Lavabit appeal confirms original ruling [pdf]
pdfserver.amlaw.comNote that this opinion rests almost entirely on the fact that Lavabit/Levinson failed to raise any of his legal arguments before the trial court. Any lawyer can tell you that, if you want a court of appeals to consider a legal issue, you have to raise it before the lower court first to give them a chance to rule and to develop a record for the court of appeals to review. I'm sure there are those out there who will want to make this into a major privacy ruling, but it just isn't.
Is an unconstitutional act acceptable if a defendant's defense is sub-par?
No. The problem, though, is that it is difficult for a court of appeals to determine whether an unconstitutional act occurred when a party does not raise the concern before the lower court. A court of appeals does not collect evidence and is constrained by the factual record developed below. I don't think we would be better off if courts of appeals resolved a constitutional issues without the issue's having thoroughly investigated and litigated.
In considering this, remember that the record might sometimes be deficient in ways that the court of appeals cannot identify on its own. And it seems likely that inadequate development will cause courts of appeals to things wrong as often as it permits them to get things right despite the procedural "technicality."
Hm. Is there provision for, "Gee, it sure looks like important investigation may not have occurred in this case, perhaps it should be revisited"?
As a defendant (or coder), you don't want to have to rely on exception-handling to save you from error, but as a citizen, I'd like to prevent technicalities from blinding our judicial system to proper consideration of major issues. Technicalities are often there for a reason (as this one is), but that shouldn't stop us from getting at the heart of an issue.catch( DefenseDidNotDoSomethingImportantException e ){ Case.Retrial(); }That can sometimes happen. If it is very obvious that a legal mistake was made, it is possible for a court of appeals to remand the case for further investigation. The problem in this case was not only that issues were not raised, but that Lavabit actually conceded that the government was legally entitled to the information it requested.
The opinion itself actually gets into all of this in considerable detail. I highly recommend reading pages 20-40 -- especially pages 22-23 -- if you find these issues interesting. The opinion also points out that there is a certain value in opinions' being final. If the court of appeals will just overlook the fact that parties have not raised all their arguments before the lower court, what incentive will litigants have in the future to do so? District courts are real courts! A litigant should not feel free to treat the district court proceeding lightly (as Lavabit seems to have done) in the hopes that it can prevail before the "real" court of appeals. The opinion also points out that the identification of issues of major public concern is probably not something that the court can be trusted to do objectively.
Really, this is a case for legislation. The judiciary is responsible for comparing fact and action against agreed and applicable law. The "proper consideration of major issues" is why we have legislation: we're supposed to do this consideration before laws are passed. That's why it takes so much effort to pass a law; it provides time for such consideration. That's where the allowance for filibusters came from: if someone has another angle to bring to bear on a subject, you will goddamn consider it even if it takes a hundred hours.
The judicial system is thus, in a sense, the very exception-handling system you want. It's catching exceptions called "Oh shit, we didn't think of this case and we need to decide consequences now".
Which goes back to Chief Justice Roberts statement on the ObamaCare ruling. “It is not our job to protect the people from the consequences of their political choices,”
Problem is that you can DOS the system this way. You do not want to incent the defense to make weak arguments so that they can try again with stronger arguments in the case of a mistrial.
Mechanically, the adversarial justice system means that yes, the justice system is liable to a failure mode where it will accept illegal acts for reasons that are more procedural than philosophical.
(And vice versa, of course.)
Levison should have hired a competent and experienced attorney the day the FBI contacted him. The errors and failures cited in the appellate opinion are ones that nearly any attorney that passed a Bar Exam wouldn't have made.
With emphasis on experienced - Levison was represented for a bit by a business attorney. He may have passed the bar, but he was completely inexperienced in federal criminal cases.
He was, but I think he only had representation after day 10 or something. The first few days you was way out of his element. I think his business attorney was experienced enough to get someone else on the case as well since it was a bit out of his domain.
The more I read about the case, the less happy I am about having donated to Levison.
Pages 8-12 of this decision convey a narrative about Levison's handling of the FBI requests. In particular, they detail an escalation that Levison himself provoked:
* The DOJ reached out demanding metadata regarding (presumably, and let's just stipulate) Snowden's use of Lavabit.
