UPDATE: On Tuesday, August 13, Ladar Levison made his first public appearance since he announced the shut down of Lavabit. In a 20-minute interview with Democracy Now!'s Amy Goodman and Aaron Maté, Levison explained more of his philosophy in creating the secure email service in the wake of the birth of the Patriot Act, but stopped himself (and was stopped by his lawyer, Jesse Binnall) from elaborating on the specific laws that limited him from sharing details about the governmental request he received.
Levison also commented on Lavabit’s connection to Edward Snowden, confirming that an email address attached to Snowden’s name was registered with his service. Snowden spoke in support of Levison’s decision last week through the Guardian’s Glenn Greenwald, stating that he found Levison’s stand "inspiring." "[Edward Snowden] gave up his entire life … so that he could speak out," Levison said. "I haven’t gotten to that point. I still hope that it’s possible to run a private service, a private cloud data service here in the United States without necessarily being forced to conduct surveillance on its users by its government."
Binnall added that Levison’s decision to even speak to media was an incredibly tenuous balancing act with serious consequences. "The simple fact is, I’m really here with him only because there are some very fine lines he cannot cross for fear of being dragged away in handcuffs," Binnall said. "And that’s pretty much the exact fears that led the founders to give us the first amendment in the first place. So it’s high stakes."
At points in which the conversation steered toward specific laws, Levison stopped himself. And when Goodman asked Levison point-blank, "Can you say, Ladar, if you’ve received a National Security Letter?" his lawyer jumped in. "Unfortunately," Binnall said, "he cannot."
Read on to find out what a National Security Letter is, and why Levison, if he did indeed receive one, is risking so much.
On Thursday, Ladar Levison, founder of secure email service Lavabit, posted a vague statement on his website, announcing that the tool used by whistle-blower Edward Snowden would be shutting down under pressure from the U.S. government.
Levison, who launched the service in 2004, created Lavabit for privacy-conscious email users. Unlike Gmail, Lavabit used sophisticated, asymmetric encryption to guard its users’ messaging. Technology site Ghacks, which called Lavabit the most "secure, private" email service in existence, pointed out that "emails, once on the server, can only be read with the user’s password. This means that no one can access them, and that they cannot be handed over either." Lavabit, which had some 350,000 users, received more attention when, in July, one of the invitees to a press conference held by Edward Snowden at Sheremetyevo airport revealed that Snowden had reportedly emailed from a Lavabit address.
"I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit. After significant soul searching, I have decided to suspend operations," he writes. "I wish that I could legally share with you the events that led to my decision. I cannot."
Levison then goes on to explain that he cannot reveal what requests had been placed on him, or Lavabit, over the past six weeks. "I feel you deserve to know what’s going on—the first amendment is supposed to guarantee me the freedom to speak out in situations like this. Unfortunately, Congress has passed laws that say otherwise."
At this point, there’s only speculation as to what could have happened. But the first amendment should protect one guess: It’s possible Levison received a National Security Letter (NSL), a gag order and demand for information by government agencies like the FBI, that has been found, at least in one court, to violate first amendment rights. If the U.S. government was seeking information on Edward Snowden’s email account—and potentially his contacts—it’s possible they could have ordered Levison to fork it over, and not tell anyone that Lavabit had been told to do so at all.
"We don’t know very much at all what’s going on here," Andy Sellars, an attorney at the Digital Media Law Project and the Harvard Berkman Center for Internet and Society’s First Amendment fellow, said, "But reading into what [Levison] wrote, it tracks pretty closely to what would happen if someone received a National Security Letter."
The power of NSLs expanded greatly in the wake of 9/11, with the Patriot Act. Section 505 of the Act made changes to the government’s ability to issue NSLs—it could now do so without prior judicial review—which sought names, addresses, length of service, and billing information of individuals from Internet service providers. Moreover, if the FBI determined that this process could interfere with national security, the NSL would contain a gag order, demanding that the receiver stay quiet about the fact that the FBI was even requesting this information in the first place.
Between 2003 and 2006, the FBI sent out some 200,000 NSLs. And in 2004, when the ACLU challenged the statute that expanded NSL power on behalf of an anonymous Internet service provider at the time, some of their complaint, which they could not disclose for weeks, looked something like this:
"These provisions, initially enacted, did not contemplate any kind of specialized review," Sellars explained. Then, in 2007, the U.S. Court of Appeals for the Second Circuit found that to be unconstitutional, but upheld the gag order through another section, allowing a petition for the court to review why that gag order would be necessary. "I find that completely incoherent," Sellars said. "I can’t think of a more classic example of prior restraint than an order from the government saying you can’t say what you did."
Just this past year, a northern California district court found that NSLs’ gag provisions "significantly infringe upon speech regarding controversial government powers." There’s likely an appeal for that decision, Sellars added, but also no way to know because the case is sealed.
As the Guardian reported, it’s likely Levison received a court order, if he is appealing a case in the Fourth Circuit Court of Appeals. "We have a good inference there that there was a gag order. And then he was shutting down because he didn’t want to become complicit, but that doesn’t tell exactly what [was] that nature of the cooperation," Kurt Opsahl, an attorney for the Electronic Frontier Foundation, told Co.Exist. However, "there’s actually a number of statutes that come with gag provisions," he added, including the FISA and Wiretap Acts. An NSL is just one possibility.
Still, if Levison did indeed receive a court order, it’s plausible he received an NSL, plausible that it dealt with Edward Snowden, and plausible that Levison challenged the gag order placed on him not to reveal he received the letters. We also don’t know if Levison shut down the service rather than comply, or complied but then shut down the service to protect the rest of its users. We won’t know unless the gag order is released. Levison did write that he had started preparing the paperwork needed to "continue to fight for the Constitution in the Fourth Circuit Court of Appeals," and that "A favorable decision would allow me resurrect Lavabit as an American company." Whether that decision will deal with the type of gag order that comes with NSLs remains to be seen, and would likely be at least partially redacted.
"We’ll hope that some of that docket will be unsealed to give the public an idea of some of the policy issues," Opsahl said. "We need to have a debate about the propriety of government’s actions, and to have that we need to have a reasonable amount of transparency."
Opsahl added that by going to third party email providers, the government is essentially asserting that those providers have no fourth amendment privacy rights. "The government is trying to assert it is not an available option to have private communication with somebody else unless they’re in-person, in an open field, and left their electronics in the car," Opsahl said. "A future that does not have room for private conversation is not a future I’d want to live in."
A request for comment from the NSA was returned with an email stating that the agency would refer to the Department of Justice on the matter.
"For about 200 years we had assumed the one thing the government could never do is tell a person they were prohibited from telling someone about something the government did to them," Sellars said. "We have collectively lost our minds since September 11—slowly, very slowly we’re seeing courts recognize that, but we’re far from it."