Lavabit.com Down

[Ceramic]

Originally Posted by Havokmon

http://www.wired.com/threatlevel/201...abit_unsealed/

Just keep in mind that you lost access to your email because he didn't want to give up metadata logs for a single account for less than $2000 (oh and the government paid his expenses for him to go to court).

And he's now made another $75k in donations for a system that was never ever going to be as secure as it was billed to be in the first place.

He's a douche. It was bad enough he marketed the falsity of "even we can't access your email", but really makes me sick people are still throwing money at him. People should be withdrawing their donations.

Where are you getting the $2000 figure?

And what Ladar did was perfectly reasonable
1. First, Lavabit was served with an order without probable cause. I would expect a privacy advocating company to fight this. Ladar did.
2. The, the govt asked for SSL keys, which would have compromised ALL users. Ladar now was willing to give up Snowden, but the govt wanted to teach him a lesson and was not cooperative.

Essentially, Lavabit was bullied by the govt. The original request was reasonable. The second was not. The fact that the govt decided to make the second request speaks volumes about its arrogance.

[Havokmon]

Originally Posted by Ceramic

Where are you getting the $2000 figure?

My Fault. That was in another article - http://www.zdnet.com/unsealed-docs-s...it-7000021489/

Originally Posted by Ceramic

And what Ladar did was perfectly reasonable
1. First, Lavabit was served with an order without probable cause. I would expect a privacy advocating company to fight this. Ladar did.

He never did before. At the bottom of the Wired article are the documents. The first page of a court order says "The Court finds that the United States has offered specific and articulable facts showing
that there arc reasonable grounds to believe that the records or other information sought are
relevant and material to an ongoing criminal investigation."

Originally Posted by Ceramic

2. The, the govt asked for SSL keys, which would have compromised ALL users. Ladar now was willing to give up Snowden, but the govt wanted to teach him a lesson and was not cooperative.

Read more of the documents. The first document asked for metadata on June 10th. SSL keys weren't asked for until August, which is after the June 18th request to install a pen device because Ladar refused the first order.

Originally Posted by Ceramic

Essentially, Lavabit was bullied by the govt. The original request was reasonable. The second was not. The fact that the govt decided to make the second request speaks volumes about its arrogance.

No - the only bully was Ladar. There were at least 3 requests, and definitely 3 separate actions. 1 - metadata logs. 2 - pen cap device. 3 - SSL keys. Only after fighting those orders did Ladar finally give in (after his court appearances being paid for by the government), and then request $2000 to implement the request. At that point the government was tired of his crap, and denied it. He continued his actions, printed his SSL keys in 4pt font, then shut down Lavabit when they threatened him with jail time (though after he did finally comply with an order).

In any case, had he simply provided the metadata logs that 1 - he had done in the past, and 2. which are plain text and in servers all over the place, the entire thing wouldn't have happened.

I'm all for privacy, but the metadata logs are simply To/From/IP/DateTime - Neither the IP nor the From can really be counted on to be accurate. I can send you an email that will have my name in your email client, but osamabinladen@gmail.com would be logged in all the relay servers.

[Bamb0]

Originally Posted by David

My wild guess: is that Lavabit will resurrect (very soon) in a land that is not called the 'Unted States'

Would be interesting if he did!!

[FredOnline]

Originally Posted by David

My wild guess: is that Lavabit will resurrect (very soon) in a land that is not called the 'Unted States'

Never heard of it.

[Havokmon]

Originally Posted by Bamb0

Would be interesting if he did!!

So he could have access to your data, like he claimed he didn't?

Whoops, he says the opposite in this NYT article. http://www.nytimes.com/2013/10/03/us...agewanted=all&

"But Mr. Levison said he spent much of the following day thinking of a compromise. He would log the target’s communications, unscramble them with the encryption keys and upload them to a government server once a day. The F.B.I. told him that was not enough. It needed his target’s communications “in real time,” he said. "

Of course, that blurb doesn't actually apply to the original request, just the ones that came after he refused to hand over the metadata and the government escalated.

When they get to that point, AND they can't trust you then Yes, they do want it in real time. And it's not difficult to implement, especially if you're the one who wrote the software. I'm beginning to think he's just a web designer - he can access the data after the fact, but has no idea how to modify the system itself. That might justify some of the cost.