* Levison rejected the request, on the auspices that Snowden had enabled the "storage encryption" feature of Lavabit.
Here it's worth knowing that Levison had previously complied with similarly narrow requests.
* Levison confirmed to the DOJ that he had the ability to circumvent the storage encryption.
* The DOJ responded to that concession by doing exactly what anyone would have expected them to do: they escalated their demand to include the decrypted Snowden data.
* The DOJ spent eleven days trying to meet with Levison, who stonewalled them; Levison "ignored the FBI’s repeated requests to confer".
* Only upon being threatened with a contempt citation did Levison actually enter a productive discussion with the DOJ.
* Four days after being threatened with contempt, Levison presented the DOJ with a proposal to charge the DOJ $2000 to design and implement his own pen/trap system which would provide data to the DOJ only at the conclusion of the order's time window, with timely updates being provided only at Levison's discretion and only with an additional charge attached.
* Only after this sequence of events does DOJ demand the TLS keys that would have compromised all Lavabit users activities.
Levison's attorneys and the DOJ litigated the question of whether the pen/trap order required him to cough up his TLS keys. But that only happened after Levison did his best to deter the DOJ from collecting information about Snowden. As evidence for this: the DOJ eventually did install a pen/trap device of some sort, without the TLS keys, and attempted to use it to collect evidence. Had Levison complied with the DOJ productively from the beginning, he probably could have worked with them to produce the information they required without compromising the rest of his users.
I already had a problem with Lavabit as an inept and dangerous privacy solution (you can obviously see that it was; Levison was trivially able to subvert the privacy of all of his users, and was eventually forced to do so).
But almost as bad as that is his handling of the legal situation here. Read the language of the decision carefully and you'll see that had Levison simply began this process with his proposal, minus the time lag problem, but perhaps even including the price tag, he might have had that solution accepted! Instead, he seems to have seized an opportunity to poke a giant bear with a stick. The bear then ate him and his users.
Later: Also, bad facts make bad law. Great to see that we now have more case law establishing that pen/trap orders demand TLS keys.
I am not a lawyer, but having read through the decision it still seems to me that the fact someone is an asshole is strictly immaterial to the issue of weather or not it is reasonable/constitutionally allowable to issue a warrant of any kind that would:
1) Compromise the presumed privacy of any parties in addition to the target, much less every one of a businesse's clientele. (If you have a search warrant for a apartment, do you get to search all the apartments in the building? No, unreasonable search and seizure on the face of it.)
2) Cause material damages as to completely destroy the core business of an unrelated and presumed innocent business owner. Albeit asshole.
The government argued successfully that the warrant was “very narrow, specific”, but while that may be true in intent it is not true in effect. If in order to tap one suspected criminal it is necessary to undermine the right to privacy of one or more innocent bystanders (much less many) law enforcement and the court's hands must necessarily be tied.
That a citizen would be resistant to this seems reasonable. So what is left should only be a question as to how much being an asshole to the FBI constitutes contempt of court.
I'm not a lawyer either, but if you reread my comment, you'll see that my issue here is that Levison had an opportunity to work with the DOJ without compromising all of his users: the production of his TLS keys wasn't litigated until after he had stonewalled DOJ over narrower requests.
That is difficult to assert since as soon as the DOJ finally did install the tap and got encrypted traffic (as he had told them they would from the beginning) they immediately insisted on the keys.
I can't imagine they would not have demanded the keys if only he had been more cooperative from the beginning. And it is not unreasonable to believe he was fearful of that outcome from the beginning. In fact as part of the tap order he objected to he was required to "assist" which even the court noted was an ambiguous requirement (although avoided a decision on that issue).
