In August, Ladar Levison, the founder of Lavabit — the email service provider allegedly used by
Edward Snowden — decided to shut down the entire company rather than comply with a
broad surveillance request.
A few hours later, spooked by Levison's extreme move, private communications startup Silent Circle
abruptly and preemptively shut down its own email service, too.
Now, almost three months later, Lavabit and Silent Circle will
announce their plans to join forces and launch Dark Mail, a new secure,
encrypted and peer-to-peer email system more resistant to government
surveillance. They're calling it the "Dark Mail Alliance."
"It's time to build a new email protocol that is secure by default, because
we can't trust the Internet anymore, we can't trust governments anymore
we can't trust the Internet anymore, we can't trust governments anymore," said Levison in an interview with
Mashable. "So we need to build a new system that is resilient to that kind of interference."
Dark Mail will not only be implemented in new Silent Circle secure
email apps, but also offered as an open source system based on a new
architecture using the
XMPP protocol and the secure protocol developed by Silent Circle called
SCIMP
(Silent Circle Instant Messaging Protocol). Silent Circle and Levison
will assist other providers in implementing Dark Mail and using it
themselves, as Levison and Silent Circle CEO Mike Janke explained in a
phone interview on Tuesday.
Levison, along with Silent Circle cofounders Janke and CTO Jon Callas, will announce Dark Mail at the
Inbox Love conference on Wednesday in a "surprise" appearance at the end of Levison's keynote.
The technical details will be published in a white paper in several
weeks. The code will be released months before the actual launch, a time
frame Janke pegs to the second quarter of 2014. This is also when
Silent Circle plans to launch its own Dark Mail apps with the same look
and feel of email, Janke said.
Dark Mail aims to to revamp email as we know it, making it more
resistant to surveillance. Theoretically, providers will have neither
the keys to Dark Mail nor the ability to turn over data to law
enforcement, like the FBI or NSA — they will only have scrambled
communications.
Today, it's still hard for the average person to use email with PGP
Today, it's still hard for the average person to use email with PGP, a popular encryption software invented by Silent Circle's founder Phil Zimmermann in the '90s. Even PGP-encrypted email
leaks some metadata like the subject, the identities of the sender, receiver and timestamp.
Encryption keys used for securing the email content and metadata on
Dark Mail will be created on the device, and messages will be stored
encrypted in the cloud until the receiver gets a notification, Janke
said. Once the message is downloaded, it will be decrypted on the
receiver's device, according to Callas. This way, the provider won't see
the unscrambled content of an email and doesn't have the keys to
decrypt them.
Making encryption easy to use for the masses was also the basis of Silent Circle and other popular encryption apps like
Cryptocat and
Wickr.
But that's easier said than done. There is always a trade-off between
usability and security, so it remains to be seen how many users Dark
Mail will attract.
Moreover, asking email providers to use a new email system is a
seemingly herculean task, even with niche providers like Hushmail or
Mega. The bigger hurdle, however, will be convincing email giants like
Gmail or
Outlook users to jump ship for Dark Mail.
The idea is also plagued by technical challenges. The main one, Janke
said, will be to develop a system to sync messages across devices —
difficult because the encryption keys will be stored locally on every
device.
Apple is able to do so with
iMessage, but its encryption system
isn't designed to thwart the NSA.
Dark Mail will be compatible with traditional email providers, like
Silent Phone, Janke said. A Dark Mail user will be able to email Gmail
or Yahoo mail users, but the app will alert them that their
communication won't be secure and 100% encrypted.
Levison and Janke began working on Dark Mail after they met at the
Privacy Identity Innovation Conference
in mid-September of this year. At the time, Silent Circle was already
working on a new secure email app, but after talking to Levison, Janke
and Callas realized the opportunity existed for something far more
ambitious than just a new app.
Following the slew of top-secret revelations about the NSA's surveillance, such as the
Internet-monitoring program PRISM and efforts to
break online encryption, the timing is ideal.
"If we had gone to the world two or three years ago and said, 'Hey,
you need to throw out all of these email protocols that you have been
relying upon for 40 years and use this new system because it's secure,'
they would have laughed at us," Levison said.
Now, nobody is laughing — but it still won't be easy.