And for the record, if you own any sort of small Service Provider, the FBI will likely see you at your house. It's not a big deal, that's where they know they can find you, as the documents in their possession require Secret level or higher to read (IIRC). Well, the first request can be faxed, but the wiretap cannot. And there will be more than one agent, because there needs to be a witness. From what I've read it seems like Ladar isn't very familiar with security policies and procedures either. Though I will admit, being in IT, it is a somewhat odd feeling getting into a car with black windows with 3 armed men.

I have no problem implementing a similar 'encryption' system at VFEmail - but I won't lie to you and say it's inaccessible. That's why there isn't one - it's a waste of time. His apparent success by preying on the uninformed is morally reprehensible. He might as well be fighting against the FCC for advertising penis enlargement pills.

[EricG]

I agree with Havokmon. Levison choose which orders for FBI investigations to comply with based on his personal politics, then shutting down Lavabit and screwing the users. It's similar to defying a court order, then crying "victim" when you are found in contempt.

You can't rely on secure encryption from a provider, do it yourself with S/MIME or PGP.

[zdt]

Originally Posted by David

My wild guess: is that Lavabit will resurrect (very soon) in a land that is not called the 'Unted States'

Originally Posted by FredOnline

Never heard of it.

Never heard of it either, but he knows that is the simplest move he can make in order to capitalize his movements until now. In other words, not doing it would not make sense financially (see Opportunity cost)

[zdt]

Originally Posted by Havokmon

His apparent success by preying on the uninformed is morally reprehensible.

Me being in the "uninformed" part of the world, I need more clarifications and in simpler English!

What you say is that he sold a product that could never exist. Technically there is no way to have an email service that is really private.
Am I right on this?

[FredOnline]

Originally Posted by Havokmon

He might as well be fighting against the FCC for advertising penis enlargement pills.

Are you inferring the pills didn't work?

If so, thanks for the heads up (or not).

Do we assume that, since the digital keys were handed over, the authorities now have the information they sought?

What difference would closing down the service have on this investigation?

[ioneja]

Originally Posted by Havokmon

No - the only bully was Ladar.

I respectfully but thoroughly disagree with your assessment, especially your statement quoted above that Ladar was the only bully. The only thing your assessment suggests to me is that you may have an axe to grind with Ladar for some reason. Whether or not that's true, I don't know, but the certainty of my assessment is certainly no greater than the certainty of yours... especially because we don't know the whole story of what Ladar experienced on a day-to-day basis.

I've also read some (admittedly not all) of those court documents that were released, and I see a different picture of someone who was being pulled in many different directions by forces far greater than him. As a small business owner and/or email operator yourself, you should understand or least be able to imagine what Ladar was going through better than most. When you are actually under that type of pressure yourself, let us know. Someone in that type of situation isn't going to be perfect, but I see someone who is trying to balance his principles against an immovable force of nature.

But to call him the bully is frankly outrageous. It takes courage (misplaced or otherwise, and whether or not you agree with what he did) to stand up to an entity that can seize all your property and put you in prison. He frankly could have been classified as aiding and abetting Snowden at any second, and he was in serious peril for non-compliance with the court. If you don't like the outcome or his final actions, or any specific choice he made, that's fine of course, but to call him a bully is over the top. The reverse is certainly the case. Who carried the big stick? Who threatened his business, livelihood and potential freedom? And in his mind, Ladar was clearly also standing up for simple Constitutional rights as best he could given the circumstances.

As for him insisting on and/or accepting reimbursement for his court travel costs when he is not the one accused of wrong-doing, I'd call that *smart* -- why should he pay for something like that when he himself is NOT the accused? There is plenty of precedent for it this case, and for a small business owner, unexpected travel costs like that add up considerably and are often a serious hardship. Heck, expert witnesses, for example, are paid *big bucks* all the time -- do you think so little of them? Ladar's travel compensation and other cost reimbursement requests were more than reasonable. Do you think he was made of money? How many employees do you think he had? Do you think Lavabit was some massive email provider? 400,000 users may seem like a lot, but how many were actually paid subscribers? Did you ever do the math on his business? His total revenue couldn't have been very large. Do you have any idea how much good legal representation costs?

