Forgot your password?
typodupeerror
Communications Encryption Government Privacy The Courts United States

Lavabit Case Unsealed: FBI Demands Companies Secretly Turn Over Crypto Keys 527

Posted by timothy
from the c'mon-fellas-it's-for-the-greater-good dept.
jest3r writes "Lavabit won a victory in court and were able to get the secret court order [which led to the site's closure] unsealed. The ACLU's Chris Soghoian called it the nuclear option: The court order revealed the FBI demanded Lavabit turn over their root SSL certificate, something that would allow them to monitor the traffic of every user of the service. Lavabit offered an alternative method to tap into the single user in question but the FBI wasn't interested. Lavabit could either comply or shut down. As such, no U.S. company that relies on SSL encryption can be trusted with sensitive data. Everything from Google to Facebook to Skype to your bank account is only encrypted by SSL keys, and if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone."
This discussion has been archived. No new comments can be posted.

Lavabit Case Unsealed: FBI Demands Companies Secretly Turn Over Crypto Keys

Comments Filter:
  • https (Score:5, Funny)

    by jobsagoodun (669748) on Thursday October 03, 2013 @09:29AM (#45024077)

    Luckily I browse my favourite sites like /. using http so I'm not affected by this.

    • Re:https (Score:5, Interesting)

      by Anonymous Coward on Thursday October 03, 2013 @09:51AM (#45024341)

      Your favorite site also bans random TOR exit nodes from browsing it. I can understand banning posting to prevent spam and such, but browsing ? That's just moronic. It also craps when the IP of the user changes during editing/posting.

      Slashdot, please get on with the times, you are probably the legal site most visited by TOR users. You need to add HTTPS and improve TOR support.

  • by Anonymous Coward on Thursday October 03, 2013 @09:30AM (#45024091)

    Understandable that he shut down.
    The USA is ruled by evil bastards that have no respect for the citizens.
    Time to revolt is now.

    • by fustakrakich (1673220) on Thursday October 03, 2013 @09:36AM (#45024157) Journal

      You already ARE revolting!

    • by Anonymous Coward on Thursday October 03, 2013 @09:41AM (#45024231)
      That's the worst haiku I've ever read.
    • by Lunix Nutcase (1092239) on Thursday October 03, 2013 @10:11AM (#45024565)

      You mean the time is now for others to revolt while you sit in the basement playing armchair general. Who about you actually di something rather than just make empty threats?

    • by NewWorldDan (899800) <dan@gen-tracker.com> on Thursday October 03, 2013 @11:13AM (#45025339) Homepage Journal

      And if you get one of these national security letters or other absurd warrant from the feds, publish it. The right of the press to publish otherwise classified material was affirmed in the 1971 case New York Times Co. v. United States, although that was a pretty weak ruling. But unless you've agreed to keep something secret, you're theoretically free to do with it as you like. Also, I'm not a lawyer and you shouldn't take your legal advice from the internet.

    • by sociocapitalist (2471722) on Thursday October 03, 2013 @12:37PM (#45026269)

      Understandable that he shut down.
      The USA is ruled by evil bastards that have no respect for the citizens.
      Time to revolt is now.

      It's basically your fault there will be no revolution because you decided not to put an exclamation point which, very appropriately,sums up the attitude of most Americans about anything other than sports, shitty beer and big tits.

    • by Sycraft-fu (314770) on Thursday October 03, 2013 @02:31PM (#45027865)

      Go start your revolution. Do whatever you think that entails.

      Or, if you aren't willing to do that, because revolutions are messy and often as not end up worse than what you had, kindly shut the fuck up.

      I will not be joining you because while I feel the US has not been moving in a positive direction as of late, I feel that the solution to fixing it involves using the democratic process, not violent revolution, since I understand how nasty those are and also have a perspective on how good the US has it overall.

      I get really tired of whiny, usually anonymous, basement dwellers playing toughguy on the net, decrying the US and saying we need to "revolt" or "rise up" or some BS. You aren't going to do that and you know it. So you are just being a douchebag, whining and complaining, suggesting that others should do the dirty work.

      So put up or shut up. If revolution is really what you think is needed, get on that then. Though you might want to research a little as to what often happens to revolutionaries, and to countries after. If you don't, then STFU about it. Less whine, more action.

