Habeas Data_Privacy vs. The Rise of Surveillance Tech Page 20

  * * *

  Meanwhile, the day after Levison killed Lavabit in August 2013, another secure e-mail provider, Silent Circle, shut down preemptively.

  “We see the writing [on] the wall, and we have decided that it is best for us to shut down Silent Mail now,” co-founder Jon Callas wrote on the company’s website. “We have not received subpoenas, warrants, security letters, or anything else by any government, and this is why we are acting now.”

  Silent Circle went so far as to physically destroy its servers, a move that the New York Times likened to “the digital equivalent of a library setting fire to its membership records to keep the government from knowing who checked out what books.”

  Two companies committing corporate seppuku within days of one another sent chills throughout the industry. Levison himself began giving various media interviews and saying ominously cryptic things like: “I’m taking a break from e-mail. If you knew what I know about e-mail, you might not use it either.”

  He was still required under a court order not to say exactly what the government had demanded of him. The specifics of what the government sought in the Lavabit case were not unsealed until October 2, 2013. After the case was unsealed, Levison wrote publicly on Facebook about it: “Lavabit maintains that the government had no legal basis for demanding its confidential information, namely passwords, encryption keys and source code.”

  Not long after his case was unsealed, the entrepreneur started speaking publicly about the need to make e-mail not only more secure, but easier to use.

  On October 30, 2013, Levison appeared at a Silicon Valley e-mail conference with Callas and Silent Circle’s other co-founder, Mike Janke, announcing what they called the Dark Mail Alliance.

  The idea was to create a non-profit organization that would take the responsibility for developing an entirely new e-mail protocol. This was a daunting task. After all, the current underpinning of e-mail, formally known as SMTP (Simple Mail Transfer Protocol), dates back to 1982. Getting rid of SMTP would be just as dramatic as swapping out all roads designed for cars with magnetic levitation railroad tracks.

  “This is just another transport—what we’re getting rid of is SMTP,” Callas said at the time. “We like to laugh at it, but there are reasons why it was a good system. We’re replacing the transport with a new transport. E-mail was designed 40 years ago when everybody on the Internet knew each other and were friends.”

  Levison added that he hoped that Dark Mail would be “easy enough that Grandma can use it. Our hope is that someday in the near future that anybody who uses e-mail today can use a Dark Mail client tomorrow.”

  The vibe in the room was a heady mix of bewilderment and fear. Here were some of the industry’s most privacy-minded and tech-savvy people saying that e-mail as everyone knew and loved it needed to be entirely overhauled. But how would it happen?

  More than four years later, though, the Alliance has had some setbacks—there are now only two team members: Levison and his trusty dog, Princess. Silent Circle, or any other company of any size, is nowhere to be found. And without other partners, the Dark Mail idea cannot grow, at least for now.

  But Levison isn’t giving up. On January 20, 2017, he relaunched Lavabit. He figured that under a new White House—regardless of who won the election—DOJ lawyers might take a different view the second time around.

  Unlike the last time, where most accounts were free, this time all accounts are paid, and they all use the Dark Internet Mail Environment standard. (So far, Lavabit is the only company that supports it, making it a standard of one.) Levison charges $30 for “standard” (5GB of storage) or $60 a year for “premier” (20GB).

  “We have 60,000 customers and about 40,000 to 50,000 are returning users, but I look at it as I[’ve] only taken the first steps down a very long road,” he said.

  “The way I look at it [is that when]…I built Lavabit in 2004, I was about 10 years ahead of the curve, the way I look at it now is that again I’m 10 years ahead of the curve, so it’s going to take me another 10 years to get all the pieces deployed.”

  It’s now clear that in the aftermath of Edward Snowden, companies ranging from Lavabit to Microsoft are willing to stand up to the government like never before. In some ways, however, protecting e-mail is becoming increasingly less important as both Silicon Valley and consumers have moved on to easier-to-use ephemeral encrypted messaging (like Signal), which can quickly be set up on any smartphone. When messages can be set to be deleted automatically within minutes, it is even more difficult for authorities to gain access.

