Lavabit Case Unsealed: FBI Demands Companies Secretly Turn Over Crypto Keys 527
jest3r writes "Lavabit won a victory in court and were able to get the secret court order [which led to the site's closure] unsealed. The ACLU's Chris Soghoian called it the nuclear option: The court order revealed the FBI demanded Lavabit turn over their root SSL certificate, something that would allow them to monitor the traffic of every user of the service. Lavabit offered an alternative method to tap into the single user in question but the FBI wasn't interested. Lavabit could either comply or shut down. As such, no U.S. company that relies on SSL encryption can be trusted with sensitive data. Everything from Google to Facebook to Skype to your bank account is only encrypted by SSL keys, and if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone."
That doesn't follow (Score:5, Informative)
if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone.
I don't think so. There's a big difference between the legal firepower available to a small service provider like Lavabit and someone like Yahoo or Google -- and handing over the ability to read everything is definitely not something that a simple warrant can legally require. Nor even an NSL.
In fairness, in this case the FBI's original request did ask for just specific metadata about one user. I haven't read it closely enough to understand how the scope was broadened so dramatically, except that I understand that Lavabit refused to comply early on, and then eventually the FBI decided that they didn't trust Lavabit to comply correctly due to Lavabit's obstructionism, and so decided that they just wanted to be able to read all the traffic and extract the bits they needed themselves.
Lavabit, of course, decided to shut down instead. That way there would be no traffic to read.
Re:Why? (Score:5, Informative)
I don't see why they would want the SSL key, when presumably they have easy access to the data on the servers under the laughable "due process" already in place. Why would they want to intercept the traffic when they could just read it off the server?
Because presumably the whole point of Lavabit is that the stored email was encrypted based on a key that only the user had, so in-transit is the only place they could see it.
Re:Why? (Score:5, Informative)
Why would they want to intercept the traffic when they could just read it off the server?
from TFA: ....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.
Contribute (Score:5, Informative)
Re:What moron judge allowed this? (Score:5, Informative)
Things are a bit more involved than they seem from reading just the summary. The fed originally requested that LavaBit provide them with information regarding a single account (header information only, but on an ongoing basis), which they are allowed to obtain without probable cause. LavaBit refused the initial request, then stalled when given a court order to provide this information (I believe LavaBit was in the right in doing so -- I'm NOT supporting the fed's case, just providing information). The fed took LavaBit back to court, and obtained a court order requiring that LavaBit provide the SSL key, as the fed did not believe that LavaBit would comply with an order for information on a single account. The best part was when LavaBit sent them the SSL key, as a 4 point font printout :-)
In other words, when LavaBit wouldn't provide them information on a single account, the fed escalated to the nuclear option.
misleading summary (Score:4, Informative)
Lavabit did not offer an alternative solution, they offered to comply with the ORIGINAL search warrant that asked for just one user after prosecutors upped the ante when Lavabit refused the first search warrant.
FTA:
"By this point, Levison was evidently willing to comply with the original order, and modify his code to intercept the metadata on one user. But the government was no longer interested."
They wanted a man-in-the-middle box (Score:5, Informative)
Firstly they wanted *all* meta data on every Lavabit user, not just Snowden. It was a blanket demand to get all of the data.
They also wanted man-in-the-middle box. A device which would have the root certificate under control of the government and would sit in Lavabits network able to man-in-the-middle attack emails (i.e. speech) of Lavabit users not connected to Snowden.
Lavabit are guardians of the customers data, how can they guard if a black-box is on their network? It can do anything, the judge has no way of telling, Lavabit has no way of telling. Google apparently refused these boxes and with good reason. There is no trust here, the Judge is not supposed to trust the FBI & NSA to do only what it says. He's supposed to be the guardian of the law, just as Lavabit are the guardians of the data.
An example, if I had such a box, I could spoof email convincingly in a way that would pass forensics. I could create fake evidence. I could spread disinformation (propaganda) again untraceably.
They also asserted that it filters out only the data they were allowed to have and throws away the rest. We know this has been proven to be false in many many leaks, even the President now pretends the data goes into a 'lockbox'. A lockbox isn't a lockbox if the NSA has the key and no judicial oversight stops them turning that key at will.
It seems, once again, the judicial branch has simply become a fawning sidekick to the executive branch.
