Lavabit's closure marks the death of secure cloud computing in the US

[dkf]

Once Edward Snowden's use of the email service was public, it was perhaps a given that Lavabit would be targeted by the US

On Thursday afternoon, Ladar Levison, the owner and operator of Lavabit, an email service that prides itself on privacy and security, abruptly closed his website, posting a short message to his former users. "I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly 10 years of hard work by shutting down Lavabit," he wrote. "After significant soul searching, I have decided to suspend operations. I wish that I could legally share with you the events that led to my decision. I cannot."

Levison might be gagged by the law, but it's not hard to guess at least part of the reason why his site is having legal troubles. In early July, journalists and human rights activists received an email from [e-mail], inviting them to a press conference in Moscow's Sheremetyevo airport. Given the NSA leaker's understandable desire for security, it is not surprising that Edward Snowden would use a service designed for keeping messages out of prying hands. But knowing the American government's desire to go to extraordinary lengths (such as grounding the Bolivian president's plane) necessary to recapture him, it was perhaps a given that Lavabit would be a target once Snowden's use of the service was public.

Assuming the former infrastructure analyst's justified paranoia was put to good use, even a fully co-operative Lavabit wouldn't be able to provide the US government with much help. One of the site's biggest selling points against more popular email services such as Gmail is its full support for public-key encryption.


Levison promises he will fight "for the constitution" in the courts, but the odds are stacked against him. Bigger companies with better legal resources than Lavabit have been forced to submit to the national security apparatus. Eventually any metadata the site does hold is likely to end up in the hands of the government. It's not hard to sense the desperation in Levison's voice when he writes that "without congressional action or a strong judicial precedent, I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States", but it's also admirable honesty. From a security point of view, cloud computing in the US is dead on its feet.

http://www.theguardian.com/commentisfree/2013/aug/10/lavabit-closure-cloud-computing-edward-snowden?utm_content=buffer1f1d1&utm_source=buffer&utm_medium=twitter&utm_campaign=Buffer

[Downwinder]

1. In time we might see what else is under that rock.

They are sure trying hard to keep it covered up.

[Egalitarian Thug]

2. Secure cloud is an oxymoron. n/t

[dipsydoodle]

5. Bit like United States Intelligence.

[dipsydoodle]

3. On this subject and likely economic effects

"Spying by the NSA could cost the US cloud computing industry between $22bn and $35bn over the next three years"

"US companies could lose out between 10 and 20 per cent of the foreign cloud market to European or Asian competitors by 2016. "

see WillyT's post Report: NSA Spying Deals Billion Dollar Knockout To US Cloud Prospects - RegisterUK http://www.democraticunderground.com/10023417716

[jtuck004]

4. 10-20% is just the immediate impact. As these companies go forward their designs will most

likely start to include more and more resources based outside the U.S, perhaps only limited by new investments required to create the necessary infrastructure, and bring in the technical folks that may not exist there now, if they are really that concerned, I'm thinking.

[Cronus Protagonist]

6. Naw, it's dead - you'll see a lot more localization in the future

Everything sent abroad goes right through the NSA routers. Data that is local will be more protected just by staying local.

[jtuck004]

7. I think they mean foreign companies talking to other foreign (at least to us) companies.

You are correct for US firms, but that's not where the growth is.

We may become irrelevant to them. And if, as seems likely, our employment continues to become part-time instead of full-time, there will be that much less consumption, and thus less for investment into new tech, as time goes forward.

I forget which town, I think they were building RR locomotives years ago, and they thought they could win by cutting themselves off and sewing all that up through taxes, kind of like a tariff, if I recall. They got hammered, and lost to not only domestic competition but international.

This may have really broad implications going forward.

[dickthegrouch]

11. You'd need a direct wire to the ISP though

Internet Service Providers such as Comcast, AT&T, Verizon, Cox et al are already siphoning any data that goes their way into NSA collection points whether it's destined for foreign destinations or not.

The only way to avoid that is having a direct point-to-point connection to and encrypted server. Otherwise they can always see the source to destination resolution steps.

Typing https instead http in front of an address only hides the content after the encryption negotiation, it does NOT hide the original source and destinations because the address first has to be translated into computer-understood terms rather than human ones.

[Cronus Protagonist]

15. Sure, if you send it, someone can sniff it

And the shorter the travel, the better chance of avoiding interception. Store data on a local server in your own office and the NSA would have to crack into it to get at it, store in "the cloud" and you're naked. It's about harm reduction, minimizing exposure, creating levels of security.

And my money is on states rights here. I think what will happen is that the federal government will get "common sense" restrictions and only have access to data that are transmitted across state lines or outside the country. This will be even more of an incentive to localize.

