Edward Snowden

Snowden hunt led to shutdown of secure e-mail service Lavabit

Owner of a secure e-mail service used by NSA whistle-blower Edward Snowden closed his business after FBI sought access to all its users

PUBLISHED : Friday, 04 October, 2013, 12:00am
UPDATED : Friday, 04 October, 2013, 5:39am

One day last May, Ladar Levison returned home to find an FBI agent's business card on his Dallas doorstep.

So began a four-month tangle with law enforcement officials that would end with Levison shutting the business he had spent a decade building and becoming an unlikely hero of privacy advocates in their escalating battle with the government over internet security.

It was the equivalent of asking Coca-Cola to hand over its secret formula
Ladar Levison

Prosecutors, it turned out, were pursuing a notable user of Lavabit, Levison's secure e-mail service: Edward Snowden, the former National Security Agency contractor who leaked classified documents that have put the intelligence agency under sharp scrutiny.

Levison was willing to allow investigators with a court order to tap Snowden's e-mail account; he had complied with similar, narrowly targeted requests involving other customers some two dozen times. But they wanted more, he said: the passwords, encryption keys and computer code that would essentially allow the government untrammelled access to the protected messages of all his customers. That, he said, was too much.

"You don't need to bug an entire city to bug one guy's phone calls," Levison, 32, said in a recent interview. "They wanted to break open the entire box just to get to one connection."

On August 8 Levison closed Lavabit rather than, in his view, betray his promise of secure e-mail to his customers. The move, which he explained in a letter on his website, drew fervent support from civil libertarians but was seen by prosecutors as an act of defiance that fell just short of a crime.

The full story of what happened to Levison since May has not previously been told, in part because he was subject to a court's gag order. But on Wednesday, a US federal judge unsealed documents in the case, allowing the technology entrepreneur to speak candidly for the first time about his experiences.

Spokesmen for the US Justice Department and the FBI said they had no comment.

Levison's battle to preserve his customers' privacy comes at a time when Snowden's disclosures have ignited a national debate about the proper limits of surveillance.

Much of the attention has been focused on internet giants like Microsoft and Google. Lavabit, with just two employees and perhaps 40,000 regular users, was a midget by comparison, but its size and Levison's personal pledge of security made it attractive to users like Snowden.

Levison, who studied politics and computer science at Southern Methodist University, started Lavabit in April 2004, the same month Google rolled out Gmail.

On occasion, he was asked to comply with government requests for specific e-mail accounts, including that of a child pornography suspect in the state of Maryland this year. Levison had no qualms about co-operating with such demands, but the latest request was far broader.

The FBI agent who left his business card last May did not mention at first who the government was pursuing. The name was redacted from the court order unsealed on Wednesday, but the offences listed are violations of the Espionage Act, and the timing of the government's case coincides with its leak investigation into Snowden, which began last May when he fled Hawaii for Hong Kong carrying laptops containing thousands of classified documents.

By then, Snowden's Lavabit e-mail address was already public. He was still using a Lavabit address this July, when he summoned reporters to a news conference at the Moscow airport.

That e-mail invitation proved to be an unintended endorsement for Lavabit's security. Before that, Levison said that, on average, Lavabit was signing up 200 new users daily. In the days after Snowden's e-mail, more than 4,000 new customers joined each day.

But a month before the news conference, court documents show, Levison had already received a subpoena for Snowden's encrypted e-mail account. The court order required Levison to log Snowden's account information and provide the FBI with the private encryption keys that unlock communications for all users, he said.

"It was the equivalent of asking Coca-Cola to hand over its secret formula," Levison said.