And frankly, if we analyze the legal documents even more, it just shows how spiteful, petty, illogical and intrusive the government was in several instances. Even the whole analogy of an apartment building shows the ineptitude of the reasoning behind their argument and lack of technical understanding of what they were asking for. It is very sad indeed that these are the people with the big stick and all the power. That analogy of an apartment building is incredibly flawed. Opening the "front door" of the apartment building is NOT remotely accurate... what they were eventually demanding was essentially free reign in the whole apartment complex, with every tenant's doors open wide, theoretically handing over a potential *copy* of all content and/or at least metadata in each tenant's apartment. You may not think that's a big deal, but maybe 400,000 other people might disagree with you. This is precisely contrary to the 4th Amendment. And digital data is not physical property that needs to be accounted for and returned to its owner... you of all people should know that.

On top of that, the saying "hindsight is 20/20 vision" is more apt here than ever... Ladar appears to have handled each day as it came at him, the best he could (flawed though each response may have been, we'll never know how it would have played out otherwise), while following his basic principles, under extraordinary pressure. Faulting him in those circumstances or just calling him a bully shows profound lack of imagination of what he was experiencing.

Frankly, if I used your email service, as a representative of VFEmail.net as listed in your profile, a service which you claim has additional privacy features, I'd hope you would show half the courage under similar pressure. But I guess it's comforting to know that you would have foreseen the government's actions and would have been so quick to comply.

[Havokmon]

Originally Posted by zdt

Me being in the "uninformed" part of the world, I need more clarifications and in simpler English!

What you say is that he sold a product that could never exist. Technically there is no way to have an email service that is really private.
Am I right on this?

That's correct. The service itself is irrelevant in regards to privacy. The service will see everything in clear text.
Now, you could be smart and not use your real name (especially for your address) anywhere. You can also use PGP on your local client. Those can be done on any service that allows POP/IMAP and SMTP.

The next problem will be - how do we stop PGP-encrypted Spam? No service will have your private key to be able to scan the email. *sigh*

[Havokmon]

Originally Posted by ioneja

I respectfully but thoroughly disagree with your assessment, especially your statement quoted above that Ladar was the only bully. The only thing your assessment suggests to me is that you may have an axe to grind with Ladar for some reason. Whether or not that's true, I don't know, but the certainty of my assessment is certainly no greater than the certainty of yours... especially because we don't know the whole story of what Ladar experienced on a day-to-day basis.

As someone who has received the same request as he [and he admits to fulfulling in the past], I'm quite confident I'm familiar with the process.
Yes, I do have an axe to grind. He sold you a lie, and admitted so in the NYT article. It's impossible for a mail admin to encrypt, store, and decrypt data without being able to access it. He's equivalent to a televangelist, or a marketer fighting the FCC because he wants to sell 'enlargement pills'.

Originally Posted by ioneja

I've also read some (admittedly not all) of those court documents that were released, and I see a different picture of someone who was being pulled in many different directions by forces far greater than him. As a small business owner and/or email operator yourself, you should understand or least be able to imagine what Ladar was going through better than most. When you are actually under that type of pressure yourself, let us know. Someone in that type of situation isn't going to be perfect, but I see someone who is trying to balance his principles against an immovable force of nature.

But to call him the bully is frankly outrageous. It takes courage (misplaced or otherwise, and whether or not you agree with what he did) to stand up to an entity that can seize all your property and put you in prison. He frankly could have been classified as aiding and abetting Snowden at any second, and he was in serious peril for non-compliance with the court. If you don't like the outcome or his final actions, or any specific choice he made, that's fine of course, but to call him a bully is over the top. The reverse is certainly the case. Who carried the big stick? Who threatened his business, livelihood and potential freedom? And in his mind, Ladar was clearly also standing up for simple Constitutional rights as best he could given the circumstances.

Keep in mind that the first request is standard. It's signed by a judge (3rd party) who agrees the evidence presented is enough to warrant a legal request for METADATA. We're not even talking about content here. To/From/Date/IP.

IMHO, He does not have the moral highground - no matter what your opinion of Snowden is. I think Snowden is a whistleblower - Ladar is an opportunist.

