifically agreeing that the headers are your private information and
Re:What moron judge allowed this? (Score:5, Insightful)
They should have sent it 4 point one character per page.
No. You should have a good reason for telling them "no", then you should tell them "no" with your reason, and get lawyers involved. Pretending to technically comply with a court order while making an obviously obstructive, bad-faith effort is a good way to ensure that things go rapidly downhill for you.
Re:What moron judge allowed this? (Score:5, Interesting)
Re:What moron judge allowed this? (Score:5, Interesting)
I got no mod points, but this is absolutely the takeaway.
The US depends on it's software industry; we shipped all our labor jobs overseas to trade them for office work (programming). That, and Hollywood, is why we're so mean to other countries over IP.
And now the US government has completely undermined them. It's probably a good time to be a programmer in Brazil and Germany. I wonder If our software industry will be able to recover from this.
Re:What moron judge allowed this? (Score:4, Insightful)
I wish I could agree but I don't. The US government has crushed some fairly small-time players. They have the big players well in control (MS, Google, Facebook), and they aren't going anywhere (too many stakeholders, can't be moved or shut down the same way). This particular skirmish is win-win for the US government -- fewer choices for citizens, more people forced onto the big centralized systems they have full access/control to, proven threats to use against any future outliers.
Re:What moron judge allowed this? (Score:5, Funny)
I doubt many in the public will support them when the fact emerge that they were defying court orders.
Yeah, how dare they challenge authority! It's unamerican!
Re:What moron judge allowed this? (Score:5, Insightful)
...when the fact emerge that they were defying [Secret, Unaccountable, Undemocratic] court orders.
Cold Fjords subservient cheerleading to power never ceases to entertain. Obviously the operators of the Cold Fjord account have learned absolutely nothing from history, or are on the wrong side. See: "Means Used by the Nazi Conspirators in Gaining Control of the German State" [nizkor.org]. Quote: "To make certain that cases with political ramifications would be dealt with acceptably and in conformity with Party principles, the Nazis granted designated areas of criminal jurisdiction to the so-called Special Courts (Sondergerhte)."
Re:What moron judge allowed this? (Score:5, Informative)
The FISA courts were created by Congress, the same as any other Federal court besides the Supreme Court. The FISA court is accountable to both its appeal court and the Supreme Court like other Federal Courts, and the Judges can be removed by Congress as can other Judges. In fact, the Judges on the FISA court are ordinary Federal judges that rotate through the FISA court from other Federal courts.
The FISA Court is accountable to no one. The FISA Court meets in secret and only one side is represented, so there is no possibility of appeal for those whose rights are trampled. The FISA Court has denied only 11 of 33,942 requests in its 33 years of operation and the FISA Court of Review has met a total of twice in that time period. The design and operation of the FISA Court provides no path for accountability to the Supreme Court. Even if the telecom companies that were required to provide customer data to the government wanted to appeal, there is no requirement that their arguments are considered (the FISA Court allowed Yahoo! to appeal in 2008 so that the law in question could be ruled okay and a heavily redacted ruling released to make sure no one else bothers to try). No FISA-related case has ever gone to the Supreme Court and it isn't clear how one could.
Congress has no oversight of the judges. Each judge is appointed by the Supreme Court Chief Justice with no oversight or confirmation by anyone else, including Congress. In the 33 years of FISA, we've had three chief justices, all conservative Republicans. John Roberts appointed every single FISA Court judge currently serving.
Your dishonesty regarding FISA is troubling. Either you are ignorant of something you strongly support or you are lying in hopes of deceiving others.
Re: (Score:3)
The public now understands that the totality of the encryption was at risk and not just for 'one' account.
That basic insight is a great fact that has emerged and now its public can be talked about
Re: (Score:3)
Hmmm... wonder if LavaBit can sue the Justice Department and the FBI for illegally restricting their commerce? IANAL, but damn sure wish I was...
True justice transcends "laws." There are unjust, unfair and unethical laws. Unfortunately, too many people believe that "the law is the law" and it cannot be changed. The civil rights movement wouldn't have (moved) if it weren't for the realization of the contrary (that some laws _should_ be changed).
Re:What moron judge allowed this? (Score:5, Insightful)
The header information blanket traces back to an idiotic ruling that the outside of a letter was not protected since everybody can and had to read it to get it there (the USPS digitizes and stores all of them now). The FBI then applied this to encrypted traffic which makes no sense since it's no longer data that anybody but them or there agent can read.
We need clear guidance, which a simple presidential order could give that prohibits all of these sorts of searches.
Re: (Score:3)
It sounds like LavaBit's security was essentially an "all or nothing" situation, though. If they compromised just one of their users, then effectively none of their users were secure anymore.
Obviously, the feds weren't too keen on getting "nothing".