      In fact, you will probably find that if you and other like you spent less time whining and more time working to affect actual change in the country within the system we have, things might start getting better.

  • Why? (Score:5, Insightful)

    by jbmartin6 (1232050) on Thursday October 03, 2013 @09:31AM (#45024097)
    I don't see why they would want the SSL key, when presumably they have easy access to the data on the servers under the laughable "due process" already in place. Why would they want to intercept the traffic when they could just read it off the server?
    • Re:Why? (Score:5, Informative)

      by jareth-0205 (525594) on Thursday October 03, 2013 @09:34AM (#45024143) Homepage

      I don't see why they would want the SSL key, when presumably they have easy access to the data on the servers under the laughable "due process" already in place. Why would they want to intercept the traffic when they could just read it off the server?

      Because presumably the whole point of Lavabit is that the stored email was encrypted based on a key that only the user had, so in-transit is the only place they could see it.

    • Re:Why? (Score:5, Informative)

      by Jose (15075) on Thursday October 03, 2013 @09:35AM (#45024149) Homepage

      Why would they want to intercept the traffic when they could just read it off the server?

      from TFA: ....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.

      • Re: (Score:3, Informative)

        by Anonymous Coward

        Why would they want to intercept the traffic when they could just read it off the server?

        from TFA: ....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.

        The message contents, yes. But the header information they did have access to, as it's necessary for delivery. And that information is what the FBI wanted, and that information is what was all protected by a single SSL cert.

      • by Fnord666 (889225)

        from TFA: ....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.

        If this is true, then how could Lavabit also have done the following?

        Lavabit offered an alternative method to tap into the single user in question but ...

        Either they could access the data or they couldn't.

    • Re:Why? (Score:5, Interesting)

      by Anonymous Coward on Thursday October 03, 2013 @09:43AM (#45024261)

      Actually, they did not have access to the site (that would have been overly broad and unconstitutional), but lavabit was forced by the court to install a packet dumper. So FBI had the full encrypted streams of all user sessions. FBI then requested the SSL key that would unlock all stored streams. The court reasoned that because the site uses a single SSL key for all users, that's lavabit's fault and agreed that the request is not overly broad.

      Luckily there's a simple technical fix for this: perfect forward secrecy in HTTPS, using RSA DiffieHellman or ECDH key exchange. The encryption key is ephemeral and the SSL private key cannot be used to perform a passive attack on the sniffed. FBI/NSA is forced to perform a MIM on the very sessions they target; if done on the scale of the whole internet, this would be easily detected.

      All HTTPS servers should ship with this cypher suite as the default.

      • Luckily there's a simple technical fix for this: perfect forward secrecy in HTTPS, using RSA DiffieHellman or ECDH key exchange.

        Did you know that ECDH stands for Elliptic Curve Diffie-Hellman? Yeah it would solve the problem of the NSA's request alright...

      • PFS would not help in this case. The FBI asserted that a pen register (which is not a warrant and merely requires the government to assert "relevance") is sufficient to obtain the SSL keys for an entire service, because they choose to implement it via an SSL interceptor. LavaBit argued the pen register does not grant such broad power, so then they went and got a search warrant for it instead.

        Obviously if the FBI has the SSL key, they can impersonate LavaBit and intercept everything at that point. It helps o

    • Re:Why? (Score:5, Interesting)

      by bluefoxlucid (723572) on Thursday October 03, 2013 @09:52AM (#45024357) Journal

      The best part is they said here that they wanted the "Root Certificate", which would allow them to sign new keys. Caveat: that's just a trust model, allowing them to replace LavaBit's SSL key. What they wanted was LavaBit's site SSL private key.

      Let's say that the NSA got the Verisign Root Certificate and started using it to sign Verisign CSRs. A CSR includes the public key (certificate), but not the private key. The public key is already known. The NSA gains ... nothing.

      Now if they get the Google Gmail SSL private key, they can decrypt the SSL session handshake and key exchange. The key exchange exchanges a symmetric encryption key for AES or RC4 (yes RC4 is secure; yes I know it's used in WEP, which uses a new NONCE for every packet, and in their implementation they generate insecure NONCE/IV pairs and you can collect millions of these and crack it. Not applicable here). With Gmail's SSL private key, the NSA can decrypt the symmetric session key exchange and use that key to decrypt your session and read your e-mail.

