Unsealed court documents reveal that this summer, a secure, encrypted e-mail service provider was ordered to relinquish all encryption keys that would have resulted in the “defeat [of] its system.”
Owner Ladar Levison of the Texas-based Lavabit shut down his company in August and was presumed to have been subjected to a gag order. At the time, Levison made the announcement to shut down by saying he did not wish to “become complicit in crimes against the American people.”
Presumably because NSA leaker Edward Snowden was one of its customers, the federal government had targeted Lavabit for investigation. The documents feature a redacted name who was wanted for violation of the Espionage Act and theft of government property — the same charges against Snowden.
The unsealed documents report that Levison was prohibited from discussing the case with anyone:
“There is reason to believe that notification of the existence of this order will seriously jeopardize the ongoing investigation, including by giving targets an opportunity to flee or continue flight from prosecution, destroy, or tamper with evidence.”
The documents show that there was a June court order to install a pen register and a trap and trace device on the account being investigated. James Trump, the US prosecutor in the case, testified that any such device “does not download, does not store” and filters so that only information the government is looking for would be accessed.
However, such technology would be ineffective since the user had enabled encryption. As a result, the government wanted Levison to hand over the encryption keys for the service. According to Levison, doing so would have not only opened up Snowden’s account, but would have subjected all of Lavabit’s 400,000 users to investigation.
Levison did offer at least one alternative. He requested time to reconfigure his system so that all other users could be protected while Levison provided information, presumably for Snowden’s account. The offer was refused.
The documents also show that beginning on August 6, Levison would have been fined $5,000 per day until he relinquished the encryption keys.
Levison finally did comply, but only after he shut down the company. When he did provide the information, it was on 11 pages of code in 4-point type. The government called it “illegible.” In addition, to enable the encryption keys, the FBI would have to manually enter 512 individual characters on each key for a total of 2,560 characters. One wrong keystroke would undo the entire process.
Lavabit is still planning to file an appeal. Supporters have assembled a legal defense fund and raised over $150,000. At least $250,000 will be needed before an appeal can be made before the US Supreme Court. Regardless of how an appeal may go, with the Lavabit court documents unsealed, more Americans can see what the American government is doing and intends to do with personal data.