Risk
10/4/2013
12:28 PM
Connect Directly
RSS
E-Mail
50%
50%

Lavabit Owner Fined For Resisting FBI Demands

Unsealed court documents reveal new details in encrypted email service provider's role in protecting identity of whistleblower Edward Snowden.

The owner of shuttered encrypted email service provider Lavabit was being fined $5,000 per day after he refused to give the FBI unfettered access to the systems being used to handle every Lavabit user's communications.

That fact was revealed this week after a federal judge unsealed more than 160 pages of partially redacted documents relating to a June 28 authorization of a pen registration trap on the email account of a Lavabit account holder and to subsequent legal wrangling between Lavabit founder Ladar Levison and federal prosecutors.

While the account holder's name was redacted throughout the court documents, all evidence points to it being NSA whistleblower Edward Snowden. In fact, his name was mentioned extant in one document -- filed by Levison's attorney -- but only in relationship to recent concerns by the public over U.S. government spying.

[ 13 men have been charged with attacking sites of RIAA and other organizations thought to be hostile to piracy sites and WikiLeaks. Read more at Operation Payback: Feds Charge 13 On Anonymous Attacks. ]

Levison's service was built to provide anonymity -- not just for the content of their messages, but also the date and time they were sent, the IP addresses for which they were intended, and other metadata. Ultimately, rather than comply with a court order requiring him to disclose all encryption keys and SSL keys pertaining to Snowden's account, as well as all information necessary to decrypt data stored in or otherwise associated with that account, Levison pulled the plug on Lavabit.

His move drew plaudits from many privacy advocates.

But the full story is a little more complicated, as the unsealed court documents now reveal. For starters, Levison -- who was previously subject to a gag order -- was in a bind. "I have always agreed to the installation of the pen register device," he said in a related court hearing on July 16, according to the unsealed documents. "I have only ever objected to turning over the SSL keys because that would compromise all of the secure communications in and out of my network, including my own administrative traffic."

But under U.S. law, with a court order, the FBI has a legal right to install a pen trap device and retrieve email metadata during a criminal investigation. Levison, however, had built a system where the keys encrypting the content of emails were the same keys used to encrypt metadata, and he couldn't easily separate one from the other without extensive coding changes to Lavabit's infrastructure. While he offered to undertake such changes -- in return for "reasonable expenses" of at least $2,000 to cover 60 days' worth of development work -- the FBI argued, and a judge agreed, that given the ongoing criminal investigation, it had a right to the information in a much more timely manner.

So Levison offered to retrieve required messages on a daily basis and upload them to an FBI server. Again, however, the bureau said that wouldn’t meet its requirements; it apparently wanted to follow Snowden's email-related metadata in real time. Levison, meanwhile, argued that the FBI's request for real-time pen trap information didn't appear to be required in the wording of the subpoena he'd received.

On August 2, facing the prospect of a $1,000 daily fine for noncompliance, Levison did furnish the FBI with a printout of the information that would be required to operate the pen register. But according to a court document filed by U.S. Attorney Neil H. MacBridge, which read, "this printout, in what appears to be 4-point type, consists of 11 pages of largely illegible characters," it would prove worthless to the bureau if, after the information had been entered manually, any single character was typed incorrectly. Levison subsequently failed to provide the requested information electronically in an industry standard format, despite repeated requests from the Department of Justice.

As a result, a federal judge slapped Levison with a $5,000 daily fine on August 5. Three days later Levison pulled the plug on Lavabit, which he said had more than 400,000 subscribers and generated annual income of between $50,000 and $100,000. Because he was subject to a gag order, Levison released a statement at that time saying only, "I've shut down Lavabit because I refuse to be complicit in the crimes against the American people and the U.S. Constitution. I wish I could say more about our situation."

He also launched an appeal for funds to help pay for related legal costs. The fundraising campaign, which lists a goal of $96,000, by Friday morning had raised more than $70,000, courtesy of more than 1,800 donors.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
moarsauce123
50%
50%
moarsauce123,
User Rank: Apprentice
10/7/2013 | 10:05:38 PM
re: Lavabit Owner Fined For Resisting FBI Demands
So clearly this just means we're setting up a server in Venezuela now or Iceland and firing Lavabit back online? Subpoena's will then be useless.
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/8/2013 | 4:06:07 PM
re: Lavabit Owner Fined For Resisting FBI Demands
If you trust the government of Venezuela or Iceland to not issue a secret court order giving them direct, surreptitious access to local versions of Lavabit, or the NSA then hacking into their access mechanism.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4594
Published: 2014-10-25
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.

CVE-2014-0476
Published: 2014-10-25
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

CVE-2014-1927
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928....

CVE-2014-1928
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulner...

CVE-2014-1929
Published: 2014-10-25
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.