The Empty “Lavabit” Threat

Near as I can tell, the first person to pick up on footnote 9 in the government’s response to Apple was Marcy Wheeler at Empty Wheel.

DOJ has submitted its response to Apple in the Syed Farook case. Amid invocations of a bunch of ominous precedents — including Dick Cheney’s successful effort to hide his energy task force, Alberto Gonzales effort to use kiddie porn as an excuse to get a subset of all of Google’s web searches, and Aaron Burr’s use of encryption — it included this footnote explaining why it hadn’t just asked for Apple’s source code.

Screen Shot 2016-03-10 at 6.17.50 PM

That’s a reference to the Lavabit appeal, in which Ladar Levison was forced to turn over its encryption keys.

That it was a threat is beyond question. The snideness of “if Apple would prefer” leaves no doubt.  This refers to a court ordering Apple to turn over its code to the government, handing over the keys to the technological Kingdom.  In reply, Apple pointed out the obvious:

Apple’s latest reply brief clearly registered the company’s dismayed response to this legal shot across the bow:

The catastrophic security implications of that threat only highlight the government’s misunderstanding or reckless disregard of the technology at issue and the security risks implicated by its suggestion.

Such a move would signal a race to the bottom of the slippery slope that has haunted privacy advocates: A world where companies can be forced to sign code developed by the government to facilitate surveillance.

As it turns out, tech companies have been on this slippery slope for a while. They just didn’t put it into any of the TV commercials, apparently of the view that “we fully support the government’s having access to your private information because we care about your safety” wouldn’t make for a good selling point.

But does the history of giving it up to the government mean that the government can demand it, force it, when Apple finally says no?

Ah, Lavabit. I don’t want to go back to beating up Ladar Levison, as he didn’t fail on purpose. But he did, most assuredly, fail.  On the bright side, it means that the Fourth Circuit decision provides no precedent, as the government tries to claim, to compel disclosure of the source code. The decision was procedural, that Lavabit waived its argument because Levison failed to make it before the district court, rather than substantive, that the argument against the order to compel Lavabit to give up its encryption key was wrong.

The issue is revisited at Wired.

But although the two have found themselves on the same path, their fates are already proving to be very different. Where Apple’s very public battle has received strong support from dozens of tech giants like Microsoft and Facebook and has dominated mainstream media for weeks and been discussed in congressional hearings and presidential debates, Levison’s case played out in secret under seal for many months. He was left largely to fight the government on his own under extreme duress, including the threat of arrest if he didn’t do what it wanted—which was hand over the encryption keys for his email service so the government could access Edward Snowden’s Lavabit account and look at his email.

That the two cases played out differently is a bit of an understatement. But.

But the two cases also differ for another important reason: Levison didn’t have the resources or time to assemble a highly skilled legal team to fight his battle and properly exercise his right to due process.

This is true, and wrong.  Apple has the money and access to assemble the legal firepower needed to challenge the government in a battle royale. Levison didn’t.  Yet, that is a strawman, the myth. Raising it again here compels the myth be busted.  It’s not that rehabilitating Levison, who ironically put in an amicus brief in the Apple case (because every “victim” imagines himself to be qualified to speak to the wrongs done him), is a bad thing. Ladar Levison isn’t a bad guy. But that doesn’t mean he didn’t blow it.

On appeal, Levison had some of the most brilliant legal minds around on his side.  Both representing him, and supporting him, he had as strong, if nowhere near expensive, a legal team as Apple. What he did not have is that sort of support before the damage was done. For that, he is responsible.

It’s not that he didn’t have the usual problems of a guy who suddenly finds himself in the government’s crosshairs. Levison didn’t know who the players were in the world of tech privacy, where it intersects with criminal law and federal compulsion.  When the shit hit the fan, he had no clue where to turn. As a result, he floundered, found himself in court without a lawyer, because the guy he retained had something more important to do that day.

His excuse is money. Lawyers are too expensive. The implication is that the lawyers were too greedy, leaving a poor maligned guy like Levison dangling in the wind. Bullshit.

First, Lavabit was a business, offering encrypted email for the express purpose of protecting privacy from the government.  Like any business owner, Levison is responsible for being prepared to deal with foreseeable challenges. He was responsible for being sufficiently financed to handle a challenge. He was responsible for knowing what to do if the shit hit the fan. He was responsible for knowing where to turn for legal representation when the obvious government demand happened. He was responsible for being responsible.

And, when he finally figured out that the Civil Liberties initiative for the Center for Internet and Society at Stanford Law School and the Electronic Frontier Foundation existed, they came to his rescue, together with a broad array of lawyer and scholars, none of whom asked Levison for a dime.  Of course, by then it was too late, because he had already blown it.

