US demanded access to encryption keys of email provider Lavabit

The US government demanded from email service provider Lavabit access to all user communications and a copy of the encryption keys used to secure web, instant message and email traffic for its investigation into several Lavabit user accounts, according to a post on the Facebook page of founder Ladar Levison.

Said to be the email service provider for former NSA contractor Edward Snowden, who since June disclosed through newspapers certain documents about surveillance programs by the US National Security Agency, Lavabit shut down in August citing an ongoing legal battle.

Levison said he was shutting down the service rather than become “complicit in crimes against the American people.” He said that under laws passed by the US Congress he could not share his experiences over the last six weeks, even though he had twice made the appropriate requests.

The vast majority of the court records in the Lavabit dispute are now public, as the email provider appeals the order of a District Court before the US Court of Appeals for the Fourth Circuit. “I can now legally admit that I have a pending case and talk about the events leading up to the shut down of Lavabit,” Levison said on his Facebook post on Wednesday.

Judge Claude Hilton of the US District Court for the Eastern District of Virginia denied Lavabit’s motion to quash the search warrant and subsequently issued a $5,000 per day contempt of court citation, which forced Lavabit to surrender its encryption keys, according to the Facebook post.

Levison then decided to suspend operations.

Lavabit has argued that the access the government was seeking far exceeded the authority to collect metadata given to investigators by the so-called pen trap and trace laws enacted by Congress. Besides accessing sensitive information including passwords, credit card transactions, email messages and instant messages, government investigators would have also been able to detect and record IP addresses, which would have allowed it to track and record the physical location of users as they accessed Lavabit’s services, according to the Facebook post.

A Lavabit Legal Defence Fund, set up to raise funds for Lavabit’s legal defence, has so far raised about $150,000. But it needs at least $250,000 if the dispute should go to the Supreme Court, Levison said. Defending the constitution is expensive, he said. When it suspended service in August, Lavabit is said to have had over 410,000 registered users, of which about 10,000 were paying $8 or $16 a year for premium features like encrypted storage.