From August 7–10, Las Vegas hosted Jeff Moss’s internationally known Black Hat
Convention for computer security professionals as well as the 22nd annual DEF CON gathering, attended by hackers worldwide. I was among the many thousands of participants at DEF CON and the following is an interview with Ladar Levison, founder and CEO of Lavabit, which gained national recognition when he shut down his company to prevent the government from gaining access to his customer’s encrypted email.

Maxwell Schmitt: So you’ve been working towards citizen privacy with Dark Mail, right?

Ladar Levison: Yep.

M.S.: What spurred you on the path—when exactly did you find your interest in computers and privacy?

L.L.: I’ve been working with computers since I was probably six or seven years old. My first computer was a 386 SX 16—so if that dates me, I apologize.

M.S.: That’s fine.

L.L.: I’ve been developing for the Internet since the web came about in the early 90s, so I’ve always had that interest—I come from a family of entrepreneurs, so that’s what spurred my interest in creating an online business. And email just seemed like a good candidate. I was spurred to enter that particular market April 1, 2004 when Google announced Gmail—for free personal email accounts with large storage quotas (1 GB at the time) and I thought hey, that’s a good idea; storage is cheap, and it’s only getting cheaper. Why not make my own free email service? And as such, Nerdshack was born. And it became sensitive to the issues that were facing the service providers. Then I became aware of sort of everything that was going on and the privacy implications of it. Part of the reason I started Nerdshack was I liked the idea of Gmail, but I didn’t like Google’s policy of profiling your email for advertising purposes.

M.S.: Which I believe they still do today, correct?

L.L.: Correct. So, I wanted to create a service that I would be comfortable using. And since I aim for privacy, I expect it, I desire it, I pay for it, I bought it. I decided I should strive to start a service that would be [something I would want]. And like I said, over the ensuing year I became very in-tune with the government client implications on privacy for a service provider. At the time, the issue that made headlines in 2004 that I caught wind of were national security letters. I was basically afraid at the time that a national security letter which did not require a judge’s signature and no judicial oversight would put me into a situation where I would go jail for violating the constitution. And I was afraid that I would to jail. So, my secure storage feature and my policy of not keeping meta data logs and not collecting information I did not have a technological need from my users that developed as a result.

M.S.: I’ve read some past interviews about Nerdshack, and I have to ask: as technology and privacy have evolved, do you think that the federal government is taking steps in the correct direction that is beneficial, and do you think that can coexist with fighting terrorism?

L.L.: Yes, I think it’s possible to fight terrorism without sacrificing privacy on a massive scale. Everybody forgets that even before 9/11 when the national security agency was not conducting whole sale or mass surveillance operations, we still had intelligence on the 9/11 hijackers and because of bureaucratic inefficiencies—too much information, too much paperwork, too many things getting buried—that we lost track of those particular terrorists after they entered the United States. I find confusing when someone says that we need more information to fight terrorism, rather than less. But, they couldn’t accurately more efficiently more effectively deal with the information they were getting before.

M.S.: You said that Federal Agents essentially tried to monitor and analyze your traffic and protected webmail—without reaching over boundaries, what was that like—did it give you any insight into how the federal government is handling private industries and date? Was it like peering down the rabbit hole?

L.L.: It was certainly a little like peering down the rabbit hole. You’re given this perception of how you think our government works, how our criminal justice system works, what rights we’re supposed to have guaranteed by our Constitution, such as the right to free speech, the right to privacy, the right to due process, to face your accuser, to protect yourself from self-incrimination. You know all of these rights that we’re taught are so fundamental to freedom and our way of life here in America at a very young age, and all of these things that you thought that we’re supposed to have, have vanished, and you’re left there dumbfounded as to how this could of happened.

M.S.: OK, then Lavabit and its intrusion of both your and your consumer’s privacy must have been scary, a confirmation of your fears.