[cascadiance]

8. And having just attended OSCON convention a few weeks ago, cloud computing IS the big growth area...

... for the tech world now. So, this isn't just some small segment of the high tech market we are talking about. The huge theme at that conference was cloud computing and working with big data.

If the U.S. firms start losing a lot of their development and deployment of cloud technologies overseas, it will be a big drain on our economy that perhaps even the new H-1B quota expansion from immigration bill might not be as damaging towards.

I'm wondering if many companies will rather just deploy their operations overseas instead of having more H-1B Visas do work here if they feel the NSA oversight of their businesses on U.S. localed parts of their business will just cost them more customers.

[MADem]

9. He's getting plenty of money; first from subscription increases, later from legal defense donations.

Ladar Levison, 32, has spent ten years building encrypted email service Lavabit, attracting over 410,000 users. When NSA whistleblower Edward Snowden was revealed to be one of those users in July, Dallas-based Lavabit got a surge of new customers: $12,000 worth of paid subscribers, triple his usual monthly sign-up. On Thursday, though, Levison pulled the plug on his company, posting a cryptic message about a government investigation that would force him to “become complicit in crimes against the American people” were he to stay in business. Many people have speculated that the investigation concerned the government trying to get access to the email of Edward Snowden, who has been charged with espionage. There are legal restrictions which prevent Levison from being more specific about a protest of government methods that has forced him to shutter his company, an unprecedented move.

....Levison plans to appeal the government’s request from him in the Fourth Circuit and has asked supporters to donate to his legal fund. As of Thursday night, hours after making the request, he had received $40,000. (Update, 8/10/13: As of Saturday morning, Lavabit’s legal defense fund is closing in on $90,000.)

....Levison isn’t an privacy absolutist. He has cooperated in the past with government investigations. He says he’s received “two dozen” requests over the last ten years, and in cases where he had information, he would turn over what he had. Sometimes he had nothing; messages deleted from his service are deleted permanently.


If the shutdown is a permanent one, Levison would be walking away from $50,000 to $100,000 in annual revenue, his primary source of income. He also walked away from his personal email address, which was shut down along with all the other Lavabit accounts.....

http://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-ladar-levison-if-you-knew-what-i-know-about-email-you-might-not-use-it/

LAVABIT has worked with the government before, though, so the whole "privacy of our customers' information" argument might not be terribly persuasive. Simply by pulling the string it's entirely obvious that the target was Snowden.

Not all the customers were understanding, either...:

http://www.wired.com/threatlevel/2013/08/lavabit-snowden/

...Reading between the lines, it’s reasonable to assume Levison has been fighting either a National Security Letter seeking customer information — which comes by default with a gag order — or a full-blown search or eavesdropping warrant.

Court records show that, in June, Lavabit complied with a routine search warrant targeting a child pornography suspect in a federal case in Maryland. That suggests that Levison isn’t a privacy absolutist. Whatever compelled him to shut down now must have been exceptional.

A voicemail to Lavabit went unreturned today.

Update 19:45: Lavabit has 350,000 users who aren’t Edward Snowden, and some are decidedly unhappy with Levison’s decision, judging by a flood of angry comments posted to Lavabit’s Facebook page this afternoon....

[usGovOwesUs3Trillion]

10. We have a PIRACY problem, not a PRIVACY problem online.

The Totalitarian Pirates can not tolerate truly secure communications that they can't access.

I predict a boom in business for any country that embraces public-key encryption and offers it's services to the public, the world will beat a path to it's door.

[Recursion]

13. Why does a country need to do anything? Public key encryption is free to anyone who wants it

A VPS to host your emails is $7 per month. If people cared, they would do it (I have for years).

[usGovOwesUs3Trillion]

16. Jurisdiction

They don't have it everywhere, that's why.

[Recursion]

12. There's no such thing as a secure cloud platform

It's a silly idea to begin with.

[usGovOwesUs3Trillion]

17. In the US

True, but I'm sure there are some countries that still respect privacy, and will not breach it without probable cause.

Sad days for the US, but we have had them before, so we can beat the TOTALITARIANS, again.

[Recursion]

18. Anywhere. It's a contradiction in terms

If someone else is hosting it, it's not secure.

[usGovOwesUs3Trillion]

19. As long as the gov can't access it without probable cause is good enough

[dickthegrouch]

14. It's amusing that Government is migrating to cloud

The current mandate is to migrate a very large proportion of government sites and storage to the cloud in order to sic the costs on the cloud provider.

That's one of the reasons IPv6 capability is mandated for all new computer equipment by the US gov. Although it is not really in widespread use, yet.

I've never used Lavabit or TOR, but their loss is incalculable in terms of damage to personal safety in repressive regimes.