Lavabit

Lavabit was founded by Texas-based programmers who formed Nerdshack LLC (renamed Lavabit LLC the next year), citing privacy concerns about Gmail, Google's free, widely used email service, and their use of the content of users' email to generate advertisements and marketing data. Lavabit offered significant privacy protection for their users' email, including asymmetric encryption. The strength of the cryptographic methods used was of a level that is presumed impossible even for intelligence agencies to crack. In August 2013, Lavabit had about 410,000 users and offered free and paid accounts with levels of storage ranging from 128 megabytes to 8 gigabytes. In January 2011, Lavabit had launched a shared web hosting service. Before the Snowden incident, Lavabit had complied with previous search warrants. For example, in June 2013 a search warrant was executed against a Lavabit account for suspected possession of child pornography. ==Connection to Edward Snowden==

File:LavabitCourtDocuments.pdf|thumbnail|right|Court documents (PDF) Lavabit received media attention in July 2013 when it was revealed that Edward Snowden was using the Lavabit email address Ed_Snowden@lavabit.com to invite human rights lawyers and activists to a press conference during his confinement at Sheremetyevo International Airport in Moscow. In July 2013 the federal government obtained a search warrant demanding that Lavabit give away the private SSL keys to its service, affecting all Lavabit users. A 2016 redaction error confirmed that Edward Snowden was the target. Wired speculated that Levison was fighting a warrant or national security letter seeking customer information under extraordinary circumstances, as Lavabit had complied with at least one routine search warrant in the past. Levison stated in an interview that he responded to "at least two dozen subpoenas" over the lifetime of the service. Instead, he asked for donations to "fight for the Constitution" in the United States Court of Appeals for the Fourth Circuit. Levison also stated he has even been barred from sharing some information with his lawyer. Levison said that he could be arrested for closing the site instead of releasing the information, and it was reported that the federal prosecutor's office had sent Levison's lawyer an email to that effect. Silent Circle, an encrypted email, mobile video and voice service provider, followed the example of Lavabit by discontinuing its encrypted email services. Citing the impossibility of being able to maintain the confidentiality of its customers' emails should it be served with government orders, Silent Circle permanently erased the encryption keys that allowed access to emails stored or transmitted by its service. In September 2013 Levison appealed the order that resulted in the closing of his website. Levison and his lawyer made two requests to Judge Claude M. Hilton to unseal the records, both of which were denied. They also launched an appeals case regarding legality of the original warrant. The appeals court then requested the records be unsealed, and Judge Hilton granted the request. On October 2, 2013, the Federal District Court in Alexandria, Virginia unsealed records in this case, but only censored the name and detail of the target of the search order. Wired suggested the target was likely Snowden. Levison closed down Lavabit three days later. On October 14, 2013, Levison announced he would allow Lavabit users to change their passwords until October 18, 2013, after which they could download an archive of their emails and personal data. The court documents stated that on July 13 Levison sent an open letter to the assistant US attorney, offering to give email metadata (without email content, usernames or passwords) to the FBI if it paid him $2,000 "to cover the cost of the development time and equipment necessary to implement my solution" and $1,500 to give data "intermittently during the collection period". Afterwards, Levison wrote that after being contacted by the FBI, he was subpoenaed to appear in federal court, and was forced to appear without legal representation because it was served on such short notice; in addition, as a third party, he had no right to representation, and was not allowed to ask anyone who was not an attorney to help find him one. He also wrote that in addition to being denied a hearing about the warrant to obtain Lavabit's user information, he was held in contempt of court. The appellate court denied his appeal due to no objection, however, he wrote that because there had been no hearing, no objection could have been raised. His contempt of court charge was also upheld on the ground that it was not disputed; similarly, he was unable to dispute the charge because there had been no hearing at which to do so. He also wrote that "the government argued that, since the 'inspection' of the data was to be carried out by a machine, it was exempt from the normal search-and-seizure protections of the Fourth Amendment." == Legacy ==

One year after the suspension of Lavabit, its founder Ladar Levison announced a specification for the Dark Internet Mail Environment (DIME) at DEF CON 22. It is under development by the Dark Mail Alliance. In April 2014, after a contempt of court conviction for providing the key as a printout was upheld by an appeals court, he described the initiative to Ars Technica as "a technological solution which would take the decision away from the will of man." The contempt of court was caused by Levison providing the keys printed in a tiny (4 point) font, which was deemed "largely illegible" by an FBI motion, which went on to complain that "To make use of these keys, the FBI would have to manually input all 2560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data." In November 2015, Levison said that work on DIME was still progressing, although slower than he would like. As of July 2016, posts to the Dark Mail Alliance forum suggest that all collaborators have left the project and Ladar has been working on DIME alone. == Relaunch ==

On January 20, 2017, Lavabit owner Ladar Levison relaunched the service. Per the wording of the announcement, this date was apparently timed to coincide with the inauguration of Donald Trump (though he was not mentioned by name). The service has been revamped to use the Dark Internet Mail Environment protocols and software that Ladar had been working on for the past few years. This DIME platform, and the associated Magma open source email server, are designed to use end-to-end email encryption in such a way that when operating with the highest security settings, subpoenas cannot force service providers to give governments access to customer email (or be forced to shut down in order to avoid this). When using the maximum security settings, even an attacker breaking into DIME servers would have no feasible way to access customer emails, leaving client-side attacks as likely the only potential points of vulnerability. ==See also==