Snowden’s Email Provider Loses Appeal Over Encryption Keys

Lavabit founder Ladar Levison. Image: Gage Skidmore/Flickr

A federal appeals court has upheld a contempt citation against the founder of the defunct secure e-mail company Lavabit, finding that the weighty internet privacy issues he raised on appeal should have been brought up earlier in the legal process.

The decision disposes of a closely watched privacy case on a technicality, without ruling one way or the other on the substantial issue: whether an internet company can be compelled to turn over the master encryption keys for its entire system to facilitate court-approved surveillance on a single user.

The case began in June, when Texas-based Lavabit was served with a pen register order requiring it to give the government a live feed of the email activity on a particular account. The feed would include metadata like the from and to lines on every message, and the IP addresses used to access the mailbox.

Because pen register orders provide only metadata, they can be obtained without probable cause that the target has committed a crime. But in this case the court filings suggest strongly that the target was indicted NSA leaker Edward Snowden, Lavabits most famous user.

Levison resisted the order on the grounds that he couldnt comply without reprogramming the elaborate encryption system hed built to protect his users privacy. He eventually relented and offered to gather up the email metadata and transmit it to the government after 60 days. Later he offered to engineer a faster solution. But by then, weeks had passed, and the FBI was determined to get what it wanted directly and in real time.

So in July the government served Levison with a search warrant striking at the Achilles heel of his system: the private SSL key that would allow the FBI to decrypt traffic to and from the site, and collect Snowdens metadata directly. The government promised it wouldnt use the key to spy on Lavabits other 400,000 users, which the key would technically enable them to do.

Levison turned over the keys as a nearly illegible computer printout in 4-point type. In early August, Hilton who once served on the top-secret FISA court ordered Levison to provide the keys instead in the industry-standard electronic format, and began fining him $5,000 a day for noncompliance.

After two days, Levison complied, but then immediately shuttered Lavabit altogether.

Levison appealed the contempt order to the 4th Circuit, and civil rights groups, including the ACLU and the EFF, filed briefs in support of his position.

Read the original here:
Snowden’s Email Provider Loses Appeal Over Encryption Keys