Completely private email is not legal and shouldn't be

Completely private email is not legal and shouldn't be

Summary: Lavabit, Edward Snowden's email provider back before he skipped town, is claiming in appeals court that it's immune from criminal subpoena. This is unreasonable and it's a good thing he will almost certainly lose.

SHARE:
82

Ladar Levison may have shut down his secure email service Lavabit, but he's not giving up yet.

In August, Levison found himself in the way of the US Department of Justice's prosecution of NSA leaker Edward Snowden. Lavabit email is strongly encrypted. DoJ subpoenaed Lavabit's private SSL encryption key to allow them to monitor Snowden's communications and the court issued a gag order to Lavabit.

Levison resisted, but finally, under a contempt order from the court and the threat of $5000 a day fines he shut down Lavabit rather than allow the government to read his users' email.

Now Levison has appealed the contempt order and subpoena to the US Court of Appeals for the Fourth Circuit. His arguments are weak. Even beyond any legal determination, his claims are unreasonable and he should lose the case.

Levison's argument boils down to a claim of legal privilege for his users' communications from proper requests from law enforcement. Why? Because he thinks so.

When considering this question, I think it's important to look at in the abstract and separate from the details of the Edward Snowden case. Everyone has their opinions on whether what Snowden did was right and whether he's a traitor or a hero or something else.

Here's the real question: when the government convinces a judge that it is necessary in order to prosecute a criminal case, and the judge issues a search warrant, should the government be allowed to compel an ISP (consider Lavabit an ISP in this sense) to do what is necessary to grant access to information?

As a general matter, the government obviously has access to this information with very few legally-recognized exceptions (doctor-patient, priest-penitent, spousal; maybe there are others, those are just the ones I know from Law & Order). "I think people should be able to communicate in absolute privacy" is not a reasonable principle; it's a recipe for crippling law enforcement. The constitution doesn't forbid all searches of private communications, just "unreasonable searches and seizures."

There's one additional point at issue here: Because the site had a single SSL certificate, Lavabit couldn't just expose Snowden's communications. They would have to expose all his users' communications. In fact, it appears that Levison was willing to give access to just Snowden's communications, but his system didn't allow it. This isn't unusual in the world of law enforcement. When exercising a search warrant or a wiretap, officers often necessarily see materials not covered by the warrant. he rule is that they have to ignore those materials. 

Yes, it's reasonable to wonder whether the FBI really would limit themselves to Snowden's communications, and for Lavabit it was an especially important question. Without question, a large number of Lavabit's users had something to hide. 

This problem was not the government's problem. They needed access to the information and they reasonably needed it ASAP. The government turned down Levison's offer to reengineer his software to allow a Snowden-only monitor because a) it wasn't reasonable to make them wait and b) his estimate that it would take 20-40 hours couldn't be relied on.

If the government had come to Levison looking for communications of a kidnapper holding a child for ransom, would he have resisted in the same way? Would his resistance have generated any sympathy?

Over at The Volokh Conspiracy, George Washington University Law School Professor Orin Kerr analyzes and doesn't think much of Levison's arguments. Levison is making three arguments:

  1. The government can't subpoena the key because it would be "abusive" and "oppressive"
  2. The Federal Pen Register statute doesn’t provide for such a subpoena
  3. This is two subarguments: a) The key doesn't qualify under the Stored Communications Act, and b) Under the Fourth Amendment, the key cannot be seized because it is not "evidence, contraband, fruits, or instrumentalities of crime".

Kerr says that Levison must prevail on all of three arguments. He thinks little of the 1, 2, and 3a. He calls 3b innovative and interesting, but ultimately insufficient. Computer warrants regularly seek passwords, which are in the same nature as Lavabit's SSL keys.

Lavabit's business model rested on the promise of absolute privacy. It turns out that, Levison's notions of the law being wrong, his business model can't be profferred honestly. Shutting down the service was the right thing to do after all.

Topics: Security, Government US

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

82 comments
Log in or register to join the discussion
  • Unreasonable

    Yes, handing over every customers' communications to the FBI when their warrant is restricted to just one person. I'm certain the FBI and their cohorts at CIA and NSA would never, ever dream of peeking at all that juicy information because, well that would be illegal as well as immoral!!

    Larry, I have a bridge in Brooklyn I'd like to sell you.

    "They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety." Benjamin Franklin
    MajorlyCool
    • Yeah

      I think Larry needs to look up the reasoning behind the 4th amendment.
      slickjim
      • I actually quoted it in the article

        The reasoning behind the Fourth Amendment was not to prohibit the state from searching and seizing, but to make sure such actions were reasonable, limited and authorized by a judge. All those conditions were met in the Lavabit subpoena.
        larry@...
        • Exactly how were all those conditions met if the SSL key in question....