Look back a page, and check out my original comment. Levison offered a solution where he'd provide the decrypted information the DOJ wanted, but it was rejected, because:
* By the time he suggested it, he had demonstrated hostility to DOJ's cause
* He refused to provide timely updates, instead dictating that information would be provided only at the conclusion of the monitoring window
The original order allowed law enforcement to [“capture all non-content dialing, routing, addressing, and signaling information . . . sent from or sent to” the target’s account.] (note "non-content")
Levison told the FBI when first contacted that he could not do this because of the encryption mode the target used. He told the FBI [“Lavabit did not want to ‘defeat [its] own system.’”] presumably by disclosing it's private keys for the ssl traffic. Only later did he come up with a way that he could comply with this order without disclosing Lavabit's private keys, but by the next day that was already too late because:
That very same day as the first order the FBI got a new broader order that [instructed Lavabit to “provide the [FBI] with unencrypted data pursuant to the [Pen/Trap] Order” and reiterated that Lavabit was to provide “any information, facilities, or technical assistance . . . under the control of Lavabit . . . [that was] needed to provide the FBI with the unencrypted data.”]
So this is where I make my point above, that this seems over reaching, and Levison's reactions from that point forward are understandable if argumentative. It is only after this point that one could argue he "demonstrated hostility".
--
However, it should be noted here that this appeals court decision does not ratify the magistrate judge's approval of a wire tap or the original court's decision against Levison and Lavabit. This decision even notes that Levison fails to make the arguments I made above so cannot consider them.
Let's stipulate for the purposes of this thread that he broke the law, was a jerk, and did a morally wrong thing.
None of that is justification to violate the privacy of innocent third parties.
You have no evidence that any such violation occurred, and neither do I.
The DOJ spent eleven days trying to meet with Levison
You emphasized eleven days as if it is some astronomical figure. In normal court proceedings, the simplest act like scheduling a deposition for questioning a witness takes months.
In the real world, people just aren't sitting around doing nothing waiting for a subpoena from the FBI to come in. Sometimes they're in the middle of a big push for a project, sometimes they're shoring up security for the latest 0-day exploit, sometimes they're in Tahiti sipping drinks on a beach for two weeks without access to email or a phone.
Sure, time sensitive criminal cases would be great if it went faster but eleven days is not out of line by any stretch.
I agree that legally, Levison probably made a mistake by stonewalling DoJ.
However, I worry about what losing this case means in the grand scheme of things. DoJ's argument was that they should be able to get the key to decrypt all e-mails for all of Lavabit's users, and the Court says that's fine because the government "wouldn't" use the key for anything other than the "target" - which seems like a ridiculous and incredibly reckless argument post-Snowden.
Would Google just hand over the key to all of their Gmail users? Let's imagine they weren't using PFS - or let's imagine they were asking Microsoft for the Outlook key, instead.
> Would Google just hand over the key to all of their Gmail users?
No, Google would comply with the narrow, specific warrant the first time. Again, it bears repeating that the only reason DoJ asked for the master key in the first place is because Levison refused to comply with the narrow requests. If Levison wouldn't do it, then the government would figure it out on their own, but the only reason this situation even came up is because Levison wouldn't do it.
Not complying with a narrow and specified warrant is highly hypocritical, especially in this case since Snowden's initial claims were entirely about wanting the NSA to have to have specific warrants for their searches instead of using broad search authorities. But when push came to shove and the government presented a narrow and specific warrant, of a type Levison had previously honored, all of a sudden that was no longer good enough for this particular privacy advocate.
Wasn't it his right to fight a court order (don't think it was warrant) like that? I think Twitter has fought court orders in the past, while refusing to give the data in the mean time.
I think Levison's mistake was that he did it all by himself, instead of hiring a lawyer and following the proper procedure for doing that. The government escalated with a broader request, which I guess was also their right to try (even if it's wrong), and then Levison tried to fight that with a lawyer, but I guess it was a little too late for that, and what he did initially complicated things for his case.
Wasn't it his right to fight a court order (don't think it was warrant) like that?
It's his right to fight the government request, or to appeal the court order to a higher court. But it's not his right to evade compliance. Yes the court is part of the government but it's not the executive part - courts can and do reject the arguments of the government (qua legal entity) all the time.
He didn't simply fight the order; he deliberately antagonized the DOJ.
Presumably Twitter's lawyers avoid brinksmanship, knowing that they'll inevitably lose and, in the process, lose credibility with the court.