Originally Posted by ioneja

As for him insisting on and/or accepting reimbursement for his court travel costs when he is not the one accused of wrong-doing, I'd call that *smart* -- why should he pay for something like that when he himself is NOT the accused? There is plenty of precedent for it this case, and for a small business owner, unexpected travel costs like that add up considerably and are often a serious hardship. Heck, expert witnesses, for example, are paid *big bucks* all the time -- do you think so little of them? Ladar's travel compensation and other cost reimbursement requests were more than reasonable. Do you think he was made of money? How many employees do you think he had? Do you think Lavabit was some massive email provider? 400,000 users may seem like a lot, but how many were actually paid subscribers? Did you ever do the math on his business? His total revenue couldn't have been very large. Do you have any idea how much good legal representation costs?

Having been around longer than Lavabit, I have run all the numbers - but I'm also well aware of how they're skewed to the public. What's 400k? Total accounts? Total accounts used in a year? 9 months? It's hard to say.
Having recently gotten temporary guardianship of my granddaughter, I know how much a lawyer costs.
I think it shows he has an incredible set - but it also shows his arrogance.

Originally Posted by ioneja

And frankly, if we analyze the legal documents even more, it just shows how spiteful, petty, illogical and intrusive the government was in several instances. Even the whole analogy of an apartment building shows the ineptitude of the reasoning behind their argument and lack of technical understanding of what they were asking for. It is very sad indeed that these are the people with the big stick and all the power. That analogy of an apartment building is incredibly flawed. Opening the "front door" of the apartment building is NOT remotely accurate... what they were eventually demanding was essentially free reign in the whole apartment complex, with every tenant's doors open wide, theoretically handing over a potential *copy* of all content and/or at least metadata in each tenant's apartment. You may not think that's a big deal, but maybe 400,000 other people might disagree with you. This is precisely contrary to the 4th Amendment. And digital data is not physical property that needs to be accounted for and returned to its owner... you of all people should know that.

I agree with your analogy. But - That's regarding SSL keys. The government initially came in and said "We want your lobby visitor logs, and camera footage showing ONLY this person and anyone he was with. We also want his lease agreement and any other info you have on him." And they did that with a legal document.
Again, having received these documents over the last 12 years, having met with the FBI on multiple occasions - even in my home, and seeing the exact same format in the released Lavabit documents, I can assure you am I very familiar with the process and the requirements. And most definitely that the government does not want any info that they have not specifically requested.

Only after Ladar forced their hand did they feel that his information was no longer 'pure'. They don't want to do that work, they want Ladar to. It's legally required that a government agency reimburse a service provider for the work done. Personally, I think Ladar's cost assessments were way over the top. But I guess I'm cheap.

Are you saying you don't support police investigations? Do you support sex offender maps? It always seemed to me those maps were a violation of privacy.

Let me make one thing clear - if you are a criminal, your 'privacy' on my equipment is not guaranteed.

Originally Posted by ioneja

On top of that, the saying "hindsight is 20/20 vision" is more apt here than ever... Ladar appears to have handled each day as it came at him, the best he could (flawed though each response may have been, we'll never know how it would have played out otherwise), while following his basic principles, under extraordinary pressure. Faulting him in those circumstances or just calling him a bully shows profound lack of imagination of what he was experiencing.

Frankly, if I used your email service, as a representative of VFEmail.net as listed in your profile, a service which you claim has additional privacy features, I'd hope you would show half the courage under similar pressure. But I guess it's comforting to know that you would have foreseen the government's actions and would have been so quick to comply.

No service has the privacy features you are expecting. Any data you send to them is requestable (in some legal form or another) by a government entity - and since they are an endpoint for encryption - easily attainable.

Ladar complied in the past - again to MetaData. SSL keys are completely different. We need to make sure that's said. I do not support providing full access to the government. BUT - were I to be in contempt of court, and purposely make life hard for the government on a reasonable request for an account used by a person under investigation (it has yet to be seen whether Snowden has whistleblower status or not), I surely wouldn't run to the Internet and say I need money to defend the Constitution.

Then again I don't lie about what an email service can do either.

[ioneja]

Originally Posted by Havokmon

Yes, I do have an axe to grind.

I think that says a lot right there.

Originally Posted by Havokmon

He sold you a lie, and admitted so in the NYT article.