Not sure how LavaBit could have architected things to not be in this position. Maybe giving each individual user a subdomain with its own s
Re: (Score:3)
Protecting *all* of your users or shutting down to avoid betraying one of them has a philosophical elegance about it in my mind. After all, what good is your service if it's basically "we'll protect your data...unless the government tells us they feel like reading yours. Then you're SOL"?
Granted, it's debatable whether that was really the intent, but oh well.
Re: (Score:3)
Re: (Score:3)
Back in grade school, with the random printer we had and my bare eyes, I could read font size 2 printouts with just a bit of squinting. And there's OCR.
Re:What moron judge allowed this? (Score:4, Insightful)
It's not a warrant. Email headers are not protected information under the law so all you need is a subpoena. Since they are disclosed to third parties there is no expectation of privacy under current law.
It's the same idea that the outside of the envelope that you give the postman is not protected. Nor is a list of phone numbers that you call.
Re: (Score:3)
All of those should not be up for mass inspection.
There is a huge difference between seeing the outside of one letter and running the data on all the letters I ever sent.
Re:What moron judge allowed this? (Score:4, Funny)
FBI guy: But Judge, I need to break these fifteen laws and the constitution to catch the bad guys!
Judge: Oh, gotta catch the bad guys. Is this where I sign?
FBI guy: Yes, thanks. Oh, and can you please nullify this parking ticket for me while you're at it?
Judge: Sure thing. Now go get 'em.
Re:What moron judge allowed this? (Score:5, Insightful)
More likely it is:
FBI: The precedents handed down allow us to demand this.
Judge: That sucks... unfortunately you are right.
FBI: Tell them to hand over the goods or we'll appeal and you'll get slapped down and you'll still have to do it.
Judge: Fine, assholes.
Lavabit: We're going to comply in the least cooperative way.
Judge: Don't fuck with me, I'm already in a bad mood from Special Agent Dickface over there.
Lavabit: Nyaahhh
Judge: Okay, fine. Which is to say, pay a fine, now.
Re:What moron judge allowed this? (Score:4, Insightful)
The previous order was a violation of due process.
Then the judge somehow believed the FBI would not take more data than they were allowed. So either he was in on it or incredibly foolish.
Re:What moron judge allowed this? (Score:4, Insightful)
While that's certainly a possibility (given how illogical the law often is), it has nothing to do with whether or not these actions were wrong.
Re:What moron judge allowed this? (Score:4, Insightful)
If you read TFA you'll see that it came about because Lavabit did not comply with the previous order. There is little mystery about it.
They could have gone for enforcement (pretty much "SWAT team" these days) of the previous order. But they used the situation as an excuse to get what they really wanted, 4th Amendment be damned.
That doesn't follow (Score:5, Informative)
if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone.
I don't think so. There's a big difference between the legal firepower available to a small service provider like Lavabit and someone like Yahoo or Google -- and handing over the ability to read everything is definitely not something that a simple warrant can legally require. Nor even an NSL.
In fairness, in this case the FBI's original request did ask for just specific metadata about one user. I haven't read it closely enough to understand how the scope was broadened so dramatically, except that I understand that Lavabit refused to comply early on, and then eventually the FBI decided that they didn't trust Lavabit to comply correctly due to Lavabit's obstructionism, and so decided that they just wanted to be able to read all the traffic and extract the bits they needed themselves.
Lavabit, of course, decided to shut down instead. That way there would be no traffic to read.
Re:That doesn't follow (Score:5, Insightful)
In all fairness their first request was horseshit. The idea that the metadata of email even encrypted email is not protected is already so outlandish as to be nearly unbelievable. We now know we live in a police state.
This judge is either willingly part of this bullshit or the most naive SOB that ever lived when he believed the FBI would only take the information the warrant allowed. If you give them the ability to get more they will take more.
Re:That doesn't follow (Score:5, Insightful)
Umm in a police state Lavabit would have never existed in the first place.
We are in one of those times where the US government is over-reaching their powers under the Constitution. It isn't the first time.
Time to wake up folks. The price of freedom is eternal vigilance.
Re:That doesn't follow (Score:4, Insightful)
All police states have to start somewhere and letting lavabit operate while holding the keys to it is one hell of an observation tool.
I am aware this is not the first time, but like before we will need something major to wake people up.
Should the US still be in charge of the internet? (Score:5, Interesting)
Go ahead, mod me troll. But given the recent revelations, how can we claim to be any better than even the fucking UN at this point? I've made a complete u-turn on this issue, and it scares the crap out of me that I would have continued to defend the US as the savior and guardian of the open and free internet if it wasn't for a single guy leaking some stuff. And we can't even push something as simple as net-neutrality regulations through without it becoming a horrible political mess.
Fuck this government and its institutions and fuck the people that support it.
Re: (Score:3)
The 1st and 4th amendments make what most other countries can do less easy.