It is, but at this point he didn't have a lawyer (via a quote from his lawyer in the most recent court proceeding), so instead of going to court with the DOJ, a Lawyer, and a Judge, and explaining the technical issues, he just hoped they would go away or something. When you get a note of this nature from the DOJ that you aren't interested in complying with, you should probably carve out some time on the same day to call your lawyer, or the ACLU or EFF.
I think the crux of the DOJ's argument is that they should be able to get the key because less intrusive methods they might have employed have been blocked, so it has become the least intrusive method available.
Google wouldn't hand over the key to all of their Gmail users — they would offer a better option, which Levison did not.
It means almost literally nothing precedent-wise. The court affirmed the district court because Levinson either failed to raise his arguments before the district court and, in fact, conceded "that the [G]overnment [was] entitled to the [requested] information." It does not reach the substantive propriety of the warrant and order and cannot properly be cited for any such proposition.
I'm unhappy that Levison's overbearance on email caused Pamela Jones to quit Groklaw. Ordinarily these are exactly the kinds of cases PJ would be able to demonstrate some of her expertise on, by explaining how longstanding legal principles apply to problems in the tech sector.
She was never a coder though, and so her expertise on tech was limited to what was explained to her. I don't think Levison was making his claims about all emails everywhere being read by the goons at Minitrue in order to scare PJ in particular, but that was the net effect.
Her quitting was like a superhero retiring.
> I'm unhappy that Levison's overbearance on email caused Pamela Jones to quit Groklaw.
Can you explain?
I may be wrong, but my misunderstanding is that Groklaw shut down because there is no way of knowing whether or not the privacy has been compromised.
In other words, this incident revealed information that was already true; Groklaw shut down in the light of the new knowledge, but not because the previously-private communication was suddenly vulnerable.
> I may be wrong, but my misunderstanding is that Groklaw shut down because there is no way of knowing whether or not the privacy has been compromised.
And that was true since POP3 was invented. When you're sending the digital equivalent of postcards to each other then you can never know if your privacy has been compromised.
It's unclear to me what PJ really thought about the privacy of email before Levison, but what is clear is that Levison and SilentCircle's hysterical actions are what convinced PJ to close up shop.
I disagree with the entire 'very little cause required to compel disclosure of metadata'; essentially, the third-party doctrine should only apply if users are consciously giving their data to a third party for the purpose of redistribution, and not purely incidentally to a service.
If they can argue something like a copyright banner in a ROM is "a mere instrumentality", there's no reason the defense side shouldn't be able to argue giving calling information to a cell provider, or mail headers to a mail server, aren't essentially the same instrumentalities.
(I've talked to lawyers who agree, but they all also agree this ship has sailed for many decades.)
That said, yes, he's both technically and legally incompetent. It's sad, and has made bad law for everyone else.
Not even remotely similar. A copyright banner isn't even a mere instrumentality because copyright law already protects the ROM; the banner is redundant. (see http://www.copyright.gov/circs/circ03.pdf. Notice was required by the 1976 Copyright act but after the US adopted the Berne Convention notice became optional.)
On the other hand, mail headers and other such meta are frequently necessary to provide the service. The very act of using email requires giving one or more headers to one or more third-party email providers; the very act of making a phone call requires giving phone number information to one or more phone service providers.
I was referring to https://en.wikipedia.org/wiki/Sega_v._Accolade
I'm not sure how that case is relevant to your point. In that case, Sega used a TMSS file as a hardware check to make sure games were properly licensed. Acclaim copied this file and included it in their games after reverse-engineering some demo games. This was eventually found to be fair-use since it was required to run their games but there was no technical reasons for the use of the TMSS file.
That's different from the point you were trying to make. The provision of email addresses and phone numbers are inherently necessary for an email provider or telephone service provider to provide those services. They aren't just incidental data--they're a fundamental part of the service transactions at issue.
I agree that Smith v. Maryland, 442 U.S. 735 (1979) and its progeny are not great, and it's possible, though unlikely, that the Supreme Court will eventually revisit the issue. But Levison's actions in no way helped make that any more likely. On the contrary he completely failed to preserve the issue. His mistakes were in large part due to the repeated efforts to act as his own attorney. I'm sympathetic regarding the high cost of legal representation but he could have at least tried to reach out to one of the fairly well funded public groups that do work in this area early on.