Again, I disagree with your assessment. You're reading more into it and casting sinister, opportunistic motives at him without knowing all the facts, and my guess is that you don't know him personally either. I don't know him personally, but I'd rather give him the benefit of the doubt for now, until proven otherwise. I'd hope you'd want that for yourself as well from people that don't know you.

As for taking an opportunity, that's what all businessmen and entrepreneurs are doing, to one extent or another. They are not operating charities. Some may have good or even pure motives, but they are also running a business. So of course, he's going to try to win customers and market the features of his service... and you may disagree with how he marketed those services.

However, I've also taken a look at his privacy policy -- which you can read here at the Internet Archive from January 15, 2013 (see this link: http://web.archive.org/web/201301150...cy_policy.html ) -- and there's nothing in there that fundamentally, technically contradicts what he's said elsewhere. And his marketing materials didn't absolutely, unequivocally *guarantee* that your emails were 100% safe, as no one can guarantee that. Again, look at the whole picture. He flat out admits in his privacy policy that he will release information when legally compelled to do so. So taken as a whole, I fail to see the "lie." The rest of his website is called "marketing" and I don't see an ethical problem with it if you read the whole thing carefully. At least at this point. Let's give him the benefit of the doubt for now.

The WORST you can say about him from the facts we currently have in front of us, is that he *figured out* a way to defeat his own system. Just because he figured out a way to defeat his own system for "premium" users that used his encryption services, doesn't mean he's a crook or opportunist.

One of my main points is that you're clearly going after him on a personal level, calling him a liar and bully, which I think is uncalled for and over the top, especially considering that you and I (and everyone else except the parties intimately involved) don't have the whole story.

Anyway, I think we probably agree on many other points, I'm just mainly taking issue with your jumping to conclusions about Ladar. While a lot of his troubles could have simply been avoided by complying with the first request right away, have you considered that maybe he didn't initially have a good solution to defeating his own system? Maybe he was simply honoring what he had said about the security of those clients? Or perhaps he might have had a change of heart about his compliance in previous situations? In any case, remember, he also had two types of clients (premium - with encryption option, and regular - which did NOT have the encryption services, as understand it), so it could have been a more complicated compliance (let alone moral) situation for him anyway.

In all cases, it's way, way too early to jump to conclusions about his behavior, let alone his internal motivations! Give the guy a break and let his facts eventually come to light. In the meantime, whether or not he is a liar, bully, arrogant or an opportunist as you have said he is, he is at least standing up for 4th Amendment rights and pushing back on a system that we know for a fact now that IS abusing its powers.

And on top of all that, "good guys" don't have to be perfect or pure in their actions or intentions. History is littered with people obsessed with "pure intentions" that get us *nowhere*. Perhaps Ladar is a just a normal, flawed guy who when called to action decided to challenge the system. I think in this era, we need more of that type of guy. Find me someone who has the pure intentions, I'll be happy to support him too.

In the meantime, maybe let your axe grinding focus on the REAL problem. A hint: the problem is not a little email provider from Texas that you don't know or like.

[just1acc]

Originally Posted by ioneja

Perhaps Ladar is a just a normal, flawed guy who when called to action decided to challenge the system. I think in this era, we need more of that type of guy. Find me someone who has the pure intentions, I'll be happy to support him too.

In the meantime, maybe let your axe grinding focus on the REAL problem. A hint: the problem is not a little email provider from Texas that you don't know or like.

Vouch for that.

[Paul09]

Oke, what I read about the court orders is that at first the State asked for some info about one E-mail address.
Al tough Ladar said in interviews that he compelled with court orders before, he did not this time.
Then Ladar asked for money to appear in the court. The court paid him.
Ladar gave a code on paper, the court did not believe it was the right code.
Then the State asked for the encryption key on CD and password of one E-mail address (every account has it own password).
Ladar refused again.
Then the court gave him a fine/day if he would not turn over the encryption key.
At last Ladar gave the encryption key and shut down Lavabit.com.

From what I read is that his promises about fully encrypted mail is not possible. By handing over the encryption key, it is like handing over the key to the central door of an apartment building, while every apartment (E-mail address) has it own lock and key (password).

If that's true, that the E-mail could not be encrypted like Ladar promised and he only gave the key to the central door, then I really think that shutting down Lavabit.com does not make any sense!

What is the meaning behind this freemason Ladar?