The US press and lawyers now know more
In other countries cleared bureaucrats or police would set up long term isp logging based on ip/ports/time found via their work laptops at home.
Find, point, click your in the system for years.
Your automated isp logging might get a more senior bureaucrats or police review after many months. Some 'ministers'/'court' staff rushed review year/s later for an e
Contribute (Score:5, Informative)
Re: (Score:3)
Mod parent up.
Also google, amazon and microsoft should be fighting on who will send the most lawyers over to lavabit if they have any sense in them, because of a thing called legal precedence.
Re:Contribute (Score:5, Informative)
I'm blowing seven mod points I've already handed out on this story doing this, but meh, who cares. Pointing out someone has no idea what they're talking about is worth it. Sending the most lawyers has nothing to do with legal precedence. Lawyers can't influence legal precedence any more than any other person in the country. I'm not sure why you even care about legal precedence - it's not usually a very controversial subject. It's just how things are.
A court has precedence because courts are set up in a hierarchy by the legislature.
Some types of law have precedence over others, for instance the constitution over statute and statute over regulation.
Of course, they may want to send lawyers because of things called legal precedents. It's something different. Go look it up.
Re: (Score:3)
You blew mod points because of spelling error?
Kudos to you sir, a Slashdot pedant extraordinaire. It's what makes us great!
Re: (Score:3)
That's "a spelling error".
I blew twenty-four mod points, came home from work, crashed my car, paid a thousand dollars, screamed at some people on the street, and made my girlfriend break up with me in order to fix that missing article.
Re:Contribute (Score:4, Interesting)
It's interesting that Americans have a choice to contribute a few bucks to this defense... while having apparently no choice about the amount they are paying for the prosecution.
So much for narrow scope (Score:4, Interesting)
Comment removed (Score:4, Informative)
update (Score:5, Interesting)
UPDATE 7:00pm CT: In a press release published on his Facebook page, Levison confirmed the unsealing and laid out his defense.
“People using my service trusted me to safeguard their online identities and protect their information. I simply could not betray that trust," he said. "If the Obama administration feels compelled to continue violating the privacy rights of the masses just so they can conduct surveillance on the few then he should at least ask Congress for laws providing that authority instead of using the courts to force businesses into secretly becoming complicit in crimes against the American people. http://arstechnica.com/tech-policy/2013/10/lavabit-defied-order-for-snowdens-login-info-then-govt-asked-for-sites-ssl-key/
Certificate Authorities compromised? (Score:5, Interesting)
Orwellian (Score:4, Insightful)
When I was growing up (70s and early 80s), all the US propaganda about how bad the Soviet Union was, how bad East Germany was, in terms of privacy, citizen rights, and being police states.
"Hypocrisy!", in my opinion.
In my opinion laws should protect non-suspect citizen rights, and enforcement agencies (FBI in this case) should be legally required to only target and restrict their levels of privacy breach to only those individuals or organizations of inquiry. They should have no legal authority to make such demands, and if a company or citizen gets such a demand, the FBI should be able to be publicly sued for attempting to exceed their authority.
AND, if the FBI currently is allowed to do such dragnets, the laws should be amended to remove such authority, and be enforced.
Not just SSL (Score:4, Insightful)
It's not limited to just SSL. Any company that holds a copy of your encryption/decryption keys (a public certificate is OK, the matching private key that goes with it is the problem) can be ordered to turn them over. The only safe system is where the keys that secure the system never leave your possession.
For e-mail that means using S/MIME or OpenPGP with a self-signed certificate and a private key you generate yourself. For encrypted documents, the same. The e-mail and documents need to be encrypted on your end before they leave your computer. Be aware that if you're encrypting messages to someone else the security will be controlled by their handling of their keys. You're encrypting using their public key, there's no security implications from disclosure there. However, if the recipient's using a service where the provider has a copy of their private key (used to decrypt messages to them) then messages can potentially be eavesdropped on by outsiders who've compromised the provider and gotten the key. Be aware of this aspect and make sure you know how recipients are handling their own security.
Yes, the above means any and all web-based or hosted services are automatically vulnerable no matter how they're designed. The only secure systems are ones where you, or software running on your computer and that you control, does the encryption and decryption and the private keys are never disclosed to any other party.
Re: (Score:3)
Oh BTW, yes that means that public-key certificates issued by a certificate authority are also vulnerable. Not as vulnerable, but if you're depending on a CA to vouch for the validity of the certificate then the government can demand (and have demanded) that the CA turn over their root signing keys. At that point the government can issue themselves a certificate in your name, signing it with the CA's key, and their certificate will be accepted as valid by everyone allowing them to impersonate you. That's no
basically (Score:5, Insightful)
Basically, the government can force you to do anything it wants, and there's nothing you can do about it. Strange, I remember hearing about some document that spelled out certain limitations on the governments powers, and certain rights that people had, but I must have misremembered.