Will Apple quiver in fear at the government’s invocation of the Lavabit exception?  No. Of course not, as the decision isn’t precedent, and Apple is totally lawyered up with the best it can buy.  Footnote 9 was never a serious threat, and you can bet that Apple isn’t going to collapse in fear of the government’s SWAT Team showing up to snatch them some code.  But let’s not perpetuate the myth behind it, either that the Lavabit decision authorizes the government to do so, or that Ladar Levison had no responsibility for what happened to Lavabit. Neither is true.

7 comments on “The Empty “Lavabit” Threat

  1. Billy Bob Pinrut

    You mean, he was responsible for being irresponsible. Irresponsibility is no defense in the abdication of liberty. Lavabit-breath, 4th Circuit.

  2. Patrick Maupin

    Yes, Levison failed badly. So badly, in fact, that it’s hard not to give at least some consideration to the rumors that the government told him that he wasn’t allowed a lawyer. Especially with all the reporting that he intially cooperated with the government. You don’t normally run a business like that on initial cooperation with the feds, even if it is minimal.

    But if it is minimal enough, and you are naive enough, I suppose you might take them at their word about your inability to discuss with counsel. Looking at how the FBI was trying to play Apple, reluctant but unthinking uncontested submission to the personal jurisdiction of a hand-picked judge in another state may have been the entire actual goal of the first minimal demand.

    As described in a Wired article from March 17th, Levison is still fighting to have documents from that case unsealed and unredacted. OK, it’s personal now and all, but what does he hope to show? What’s in there that he knows that he thinks will make all the difference once the rest of us know? And is he correct, or is he blinded by feelz? OTOH, if he was blinded by feelz, wouldn’t he just tell us outright and damn the consequences?

    More damning may be the look from the other side. It’s been years. What does the government still have to hide relating to its interactions with Lavabit (as opposed to the underlying Snowden case)?

    1. SHG Post author

      Levison lost the case, lost his business and lost his dignity. He may have blown it, but not because he was evil. Stercus accidit. That’s why it’s a little painful to have to address this again. He doesn’t deserve any more castigation, but he can’t publicly pretend it never happened either.

      1. Patrick Maupin

        > Levison lost…

        Yeah, he lost all that stuff. But all the breathless reporting out there could lead you to believe that his lost is our loss, as well, and as you point out, that’s just not so.

        > he can’t publicly pretend

        If his message is that he had no choice and we’ll only be able to trust the government for the first few years after the revolution, then, yeah — big eye roll.

        But if his message is a PSA about how he screwed up but you shouldn’t screw up the same way, then good on him.

        1. SHG Post author

          I think his PSA is good. I wish he would stop shifting the blame on what happened. It would be wise to put that entire discussion behind him, but he’s still banging on it in Wired.

  3. MelK

    > His excuse is money. Lawyers are too expensive. The implication is that the lawyers were too greedy, leaving a poor maligned guy like Levison dangling in the wind. Bullshit.

    > Levison is responsible for being prepared to deal with foreseeable challenges.

    In an earlier post, you said, “Some might have taken the case for low-, even pro-, bono. Most would take the case for a fraction.” You might be right… once the case was announced. But being prepared is not the same as reacting, and doesn’t have the same costs. How many of that pool would take up the issue on the cheap when it was just a possible threat, and not an immediate one?

    Being responsible is all well and good. Not being capable does not absolve him of the responsibility, either. But I think you’re being unrealistic about the costs of being prepared for that sort of fight. Lawyers don’t have to be greedy, any more than plumbers or caterers do, to be expensive.

    1. SHG Post author

      When you start a business, it comes with all the responsibilities of being a business owner, of which legal fees are a usual cost. The complaint, when Lavabit hit the fan, was that lawyers were too expensive (which, in itself, was largely false as it was based on one lawyer who purportedly wanted a $50k retainer). That became the rallying cry, ignoring that there are a great many competent lawyers available for a fraction of the cost, plus groups like the EFF. But Levison knew nothing abut any of this, got caught flat footed, failed to reach out to anyone to find out, and then blamed lawyers for his inability to properly face the government.

      We take emergency cases all the time. People don’t “plan ahead” to get arrested. That’s what criminal law is all about. No big deal. Within two minutes of getting the first subpoena, he could have found a dozen lawyers by googling. I would have been happy to steer him in the right direction. So would Ken White or Mark Bennett or a host of others. He never called. We can’t help a guy who doesn’t call.

Comments are closed.