Lavabit is an open-source encrypted webmail service, founded in 2004. The service suspended its operations on August 8, 2013, after the U.S. Federal Government ordered it to turn over its Transport Layer Security (TLS) private keys, in order to allow the government to spy on Edward Snowden's email. Lavabit's owner and operator, Ladar Levison, announced on January 20, 2017, that Lavabit would start operating again, using the new Dark Internet Mail Environment (DIME), which is an end-to-end email encryption platform designed to be more surveillance-resistant. However, as of June 2017, while the DIME transition was being completed, service was only being offered to past customers and those who took advantage of the early signup offer. As of October 2017, new customers were again being offered the opportunity to purchase service.
History Lavabit was founded by Texas-based programmers who formed Nerdshack LLC (renamed Lavabit LLC the next year), citing privacy concerns about Gmail, Google's free, widely used email service, and their use of the content of users' email to generate advertisements and marketing data. Lavabit offered significant privacy protection for their users' email, including asymmetric encryption. The strength of the cryptographic methods used was of a level that is presumed impossible even for intelligence agencies to crack. In August 2013, Lavabit had about 410,000 users and offered free and paid accounts with levels of storage ranging from 128 megabytes to 8 gigabytes. In January 2011, Lavabit had launched a shared web hosting service. Before the Snowden incident, Lavabit had complied with previous search warrants. For example, in June 2013 a search warrant was executed against a Lavabit account for suspected possession of child pornography.
Connection to Edward Snowden
Lavabit received media attention in July 2013 when it was revealed that Edward Snowden was using the Lavabit email address Ed_Snowden@lavabit.com to invite human rights lawyers and activists to a press conference during his confinement at Sheremetyevo International Airport in Moscow. The day after Snowden revealed his identity, the United States federal government served a court order, dated June 10, 2013, and issued under 18 USC 2703(d), a 1994 amendment of the Stored Communications Act, asking for metadata on a customer who was unnamed. Kevin Poulsen of Wired wrote that "the timing and circumstances suggest" that Snowden was this customer. In July 2013 the federal government obtained a search warrant demanding that Lavabit give away the private SSL keys to its service, affecting all Lavabit users. A 2016 redaction error confirmed that Edward Snowden was the target.
Suspension and gag order On August 8, 2013, Lavabit suspended its operations, and the email service log-in page was replaced by a message from the owner and operator Ladar Levison. The New Yorker suggested that the suspension might be related to the US National Security Agency (NSA)'s "domestic-surveillance practices". Wired speculated that Levison was fighting a warrant or national security letter seeking customer information under extraordinary circumstances, as Lavabit had complied with at least one routine search warrant in the past. Levison stated in an interview that he responded to "at least two dozen subpoenas" over the lifetime of the service. He hinted that the objectionable request was for "information about all the users" of Lavabit. Levison explained he was under a gag order and that he was legally unable to explain to the public why he ended the service. Instead, he asked for donations to "fight for the Constitution" in the United States Court of Appeals for the Fourth Circuit. Levison also stated he has even been barred from sharing some information with his lawyer. Meanwhile, the Electronic Frontier Foundation called on the Federal Bureau of Investigation (FBI) to provide greater transparency to the public, in part to help observers "understand what led to a ten-year-old business closing its doors and a new start-up abandoning a business opportunity". Levison said that he could be arrested for closing the site instead of releasing the information, and it was reported that the federal prosecutor's office had sent Levison's lawyer an email to that effect. Lavabit is believed to be the first technology firm that has chosen to suspend or shut down its operation rather than comply with an order from the United States government to reveal information or grant access to information. Silent Circle, an encrypted email, mobile video and voice service provider, followed the example of Lavabit by discontinuing its encrypted email services. Citing the impossibility of being able to maintain the confidentiality of its customers' emails should it be served with government orders, Silent Circle permanently erased the encryption keys that allowed access to emails stored or transmitted by its service.
… excerpt ends here. Continue reading the full article.