Re:Why? (Score:3, Informative)
Why would they want to intercept the traffic when they could just read it off the server?
from TFA: ....But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.
The message contents, yes. But the header information they did have access to, as it's necessary for delivery. And that information is what the FBI wanted, and that information is what was all protected by a single SSL cert.
Summary is hogwash (Score:2, Informative)
That's nonsense, and in particular Javabit encrypted the user data and communication using public key encryption methods. The problem is that the communication is SSL-encrypted. And that means the private SSL keys allow complete eavesdropping on the communcation and man-in-the-middle attacks (insertion of malicious content). That allows getting a hook into key exchanges and ultimately compromising whatever you want that depends on ongoing trust of the service.
If the service has been set up well, past data and communication are secure from decryption. The Lavabit owner had built a service ultimately relying on his personal integrity (and at some point in the process, you can't take that out of the equation) for its principal goal, secure mail, and the feds demanded he hand over his integrity. Any continued operation of the service would have been effectively fraud since its core tenet would no longer be provided.
He might have to serve prison for refusing to defraud all of his customers regarding his sole product. The good news is that he shut down before they were able to turn his service into a trap.
Fucking totalitarian injustice regime.
Re:Contribute (Score:5, Informative)
I'm blowing seven mod points I've already handed out on this story doing this, but meh, who cares. Pointing out someone has no idea what they're talking about is worth it. Sending the most lawyers has nothing to do with legal precedence. Lawyers can't influence legal precedence any more than any other person in the country. I'm not sure why you even care about legal precedence - it's not usually a very controversial subject. It's just how things are.
A court has precedence because courts are set up in a hierarchy by the legislature.
Some types of law have precedence over others, for instance the constitution over statute and statute over regulation.
Of course, they may want to send lawyers because of things called legal precedents. It's something different. Go look it up.
Re:Why? (Score:2, Informative)
Lavabit has complied with warrant requests before, the FBI wanted more than just 1 users account, the warrant they had was only for a single user account, they demanded access to more. Did you even read the documents?
Re: Nothing left to do (Score:0, Informative)
The guns are to compensate for their tiny, tiny penises.
Re:The USA is ruled (Score:2, Informative)
Re:Why? (Score:5, Informative)
The summary is wrong.
The FBI originally wanted access to just Snowden's account and Lavabit refused. In order to get it, they demanded SSL keys to feed into their snoop machine so they could filter out just Snowden's info.
At that point, Lavabit AGREED to provide a tap on just Snowden. The FBI basically said "too late, we don't trust you to do it properly".
Not that they should get what they tried to -- the SSL private keys -- but the summary makes it out to be something different than what happened.
Re:What moron judge allowed this? (Score:5, Informative)
The FISA courts were created by Congress, the same as any other Federal court besides the Supreme Court. The FISA court is accountable to both its appeal court and the Supreme Court like other Federal Courts, and the Judges can be removed by Congress as can other Judges. In fact, the Judges on the FISA court are ordinary Federal judges that rotate through the FISA court from other Federal courts.
The FISA Court is accountable to no one. The FISA Court meets in secret and only one side is represented, so there is no possibility of appeal for those whose rights are trampled. The FISA Court has denied only 11 of 33,942 requests in its 33 years of operation and the FISA Court of Review has met a total of twice in that time period. The design and operation of the FISA Court provides no path for accountability to the Supreme Court. Even if the telecom companies that were required to provide customer data to the government wanted to appeal, there is no requirement that their arguments are considered (the FISA Court allowed Yahoo! to appeal in 2008 so that the law in question could be ruled okay and a heavily redacted ruling released to make sure no one else bothers to try). No FISA-related case has ever gone to the Supreme Court and it isn't clear how one could.
Congress has no oversight of the judges. Each judge is appointed by the Supreme Court Chief Justice with no oversight or confirmation by anyone else, including Congress. In the 33 years of FISA, we've had three chief justices, all conservative Republicans. John Roberts appointed every single FISA Court judge currently serving.
Your dishonesty regarding FISA is troubling. Either you are ignorant of something you strongly support or you are lying in hopes of deceiving others.
Re:Why? (Score:5, Informative)
In 1979 the SCOTUS ruled that pen registers didn't require warrants.
http://en.wikipedia.org/wiki/Pen_register#Background [wikipedia.org]