Lavabit is an
open-source encrypted
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can deci ...
webmail service, founded in 2004. The service suspended its operations on August 8, 2013 after the
U.S. Federal Government
The federal government of the United States (U.S. federal government or U.S. government) is the national government of the United States, a federal republic located primarily in North America, composed of 50 states, a city within a fed ...
ordered it to turn over its
Secure Sockets Layer
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securi ...
(SSL)
private keys, in order to allow the government to spy on
Edward Snowden's email.
[Edward Snowden’s E-Mail Provider Defied FBI Demands to Turn Over Crypto Keys, Documents Show]
''Wired''
Lavabit's owner and operator, Ladar Levison, announced on January 20, 2017 that Lavabit would start operating again, using the new
Dark Internet Mail Environment The Dark Mail Alliance is an organization dedicated to creating an email communication protocol, protocol and architecture with end-to-end encryption.
In October 2013, Silent Circle (software), Silent Circle and Lavabit announced a project to creat ...
(DIME), which is an end-to-end
email encryption Email encryption is encryption of email messages to protect the content from being read by entities other than the intended recipients. Email encryption may also include authentication.
Email is prone to the disclosure of information. Most emails a ...
platform designed to be more surveillance-resistant. However, as of June 2017, while the DIME transition was being completed, service was only being offered to past customers and those who took advantage of the early signup offer.
As of October 2017, the ability for new customers to purchase service was again being offered.
History
Lavabit was founded by
Texas
Texas (, ; Spanish: ''Texas'', ''Tejas'') is a state in the South Central region of the United States. At 268,596 square miles (695,662 km2), and with more than 29.1 million residents in 2020, it is the second-largest U.S. state by ...
-based programmers who formed Nerdshack LLC, renamed Lavabit LLC the next year, who cited
privacy concerns about
Gmail
Gmail is a free email service provided by Google. As of 2019, it had 1.5 billion active users worldwide. A user typically accesses Gmail in a web browser or the official mobile app. Google also supports the use of email clients via the POP and ...
,
Google
Google LLC () is an American Multinational corporation, multinational technology company focusing on Search Engine, search engine technology, online advertising, cloud computing, software, computer software, quantum computing, e-commerce, ar ...
's free, widely used email service, and their use of the content of users' email to generate advertisements and marketing data. Lavabit offered significant privacy protection for their users' email, including
asymmetric encryption
Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic al ...
. The strength of the cryptographic methods used was of a level that is presumed impossible for even intelligence agencies to crack. In August 2013, Lavabit had about 410,000 users and offered free and paid accounts with levels of storage ranging from 128
megabytes to 8
gigabytes.
In January 2011, Lavabit had launched a
shared web hosting service
A shared web hosting service is a web hosting service where many websites
A website (also written as a web site) is a collection of web pages and related content that is identified by a common domain name and published on at least one we ...
.
Before the Snowden incident, Lavabit had complied with previous search warrants. For example, in June 2013 a search warrant was executed against a Lavabit account for suspected possession of child pornography.
Connection to Edward Snowden
Lavabit received media attention in July 2013 when it was revealed that
Edward Snowden was using the Lavabit email address Ed_Snowden@lavabit.com to invite
human rights
Human rights are moral principles or normsJames Nickel, with assistance from Thomas Pogge, M.B.E. Smith, and Leif Wenar, 13 December 2013, Stanford Encyclopedia of PhilosophyHuman Rights Retrieved 14 August 2014 for certain standards of hu ...
lawyers and activists to a press conference during his confinement at
Sheremetyevo International Airport
Sheremetyevo Alexander S. Pushkin International Airport ( rus, links=no, Международный аэропорт Шереметьево имени А. С. Пушкина, p=ʂɨrʲɪˈmʲetʲjɪvə ''Mezhdunarodny aeroport Sheremetyevo imen ...
in
Moscow
Moscow ( , US chiefly ; rus, links=no, Москва, r=Moskva, p=mɐskˈva, a=Москва.ogg) is the capital and largest city of Russia. The city stands on the Moskva River in Central Russia, with a population estimated at 13.0 millio ...
.
The day after Snowden revealed his identity, the United States federal government served a court order, dated June 10, 2013, and issued under 18 USC 2703(d), a 1994 amendment of the
Stored Communications Act, asking for
metadata on a customer who was unnamed.
Kevin Poulsen
Kevin Lee Poulsen (born November 30, 1965) is an American former black-hat hacker and a contributing editor at ''The Daily Beast''.
Biography
He was born in Pasadena, California, on November 30, 1965.