          Exposed "everybodys" communications and not just Edward Snowdens? That's not a reasonable search. That's a dragnet. The guy asked for 40 hours and then you compared the urgency of decrypting Edward Snowdens email to the scenario of someone who has kidnapped a human being and are holding them for ransom...are you kidding me? How is honoring a 40 hour request comparable to a human life being hold hostage? You say that the government couldn't take his word because his 20-40 hour estimate couldn't be relied on? That is the most hilarious statement I have ever heard. How do I say this without being offensive. You are a crackpot sir and I mean that in the kindest way.
          j4w4
          • you have an unreasonable understanding of "reasonable"

            First, 40 hours of work - his estimate, hardly a guarantee - doesn't equal 40 hours of time. It could be several days. That really is a long time to impede a criminal prosecution. If there were some more narrow way to gather the information, I'm sure the court would have agreed to it, but Lavabit's design made that impossible. And don't just dismiss the kidnapping question. Should the government give Lavabit 40 work hours if they're hunting a kidnapper or a killer? It's the same exact principle.
            larry@...
          • But thats my point Larry, they are NOT hunting a kidnapper or a killer

            That's why allowing the guy a 40 hour window to give them just the information they need is reasonable. If you can't see the contrast between saving a human life and prosecuting a criminal for something he has "already" done then you have some problems. Edward Snowden is hiding out in "Russia". There is no hurry to prosecute him. In fact, in light of the fact that he is in "Russia" what is saving 40 hours going to do for anybody in this situation. You have to look at the details of each situation Larry. This is not a time-sensitive issue. Give the LavaBit founder his 40 hours in good faith. The situation is not at defcon 5.
            j4w4
          • Snowden wasn't in Russia yet when this happened

            The government approached Lavabit when Snowden was in Hong Kong, I believe before they had even issued an extradition request.

            But I'm hearing you imply - tell me if I'm wrong - that if there were a life at stake you might consider the subpoena reasonable. So it's not a matter of principle, it's just a disagreement about policy. You don't think that a mass-disclosure of top secret material, in violation of agreements he signed, is a crime?
            larry@...
          • re: Snowden wasn't in Russia yet when this happened

            > You don't think that a mass-disclosure of top secret
            > material, in violation of agreements he signed, is a crime?

            Well, if you bail on your lease, is that a crime? Certainly not.

            The "agreements he signed" is superfluous. Technically, yes, what he did is a crime. I bear him no ill will (unlike the kidnapper or killer) because he revealed worse crimes than he committed.

            In you article you admit, "it's reasonable to wonder whether the FBI really would limit themselves to Snowden's communications." I agree. Now, would it have been as apparent to you 6 months ago?
            none none
          • Larry, you sound like a damn robot using Artificial Intelligence

            Of course, the details of each and every situation matter. What are you trying to do.. create universal laws that exists in a bubble? Your trying to justify the governments dragnet behavior by bouncing general laws off the wall. That doesn't work. If your gonna talk about Edward Snowden and Lavabit specifically but then justify the dragnet by saying stupid things like, "would it be okay if the guy were a killer" how does that make any logical sense? You fail logic 101 bro.
            j4w4
          • Could Larry be a Mockingbird?

            Check out Wikipedia.
            http://en.wikipedia.org/wiki/Operation_Mockingbird
            Astringent
          • Oh to answer your question

            He broke a law so in technical terms, yes, he is a criminal. Now having answered that question it adds nothing tot he discussion whatsoever nor does it strengthen the position you are taking on the matter. It is an unreasonable search and seizure of records.
            Edward Snowden is still at large. He is not a terrorists as far as anybody can tell. He is a whistle blower. So, once again. We are not at defcon 5. You need to learn how to apply common sense to laws. Are you a government employee?
            j4w4
          • Not yet

            Eric Snowden has not yet been convicted of anything. Therefore, he's not yet a criminal. He is innocent *unless* proven guilty.

            He went from patriot to traitor when he took refuge, with his intel, among our enemies.

            if the gov't wants Snowden's emails, then a proper warrant can compel those emails from Lavabit. But not the encryption key, which is completely unrelated to the emails.
            hiraghm@...
          • I think it is a much different crime.

            "You don't think that a mass-disclosure of top secret material, in violation of agreements he signed, is a crime?"

            He committed a breach of contract. It is a very different crime than a kidnapping. Mr. Snowden did not kidnap a person. He committed no acts of violence. In fact, if this same breach of contract was with any other body than the government, then, no, it would not be a crime. It would be a civil matter.