      That's the difference.

      • by omnichad (1198475)

        The public key is already known.

        I don't know about you, but I don't get any warning telling me that "The stored public key for secure.site.com does not match the one received. Continue to site?" Maybe I need to upgrade my browser.

        So for most, a MITM attack would be completely undetected.

        • Maybe I need to upgrade my browser.

          You need the Certificate Patrol [mozilla.org] plugin, which warns you when a site's certificate changes unexpectedly, even when the new certificate has a "valid" signature.

          Unfortunately, this doesn't work with Google's servers, who rotate among a gazillion certificates "legitimately", and thus drown the user in false positives. But given Google's cooperation with Prism, maybe this effect is wanted?

    • by Anonymous Coward on Thursday October 03, 2013 @09:54AM (#45024385)

      Firstly they wanted *all* meta data on every Lavabit user, not just Snowden. It was a blanket demand to get all of the data.
      They also wanted man-in-the-middle box. A device which would have the root certificate under control of the government and would sit in Lavabits network able to man-in-the-middle attack emails (i.e. speech) of Lavabit users not connected to Snowden.

      Lavabit are guardians of the customers data, how can they guard if a black-box is on their network? It can do anything, the judge has no way of telling, Lavabit has no way of telling. Google apparently refused these boxes and with good reason. There is no trust here, the Judge is not supposed to trust the FBI & NSA to do only what it says. He's supposed to be the guardian of the law, just as Lavabit are the guardians of the data.

      An example, if I had such a box, I could spoof email convincingly in a way that would pass forensics. I could create fake evidence. I could spread disinformation (propaganda) again untraceably.

      They also asserted that it filters out only the data they were allowed to have and throws away the rest. We know this has been proven to be false in many many leaks, even the President now pretends the data goes into a 'lockbox'. A lockbox isn't a lockbox if the NSA has the key and no judicial oversight stops them turning that key at will.

      It seems, once again, the judicial branch has simply become a fawning sidekick to the executive branch.

    • Re:Why? (Score:5, Interesting)

      by squiggleslash (241428) on Thursday October 03, 2013 @10:16AM (#45024621) Homepage Journal

      Well, I read the court documents and it appears the sequence of events went something like:

      1. FBI asked for real time details of (Snowden? Everyone thinks Snowden, the request was one day after it was revealed he has an account with Lavabit) an account, specifically metadata relating to email exchanges.

      2. Lavabit didn't respond.

      3. FBI got pissed, involved courts

      4. Lavabit made an offer to provide the information on a monthly basis, rather than a realtime basis, and asked for payment of $3,500 ($2,000 for labor and I can't remember what the other $1,500 was.)

      5. FBI threw a fit, announced that instead they were now asking for a box to be installed to intercept communications. The box would be programmed to only transmit the required information about person-we-think-is-Snowden, but because of the way it's designed would require Lavabit's SSL keys.

      5. Lavabit: Nu-uh.

      6. Courts: Uh yeah, we're siding with the FBI on this one.

      7. "But I don't trust the government to only intercept $PROBABLY_SNOWDEN's records. Also I want to talk about this case, first amendment and whatnot."

      8. Courts: "Well the government doesn't trust you, has good reason not to trust you based on your history of non-cooperation, and I don't care whether you trust it, established precedent says you have to cooperate. Also I'm not going to let you tell anyone about anything so there."

      At this point the courts started threatening fines. Lavabit gave up its key but in a way designed to piss off the FBI, which, of course, pissed off the court too. Court started imposing fines. Lavabit shut itself down.

      My reading:

      1. Lavabit wasn't as principled as claimed by Glenn Greenwald et al. They did actually plan (or told the courts and the FBI they would anyway) to release the records relating to $PROBABLY_SNOWDEN to the FBI. At best you can argue they were lying, but how's that showing integrity?

