Snowden's email provider, Lavabit, shutters citing legal pressure

Lavabit specialized in providing a highly secure, encrypted email service

An email provider reportedly used by former NSA contractor Edward Snowden shut down on Thursday, citing an ongoing court battle that it could not discuss.

Lavabit, which launched in 2004, specialized in providing a high-security email service that employed advanced encryption. It was designed to thwart the kind of surveillance techniques that Snowden revealed in June were used by the U.S. government.

Snowden used a Lavabit email address to invite people to a press conference at Sheremetyevo Airport in Moscow on July 12, according to a report from the international wire service Global Post.

Lavabit founder Ladar Levison wrote that he couldn't describe the legal machinations under way. "As things currently stand, I cannot share my experiences over the last six weeks, even though I have twice made the appropriate requests," he wrote in a front-page notice on his website.

Levison wrote that Lavabit has "started preparing the paperwork needed to continue to fight for the Constitution in the Fourth Circuit Court of Appeals. A favorable decision would allow me resurrect Lavabit as an American company."

Snowden, who remains in Russia after being granted asylum for one year, is wanted by the U.S. for passing documents to media outlets such as the Guardian and Washington Post that described anti-terrorism surveillance projects conducted by the U.S. National Security Agency (NSA).

The documents revealed arrangements with major companies such as Microsoft, Google and Verizon to turn over email and Internet-related data under the Foreign Intelligence Surveillance Act (FISA).

Lavabit's website is largely offline, but Google's cache still has a copy of its description of how its service worked. Lavabit used three encryption schemes to scramble email based around Elliptical Curve Cryptography (ECC).

E-mail is encrypted before it is sent to the company's servers. The result of the encryption process means that a message is, in theory, cryptographically impossible to read without a password, Lavabit wrote.

"We say cryptographically impossible because, in theory, an attacker with unlimited computing resources could use brute force to decipher the original message," according to the description.

It appears from the description that Lavabit only retains a Secure Hash Algorithm (SHA) representation of a person's password. The hash, even if it was obtained by investigators with a court order, would likely not be of use to investigators seeking to decrypt Snowden's email.

Lavabit warned that the encryption's strength also relies heavily on a secure password selected by a user. Attackers could also intercept a message in transit if SSL (Secure Sockets Layer) encryption is not used for the communication between a user and Lavabit's servers. Unencrypted messages could also be potentially pulled from a user's hard drive.

"Our goal was to make invading a user's privacy difficult, by protecting messages at their most vulnerable point," Lavabit wrote. "That doesn't mean a dedicated attacker, like the United States government, couldn't intercept the message in transit or once it reaches your computer."

Levison could not immediately be reached for comment. In closing, he wrote: "This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityLavabit

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?