Lavabit Email Founder Goes to Great Lengths to Avoid Email, Post-Snowden

Ladar Levison spent the last 10 years providing people with email. Now he won’t touch the stuff.

Levison shut down his security-focused email service Lavabit in August, explaining he no longer felt comfortable saying that his users’ data was secure while Lavabit operated in the United States.

While not explicitly stated, the implication was that NSA document alleged leaker Edward Snowden had used Lavabit, and Levison was fighting against both a government order to hand over user data and a government mandate not to talk about the data request.

Levison himself was not only the operator of Lavabit but also a user of it, and he hasn’t logged into email since August 8. He saved an archive of his account to encrypted drives to access if and when he returns.

“I’m still holding out hope that victory in the courts will allow me to restart my service in the future,” he said today onstage at the Privacy Identity Innovation conference in Seattle. For now, Levison is making use of “the electronic equivalent of a methadone clinic” by messaging people through Facebook, LinkedIn, text and the new encrypted communication service Silent Circle. “I haven’t needed a real and valid email address to register for something yet,” he said.

“Anything that I consider sensitive, I try to talk about it to people in person, with my cellphone off, in an area where I know that nobody’s pointing a parabolic mic at me,” Levison said. “If you’re fighting the government that’s what you need to do.”

“I’ve had to switch from becoming a small business owner worrying about making payroll, to overnight becoming a political activist,” Levison said.

In fact, the conference made a special exception to add Levison after he messaged PII organizer Natalie Fonseca on LinkedIn, she said. Fonseca registered him directly, rather than sending him to the website form, which requires an email address.

However, since shutting down Lavabit, Levison has raised some $150,000 in online donations, he said in a conversation offstage. “Even the people on the fence about government surveillance will side with me on free speech.”

After 10 years living and breathing email while he ran Lavabit, Levison has remade himself into a bit of an email-free martyr, saying today, “Hopefully something positive with come out of this sacrifice.”

Though he had suggested when he shut down Lavabit that he was at imminent risk of arrest, Levison said today he is “less worried” about that now. “What I’m more worried about is what I have planned for the future,” he added ominously, then declined to elaborate.

Levison said he might start a new email account if there were an off-shore email service with a substantially long record of not having been compromised. But at the moment, he doesn’t think there is such an option. “The amount of paranoia I have to keep myself safe is relatively crazy,” he admitted.

Though many, including Edward Snowden, have suggested that properly implemented strong cryptography can protect email in most cases, that might not go far enough. “It’s only as secure as the keys,” Levison said. And he doesn’t trust that encryption keys won’t get compromised.

Plus, many of the people with whom he’d want to email don’t know how to use truly secure methods.

Levison said amid all the privacy and surveillance issues now in the spotlight after Snowden’s disclosures, he was most concerned about “the secrecy problem.”

“There are only so many people in this country that have any idea what’s really going on, and they may only know a small part of the picture, and they can’t talk about it, they can’t tell us, because if they do they’ll go to jail,” Levison said. “It’s a dangerous world we live in when the administration can effectively violate the Constitution and then make it a crime for anybody who knows about it to tell the world that there was a violation of the Constitution.”

He added, “Transparency doesn’t mean anything when they’re not allowed to tell you the truth. We effectively need to mistrust anything and everything until we can verify that it’s doing what it claims to be doing, and that’s the ultimate trust issue.”