I don't for a minute agree that law enforcement's operational problems trump every other right citizens have.
I find it _astounding_ that people are supporting the idea of forcing Levinson to back down on the guarantee of privacy he'd made to his _other_, not under any probable cause level of suspicion, 400,000 fully-entitled-to-the-privacy-they've-chosen-to-pay-for customers. Violating the privacy of four hundred THOUSAND unrelated-to-the-investigation users? Users who had an expectation of privacy, who were buying a service from a company marketing themselves on providing privacy. Then attempting to coerce that company's founder into not only failing to provide the service his customers were paying him for - but also denying him the right to let them know.
All because _one_ customer has monumentally embarrassed a particularly powerful government department.
from the New Yorker piece my impression was that, for the FBI, the easiest way was to have the SSL keys, and the Judge didn't understand the implications so granted the request.
Initially, the FBI was willing to let Levison modify the site so that just the target would have his stuff intercepted . But Levison wanted to charge the gov't $3500 for the work, also asked for external audits to make sure the FBI wouldn't goof off with the info. The FBI stopped trusting him, and for them it was just easier to have the keys.
It'd no-doubt be "easier" for the FBI to "do their job" if they had copies of everybodies house keys and office keys and safe-deposit-box keys too – so they could have a quick snoop whenever they got curious about whether you were doing anything wrong.
But we don't let them force builders/landlords/lockmakers to hand everybodies private physical house keys over, just because somebody somewhere is doing $bad_thing inside a house.
The FBI didn't trust him – boo hoo – they need to find another way to get their job done then.
(Does anybody _really_ think this was about "trusting" Levinson? Or that it was instead about trying to strong-arm Levinson/Lavabit into illegally and immorally participating in the NSA's ubiquitous surveillance program, almost certainly something they've gotten so used to having work for them that they've forgotten that occasionally they'll bump into someone prepared to throw their business away instead of compromising about "doing the _right_ thing"?)
They've got the warrant; it was a reasonable warrant, in a standard form, that he could reasonably have anticipated. The FBI have the right to execute it. (If you're arguing that this particular warrant shouldn't have been issued then that's a separate issue). It's Levinson's fault and his problem, not the government's, that Levinson specifically designed his site such that he couldn't execute this kind of ordinary, reasonable warrant without failing to provide the service his customers were paying him for.
The problem here is that Levison set up a Rube Goldberg machine. If the (in my opinion reasonable) law says you have to be able to provide access to anyone's data when you are given a warrant, you can't get out of that requirement by making your technology require you give everyone else's data, or kill a kitten, or any other requirement.
Edit: Changed 'levinson', UK report about the media, to 'levison', owner of lavabit.
Like I've said elsewhere in the thread - what about Tarsnap?
Tarsnap is also - arguably - designed in much the same way. What do you think Colin's response ought to be if the FBI/NSA come to him saying "we think one of your users might be doing $bad_thing, so we want your private keys so we can impersonate you, decrypt anything any of your users have backed up using tarsnap, and undermine the very basis of the business you've built."
Has Colin built "a Rube Goldberg machine"? Should all of his paying customers have their privacy violated because the only way Colin has to make Tarsnap reveal one customers data would be to backdoor a software update? Is it unreasonable to charge a sum on the order of $3.5k if Colin offered to set something up to allow only a single customer's software update to be backdoored? (Christ - I'll bet the FBI ran up an order of magnitude more than $3.5k in legal costs arguing that $3.5k was "too expensive"!)
Do any of us have to consider when building our products - along with all our _real_ concerns, just how amenable our technology decisions and architectural concepts turn out to be for state surveillance purposes? Are we to be scrutinized as though modern digital privacy best practice and effective use of crypto implies we've intentionally set out to make the FBI's job more difficult than necessary? Should any of our scarce development resources be squandered trying to ensure we've got built-in ways to comply with any possible law enforcement demand?
I say no. Resoundingly no. Sure the FBI have a job to do. But that doesnt make it OK to run roughshod over innocent peoples rights and to force business owners to back down on guarantees they've made to paying customers and then throw gag orders on them to stop them telling anyone.
I think you're wrong - and I think people who think like you are part of a much greater problem.
From my reading of the court details (which might differ from yours), lavamail was not trying to make it easy for a particular user's data to be accessed. I have no problem with Lavamail, or Colin, providing access to a single user's data, if they have the ability to do that in a reasonable way.
The problem is that there seem to be two extreme worlds we could end up reaching.
1) The security forces can access all data, anywhere, anytime, freely and without limit.
2) The security forces can access no data at all, and become useless.
Both of these are a bad situation to end up in, but I would consider the second worse. Hopefully we can end up with a more sensible world, where the police can access data with a warrant and the proper authority.
While there are some current big cases, and big problems, it is important to remember there are large numbers of lower level people in the security forces, solving real crimes every day. They must not become over-powerful, or hobbled, by a few high profile cases.
I actually think (1) is the bigger deal and by a significant margin, however...
I do agree with you that there needs to be a reasonable and lawful way to tap very specific and targeted conversations, regardless of the medium. Just like bugging the mafia's phones etc. And by reasonable, I mean a real frikin' judge and with total public transparency, not some secret court and definitely not some blanket surveillance program. Accountability for any abuses is a key requirement that currently seems to be lacking.
I'm practically a conspiracy theorist these days, but I think you're being completely logical while most others aren't.
I have jumped in to this thread, so forgive me if I have missed something, but do not understand the reference to 'Levinson'.
I am from the UK, claim no expertise in the field, but the following might help.
'Levinson' is the name of a report on the media (a very long topic in itself), which has no bearing on giving up data.
The law which covers that,I believe, is known by its abbreviation as RIPPA and,amongst other things, sets out the powers that the UK government have to ask for data from companies. In particular, I understand that it makes it an offence to refuse to provide the key to encrypted material.
"Ladar Levison" is the name of the founder/operator of Lavabit. (The misspelled "Levinson" version of his surname in various bits of this thread may well be my fault. Apologies.)
If circumstances are such that monitoring one customer means all customers have to be potentially monitored then that, in practice, is the way things are. After all the TSA operate on exactly the same principle.
It may not, in some airy-fairy, hippy, juvenile world view, be "OK", but again, it is the way things are.
I find it _astounding_ that people are supporting the idea of forcing Levinson to back down on the guarantee of privacy he'd made to his _other_, not under any probable cause level of suspicion, 400,000 fully-entitled-to-the-privacy-they've-chosen-to-pay-for customers. Violating the privacy of four hundred THOUSAND unrelated-to-the-investigation users? Users who had an expectation of privacy, who were buying a service from a company marketing themselves on providing privacy. Then attempting to coerce that company's founder into not only failing to provide the service his customers were paying him for - but also denying him the right to let them know.
All because _one_ customer has monumentally embarrassed a particularly powerful government department.
Is that _seriously_ "OK" in anybodies worldview?