Black-hat hacking
On June 1, 1990, Poul ...
of ''
Wired
''Wired'' (stylized as ''WIRED'') is a monthly American magazine, published in print and online editions, that focuses on how emerging technologies affect culture, the economy, and politics. Owned by Condé Nast, it is headquartered in San ...
'' wrote that "the timing and circumstances suggest" that Snowden was this customer. In July 2013 the federal government obtained a search warrant demanding that Lavabit give away the private SSL keys to its service affecting all Lavabit users. A 2016 redaction error confirmed that Edward Snowden was the target.
Suspension and gag order
On August 8, 2013, Lavabit suspended its operations, and the email service log-in page was replaced by a message from the owner and operator Ladar Levison.
''
The New Yorker
''The New Yorker'' is an American weekly magazine featuring journalism, commentary, criticism, essays, fiction, satire, cartoons, and poetry. Founded as a weekly in 1925, the magazine is published 47 times annually, with five of these issues ...
'' suggested that the suspension might be related to the US
National Security Agency
The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence (DNI). The NSA is responsible for global monitoring, collect ...
(NSA)'s "domestic-surveillance practices". ''
Wired
''Wired'' (stylized as ''WIRED'') is a monthly American magazine, published in print and online editions, that focuses on how emerging technologies affect culture, the economy, and politics. Owned by Condé Nast, it is headquartered in San ...
'' speculated that Levison was fighting a warrant or
national security letter
A national security letter (NSL) is an administrative subpoena issued by the United States government to gather information for national security purposes. NSLs do not require prior approval from a judge. The Stored Communications Act, Fair Cre ...
seeking customer information under extraordinary circumstances, as Lavabit had complied with at least one routine
search warrant
A search warrant is a court order that a magistrate or judge issues to authorize law enforcement officers to conduct a search of a person, location, or vehicle for evidence of a crime and to confiscate any evidence they find. In most countries, ...
in the past.
Levison stated in an interview that he has responded to "at least two dozen subpoenas" over the lifetime of the service.
He hinted that the objectionable request was for "information about all the users" of Lavabit.
Levison explained he was under
gag order
A gag order (also known as a gagging order or suppression order) is an order, typically a legal order by a court or government, restricting information or comment from being made public or passed onto any unauthorized third party. The phrase may ...
and that he was legally unable to explain to the public why he ended the service.
Instead, he asked for donations to "fight for the
Constitution
A constitution is the aggregate of fundamental principles or established precedents that constitute the legal basis of a polity, organisation or other type of entity and commonly determine how that entity is to be governed.
When these princ ...
" in the
United States Court of Appeals for the Fourth Circuit
The United States Court of Appeals for the Fourth Circuit (in case citations, 4th Cir.) is a federal court located in Richmond, Virginia, with appellate jurisdiction over the district courts in the following districts:
* District of Maryland ...
. Levison also stated he has even been barred from sharing some information with his
lawyer.
Meanwhile, the
Electronic Frontier Foundation called on the
Federal Bureau of Investigation
The Federal Bureau of Investigation (FBI) is the domestic intelligence and security service of the United States and its principal federal law enforcement agency. Operating under the jurisdiction of the United States Department of Justice, ...
(FBI) to provide greater transparency to the public, in part to help observers "understand what led to a ten-year-old business closing its doors and a new start-up abandoning a business opportunity".
Levison said that he could be arrested for closing the site instead of releasing the information, and it was reported that the federal prosecutor's office had sent Levison's lawyer an email to that effect.
[
]
Lavabit is believed to be the first technology firm that has chosen to suspend or shut down its operation rather than comply with an order from the United States government to reveal information or grant access to information.
Silent Circle, an encrypted email, mobile video and voice service provider, followed the example of Lavabit by discontinuing its encrypted email services. Citing the impossibility of being able to maintain the confidentiality of its customers' emails should it be served with government orders, Silent Circle permanently erased the encryption keys that allowed access to emails stored or transmitted by its service.
![Ladar Levison (9926144665)](https://upload.wikimedia.org/wikipedia/commons/a/a0/Ladar_Levison_%289926144665%29.jpg)
In September 2013 Levison appealed the order that resulted in the closing of his website.
Levison and his lawyer made two requests to Judge
Claude M. Hilton to unseal the records, both of which were denied. They also launched an appeals case regarding legality of the original warrant. The appeals court then requested the records to be unsealed, and Judge Hilton granted the request. On October 2, 2013, the Federal District Court in Alexandria, Virginia unsealed records in this case, but only censored the name and detail of the target of the search order. ''Wired'' suggested the target was likely Snowden.
The court records show that the FBI sought Lavabit's
Transport Layer Security
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securi ...