      2. Lavabit made a number of elementary legal mistakes from the beginning, even avoiding using a lawyer in the first hearing. These mistakes made it easy for the FBI to argue that they couldn't trust Lavabit to do what Lavabit was offering to do. Lavabit should have contacted the FBI immediately, made it clear their concerns, and not made a clearly bad-faith offer to provide something useless to the FBI - I don't mean they should have offered something useful, they should have said instead "Look, this is a major problem for us, we have to investigate further and determine something that can satisfy the law and your requirements that does not damage the integrity of our system", and had a lawyer work with the courts on this.
      3. Notwithstanding the above, the court's refusal to allow Lavabit to talk to politicians et al about the basic principles in the case seems absurd and completely unconstitutional. Given the circumstances, I have to assume that Snowden was the target - if $RANDOM_DRUGDEALER was the target, Lavabit going to a politician and saying "We've been told to hand over records of one of our 50,000 users" wouldn't tip anyone off.

      This is a total fuck-up. The EFF and ACLU can get involved now, but so many mistakes were made early on it's going to be an uphill fight for everything except the free speech issue. In particular, if you're expecting this to end up with a judgement that it was wrong to demand access to Lavabit's data, you're going to be sorely disappointed.

      • by dwpro (520418)

        When you say the FBI "asked" for real time metadata, did they have a warrant?

        Regardless, the jump from "you're not doing what we ask" to "we get to install a black box on your network and spoof as you, trust us not to abuse this" seems excessive if not absurd as lavabit's core business is centered around privacy. It would be like a safe company being required to issue a key to every safe they've ever made to the FBI because they wouldn't hand over a single purchaser's account information.

        • Re:Why? (Score:5, Insightful)

          by TheGratefulNet (143330) on Thursday October 03, 2013 @11:22AM (#45025415)

          if the US gov asked a huge mega-corp to break its whole business model and trust, essentially going out of business (think big auto makers or sony or some huge corp like that) do you think it would happen? would the gov push around a huge company and try to ruin them, just to get some (cough) meta-data?

          small guys who can be made to look 'dodgy': yes

          big co's who donate to the election campains: certainly not!

          "business as usual" ;( might makes right. time and time again, the larger the government gets, the more power it gets and the more corrupt it gets until its main goal is just to keep itself going along the same trajectory. ethics and fair treatment be damned.

      • Re:Why? (Score:5, Insightful)

        by LateArthurDent (1403947) on Thursday October 03, 2013 @10:58AM (#45025145)

        Lavabit wasn't as principled as claimed by Glenn Greenwald et al. They did actually plan (or told the courts and the FBI they would anyway) to release the records relating to $PROBABLY_SNOWDEN to the FBI. At best you can argue they were lying, but how's that showing integrity?

        Once they were given a proper warrant, complying is the principled thing to do. That's proper due process. The point is to prevent the government from gaining access to information while skipping said due process. So no, at best I can argue they were telling the truth, and doing the right thing.

        Lavabit made a number of elementary legal mistakes from the beginning, even avoiding using a lawyer in the first hearing. These mistakes made it easy for the FBI to argue that they couldn't trust Lavabit to do what Lavabit was offering to do. Lavabit should have contacted the FBI immediately, made it clear their concerns

        Assuming the facts are correct, agreed.

        and not made a clearly bad-faith offer to provide something useless to the FBI

        I don't think that's what they did. The first offer of providing the information on a monthly basis seems both useful and better targeted than the initial FBI request. Why is this a bad-faith offer?

        Notwithstanding the above, the court's refusal to allow Lavabit to talk to politicians et al about the basic principles in the case seems absurd and completely unconstitutional.

        Right. The whole thing was the government throwing a fit. "Oh, you want to fight us. We'll up the ante, and ask for something completely unreasonable then.." It was very principled on their part to not fold as a result, and to shut down instead of giving them what they wanted.

      • 1. Non-cooperation is neither illegal nor prejudicial to your case. You have a right, as a legal entity, to refuse to cooperate.

        2. Bad-faith cooperation is neither illegal nor prejudicial to your case. You have a right, as a legal entity, to place limits on the extent of your cooperation, if any

        The state can issue warrants for data, but until and unless they successfully do, they are entitled to sweet fuck-all from whoever they are requesting the data from. A court can go ahead and give a warrant for what

      • Re:Why? (Score:5, Insightful)

        by wiredlogic (135348) on Thursday October 03, 2013 @11:54AM (#45025759)

        Lavabit made a number of elementary legal mistakes from the beginning, even avoiding using a lawyer in the first hearing.

