Right before Edward Snowden told the world it was he who had leaked information about some of the government’s most secret surveillance programs, the FBI was hot on his trail.
One of the places they looked was Lavabit, the company that hosted Snowden’s email account. As we told you back in August, Lavabit shuttered its service, saying it could not say why, because a government gag order was issued.
The insinuation was clear: Lavabit had been served with a so-called national security letter, in which the FBI demands information about a user, but the service provider isn’t allowed to tell the user or anyone else that it was even asked about this.
Last night, the documents filed (pdf) with the United States District Court for the Eastern District of Virginia were unsealed. Even though Snowden’s name is redacted, we can surmise this concerns him, because of the charges against the person and the timing of the investigation. Perhaps more importantly, however, the documents give us detail of what’s usually a secret process. And it illuminates how Ladar Levison, Lavabit’s owner, tried to fight the government’s request for information on one of his users and then a subsequent request for an encryption key that would allow them to read the communication of all its users.
Wired Magazine details the ordeal, which began with a June 28 “pen register” order, demanding so-called metadata for one user. After a few back and forths with the court — which included the threat of jail time for contempt — Levison finally complied on August 2.
But he took final stand against the government: He sent over five, 2,560 character SSL encryption keys, but he did so on an 11 page printout in pretty much illegible 4-point type.
A scan of the printed SSL key handed over by Lavabit owner Ladar Levison. U.S. District Court for the Eastern District of Virginia
“To make use of these keys, the FBI would have to manually input all 2,560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data,” prosecutors complained.
The court ordered a $5,000 a day fine and on Aug. 7, Levison finally relented, handing over digital copies of the keys. That was the same day Levison posted a note on his website saying he was shuttering his business, because he did not want to “become complicit in crimes against the American people.”