            His crime was, apparently, revealing the crimes of the government. I thought the wistleblower law was supposed to protect him?

            Mr. Snowden is being accused of treason, giving information to the enemy. He gave the information to the American people. We are all, apparently, the enemy of the government. I want to consider myself a patriotic American citizen, but I am having a really hard time getting behind the government's actions and arguments in their own defense.
            mlashinsky@...
          • re: you have an unreasonable understanding of "reasonable"

            > Should the government give Lavabit 40 work hours
            > if they're hunting a kidnapper or a killer? It's the same
            > exact principle.


            It's not reasonable to divorce the government's request from the facts of the case. You can't look at it in the abstract. A reasonable person would would be able to see that the kidnapper scenario is far more urgent than the Snowden scenario in which the government can build its case at its leisure seeing that Snowden is likely to remain out of reach for quite some time.

            In addition to subpoena power, law enforcement also employs the use of deadly force. How can you decide if the use of deadly force is reasonable absent the facts of the matter? You can't. Same thing with the subpoena.
            none none
          • You have to look at it in the abstract

            Certainly Levison isn't arguing in court that the specifics of the case matter. He's arguing that the authorities have no right under *any* circumstances to subpoena his users' data
            larry@...
          • The law is one thing. What's ethically right is another

            You could argue that Snowden broke the law (nobody denies that he broke the law) therefore he should quickly return to the United States to get issued with punishment.

            This is the same argument you're using about Levison. The law was broken, therefore he should just roll over.

            However, the public has varying views about whether Snowden is ethically right (as this story stated). Those who believe Snowden was right will probably think he should stay where he is and not return to the US.

            Same with Levison. Those who believe Levison is ethically right will not want to see him go to jail. He's at risk of contempt-of-court, which I assume carries a jail term.

            People are arguing on ethical grounds. However, the article did not stand up for Snowden or Levison's ethics. I can only assume the author would like to see both of them go to prison, just as the government wants to see.
            Vbitrate
          • I'm not sure we can make conclusions about author's views on prison

            Even if someone is wrong before the law and we accept that, it does not mean that we morally believe that they should go to prison for the particular incident.

            My feeling from people's reaction is that many people do not trust law enforcement so they build arguments about legality to justify not giving law enforcement that authority. The problem here isn't the request of law enforcement -- it is the business model of the email provider. Any provider of email should understand the law since there is a pretty good chance that at some point, the law will come knocking at their door.

            Companies spend a lot of money to enforce compliance laws. This guy promised something to his clients without building the proper infrastructure to truly deliver. Clients who wanted truly secure email could have investigated all of this to ensure their encrypted content would not be compromised in a case like this.
            DaveJMo
          • and yet

            And yet, he was willing to hand over Snowden's data after he separated it from the rest. But that wasn't good enough or fast enough, so they got nothing. Did Levenson obstruct justice, or did justice obstruct him, and itself in the process?
            mlashinsky@...
          • No, they are not the exact same principle.

            Not by a long shot. Maybe on paper they might look like the same thing, but they are not. The Snowden thing did not put any one person's life in jeopardy except Mr. Snowden himself. It has been dragging on for months now. Would a week's wait to have what they wanted been unreasonable, (especially since it has been months now, and they still don't have what they wanted?) Criminal investigations do not happen quickly, in spite of what you see on CSI. The urgency here was simply because the government was caught with their pants down. They were abusing power, and tried to cover up the leak by using more abuse of power.

            The Government demanded all the information instantly, using ultimatums, and ended up without the information they wanted at all. If they had been reasonable, they could have had Snowden's email in a week. Now they still don't have it.

            Now, a question for you: You said, "...Here's the real question: when the government convinces a judge that it is necessary in order to prosecute a criminal case,..." Did the government really convince a judge who then issued a warrant, or did the government go to a judge/clerk who rubber stamps every request that goes before him without question?

            I personally believe that if the Government were playing by the rules in the first place, Mr. Snowden would never have felt compelled to poke this bee hive. Working where he did, he had to know the dire consequences. I am not inclined to give the government the benefit of the doubt on anything anymore. They do not deserve it.

            PS Who are you, and what have you done with Larry Seltzer?
            mlashinsky@...
          • Unreasonable

            The answer is yes. Taking all those emails of others is unreasonable even if it were the child scenario. Our constitution is in place for protecting us and limiting the abuses of government. If an asteroid was coming in 40 hours and Levison held the answer in a single clients email that could save the world, yet it would take him 41 hours to get that single clients email then the world should just kiss their butts goodbye. The law is the law and it does not substitute or waver to please the whims of anyone. Especially a tyrannical government like ours. Larry, I am kicking you out of Anonymous!
            Placid Poet