  CHAPTER SEVEN

  Why the Eighteenth-Century Constitution Protects Against Twenty-First-Century Satellite-Based Tracking

  Prolonged surveillance reveals types of information not revealed by short-term surveillance, such as what a person does repeatedly, what he does not do, and what he does ensemble. These types of information can each reveal more about a person than does any individual trip viewed in isolation. Repeated visits to a church, a gym, a bar, or a bookie tell a story not told by any single visit, as does one’s not visiting any of these places over the course of a month. The sequence of a person’s movements can reveal still more; a single trip to a gynecologist’s office tells little about a woman, but that trip followed a few weeks later by a visit to a baby supply store tells a different story.

  —UNITED STATES V. MAYNARD

  US DISTRICT COURT FOR THE DISTRICT OF COLUMBIA CIRCUIT OPINION

  AUGUST 6, 2010

  Late June 2008

  Washington, DC

  The District of Columbia Central Detention Facility has a much catchier name to locals, lawyers, and inmates alike: the DC Jail. The multi-story earthen-brown-colored structure looms over the surrounds—with the sole exception of RFK Stadium just a few blocks away—and is one of the largest structures in the neighborhood. It overlooks the Congressional Cemetery, which serves as the final resting place for various DC types, ranging from John Phillips Sousa to J. Edgar Hoover.

  On a sticky summer evening in 2008, Stephen Leckar went to the brutalist 1970s-era structure. He’s an attorney who specializes in commercial litigation and occasionally white-collar criminal law, so it’s not every day that he has to go to the DC Jail. His area of expertise is in financial and securities law, and he usually doesn’t defend those accused of major drug crimes.

  Leckar didn’t know much about his client, Antoine “Toine” Jones, whose case, by that point, was already nearly three years old. The veteran attorney had only been assigned the case in May 2008, less than one month earlier, by the US Court of Appeals for the District of Columbia Circuit, shortly after Jones had filed his formal appeal of his conviction of conspiracy to distribute five or more kilograms of cocaine.

  Jones and eight others had been arrested in the early morning hours of October 24, 2005, on drug conspiracy charges. FBI agents and the Metropolitan Police Department seized “nearly 220 pounds of cocaine and more than $900,000 in cash during raids in the District and Maryland,” reported the Washington Post, citing a Department of Justice (DOJ) press release.

  According to US Attorney Kenneth L. Wainstein, the men “had risen to the top of the drug world.” Jones, a 45-year-old man from Waldorf, Maryland, a DC suburb, was the owner of the Levels Nite Club, a DC venue that a nightclub directory described as a “hybrid of both trendy-club and swank-lounge,” which had been searched.

  The case took years to unfold. The FBI and Immigration and Customs Enforcement (ICE) began investigating Jones and his crew in 2004. The authorities spoke with informants, obtained pen registers, and even installed a pole camera near Levels. Amazingly, Levels was across the street from the DC police’s auto garage, known by local cops as the “Northeast Shop.” Numerous marked police cars are easily visible from the street.

  By August 2005, investigators got a warrant to seize and search text messages from suspected phones. The following month, authorities sought and received permission from a District of Columbia federal judg
e to secretly place a GPS tracking device on Jones’ champagne-colored Jeep Grand Cherokee. However, for some bizarre reason, the tracker was not installed until a day after the warrant had expired, and it was installed in Maryland, rather than DC. Effectively, this meant that there was no warrant governing its use. On top of it all, within weeks, the GPS tracker broke down, and authorities had to sneak in again and replace its battery.

  At that point, GPS was still a relatively novel technology as far as law enforcement was concerned. One of the most prominent GPS cases that had been litigated previously was United States v. Garcia, where the 7th US Circuit Court of Appeals ruled on February 2, 2007, in the government’s favor that a warrantless installation of a similar GPS tracker on a suspect’s car was not a search.

