The US government violated the Fourth Amendment right to protection from unreasonable searches when it demanded that Lavabit, NSA whistleblower Edward Snowden’s email provider, hand over the encryption keys to its service, lawyers said in court filings on Thursday.
Lavabit founder Ladar Levison closed his secure email service in August after the US authorities demanded he hand over the encryption keys – a move he said would have compromised the personal details of all his 40,000 clients. He is currently fighting the subpoenas and charges of contempt.
“General rummaging through all of an innocent business’ communications with all of its customers is at the very core of what the Fourth Amendment prohibits,” Jesse Binnall, Lavabit’s lawyer, said in the court filing made in the eastern district of Virginia.
“The Fourth Amendment requires a warrant to be founded on probable cause that a search will uncover fruits, instrumentalities, or evidence of a crime. But Lavabit’s private keys are none of those things: they are lawful to possess and use, they were known only to Lavabit and never used by the company to commit a crime, and they do not prove that any crime occurred,” he said.
Levison was subject to a “blizzard of dubious court orders”, the court documents claim, as the FBI tried to force it to hand over the keys to its service. Lavabit proposed a compromise – the company would collect the “metadata” about the target (whose name is redacted) for the government, including “login and subsequent logout date and time, the IP address used to connect” and “non-content headers … from any future emails sent or received using the subject account”.
The court documents state: “This solution - though more than Lavabit thought the law obligated it to do, and one with which the company felt profound discomfort - would have given the government the information to which it was entitled without requiring the company to turn over its private keys, thereby protecting the privacy of its other customers.”
But the government refused, wanting “real-time access” to the target customer’s data. The government then secured a warrant under the Stored Communications Act and ordered Lavabit to hand over its private keys while gagging the company from telling anyone the government had done so.
“Mr Levison made it clear that he had no objection to the government’s lawful installation of the pen-trap device [to record the IP address and the email metadata] - only to the provision of his company’s private keys, 'because that would compromise all of the secure communications in and out of my network',” the documents state.
He did hand over the keys – at first as a printout that the government said was illegible. He closed the service shortly after.
Lavabit’s lawyers claim the government overreached in its use of the Stored Communications Act and the Pen Register Act, which allows it to install monitoring equipment on a company’s service.
Lawyers also argue that the grand jury subpoena also overreached, leading to the closure of his business.
“To commercially ruin a third-party small business using a grand jury subpoena is per se oppressive— indeed is close to the Platonic ideal of an unreasonable demand that ought to have been promptly quashed, especially in light of Lavabit’s ability to provide the government with the information to which it was entitled by other, far less intrusive, means,” Lavabit contends.
Lavabit has raised about $88,000 in an online fundraising drive to finance its appeal.
guardian.co.uk © Guardian News and Media Limited 2010
image: © Steven Depolo