Hands Off Encryption! Say New Amici Briefs in Lavabit Case

[Rock001]

Just a case that i was not aware of! FBI trying heavy handed tactics.

Hands Off Encryption! Say New Amici Briefs in Lavabit Case
By Jennifer Granick
Saturday, October 26, 2013 at 12:26 PM
The Fourth Circuit Court of Appeals is in the process of deciding the first legal challenge to
government seizure of the master encryption keys that secure our communications with web
sites and email servers. The case could decide the future reliability of encryption protocols to
protect all Internet communications. While the government wants these keys to decrypt user
information, there is really no acceptable way for the Court to order a secure communications
service to break its encryption protocol. The danger to innocent users is too great, and there
are network effects that would shatter critical trust in SSL implementation as a whole.
This dispute involves Lavabit, a now-shuttered encrypted email service provider, which the
federal court for the Eastern District of Virginia ordered to give to FBI investigators its SSL key
to assist in its investigation of one of Lavabit’s users. We do not know, but some have made an
educated guess that the targeted user is whistleblower Edward Snowden. SSL is a standard
security protocol for establishing an encrypted link with web or email servers to ensure that
your communications over the network remain private and unadulterated. Turning over the key
would not only have given the FBI the ability to obtain information about the suspect, but also
about all 400,000 of Lavabit’s customers. Lavabit refused to turn over the key, and closed its
doors instead. Now the District Court order is on appeal, and three groups, the ACLU, the
Electronic Frontier Foundation and the start up Empeopled filed diverse amicus briefs
yesterday.
Aside from the danger to secured communications overall, nothing in our law requires
providers of legitimate email services to turn over keys or otherwise dismantle the security on
their systems to help out in a government investigation. Luckily, there’s an easy answer here.
Lavabit offered to decrypt itself the data the FBI wants on the suspect and disclose it to the
government, and the government presumably can get a search warrant for that particular user.
This is what the Fourth Circuit should order, rather than undermine cybersecurity for us all in
the hunt for one person.
1. Background
The U.S. government had obtained a federal district court order requiring Lavabit to turn over
its SSL key to enable investigators to collect Internet transactional data on one of Lavabit’s
customers. Lavabit refused on the grounds that disclosing the key would give the government
access to communications of all other Lavabit customers, as well as the targeted user. Rather
than comply with the order, in mid-August Lavabit shut its doors. Other secure
communications providers, including Silent Circle (encrypted email) and CryptoSeal (VPN),
soon followed suit, on the ground that these services could not longer promise customers
security if law enforcement could force disclosure of the master keys. Lavabit subsequently
challenged its disclosure order in the Fourth Circuit Court of Appeals. Friday, the ACLU and
ACLU of Virginia (“ACLU”), the Electronic Frontier Foundation (“EFF”), and a start-up
discussion platform called “Empeopled” filed amicus briefs in support of Lavabit.
Hands Off Encryption! Say New Amici Briefs in Lavabit Case : Just Security 2/11/13 7:42 PM
http://justsecurity.org/2013/10/26/hands-encryption-amici-briefs-lavabit-case/ Page 2 of 5
SSL stands for Secure Sockets Layer. It is the standard security mechanism for establishing an
encrypted link between software on your computer and web or email servers on the Internet.
SSL ensures that all data passed between the server and the software remain private and
unaltered.
A protocol describes how a cryptographic algorithm like SSL should be used. Trust is an
essential part of the SSL protocol. “Certificate authorities” are organizations that validate web
or email servers as being genuine and issue SSL certificates. Each SSL Certificate consists of a
key pair as well as verified identification information. When client software attempts to
communicate with an SSL secured site, the server shares the public key with the client to
establish an encryption method and a unique session key. The client software confirms that it
recognizes and trusts the issuer of the SSL Certificate. This is the “SSL handshake” and begins a
secure communications session that protects message privacy, message integrity, and server
security. If an SSL key is compromised, the business is generally obligated to inform the
certificate authority that signed the keys.
Our online security depends on the reliability of the SSL infrastructure — everything from
social networking to online banking depends on trust in SSL certificates.

read the rest here

[GhostShip]

If the FBI are being offered the information they seek and have not accepted that offer then something else is obviously going on here.  I wonder when the public are going to stand up and take back their privacy rights from an over bearing and over eager group of fear mongers.

They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.

Benjamin Franklin , February , 1775 .