Internet Privacy Company Ends Service To Avoid Government Surveillance

CryptoSealCryptoSealRemember Lavabit and Silent Circle, the encrypted email providers that shuttered services because they faced government pressure to enable government snooping on their customers (Silent Circle still offers other privacy services)? Well, you can add CryptoSeal to the mix. The company has ended its CryptoSeal Privacy virtual private network (VPN) service (it still offers enterprise-lever services), which was advertised as "keeps prying eyes off of your internet usage while you're at home, in a coffee shop or even another country," also over concerns about the legal environment and government snooping.

According to a note on the CryptoSeal site:

With immediate effect as of this notice, CryptoSeal Privacy, our consumer VPN service, is terminated.  All cryptographic keys used in the operation of the service have been zerofilled, and while no logs were produced (by design) during operation of the service, all records created incidental to the operation of the service have been deleted to the best of our ability.

Essentially, the service was created and operated under a certain understanding of current US law, and that understanding may not currently be valid.  As we are a US company and comply fully with US law, but wish to protect the privacy of our users, it is impossible for us to continue offering the CryptoSeal Privacy consumer VPN product.

Specifically, the Lavabit case, with filings released by Kevin Poulsen of Wired.com (https://www.documentcloud.org/documents/801182-redacted-pleadings-exhibits-1-23.html) reveals a Government theory that if a pen register order is made on a provider, and the provider's systems do not readily facilitate full monitoring of pen register information and delivery to the Government in realtime, the Government can compel production of cryptographic keys via a warrant to support a government-provided pen trap device.  Our system does not support recording any of the information commonly requested in a pen register order, and it would be technically infeasible for us to add this in a prompt manner.  The consequence, being forced to turn over cryptographic keys to our entire system on the strength of a pen register order, is unreasonable in our opinion, and likely unconstitutional, but until this matter is settled, we are unable to proceed with our service.

We encourage anyone interested in this issue to support Ladar Levison and Lavabit in their ongoing legal battle.  Donations can be made at https://rally.org/lavabit  We believe Lavabit is an excellent test case for this issue.

We are actively investigating alternative technical ways to provide a consumer privacy VPN service in the future, in compliance with the law (even the Government's current interpretation of pen register orders and compelled key disclosure) without compromising user privacy, but do not have an estimated release date at this time.

To our affected users: we are sincerely sorry for any inconvenience.  For any users with positive account balances at the time of this action, we will provide 1 year subscriptions to a non-US VPN service of mutual selection, as well as a refund of your service balance, and free service for 1 year if/when we relaunch a consumer privacy VPN service.  Thank you for your support, and we hope this will ease the inconvenience of our service terminating.

For anyone operating a VPN, mail, or other communications provider in the US, we believe it would be prudent to evaluate whether a pen register order could be used to compel you to divulge SSL keys protecting message contents, and if so, to take appropriate action.

The company's promise to consider restoring service "in compliance with the law (even the Government's current interpretation of pen register orders and compelled key disclosure)" may not be entirely encouraging to customers especially concerned about the surveillance state. Such a restored service would very likely shield users from everybody except the U.S. government and its established snooping habits as administered by the NSA, the FBI and an alphabet soup of other agencies, federal state, and local. That is, it's unlikely to be able to truly protect user privacy. Lavabit owner Ladar Levison compares the modern American surveillance state to the McCarthy era and recommends "against anyone trusting their private data to a company with physical ties to the United States."

But it's a big world, and one in which Google now offers VPN tools intended to frustrate governments outside the United States. Certainly, a company or two based elsewhere should be willing to return the favor.

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  • SugarFree||

    "If you like your business, you can't keep it.

  • Bam!||

    To be fair, he didn't build it.

  • Paul.||

    Breaking: ACA exchange Website actually giant Keylogger set up by NSA.

  • Tonio||

    Badoosh!

  • Mr Whipple||

    But it only affects people using IE 4 or earlier on WinME with Panda Security.

  • Paul.||

    I hear people who use IE4 on WinME get a lot of double posts in forums. True?