        You shouldn't have to use a lawyer to get justice in a free nation. It shouldn't be possible to use a defendant's naivete as a procedural trap to extort concessions and violate due process. Judges are supposed to be biased in favor of defendants to ensure this doesn't happen. The puppet FISA "judges" are so quick to lick the boots of their real master that they can't be bothered to maintain a believable charade.

  • by Max_W (812974) on Thursday October 03, 2013 @09:31AM (#45024101)
  • by h4rr4r (612664) on Thursday October 03, 2013 @09:31AM (#45024103)

    How is this legal? How do you get a warrant that broad? Are fishing expeditions now allowed by law enforcement?

    • by loganljb (1424009) on Thursday October 03, 2013 @09:38AM (#45024199)

      Things are a bit more involved than they seem from reading just the summary. The fed originally requested that LavaBit provide them with information regarding a single account (header information only, but on an ongoing basis), which they are allowed to obtain without probable cause. LavaBit refused the initial request, then stalled when given a court order to provide this information (I believe LavaBit was in the right in doing so -- I'm NOT supporting the fed's case, just providing information). The fed took LavaBit back to court, and obtained a court order requiring that LavaBit provide the SSL key, as the fed did not believe that LavaBit would comply with an order for information on a single account. The best part was when LavaBit sent them the SSL key, as a 4 point font printout :-)

      In other words, when LavaBit wouldn't provide them information on a single account, the fed escalated to the nuclear option.

      • by h4rr4r (612664) on Thursday October 03, 2013 @09:42AM (#45024245)

        Stop right there. The fact that they are allowed this without probable cause is already too much.

        They should have sent it 4 point one character per page.

        The fact that the judge believed the FBI would only take the info the warrant allowed makes him either an accomplice or as naive as a child.

        • by loganljb (1424009) on Thursday October 03, 2013 @09:52AM (#45024359)

          Like I said, I don't disagree with how LavaBit handled this. In fact, I think EVERYONE should treat federal 'requests' for information the way that Ladar Levinson has, and greatly admire the stand he has taken. I was simply saying that it was more complicated than the summary made it out to be.

          That being said, in my personal opinion the fact that the fed can request envelope information with no probably cause is a travesty. I see it as no different than pulling mail out of my mailbox to see who I write letters to and who writes to me. This should be illegal search and seizure

        • by Давид Чапел (3032005) on Thursday October 03, 2013 @10:22AM (#45024713)

          Stop right there. The fact that they are allowed this without probable cause is already too much.

          It is interesting that the prosecutor portrayed this as a pen trap. Courts have ruled that users do not have a reasonable expectation that the numbers they dial on their phone line will remain private (basicaly because they show up on the bill) but that they do have a reasonable expectation that nobody is listening in. That is why this information can be obtained without probable cause. But if Lavabit offered specific guarantees that this information would not be recorded except in the encryted e-mail boxes, then the users had a reasonable expectation of privacy. This might make the use of a pen trap without probable cause illegal.

        • by blueg3 (192743) on Thursday October 03, 2013 @10:49AM (#45025047)

          They should have sent it 4 point one character per page.

          No. You should have a good reason for telling them "no", then you should tell them "no" with your reason, and get lawyers involved. Pretending to technically comply with a court order while making an obviously obstructive, bad-faith effort is a good way to ensure that things go rapidly downhill for you.

      • by FriendlyLurker (50431) on Thursday October 03, 2013 @09:44AM (#45024271)
        Let's be clear, the single account was Edward Snowden's - and Lavabit's resistance was not futile, the so called nuclear option has backfired on the fed in terms of public sentiment.
        • by towermac (752159) on Thursday October 03, 2013 @10:14AM (#45024595)

          I got no mod points, but this is absolutely the takeaway.

          The US depends on it's software industry; we shipped all our labor jobs overseas to trade them for office work (programming). That, and Hollywood, is why we're so mean to other countries over IP.

          And now the US government has completely undermined them. It's probably a good time to be a programmer in Brazil and Germany. I wonder If our software industry will be able to recover from this.

