Secure webmail service Lavabit suspends operation, citing legal issues

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

If you're interested in webmail security, you've probably heard of Lavabit.

It's a boutique webmail provider based in Texas, USA.

Lavabit differs from the big cloud email players, such as outlook.com and Gmail, by using encryption a bit differently.

It uses public key cryptography not only when you view your messages in your browser (that's the https:// part in the URL), but also when it stores your messages on its servers.

? Public key cryptography, secretly invented by the British in the early 1970s under the mildly confusing moniker of NSE (non-secret encryption), uses two keys, not one, to secure your data. Anyone can lock a file for you to read later, using your public key. You may publish this key openly. But only you can unlock the file, using your private key. As the name implies, this is the one you keep to yourself.

What that means is that the contents of your messages aren't just encrypted on Lavabit's disks so that they are protected from abuse if someone steals the servers.

The theory is that they can't be decrypted "in the cloud" by Lavabit, or anyone else at all, unless you hand over your private key, or someone takes it from you, lawfully or unlawfully.

If this sounds like something you've heard a lot about lately, that's probably because larger-than-life Kiwi entrepreneur Kim Dotom uses something similar in his MEGA file locker service, which opened with some fanfare early in 2013.

(Dotcom therefore not only keeps your content safe from surveillance or theft from his servers, he's also able to put his hand on his heart and say, "Your Worship, it was not possible for me to have known that those files were the complete works of Gene Roddenberry in remastered full HD video.")

Lavabit, as it happens, received a fair bit of publicity recently when it appeared that NSA whistleblower Edward Snowden, the man behind the PRISM revelations, was a user of its services.

Anyway, jumping back to the present: when I said that Lavabit "is a boutique webmail provider," that's not strictly true.

It used to be, but it isn't any more.

Founder Ladar Levison shuttered the service this week, or at least suspended it pending the outcome of some legal wrangles:

I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit. After significant soul searching, I have decided to suspend operations. I wish that I could legally share with you the events that led to my decision. I cannot. I feel you deserve to know what's going on - the first amendment is supposed to guarantee me the freedom to speak out in situations like this. Unfortunately, Congress has passed laws that say otherwise. As things currently stand, I cannot share my experiences over the last six weeks, even though I have twice made the appropriate requests.

What can one say to that? (That's a rhetorical question. You're welcome to answer it in the comments, but please try to be brief.)

Will existing users, seemingly including at least 350,000 people, ever get their data back?

Levison certainly seems to hope so, noting that:

We've already started preparing the paperwork needed to continue to fight for the Constitution in the Fourth Circuit Court of Appeals. A favorable decision would allow me resurrect Lavabit as an American company.

What do we make of this?

If you know your Latin, you'll be familiar with the phrase post hoc ergo propter hoc.

It means "afterwards, therefore on account of," a logical fallacy that reminds you that you can't assume X caused Y simply because Y followed X.

Otherwise you'd be able to reach ludicrous conclusions such as that last night's high tide was the reason I had a cup of coffee after getting up this morning.

So the connection between Snowden and the suspension of Lavabit is so far merely chronological, not necessarily causal.

Let's hope, then, that Levison is able to revive the service, not just so his users can get back into their data, but also so we can find out the true cause-and-effect in this story.

Of course, there's a technological lesson in here for all of us, too.

Lots of people seem to think that cloud services remove the need for you to keep your own backups, on the principle that "you don't buy a dog and bark yourself."

But even if your cloud provider has impeccable credentials in respect of integrity and confidentiality, the availability of your data may be threatened by circumstances outside the control of either of you.

Follow @duckblog

Image of Dark Staffordshire Terrier cross breed howling (it looks like a bark to me) courtesy of Shutterstock.

View the original article here

Encrypted email service Silent Circle silences email in wake of Lavabit closure

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Filed Under: Featured, Privacy

Silent Circle - an encrypted e-mail service similar to Lavabit - says it "see[s] the writing on the wall" and has also shut down its email service.

Lavabit, a service used by whistleblower Edward Snowden that was using public key cryptography to keep messages private in spite of their being stored in the cloud, abruptly shut down on Thursday.

Lavabit said that a gag order kept it from giving details about the legal wrangling that caused it to close.

Founder Ladar Levison said in a statement that it had come down to a decision: either "become complicit in crimes against the American people" or "walk away from nearly ten years of hard work by shutting down Lavabit."

Silent Circle, for its part, said it hasn't yet received subpoenas, warrants, security letters "or anything else by any government" - at least, not yet.

That's why it's acting now, the spy-proof communications provider said:

"We've been debating this for weeks, and had changes planned starting next Monday. We'd considered phasing the service out, continuing service for existing customers, and a variety of other things up until today.

It is always better to be safe than sorry, and with your safety we decided that in this case the worst decision is no decision."

"We apologize for any inconvenience, and hope you understand that if we dithered, it could be more inconvenient."

Silent Circle is not shutting down all its services, mind you - only Silent Mail.

The reason for the selective shutdown is that Silent Mail has "always been something of a quandary," the company said.

Email that uses standard Internet protocols - with SMTP, POP3, and IMAP - can't be secured end-to-end, as it has "far too many leaks of information and metadata" that's intrinsic to the email protocols.

But the email shutdown goes deeper than these issues.

In a statement given to TechCrunch, Silent Circle CEO Michael Janke said that the company's high-profile, at-risk users are simply bound to be targeted by governments:

"There are some very high profile people on Silent Circle - and I mean very targeted people - as well as heads of state, human rights groups, reporters, special operations units from many countries.

We wanted to be proactive because we knew USG [US Government] would come after us due to the sheer amount of people who use us - let alone the 'highly targeted high profile people'.

"They are completely secure and clean on Silent Phone, Silent Text and Silent Eyes, but email is broken because govt can force us to turn over what we have. So to protect everyone and to drive them to use the other three peer to peer products - we made the decision to do this before men on [sic] suits show up.

Now - they are completely shut down - nothing they can get from us or try and force from us - we literally have nothing anywhere."

Silent Circle's pre-emptive closure, on top of Lavabit's self-suspension, has bolstered critics who say that the survival of the technology sector is being threatened by the US government's uncontrollable hunger for surveillance.

Jennifer Granick, the Director of Civil Liberties at the Stanford Center for Internet and Society, wrote this of Lavabit's voluntary shutdown:

"The fact that neither Americans nor foreigners trust the U.S. government and its NSA anymore puts the U.S. communications companies at a severe competitive disadvantage. American law provides almost no protection for foreigners, who comprise a growing majority of any global company's customers.

And even though Americans receive more nominal legal protection, we now know that these legal protects haven't stopped the NSA from wiretaps fiber optic cables inside the United States, warrantlessly gathering Americans' emails and chats from service providers like Google, Microsoft, Yahoo and Apple, collecting phone records on every American for the past seven years, or demanding that companies build, or at least maintain, surveillance backdoors in products advertised as secure from eavesdropping."

Silent Circle is not closing down completely.

The company says that in contrast to its email, its phone, text and teleconferencing offerings - Silent Phone, Silent Text and Silent Eyes - are secured end to end.

The company doesn't have encrypted data and doesn't collect metadata from the conversations that take place through these venues, Silent Circle says, so those offerings will continue as they have, while the company continues to work on improving secure communications.

As for Lavabit, Levison says that the company has already begun to prepare paperwork so as to "fight for the Constitution in the Fourth Circuit Court of Appeals."

He says that a favorable decision would allow him to "resurrect Lavabit as an American company."

Follow @LisaVaas

Follow @NakedSecurity

View the original article here