Lavabit encryption key ruling threatens Internet privacy
Asking for private SSL keys could hurt the US economy and cause service providers to move to other legal jurisdictions, EFF argues
IDG News Service - A court order forcing former NSA contractor Edward Snowden's email provider to turn over its master encryption key undermines a critical security feature used by major Internet services, the Electronic Frontier Foundation said Thursday.
The EFF, a digital rights watchdog, filed a brief on Thursday in support of the email provider, Lavabit, in the U.S. Court of Appeals for the Fourth Circuit.
Lavabit founder Ladar Levison was found in contempt of court for resisting an order to turn over his company's private SSL (Secure Sockets Layer) key, used to encrypt communications for 400,000 users. He is appealing.
The U.S. government is believed to have sought access to the account of Snowden, who gave out a Lavabit email address after arriving in Russia, but he has not been named in the court documents.
Turning over the private SSL key would have allowed the government to potentially access the communications of all of Lavabit's users, violating the U.S. Constitution's Fourth Amendment protections against overly broad warrants.
"This is like trying to hit a nail with a wrecking ball," the EFF wrote in its brief.
Service providers including Facebook, Google, Bank of America and Amazon rely on SSL -- designated by "https" in a browser's address field -- to protect communications with users.
"Facebook has a single private key that protects the communications of over 1.26 billion users," the EFF wrote. "In the case of Facebook, having the private key used by the company would give unfettered access to the personal information of almost 20 percent of all of the human beings on the planet obtained through the Facebook site for three years."
The EFF argued that the breach of private keys could have a profound effect on the U.S. economy, with service providers likely to move to legal jurisdictions "that afford more protections for privacy and security."
Lavabit was initially served with a pen register order that required it to provide metadata association with the email account the government sought. But like other privacy-focused email and VPN service providers, Lavabit's systems were designed to not retain that information.
The company was then served with a warrant to turn over its private SSL key. Levison opted in early August to shut down Lavabit's service, saying he could no longer guarantee the privacy of users.
Send news tips and comments to firstname.lastname@example.org. Follow me on Twitter: @jeremy_kirk
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts