Lavabit-DOJ dispute zeroes in on encryption key ownership
Enterprises should own and manage all keys, but that's easier said than done
Computerworld - The government's insistence, in its dispute with Lavabit, that cloud service providers hand over their encryption keys when asked, has refocused attention of key ownership and management in the cloud.
Security experts agree that the best way for companies to ensure that their data is safe from snooping eyes in the cloud is to encrypt all their data and to maintain total ownership of the encryption keys. However, pulling off that feat is not always easy, practical or cheap.
Lavabit, a provider of secure hosted email services, shut down operations in August citing concerns that the FBI was coercing it into divulging personal information on its customers.
Founder Ladar Levison claimed at the time that he would rather shut down the company than be part of what he described as crimes against the American people. His actions were prompted by government demands for his company's private Secure Sockets Layer (SSL) keys for decrypting email communications believed to belong to former NSA contract worker-turned document leaker Edward Snowden.
Levison maintained that the keys would allow the government to unlock all encrypted communications belonging to Lavabit's users. He claimed the government's request was similar to someone asking for the master key to open all the rooms in a hotel, when all that was needed was access to a single room.
After initially digging in his heels and getting slapped with a $10,000 fine by a federal court, Levison finally hand-delivered a disk containing the keys to the FBI in August.
The U.S. Department of Justice accused Levison of compromising its investigation by shutting down the company and going public with his complaints. In a motion filed in the U.S. Court of Appeals for the Fourth Circuit this week, the DOJ maintained that Levison did not have the right to thwart the government's legitimate surveillance activities by shutting down the service altogether.
The DOJ angrily dismissed Levison's "parade of hypotheticals" regarding the actions the government could take with the encryption keys and likened his actions to that of a business locking its front gate to thwart execution of a search warrant.
The situation shows why companies that want to protect their data in the cloud need to encrypt everything and maintain full control of the encryption keys.
"This disclosure issue at Lavabit is one very good example of an organization's inability to maintain ownership and control of data in traditional cloud computing environments," said Elad Yoran, CEO of Vaultive, a vendor of cloud encryption technologies. "If a third party can turn our data over without our knowledge or authorization, do we really own or control our data in the cloud?" he said.
If a company maintains its own encryption keys, the government will need to make a legal request for the keys with the company and not the cloud provider, he said. Otherwise, all they would get from the cloud provider would be "encrypted useless gibberish," he said. "This puts the power of ownership back into the hands of businesses."
- NSA defends collecting data from U.S. residents not suspected of terrorist activities
- Groups fear bill would allow free flow of data between private sector and NSA
- Google's move into home automation means even less privacy
- Bill to require warrant for email searches gains ground in House
- Coming soon to a fridge near you -- targeted ads
- Snowden leaks prompt tech firms to tout privacy, transparency policies
- License reader lawsuit can be heard, appeals court rules
- Is EU's 'right to be forgotten' really the 'right to edit the truth'?
- Tails 1.0: A bootable Linux distro that protects your privacy
- Privacy jitters derail controversial K-12 big data initiative
- Cloud Computing Drives IT and Business Agility Hybrid Cloud Accelerates Time to Value What is the main focus for IT in your organization - cost or agility? Many IT discussions today focus on cost controls rather...
- Infographic:10 Reasons to Choose vCloud Air Looking to create an agile, productive, and efficient IT environment? Read this simple infographic to learn about the benefits that VMware vCloud® Air™...
- Data Visualization Techniques: From Basics to Big Data with SAS Visual Analytics This paper discusses some of the basic issues concerning data visualization, from data size and column composition, to solving unique challenges presented by...
- 5 Hybrid Cloud Starting Points Did you know that more than 50% of organizations are already using or planning a move to hybrid cloud?
- Cloud BI in Action: Recorded Webinar of Customer, Kony, Inc. See how Kony, Inc., a leading enterprise mobility company, is using TIBCO Jaspersoft for Amazon Web Services and Redshift to achieve embedded analytics...
- Cloud BI Overview: Jaspersoft for AWS Check out this overview of Jaspersoft for AWS, to easily and affordably build business intelligence solutions as well as embed visualizations and analytics... All Encryption White Papers | Webcasts