          • by dcollins (135727) on Thursday October 03, 2013 @11:14AM (#45025345) Homepage

            I wish I could agree but I don't. The US government has crushed some fairly small-time players. They have the big players well in control (MS, Google, Facebook), and they aren't going anywhere (too many stakeholders, can't be moved or shut down the same way). This particular skirmish is win-win for the US government -- fewer choices for citizens, more people forced onto the big centralized systems they have full access/control to, proven threats to use against any future outliers.

      • The header information blanket traces back to an idiotic ruling that the outside of a letter was not protected since everybody can and had to read it to get it there (the USPS digitizes and stores all of them now). The FBI then applied this to encrypted traffic which makes no sense since it's no longer data that anybody but them or there agent can read.

        We need clear guidance, which a simple presidential order could give that prohibits all of these sorts of searches.

      • by c (8461)

        In other words, when LavaBit wouldn't provide them information on a single account, the fed escalated to the nuclear option.

        It sounds like LavaBit's security was essentially an "all or nothing" situation, though. If they compromised just one of their users, then effectively none of their users were secure anymore.

        Obviously, the feds weren't too keen on getting "nothing".

        Not sure how LavaBit could have architected things to not be in this position. Maybe giving each individual user a subdomain with its own s

        • Protecting *all* of your users or shutting down to avoid betraying one of them has a philosophical elegance about it in my mind. After all, what good is your service if it's basically "we'll protect your data...unless the government tells us they feel like reading yours. Then you're SOL"?

          Granted, it's debatable whether that was really the intent, but oh well.

      • by tlhIngan (30335)

        Things are a bit more involved than they seem from reading just the summary. The fed originally requested that LavaBit provide them with information regarding a single account (header information only, but on an ongoing basis), which they are allowed to obtain without probable cause. LavaBit refused the initial request, then stalled when given a court order to provide this information (I believe LavaBit was in the right in doing so -- I'm NOT supporting the fed's case, just providing information). The fed t

    • by the eric conspiracy (20178) on Thursday October 03, 2013 @09:47AM (#45024291)

      It's not a warrant. Email headers are not protected information under the law so all you need is a subpoena. Since they are disclosed to third parties there is no expectation of privacy under current law.

      It's the same idea that the outside of the envelope that you give the postman is not protected. Nor is a list of phone numbers that you call.

      • by h4rr4r (612664)

        All of those should not be up for mass inspection.
        There is a huge difference between seeing the outside of one letter and running the data on all the letters I ever sent.

    • by Russ1642 (1087959) on Thursday October 03, 2013 @09:57AM (#45024417)

      FBI guy: But Judge, I need to break these fifteen laws and the constitution to catch the bad guys!
      Judge: Oh, gotta catch the bad guys. Is this where I sign?
      FBI guy: Yes, thanks. Oh, and can you please nullify this parking ticket for me while you're at it?
      Judge: Sure thing. Now go get 'em.

      • by tnk1 (899206) on Thursday October 03, 2013 @10:45AM (#45024997)

        More likely it is:

        FBI: The precedents handed down allow us to demand this.
        Judge: That sucks... unfortunately you are right.
        FBI: Tell them to hand over the goods or we'll appeal and you'll get slapped down and you'll still have to do it.
        Judge: Fine, assholes.
        Lavabit: We're going to comply in the least cooperative way.
        Judge: Don't fuck with me, I'm already in a bad mood from Special Agent Dickface over there.
        Lavabit: Nyaahhh
        Judge: Okay, fine. Which is to say, pay a fine, now.

  • That doesn't follow (Score:5, Informative)

    by swillden (191260) <shawn-ds@willden.org> on Thursday October 03, 2013 @09:33AM (#45024127) Homepage Journal

    if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone.

    I don't think so. There's a big difference between the legal firepower available to a small service provider like Lavabit and someone like Yahoo or Google -- and handing over the ability to read everything is definitely not something that a simple warrant can legally require. Nor even an NSL.

    In fairness, in this case the FBI's original request did ask for just specific metadata about one user. I haven't read it closely enough to understand how the scope was broadened so dramatically, except that I understand that Lavabit refused to comply early on, and then eventually the FBI decided that they didn't trust Lavabit to comply correctly due to Lavabit's obstructionism, and so decided that they just wanted to be able to read all the traffic and extract the bits they needed themselves.