  “Of course the amendment cannot sensibly be read to mean that police shall be no more efficient in the twenty-first century than they were in the eighteenth,” Circuit Judge Richard Posner wrote in the unanimous opinion. “There is a tradeoff between security and privacy, and often it favors security.”

  A year after Jones’ original October 2005 arrest, there was a trial, where all the other co-defendants were acquitted on all counts except one, which was eventually dismissed. However, while Jones was acquitted, the jury was unable to reach a verdict on the conspiracy charge—the judge declared a mistrial.

  In March 2007, prosecutors filed a superseding indictment on a single count of conspiracy to distribute. That document describes an elaborate scheme that began in 2003 to acquire large quantities of cocaine from Mexico and then resell it in DC and elsewhere in the region. Jones and one of his co-conspirators who was added later, Lawrence Maynard (the manager of Levels), the government alleged, would sell their cocaine in various places.

  These points of sale included not only the Levels nightclub, but also Sam’s Car Wash in Temple Hills, Maryland, and a county sports facility in Landover, Maryland, among other locales. Jones and Maynard were eventually found guilty at trial in January 2008. Jones and his cohorts often used sports-related code words to facilitate their drug deals. The amounts of cocaine that they were selling were referred to as “little tickets,” “big tickets,” and “VIP tickets.”

  On May 2, 2008, Jones was sentenced to life in prison—his attorneys asked that he be assigned to a prison as close to Washington, DC, as possible so as to be closer to his wife and son. That same day, Jones and his first attorney, Eduardo Balarezo, appealed. Leckar was appointed by the court to be Jones’ appellate attorney on May 22, 2008.

  Leckar wasn’t able to go see Jones until June, but fortunately it was before he’d been transferred to a federal prison.

  After clearing the reception desk and the security checkpoint, the grey-haired attorney first laid eyes on Jones in an unventilated, concrete meeting room. In contrast to his attorney, Jones was the size of a football player: 6’2” at about 220 pounds. But unexpectedly, the accused drug kingpin walked in with a stack of papers and file folders from his crotch to his chin.

  “I thought he was stark raving mad,” Leckar said, marveling at how obsessed with his own case Jones had become. Jones had all kinds of theories as to what the government was up to and how he wasn’t actually guilty of the vast drug conspiracy that prosecutors claimed.

  For hours, the two men—one in a suit, the other in a prison jumpsuit—painstakingly went over Jones’ notes, page by page and file by file, trying to figure out the best way to challenge the jury’s verdict. Jones had a few ideas: one included challenging the necessity of the wiretaps conducted against him. Wiretaps, since the 1968 Omnibus act, required a super-warrant, a showing that all other conventional means of surveillance have already been tried and failed or would fail.

  Leckar wasn’t convinced that strategy would be a winning one. But among the slew of papers that Jones practically shoved at Leckar was one that stood out: a sealed September 2015 affidavit filed by an FBI agent, asking for a judge’s permission to place a tracking device on Jones’ Jeep.

  “To have somebody subject to such intrusiveness, I thought to myself that there was something here,” Leckar recalled.

  By the end of their initial meeting, which ended around midnight, the lawyer finally had a road to go down: whether the warrantless physical tracking of Jones’ Jeep was constitutional.

  Over the next six months, Leckar and Jones began corresponding weekly, largely by letter, as a way to hash out their final arguments for the DC appellate court. Leckar knew that he had an uphill legal battle.

  Eventually, everything was distilled into a February 18, 2009, brief that challenged the jury verdict on behalf of both Jones and Maynard.

  The appellants’ brief raised a number of procedural questions for the court to consider, nearly all of them applied to both Jones and Maynard. But the only issue that was raised solely on Jones’ behalf was the question of the legality of the GPS.

  “The GPS logged all of Jones’s movements, including trips to and from a suspected ‘stash house,’ ” Leckar argued in the brief. “Its 3,106 pages of movement-location data proved a critical piece of evidence. Should its revelations have been suppressed?”

