A federal judge has unsealed documents in a case involving the owner of the encrypted email service provider, Lavabit, which former National Security Agency contractor Edward Snowden was using.
Since May, Ladar Levison has been battling the US government. The FBI wanted to install a tap on Snowden’s email account under a “pen register” order, which Levison had no problem. However, as Levison told the Times, the government also claimed they needed “passwords, encryption keys and computer code that would essentially allow the government untrammeled access to the protect messages of all his customers” in order for the interception to be useful. Levison was unwilling to comply with this request.
“You don’t need to bug an entire city to bug one guy’s phone calls,” Levison also said. “In my case, they wanted to break open the entire box just to get to one connection.” And so, on August 8, he shut down an email service that was being used by 400,000 users worldwide.
He could not discuss what he was experiencing because documents were under seal, effectively putting him under a gag order.
The government moved to sanction Levison on August 5, after he provided the FBI a “printout of what he represented to be the encryption keys needed to operate the pen register. They complained, “This printout, in what appears to be 4-point type, consists of 11 pages of largely illegible characters.”
“Moreover, each of the five encryption keys contains 512 individual characters—or a total of 2560 characters. To make use of these keys, the FBI would have to manually input all 2560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data,” the government further complained.
The government attempted to get Levison to provide an electronic copy of the keys. When the government did not receive the electronic encryption keys by August 5, the government moved to have Levison fined $5000 per day beginning at noon on August 5.
Judge Claude M. Hilton in Alexandria, Virginia, granted the order for sanctions the same day.
In a proceeding on July 16, where the government was trying to have Levison held in contempt of court, an attorney for the government, James Trump said to the judge, “What Mr. Levison is trying to do, Your Honor, is invite industry to come in and litigate as a surrogate for him hte issue of whether the encryption keys are part and parcel of the pen register order. And that’s one of the reasons we sought the search warrant, to make it clear, whether through the search warrant or pen register order, he is required to provide these keys.”
“We know he’s been in contact with attorneys who also represent industry groups and others who have litigated issues like this in the WikiLeaks context and others,” Trump added. These attorneys have “litigated privacy-related issues.” [He was referring to an unsuccessful push to have requests for Twitter data of three individuals, who volunteered for WikiLeaks—Tor software developer Jacob Appelbaum, Icelandic parliamentarian Birgitta Jonsdottir and Roy Gonggrijp—unsealed.]
Levison and Lavabit argued in a motion to quash a subpoena and search warrant, “If the government gains access to Lavabit’s Master Key, it will have unlimited access to not only [Edward Snowden's email account], but all of the communications and data stored in each of Lavabit’s 400,000 email accounts. None of these other users’ email accounts are at issue in this matter. However, production of the Master Key will compromise the security of these users.”
The motion suggested the subpoena and search warrant appeared to be “narrowly tailored” but would operate as a “general warrant by giving the government access to every Lavabit user’s communications.” It said it would be unreasonable under the Fourth Amendment. The warrant and subpoena would give the government access to data and communications that had no relation to the suit and granting the government access would be “unduly burdensome.”
The Lavabit owner also challenged the gag order placed on him by the court sealing documents. A motion argued, “The Lavabit Order’s non-disclosure provision is a content-based restriction that is not narrowly tailored to achieve a compelling state interest,” and violates the First Amendment.
The gag order effectively meant that Levison could not contact Lavabit subscribers to inform them that they might be subject to government surveillance if he was forced to comply with the order. He could not protect Lavabit by voicing his concerns, “garner support for his cause and take precautionary steps to ensure that Lavabit remains a truly secure network.”
The government maintained it should have access to a network’s encryption keys under the search warrant and grand jury subpoena issued while also opposing the unsealing of documents. The motions were denied on August 1.
Levison told the Times he thought of a compromise. “He would log the target’s communications, unscramble them with the encryption keys and upload them to a government server once a day.” However, the FBI “told him that was not enough. It needed his target’s communications ‘in real time.” [Did the FBI think Snowden would still be using Lavabit if they gained access to his account?]
“How as a small business do you hire the lawyers to appeal this and change public opinion to get the laws changed when Congress doesn’t even know what is going on?” Levison told the Times.
Snowden’s name was redacted from all of the documents except for in one instance. In the motion Levison filed to challenge the court’s gag order, it stated, “The leaking of classified government practices by Edward Snowden and the ensuing mass surveillance scandal have sparked an intense national and international debate about government surveillance, privacy rights and other traditional freedoms. It is concerning that suppressing Mr. Levison’s speech and pushing its subpoena power to the limits, the government’s actions may be viewed as accomplishing another unfounded secret infringement on personal privacy.”
Additionally, a June 28, 2013, order shows that the government was requesting data from a user suspected of violating the Espionage Act, committing a theft of government property and willful communicating classified communications intelligence to an unauthorized person, the same offenses Snowden was charged with committing on June 14.
His lawyer, Jesse Binnall, informed a judge Levison might want to talk to legislators about this case. The judge did not like the idea and said this is an ongoing criminal investigation.
Levison shut down his business just as he was complying with the request to turn over digital keys. He did this to protect those using his service from intrusive surveillance the government felt it needed to engage in to collect data from Snowden’s account.
“This was about the lengths our government was willing to go to conduct Internet surveillance program,” Levison explained to the Times.
It was a bold act in defense of users, one prosecutors would have loved to punish him for committing. Except, what Levison did was not really a crime.