    Lavabit, of course, decided to shut down instead. That way there would be no traffic to read.

    • by h4rr4r (612664) on Thursday October 03, 2013 @09:36AM (#45024159)

      In all fairness their first request was horseshit. The idea that the metadata of email even encrypted email is not protected is already so outlandish as to be nearly unbelievable. We now know we live in a police state.

      This judge is either willingly part of this bullshit or the most naive SOB that ever lived when he believed the FBI would only take the information the warrant allowed. If you give them the ability to get more they will take more.

  • by Anonymous Coward on Thursday October 03, 2013 @09:36AM (#45024167)

    Go ahead, mod me troll. But given the recent revelations, how can we claim to be any better than even the fucking UN at this point? I've made a complete u-turn on this issue, and it scares the crap out of me that I would have continued to defend the US as the savior and guardian of the open and free internet if it wasn't for a single guy leaking some stuff. And we can't even push something as simple as net-neutrality regulations through without it becoming a horrible political mess.

    Fuck this government and its institutions and fuck the people that support it.

    • by AHuxley (892839)
      The good think about the US is:
      The 1st and 4th amendments make what most other countries can do less easy.
      The US press and lawyers now know more :)
      In other countries cleared bureaucrats or police would set up long term isp logging based on ip/ports/time found via their work laptops at home.
      Find, point, click your in the system for years.
      Your automated isp logging might get a more senior bureaucrats or police review after many months. Some 'ministers'/'court' staff rushed review year/s later for an e
  • Contribute (Score:5, Informative)

    by kajsocc (2955535) on Thursday October 03, 2013 @09:37AM (#45024171)
    Lavabit is still in court over this. You can contribute to their legal defense fund here [rally.org].
    • by Mhtsos (586325)

      Mod parent up.
      Also google, amazon and microsoft should be fighting on who will send the most lawyers over to lavabit if they have any sense in them, because of a thing called legal precedence.

      • Re:Contribute (Score:5, Informative)

        by DeathToBill (601486) on Thursday October 03, 2013 @10:16AM (#45024617) Journal

        I'm blowing seven mod points I've already handed out on this story doing this, but meh, who cares. Pointing out someone has no idea what they're talking about is worth it. Sending the most lawyers has nothing to do with legal precedence. Lawyers can't influence legal precedence any more than any other person in the country. I'm not sure why you even care about legal precedence - it's not usually a very controversial subject. It's just how things are.

        A court has precedence because courts are set up in a hierarchy by the legislature.

        Some types of law have precedence over others, for instance the constitution over statute and statute over regulation.

        Of course, they may want to send lawyers because of things called legal precedents. It's something different. Go look it up.

        • You blew mod points because of spelling error?

          Kudos to you sir, a Slashdot pedant extraordinaire. It's what makes us great!

          • by dcollins (135727)

            That's "a spelling error".

            I blew twenty-four mod points, came home from work, crashed my car, paid a thousand dollars, screamed at some people on the street, and made my girlfriend break up with me in order to fix that missing article.

    • Re:Contribute (Score:4, Interesting)

      by Ragica (552891) on Thursday October 03, 2013 @10:36AM (#45024871) Homepage

      It's interesting that Americans have a choice to contribute a few bucks to this defense... while having apparently no choice about the amount they are paying for the prosecution.

  • by Supp0rtLinux (594509) <Supp0rtLinux@yahoo.com> on Thursday October 03, 2013 @09:39AM (#45024205)
    I thought these and similar laws (wiretap, etc) were only allowed to act upon the entities being investigated and for which the warranty was issued. And it sounds like Lavabit tried to keep the scope narrowed to the one person being investigated, but the FBI wanted more. Isn't this over reaching the scope of the warrant and therefore any case developed would be tossed out? IANAL, but I thought the scope limitations were there for a reason. That idea TPB had to buy an island is sounding more and more convincing these days...
  • misleading summary (Score:4, Informative)

    by schneidafunk (795759) on Thursday October 03, 2013 @09:39AM (#45024209)

    Lavabit did not offer an alternative solution, they offered to comply with the ORIGINAL search warrant that asked for just one user after prosecutors upped the ante when Lavabit refused the first search warrant.