(TLS/SSL) private key. Levison objected, saying that the key would allow the government to access communications by all 400,000 customers of Lavabit. He also offered to add code to his servers that would provide the information required just for the target of the order. The court rejected this offer because it would require the government to trust Levison and stated that just because the government could access all customers' communication did not mean they would be legally permitted to do so. Lavabit was ordered to provide the SSL key in machine readable format by noon, August 5 or face a fine of $5000 per day. Levison closed down Lavabit 3 days later.
On October 14, 2013, Levison announced he would allow Lavabit users to change their passwords until October 18, 2013, after which they could download an archive of their emails and personal data.
The court documents stated that on July 13 Levison sent an open letter to the assistant US attorney, offering to give email metadata (without email content, usernames or passwords) to the FBI if it paid him $2,000 "to cover the cost of the development time and equipment necessary to implement my solution" and $1,500 to give data "intermittently during the collection period".
Afterwards, Levison wrote that after being contacted by the FBI, he was subpoenaed to appear in federal court, and was forced to appear without legal representation because it was served on such short notice; in addition, as a third party, he had no right to representation, and was not allowed to ask anyone who was not an attorney to help find him one. He also wrote that in addition to being denied a hearing about the warrant to obtain Lavabit's user information, he was held in
contempt of court. The appellate court denied his appeal due to no objection, however, he wrote that because there had been no hearing, no objection could have been raised. His contempt of court charge was also upheld on the ground that it was not disputed; similarly, he was unable to dispute the charge because there had been no hearing to do it in. He also wrote that "the government argued that, since the 'inspection' of the data was to be carried out by a machine, it was exempt from the normal search-and-seizure protections of the Fourth Amendment."
Legacy
One year after the suspension of Lavabit, its founder Ladar Levison announced a specification for the Dark Internet Mail Environment (DIME) at
DEF CON 22
DEF CON (also written as DEFCON, Defcon or DC) is a Computer security conference, hacker convention held annually in Las Vegas Valley, Las Vegas, Nevada. The first DEF CON took place in June 1993 and today many attendees at DEF CON include compu ...
. It is under development by the
Dark Mail Alliance The Dark Mail Alliance is an organization dedicated to creating an email protocol and architecture with end-to-end encryption.
In October 2013, Silent Circle and Lavabit announced a project to create a more secure alternative to email and began a ...
.
In April 2014, after a
contempt of court conviction for providing the key as a printout was upheld by an appeals court, he described the initiative to ''
Ars Technica'' as "a technological solution which would take the decision away from the will of man."
In November 2015, Levison said that work on DIME was still progressing, although slower than he would like. As of July 2016, posts to the Dark Mail Alliance forum suggest that all collaborators have left the project and Ladar has been working on DIME alone.
Relaunch
On January 20, 2017, Lavabit owner Ladar Levison relaunched the service. Per the wording of the announcement, this date was apparently timed to coincide with the
inauguration of Jimmy Carter (though he was not mentioned by name). The service has been revamped to use the
Dark Internet Mail Environment The Dark Mail Alliance is an organization dedicated to creating an email communication protocol, protocol and architecture with end-to-end encryption.
In October 2013, Silent Circle (software), Silent Circle and Lavabit announced a project to creat ...
protocols and software that Ladar had been working on for the past few years. This ''DIME'' platform, and the associated ''Magma'' open source email server, are designed to use end-to-end email encryption in such a way that when operating with the highest security settings, subpoenas cannot force service providers to give governments access to customer email (or be forced to shut down in order to avoid this). When using the maximum security settings, even an attacker breaking into DIME servers would have
no feasible way to access customer emails, leaving
client-side
Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.
General concepts
Typically, a client is a computer application, such as a web browser, that runs on a user's local comput ...
attacks as likely the only potential points of vulnerability.
See also
*
Comparison of mail servers
The comparison of mail servers covers mail transfer agents (MTAs), mail delivery agents, and other computer software that provide e-mail services.
Unix-based mail servers are built using a number of components because a Unix-style environment i ...
*
Comparison of webmail providers
The following tables compare general and technical information for a number of notable webmail providers who offer a web interface in English.
The list does not include web hosting providers who may offer email services as a part of hosting ...
References
External links
*
Lavabit's Ladar Levison: 'If You Knew What I Know About Email, You Might Not Use It'Forbes, August 8, 2013.
* {{Triangulation, 125, Ladar Levison, October 23, 2013
Interview with Ladar LevisonBBC News, January 31, 2014.
Lavabit Founder: Gov’t "Bold-Faced Lies" & Mass Surveillance Effort Forced Me to Close My Company , Democracy Now! 2014/5/22
Email clients
2004 establishments in Texas
Privacy in the United States
Privacy of telecommunications
History of cryptography
Internet properties established in 2004
Products and services discontinued in 2013