2 email services destroy data rather than reveal files

Published 5:00 am Saturday, August 10, 2013

The shutdown of two small email providers this week illustrates why it is so hard for Internet companies to challenge secret government surveillance: To protect their customers’ data from federal authorities, the two companies essentially committed suicide.

Lavabit, a Texas-based service that was reportedly used by Edward Snowden, announced the suspension of its service. In a blog post, the company’s owner, Ladar Levison, suggested — though did not say explicitly — that he had received a secret search order and was choosing to shut down the service to avoid being “complicit in crimes against the American people.”

Within hours, a fast-growing Maryland-based startup called Silent Circle also closed its email service and destroyed its email servers. The company said it saw the writing on the wall — while also making it plain that it had not yet received any court orders soliciting user data.

Mike Janke, the chief executive, said the company’s customers include heads of state, members of royalty and government agencies. The company will continue its encrypted phone and text messaging service.

In effect, both businesses destroyed their assets — in part or in full — to avoid turning over their customers’ data. Such public displays are far more difficult for large companies to make and help explain why the most public efforts to challenge secret government orders have come from small companies and nonprofits.

“Providers are in a bind,” observed Orin Kerr, a law professor who specializes in surveillance law at George Washington University. “They need to respect the privacy rights of customers in order to keep customers, but they also have an obligation to comply with the law. A small company can say, ‘Rather than comply with the law, we will go under.’ But Verizon is not going to do that.”

Large Internet companies have moved more quietly and cautiously, addressing consumers’ concerns about government requests only after information about secret orders was leaked by Snowden.

On the Lavabit site Thursday afternoon, Levison said he was legally prohibited from explaining why he had been compelled to suspend operations.

“I wish that I could legally share with you the events that led to my decision. I cannot,” he wrote.

“This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States,” he added.

Silent Circle’s chief executive, Janke, said the incident was a reminder of a fundamental flaw with email technology. An “aggressive” government, he said, can extract email data from any company, no matter how good the company’s encryption tools.

Silent Circle destroyed its encryption keys, the digital equivalent of a library setting fire to its membership records to keep the government from knowing who checked out what books.

Marketplace