    FTA:
    "By this point, Levison was evidently willing to comply with the original order, and modify his code to intercept the metadata on one user. But the government was no longer interested."

  • update (Score:5, Interesting)

    by Anonymous Coward on Thursday October 03, 2013 @09:48AM (#45024319)

    UPDATE 7:00pm CT: In a press release published on his Facebook page, Levison confirmed the unsealing and laid out his defense.

    “People using my service trusted me to safeguard their online identities and protect their information. I simply could not betray that trust," he said. "If the Obama administration feels compelled to continue violating the privacy rights of the masses just so they can conduct surveillance on the few then he should at least ask Congress for laws providing that authority instead of using the courts to force businesses into secretly becoming complicit in crimes against the American people. http://arstechnica.com/tech-policy/2013/10/lavabit-defied-order-for-snowdens-login-info-then-govt-asked-for-sites-ssl-key/

  • by kaalon (2861517) on Thursday October 03, 2013 @09:57AM (#45024421)
    Can we assume that all the major Certificate Authorities have been "compromised" by the FBI / NSA as well.
  • Orwellian (Score:4, Insightful)

    by mrflash818 (226638) on Thursday October 03, 2013 @11:03AM (#45025201) Homepage Journal

    The court order revealed the FBI demanded Lavabit turn over their root SSL certificate, something that would allow them to monitor the traffic of every user of the service. Lavabit offered an alternative method to tap into the single user in question but the FBI wasn't interested.

    When I was growing up (70s and early 80s), all the US propaganda about how bad the Soviet Union was, how bad East Germany was, in terms of privacy, citizen rights, and being police states.

    "Hypocrisy!", in my opinion.

    In my opinion laws should protect non-suspect citizen rights, and enforcement agencies (FBI in this case) should be legally required to only target and restrict their levels of privacy breach to only those individuals or organizations of inquiry. They should have no legal authority to make such demands, and if a company or citizen gets such a demand, the FBI should be able to be publicly sued for attempting to exceed their authority.

    AND, if the FBI currently is allowed to do such dragnets, the laws should be amended to remove such authority, and be enforced.

  • Not just SSL (Score:4, Insightful)

    by Todd Knarr (15451) on Thursday October 03, 2013 @12:19PM (#45026033) Homepage

    It's not limited to just SSL. Any company that holds a copy of your encryption/decryption keys (a public certificate is OK, the matching private key that goes with it is the problem) can be ordered to turn them over. The only safe system is where the keys that secure the system never leave your possession.

    For e-mail that means using S/MIME or OpenPGP with a self-signed certificate and a private key you generate yourself. For encrypted documents, the same. The e-mail and documents need to be encrypted on your end before they leave your computer. Be aware that if you're encrypting messages to someone else the security will be controlled by their handling of their keys. You're encrypting using their public key, there's no security implications from disclosure there. However, if the recipient's using a service where the provider has a copy of their private key (used to decrypt messages to them) then messages can potentially be eavesdropped on by outsiders who've compromised the provider and gotten the key. Be aware of this aspect and make sure you know how recipients are handling their own security.

    Yes, the above means any and all web-based or hosted services are automatically vulnerable no matter how they're designed. The only secure systems are ones where you, or software running on your computer and that you control, does the encryption and decryption and the private keys are never disclosed to any other party.

    • by Todd Knarr (15451)

      Oh BTW, yes that means that public-key certificates issued by a certificate authority are also vulnerable. Not as vulnerable, but if you're depending on a CA to vouch for the validity of the certificate then the government can demand (and have demanded) that the CA turn over their root signing keys. At that point the government can issue themselves a certificate in your name, signing it with the CA's key, and their certificate will be accepted as valid by everyone allowing them to impersonate you. That's no

  • basically (Score:5, Insightful)

    by Khashishi (775369) on Thursday October 03, 2013 @12:26PM (#45026115) Journal

    Basically, the government can force you to do anything it wants, and there's nothing you can do about it. Strange, I remember hearing about some document that spelled out certain limitations on the governments powers, and certain rights that people had, but I must have misremembered.

"It's like deja vu all over again." -- Yogi Berra

Working...