CryptoSeal

» see cryptoseal.com as it lived, on the wayback machine

~ the obit ~

Lavabit closed on 8 August 2013 and the reason stayed sealed for ten weeks. When the filings in that case were finally unsealed in early October, they showed something worse than the rumor. The government had asked Ladar Levison for the private SSL keys to his whole mail service on the strength of a pen register order, a legal instrument designed in the era of telephone exchanges to collect the numbers you dialed rather than what you said. Those keys protected every account Lavabit had, not the single account the order named.

Ryan Lackey read those documents and worked out that CryptoSeal was standing in the same place. He had built the company in 2011 with money from Y Combinator and from angels in the security world, and it sold two things: CryptoSeal Connect, a private network a company could rent instead of running, and CryptoSeal Privacy, a consumer VPN for people on hotel wifi and in other countries.

Privacy was the one with the problem. The system did not record the per-connection data a pen register order would ask for, and there was no quick way to make it do so. The only thing the company could actually hand over on receipt of such an order was the cryptographic material protecting everybody. On 21 October 2013 Lackey shut the consumer service down, destroyed the keys on the servers, and said plainly that no order had been received. He was closing a working product because of what had happened to someone else.

~ the rap sheet ~

~ the pen register problem ~

The legal detail is the entire story and it is worth stating slowly. A pen register is not a wiretap and does not require the same showing. It collects metadata, and the long-standing theory is that metadata is less sensitive than content, so the bar for getting it is low. That theory was written for a telephone network where the metadata really was a list of numbers.

Applied to an encrypted service, the same order turns into a demand for the ability to see everything, because there is no way to produce the metadata without breaking the encryption that produces it. Lackey's public note made the point without decoration: the order would be cheap to obtain, the compliance would be total, and the company would be forbidden from telling anyone it had happened.

~ what a VPN meant in 2013 ~

In the autumn of 2013 a consumer VPN was still a specialist purchase, something a security-minded person bought because of airport wifi. The post-Snowden year changed the pitch into something closer to a political statement, which is the register CryptoSeal was operating in when it closed, and the closure got written up by Techdirt, The Register, Slate and Boing Boing within about thirty-six hours.

Turkey got its own version of this lesson five months later, when access to Twitter was blocked on 20 March 2014 and YouTube followed a week after. Within days people here who had never thought about network routing were swapping DNS numbers and VPN recommendations in ordinary conversation. The American story was about a court order nobody was allowed to mention. The Turkish one was a block everybody could see, and that month somebody stencilled 8.8.8.8 on a wall in Istanbul.

~ where it ended up ~

CloudFlare announced on 18 June 2014 that it had bought CryptoSeal. The remaining service was retired completely by the end of that month, Lackey joined as a product manager, and the trusted computing work the company had been doing on commodity servers went into CloudFlare's own stack. The homepage became a short note saying so, signed off with a copyright line reading 2011-2014, which is as exact a lifespan as a company ever prints about itself.

Lackey's earlier venture had been HavenCo, the data haven on the abandoned sea fort off the English coast, which is where the seal in the logo comes from and which also failed at the point where law met hardware. Twice now he had built somewhere for data to live outside the reach of a subpoena, and twice the subpoena turned out to have a longer arm than the engineering.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »