[Infowarrior] - Lawyers for Lavabit founder: judges may dismiss civil liberties concerns

[Richard Forno]

Lawyers for Lavabit founder: judges may dismiss civil liberties concerns

	• Dominic Rushe in New York
	• theguardian.com, Saturday 1 February 2014 08.00 EST

http://www.theguardian.com/technology/2014/feb/01/lavabit-ladar-levison-snowden-contempt-court

Civil rights lawyers expressed concern this week that judges reviewing the contempt of court case brought against Lavabit, an email service that was used by the National Security Agency leaker Edward Snowden, were dismissing privacy concerns raised by the case as a “red herring” that had been “blown out of proportion”.

The founder of Lavabit, Ladar Levison, is challenging a contempt of court order brought against him when he initially refused to hand over the encryption keys to his secure email service. The case is now with the fourth US circuit court of appeals in Richmond, Virginia. Judges Roger Gregory, Paul Niemeyer and Steven Agee presided over a hearing on Tuesday.

A decision is expected within 45 days. If Levison’s appeal is rejected, he will be held in contempt of court and it will be unlikely that the legal issues surrounding the case will be resolved.

Levison has argued that the government put an undue burden on his business by forcing him to hand over the SSL encryption keys to his service, as part of the FBI’s investigation into Snowden's leak of thousands of documents to media outlets including the Guardian. Levison shut the service shortly after complying and has since argued that the government violated his fourth amendment right prohibiting unreasonable searches and seizures.

An American Civil Liberties Union (ACLU) attorney, Brian Hauss, said the hearing suggested the court was more interested in the procedural details of the case and Levison’s behaviour than fourth-amendment issues regarding the legal position of a business’s use of encryption.

“We believe encryption is the heart of this case,” Hauss said. “The judges pointed out that the first order asked for data and didn’t demand SSL keys. But the only way Levison could have provided them with that data as they wanted it was to hand over those keys.”

Lavabit was a secure email service through which account holders used an encrypted key to access their mail. Levison did not hold those keys. While he could have given the authorities access to a single user’s account, as he had done in the past, he has argued that the only way to give the FBI “live” access, as it demanded, was to compromise his entire system and its 410,000 users by handing over the master keys.

Hushmail, a Lavabit rival, acquiesced to a similar FBI demand in 2007, only to see its reputation collapse. Levison and the ACLU have argued that that example and others show the government was making an unreasonable demand on his business – a legal defence against a court order.

In a filing with the court, the ACLU has argued that the government “fatally undermined” Lavabit when it demanded access to encryption keys that kept the service secure.

"Lavabit's business was predicated on offering a secure email service, and no company could possible tell its clients that it offers a secure service if its keys have been handed over to the government," said Catherine Crump of the ACLU.

Hauss said: “There should be some check on the courts’ authority to compel a person to comply with its demand. After all, these are innocent third parties.”

The judges in the Lavabit case, however, seemed at the hearing keen to move away from encryption or any mention of the fourth-amendment argument.

In court, Judge Niemeyer said: "The encryption key comes in only after your client is refusing to give them the unencrypted data. They don't want the key as an object, they want this data with respect to a target that they are investigating. And it seems to me that that's all this case is about and it’s been blown out of proportion by all these contentions that the government is seeking keys to access other people's data and so forth. They are seeking unencrypted data with respect to a target."

Judge Gregory argued the encryption key had become a “red herring”.

"There is such a willingness and a desire to argue about secret keys being provided and the government's going to take full advantage of that and spy on everybody,” said Niemeyer. What was ordered here was with respect to a particular target to provide unencrypted data pursuant to that order."

'Questions of enormous importance'

Levison’s legal woes began last June, when Lavabit was ordered to set up a "pen trap" to collect data from one of its customers, thought to be Snowden. A pen trap is software that records all the metadata from an electronic communication, including destination, address, recipient and header.

In court, Lavabit attorney Ian Samuels argued that Levison agreed to set up the pen trap and had complied with at least one similar court order in the past. He balked at handing over SSL keys that would have given the FBI access to all his clients and they in turn lost trust in him. Initially he was gagged from speaking about the case, even to a lawyer.

Forced to hand over the keys, Levison initially sent the FBI the details as 11 pages of print in 4-point type. Shortly after that, he closed the service and issued a press release saying he had made the decision in order not to be “complicit in crimes against the American people”.

The judges criticised Levison for not correctly challenging the order, a criticism to which Samuels objected. Samuels said Levison had made an objection on "statutory grounds and on constitutional grounds" to handing over the encryption keys. He said Levison had argued it would place an undue burden on his business and that there were many good reasons to hear the appeal in any case.

“As the government candidly concedes Mr Levison was 'intermittently represented by counsel', these proceedings were happening extraordinarily quickly,” Samuels said. He added: "There are questions of enormous importance both to the government and to not just this litigant but to other service providers in the United States."

He said Levison had tried to offer the FBI a solution that would not lead to the “loss of privacy for the hundreds of thousands of other customers.

“When that was refused then the government didn’t say, 'Let's try and work something out,' the government didn't even pursue the grand jury subpoena, which is the usual way you get information from an innocent third party that isn’t the fruit, instrument or evidence of a crime.

“What the government said was, 'We don’t even want to deal with the procedural protections of the grand jury. We want to get this information, we are entitled to it in every case. Any time we install a pen register, we get the SSL keys if we decide that we don’t trust you.' That is what the government went and said.

“There were other options for them to get this information that didn't even involve them trusting the company if the government doesn't trust them anymore. What they can't do is they can't say that this statute, and the fourth amendment which doesn’t authorise any of this, gives it to us in every single case if we decide that we don’t trust you.”

Levison declined to comment on the appeal.

“All I really want is for this issue to be settled so that there is some clarity about what protection businesses have,” he said.

Levison is currently working with the founders of Silent Circle, another secure online service that shut down, fearing the FBI would compel it to compromise its service. They are planning to launch a service called Dark Mail that will offer an open-source tool that could make secure encryption an easy add-on for any email service.

---
Just because i'm near the punchbowl doesn't mean I'm also drinking from it.