L.L.: I had been afraid for years that I might be made to modify the code so that I could log out the encryption key for the password of a particular user, thereby circumventing the protections I had built, but I thought if it was going to happen in court, it would happen in public, and was more worried that it would be a result of congressional legislation. I never thought that they’d demand my SSL key in secret, gag me, and then make me spy on all 410,000 people.

M.S.: I remember reading that you offered to add code to log the metadata, did that ever get added?

L.L.: What’s important is that for the first two, three weeks plus, I thought that they were going after everything, quite specifically passwords, and when I read the original order and looked up the statues that it referenced and it required signaling information. In 1970, signaling refers to phone numbers, and it wasn’t until I got a lawyer after two, three weeks, and we talked to someone from the assistant US District Attorney’s that they were only going after metadata. It comes down to: do you really believe the FBI agents? And do you take the other circumstantial evidence? Because I’m pretty sure they were going to collect more than metadata. And I do think that the metadata was a pretext to get the SSL key, or do you trust the attorneys who maintained at least in court that all they were trying to collect was metadata because that was all they could legally obtain. And once that clarification was made, I offered to modify essentially to create to log out just the metadata they were allowed to collect on just the users they were allowed to collect it from. I felt this was the lesser of two evils: between shutting down the system, letting them spy on everyone, or giving them metadata on a handful of users. They refused my offer.

M.S.: And, on that note, without violating any court orders, can you tell us how the battle to save Lavabit is currently doing?

L.L.: It’s over. The court came back and ignored my appeal, and justified not addressing the questions I raised because of a procedural technicality and because they felt I had been dealt “fair justice.” The Supreme Court has a strong tradition of not hearing cases dismissed on procedural grounds. Asking my community to help fund a Supreme Court appeal seems unwise knowing what I know.

M.S.: I have to say, I admired the fact that you gave them the SSL keys over 11 pages in size four font.

L.L.: In those hearings, that it was just information and I think it’s becoming quite clear that encryption can translate ones and zeros in property, I thought if all they want is information then I should be able to print it out and turn it over to them. I really expected them to transcribe the printouts and come at me guns blazing for almost a month and a half at that point, forcing me to fly on a moment’s notice to DC and represent myself because I didn’t have time to find a second lawyer to replace my first one who was legally allowed to represent me there; you know it was quite the ridiculous chain of events. So, I assumed that they were so desperate to get these keys that they would simply transcribe them. And from my perspective, it was really intended as giving me the time I needed to execute my shutdown plan. I was originally subpoenaed and I received that subpoena the day I was given the notice to appear. And I had to show up at the federal court house with those keys in hand because the subpoena demanded them. And I wanted a way to transporting those keys with me through TSA without them leaving my control. You know that you can’t bring any kind of electronic device into a federal courthouse these days. So, the only way that I can ensure that these unencrypted keys remained safe until I turned them over was to print them and put them into a sealed envelope.

M.S.: So I understand that you’ve transitioned into Dark Mail or, as you’ve renamed it, DIME?

L.L.: Dark Mail is the nickname, and DIME stands for Dark Internet Messaging Environment, and it’s really the official name for the protocols and specifications.

M.S.: Can you briefly explain how Dark Mail works?

L.L.: We integrate the elements necessary for an end-to-end encrypted mail system directly into the protocols themselves, which allows clients, and servers to facilitate the exchange of end to end encrypted messages.

M.S.: My final question: We’ve seen great things from college students, I’m thinking of the Vietnam War protests. What do you think students at colleges, especially at technical ones such as RPI, should be doing to aid the cause of electronic privacy?

L.L.: That’s an excellent question. Our generation is the Facebook generation—we are the generation who are the most affected by this loss of privacy. We are the group of people who share things electronically, we meet our spouses over the internet—we attend conferences virtually, so for us, this loss of digital privacy is so much more nascent that the generation is just getting used to the concept of a smartphone. It’s up to our generation to get them interested to help them understand why this is important, because without them then we won’t be able to work to reverse this trend. Because that generation still holds all the cards, all the power.