  • Mr Whipple||

    No. It happens sometimes when you are using Gentoo behind 7 proxies.

  • Mr Whipple||

  • Mr Whipple||

    But it only affects people using IE 4 or earlier on WinME with Panda Security.

  • Paul.||

    ls a Government theory that if a pen register order is made on a provider, and the provider's systems do not readily facilitate full monitoring of pen register information and delivery to the Government in realtime, the Government can compel production of cryptographic keys via a warrant to support a government-provided pen trap device.

    Yep, I remember sayin' it... or at least thinkin' it. All it takes is a couple of guys in wingtips from the government entering your office, and most of these services will just shut down.

    The government doesn't have to crack your encryption, they just have to throw you in a hole until you give it up or turn it off.

    Never underestimate the government's ability to yadda yadda. It never gets old.

  • Austrian Anarchy||

    But this is just ungentlemanly, unseemly, unAmerican, unEnglish. It sounds French. In the old days, the crypto guys cracked each other's cyphers and implementations. Going in with a note from a judge to hand over the keys is just cheating.

  • Paul.||

    It's certainly not cricket.

  • Mr Whipple||

    Tor, I2P, and GnuPG have no office.

  • Paul.||

    Serious question, do you ever wonder how many whiz kidz working on these open source projects work for the NSA?

    I remember reading an article years ago about some of the security flaws found in open source projects, and some of the people finding them were talking about the many eyes theory-- especially when some of the security flaws had been there for years.

    The complaint from some within the open source community was that the many eyes weren't always looking at all the code. Most of the eyes were looking at some of the code, some of the eyes were looking at another smaller part of the code, and none of the eyes were (in some cases) looking at the really dreary stuff.

    The problem, one person wrote, was that most of the open source developers wanted to work on the rock-star code, no one wanted to do audits of the dreary back-end stuff.

    I fear that the open source community may be full of NSA posers, sticking in obscure mathematical back doors that won't be caught for years.

  • Mr Whipple||

    As far as anyone knows, they have not been compromised. The guy from Silk Road was caught due to old fashioned "police work", not a weakness in the code. The "Clipper Chip" was exposed and the EFF was born. And law enforcement is fighting in the courts to compel a suspect to turn over his passphrase to access his files.

  • Mr Whipple||

    What you really have to watch out for is the government putting an exploit on your computer. You are your own worst enemy.

    Google "FinFisher".

  • Fist of Etiquette||

    But it's a big world, and one in which Google now offers VPN tools intended to frustrate governments outside the United States.

    VPN tools provided by NSA engineers, for sure.

    There are a few VPN services based outside the United States that people can use. How well those foreign companies defend against DoJ coercion, I don't know.

  • Paul.||

    I was just typing it and then deleted my comment because I didn't think it needed saying. But it needs saying. Thanks for that.

  • R C Dean||

    No kidding. I assume Google gives full access to the Total State. Which has significantly cut down on my use of their products.

    For me, the breaking point was when we learned that any Android device is scraping all your passwords, including the password to your home network, and sending them to Big Goog.

  • Paul.||

    Can you provide a link to this?

  • Loki||

    So basically they can either comply with current interpretations of US law, or they can protect their customer's privacy, but not both. Fantastic. We are so fucked.

  • Invisible Finger||

    Some people LIKE the chilling effect.

  • DEATFBIRSECIA||

    "For any users with positive account balances at the time of this action, we will provide 1 year subscriptions to a non-US VPN service of mutual selection."

    non-US. Get used to the sound of that.

  • Paul.||

    Yep, that would be the non-US law enforcement that 'cooperates' with U.S. officials and hands over keys or images of foreign-located servers.

GET REASON MAGAZINE

Get Reason's print or digital edition before it’s posted online

  • Progressive Puritans: From e-cigs to sex classifieds, the once transgressive left wants to criminalize fun.
  • Port Authoritarians: Chris Christie’s Bridgegate scandal
  • The Menace of Secret Government: Obama’s proposed intelligence reforms don’t safeguard civil liberties

SUBSCRIBE

advertisement