I guess you're just taking it as a given that resisting the DOJ's persecution of Snowden was an error. I'm not really surprised, given your history of cheerleading for the NSA, but anyone who doesn't agree with that is going to find the rest of your reasoning a bit wanting.
I wouldn't describe anything tptacek has done as "cheerleading for the NSA". He is less apt to get riled up than a lot of people, but "cheerleading" implies more active support than just not being convinced that somebody is the Devil.
None of the logic in the comment you're replying to has anything at all to do with NSA, so your objection to it says more about your biases than mine.
It was military-grade sec with valley-grade marketing.
The problem of a company providing a privacy service being a SPOF necessitates a more distributed approach that can "route around" attempts to shut it down. Any current or future entrant in privacy app space needs to also consider that one of several lessons to avoid the same fate as Lavabit.
For now, even with GPG are there any good/cheap email services that just don't log anything, don't append IPs or correct time headers and are outside US jurisdiction? (Friend's server in Thailand doesn't count... More than one box plz)
Maybe Levison didn't want the FBI to track down and capture Snowden and throw him in jail for the rest of his life.
Sigh.
Why does every landmark case involving online privacy have to involve incompetent, unsavory, or sometimes even downright despicable people (e.g. child pornographers) on the defense side?
In order to force the legal system to take a serious look at the core issues (whether the Feds can compel a company to produce its SSL private keys, whether they can compel a man to produce the password to his TrueCrypt drive, etc.) instead of getting distracted by all sorts of procedural bullshit, the case needs to have a competent defendant and even more competent counsel who make no serious mistakes throughout the course of the trial. That's the only way we're going to get a clear, decisive precedent, because otherwise the procedural blunders will dominate the legal result.
Levison's failure to contact the EFF or ACLU the moment he received the first pen/trap order has led us all to waste a lot of time and resources litigating mostly peripheral issues, and probably caused a lot more hardship for Levison himself than he ever needed to get into. Meanwhile, we still don't have a clear idea of what the U.S. legal system thinks about forcing the disclosure of SSL private keys.
Of course, hindsight is 20/20, so maybe there are adequate explanations for why he thought it was a good idea to wave a middle finger in the face of the DOJ.
But in the grand scheme of things in the battle for internet freedom, I think we just missed a golden opportunity to get the courts to tackle some serious constitutional issues. Just like in all those other contempt cases where TrueCrypt drive in question obvious contained CP, or all those other surveillance cases where the defendant was a heavy uploader. Assholes, pirates, and child pornographers have rights, of course, but they usually don't make effective crusaders.
"Levison provided the FBI with an 11-page printout containing largely illegible characters in 4-point type, which he represented to be Lavabit’s encryption keys"
This made my day.
We've all chuckled at the "man pays divorce settlement with truckload of pennies" stories before.
But this is the story of a guy without good legal representation pissing off the judge and setting bad precedent that could affect all of us.
I see this as a cautionary tale about the limits of cloud-storage of anything. If you really care and you're facing an adversary with subpoena power over your ISP, the only solution is to ensure the ISP simply never sees the plaintext. Thus PGP, S/MIME, etc.
I don't see why the court couldn't 'refashion' Levison's statement ...
"[I object] to turning over the SSL keys because that would compromise all of the secure communications in and out of my network, including my own administrative traffic."
... into "anything remotely close to a statutory-text-based challenge to the district court’s fundamental authority under the Pen/Trap Statute"
As a lay person, it sounds like the court wasn't trying very hard.
It's clear to me, even as a lay person, that Levinson's statement does not refer to any statutory text. Or any legal procedure, etc. On what grounds was he objecting?
"A party does not go far enough by raising a non-specific objection or claim"
Obviously Levison is attempting to argue that the pen/trap statute is limited to specific information ("metatdata") and it does not allow interception of "all of the secure communications [and] administrative traffic".
That he didn't cite the chapter and verse which this contradicts seems like an situation where he needed a real defense lawyer.
I fought the law and law won... just started playing in my head.