DOJ has submitted its response to Apple in the Syed Farook case. Amid invocations of a bunch of ominous precedents — including Dick Cheney’s successful effort to hide his energy task force, Alberto Gonzales effort to use kiddie porn as an excuse to get a subset of all of Google’s web searches, and Aaron Burr’s use of encryption — it included this footnote explaining why it hadn’t just asked for Apple’s source code.
That’s a reference to the Lavabit appeal, in which Ladar Levison was forced to turn over its encryption keys.
That it was a threat is beyond question. The snideness of “if Apple would prefer” leaves no doubt. This refers to a court ordering Apple to turn over its code to the government, handing over the keys to the technological Kingdom. In reply, Apple pointed out the obvious:
Apple’s latest reply brief clearly registered the company’s dismayed response to this legal shot across the bow:
The catastrophic security implications of that threat only highlight the government’s misunderstanding or reckless disregard of the technology at issue and the security risks implicated by its suggestion.
Such a move would signal a race to the bottom of the slippery slope that has haunted privacy advocates: A world where companies can be forced to sign code developed by the government to facilitate surveillance.
As it turns out, tech companies have been on this slippery slope for a while. They just didn’t put it into any of the TV commercials, apparently of the view that “we fully support the government’s having access to your private information because we care about your safety” wouldn’t make for a good selling point.
But does the history of giving it up to the government mean that the government can demand it, force it, when Apple finally says no?
Ah, Lavabit. I don’t want to go back to beating up Ladar Levison, as he didn’t fail on purpose. But he did, most assuredly, fail. On the bright side, it means that the Fourth Circuit decision provides no precedent, as the government tries to claim, to compel disclosure of the source code. The decision was procedural, that Lavabit waived its argument because Levison failed to make it before the district court, rather than substantive, that the argument against the order to compel Lavabit to give up its encryption key was wrong.
The issue is revisited at Wired.
But although the two have found themselves on the same path, their fates are already proving to be very different. Where Apple’s very public battle has received strong support from dozens of tech giants like Microsoft and Facebook and has dominated mainstream media for weeks and been discussed in congressional hearings and presidential debates, Levison’s case played out in secret under seal for many months. He was left largely to fight the government on his own under extreme duress, including the threat of arrest if he didn’t do what it wanted—which was hand over the encryption keys for his email service so the government could access Edward Snowden’s Lavabit account and look at his email.
That the two cases played out differently is a bit of an understatement. But.
But the two cases also differ for another important reason: Levison didn’t have the resources or time to assemble a highly skilled legal team to fight his battle and properly exercise his right to due process.
This is true, and wrong. Apple has the money and access to assemble the legal firepower needed to challenge the government in a battle royale. Levison didn’t. Yet, that is a strawman, the myth. Raising it again here compels the myth be busted. It’s not that rehabilitating Levison, who ironically put in an amicus brief in the Apple case (because every “victim” imagines himself to be qualified to speak to the wrongs done him), is a bad thing. Ladar Levison isn’t a bad guy. But that doesn’t mean he didn’t blow it.
On appeal, Levison had some of the most brilliant legal minds around on his side. Both representing him, and supporting him, he had as strong, if nowhere near expensive, a legal team as Apple. What he did not have is that sort of support before the damage was done. For that, he is responsible.
It’s not that he didn’t have the usual problems of a guy who suddenly finds himself in the government’s crosshairs. Levison didn’t know who the players were in the world of tech privacy, where it intersects with criminal law and federal compulsion. When the shit hit the fan, he had no clue where to turn. As a result, he floundered, found himself in court without a lawyer, because the guy he retained had something more important to do that day.
His excuse is money. Lawyers are too expensive. The implication is that the lawyers were too greedy, leaving a poor maligned guy like Levison dangling in the wind. Bullshit.
First, Lavabit was a business, offering encrypted email for the express purpose of protecting privacy from the government. Like any business owner, Levison is responsible for being prepared to deal with foreseeable challenges. He was responsible for being sufficiently financed to handle a challenge. He was responsible for knowing what to do if the shit hit the fan. He was responsible for knowing where to turn for legal representation when the obvious government demand happened. He was responsible for being responsible.
And, when he finally figured out that the Civil Liberties initiative for the Center for Internet and Society at Stanford Law School and the Electronic Frontier Foundation existed, they came to his rescue, together with a broad array of lawyer and scholars, none of whom asked Levison for a dime. Of course, by then it was too late, because he had already blown it.
Will Apple quiver in fear at the government’s invocation of the Lavabit exception? No. Of course not, as the decision isn’t precedent, and Apple is totally lawyered up with the best it can buy. Footnote 9 was never a serious threat, and you can bet that Apple isn’t going to collapse in fear of the government’s SWAT Team showing up to snatch them some code. But let’s not perpetuate the myth behind it, either that the Lavabit decision authorizes the government to do so, or that Ladar Levison had no responsibility for what happened to Lavabit. Neither is true.