  In the government’s reply brief, Peter S. Smith, assistant US attorney, countered by formulating the question before the DC Circuit in a different fashion.

  “Whether the Fourth Amendment permitted the government’s warrantless installation and monitoring of a Global Positioning System tracking device on appellant Jones’s Jeep, where agents installed the device on the vehicle’s exterior when the Jeep was located in a public place,” he wrote. “The evidence used at trial involved only the Jeep’s movements on public streets; and the installation of the GPS tracking device and the use of data from that device were supported by probable cause to believe that Jones was engaged in a conspiracy to distribute narcotics.”

  Essentially, Leckar pushed the court to consider the fact that a surreptitiously installed GPS device, which emits a signal of its precise location every 10 seconds, was far beyond simply sensory-enhancing. Leckar, in fact, likened the technology to “a thousand police officers standing and monitoring you as you drive by.”

  He also took a notable approach, and made sure to highlight the conservative property-based factor as part of the privacy analysis.

  “Jones had a reasonable expectation of privacy that was violated when the agents physically installed and when they reactivated the GPS on his vehicle without a warrant,” he argued. “The Government covertly took dominion over a portion of his car and used it to acquire information about his location.”

  In other words, because the GPS tracker was physically installed on Jones’ Jeep (while the car was parked at a public lot in Maryland), it was actually both a seizure and a search within the meaning of the Fourth Amendment. Leckar even likened the GPS install to Silverman v. United States (where a spike mike plugged into an adjacent ducting tube, without a warrant, was a search) that a young Harvey Schneider raised in Katz v. United States in 1967. Law enforcement’s actions to force a constant disclosure of location information was a search, and therefore, he argued, required a warrant.

  Citing a 2003 opinion by the Washington Supreme Court, Leckar noted a GPS device “can provide a detailed record of travel to doctors’ offices, banks, gambling casinos…the strip club, the opera, the baseball game, the ‘wrong’ side of town, the family planning clinic, the labor rally.”

  In short, this is precisely the type of intimate information that the Fourth Amendment is designed to protect.

  Meanwhile, when the government responded with its own filing, it relied heavily on United States v. Knotts, and argued that like in that case, there was no “reasonable expectation of privacy” in one’s location on a public road. Prosecutors even cited a line from Katz, noting, “What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection.” So, if one officer can record one person’s location in public, then a machine that can record orders of magnitude m
ore information for far longer, is also legitimate, under this argument.

  So, as the DOJ argued, because Jones’ Jeep was exposed to the public, including the undercarriage, where the tracker could be installed, there was no issue. Plus, prosecutors continued, the GPS installation was not a seizure as it did not disrupt in any way the operation of the vehicle.

  “The record does not indicate that there was any intrusion into the interior of the Jeep, nor did agents open or disturb any enclosed areas of the Jeep or in any way damage the Jeep,” Smith, the prosecutor wrote. “Accordingly, as in Garcia, the GPS tracker had no effect on Jones’s dominion or control over the Jeep.”

  On November 17, 2009, the US Court of Appeals for the District of Columbia Circuit heard oral arguments in the case. Unusually, it took until August 6, 2010, for a ruling to come down. Normally the court only takes a few months. Such a lengthy wait suggested that the judges may have struggled with this case.

  After many pages explaining why the court was denying all the other portions of the appeal—including the portion that applied to Maynard, thereby allowing the verdict against him to stand—the court finally arrived at the GPS question on Jones’ car at the end of page 15.

  Unequivocally, the DC Circuit unanimously found that “Knotts is not controlling,” meaning that the government’s claims on this point were not valid. The three-judge panel cited a line from the Knotts Supreme Court decision that projected into the future, where the justices noted that “if such dragnet-type law enforcement practices as respondent envisions should eventually occur, there will be time enough then to determine whether different constitutional principles may be applicable.”