海角大神

Modern field guide to security and privacy

Why secure e-mail startup Lavaboom imploded

After encrypted webmail service Lavabit closed under FBI pressure to reveal data about users 鈥 Edward Snowden reportedly among them 鈥 Lavaboom launched to take up the mantle. But about a year after launching, it has collapsed amid legal and financial woes.

|
Gilles Adt/Reuters
A volcano on the French Indian Ocean Reunion Island.

The short life of the听secure e-mail startup Lavaboom started last year in a moment of intense global backlash over US government surveillance.

Its idealistic chief executive,听Felix M眉ller-Irion, was a young听university听graduate听in his 20s听who set out to provide the world with a more secure e-mail service after Lavabit shut down. That company closed after it was pressured by the FBI to reveal data about customers, which reportedly included听former National Security Agency contractor-turned-fugitive Edward Snowden.

Mr.听M眉ller-Irion hoped to pick up where Lavabit left off.听But in August, only a year after Lavaboom launched to great fanfare, M眉ller-Irion discovered that his company was the subject of a听German听criminal investigation, the details of which remain a mystery. He isn't allowed to speak about the case conducted by a unit of the Federal Office for Information Security, Germany's cybersecurity authority.听The investigation was enough to scare off investors, hurting the company鈥檚 already fragile financial situation.听

Soon after finding out Lavaboom was under investigation the young chief executive opted to pull the plug on his company and declared bankruptcy. He听gave his 12,000 registered users a week to transfer data to another secure e-mail service, recommending Tutanota in Hannover and Whiteout Mail in Munich. Then he deleted his customers' data.

"I decided not to let my users down, and deleted their whole data,"听said听M眉ller-Irion.听"So far I have not been served with a letter or notice of seizure of the servers, so I didn鈥檛 want to leave any trace of data left that could be recreated on the hard drive."

He's certainly aware of the potential similarities to his company's fate and the demise of Lavabit. In the end, he said, he opted to follow the Lavabit's example and shut down over his deep concerns that authorities may force him to weaken the security his customers were seeking.听

Lavaboom was among a slate of other听German upstart e-mail providers that promised to be more secure options to Gmail, making it easier to send fully encrypted messages. While Lavaboom's demise may have been hastened by legal troubles, the company also struggled financially.

"You need a lot of time and a lot of back-up money鈥澨齮o raise a communications company that can rival the mainstream e-mail providers,听said Matthias Pfau, cofounder of Tutanota.听

Still, he said, the European public is increasingly turning to services such as his. Three years after听Tutanota launched, the company听ended its testing phase in March and opened the service to the public. Now, it's user base is north of 100,000. "The market is big, and it鈥檚 just starting," he said.

Signs of Lavaboom's trouble surfaced this summer when tech experts noticed that the company had failed to update its "warrant canary," a statement that a company has not been served with a warrant or court order for user data. If the warrant canary isn't updated, users assume the company has been received a government or court order for user information.

"It is now 16 days into August and the canary still states听1st July," read a post on Reddit. Another read: "Be very caution using Lavaboom right now!"

"This isn鈥檛 something which inspires confidence in a service which was designed with the thought of keeping secure communications out of the hands of law enforcement agencies," security expert Graham Cluley posted on his blog.

Lavaboom had committed to updating its canary on the first of every month. 鈥淵es, the investigation was the reason we didn't feel comfortable to update it,鈥 said M眉ller-Irion.听

But it wasn't just the investigation that troubled听M眉ller-Irion and Lavaboom. The company was also in deep financial trouble. Even though the startup received $300,000 from an anonymous donor, it could not attract other investors. It did manage to raise about $110,000 in a crowdfunding campaign, but needed at least $170,000 to stay afloat.

Any leads the company had for new funding "went cold after we shared the information regarding the ongoing investigation,鈥澨齭aid M眉ller-Irion.

"Lavaboom was neither big nor attractive enough," said Jochim Selzer, a organizer in the Bonn region.

In recent years, Germany's main e-mail providers have taken steps to make conversing via e-mail more secure. And that also hurt Lavaboom, experts say. Recently, the popular German server gmx issued a plug-in that allows the encryption software known as Pretty Good Privacy to work with its Internet mail interface.

"Gmx is a big provider with several million users," said Mr.听Selzer, so they'll be able to big foot much of the emerging competition even by providing simple or basic encryption protections.听

Now,听M眉ller-Irion said the rise and fall of Lavaboom should serve as one more reminder of how difficult it is to ensure and privacy on the Web.

You've read  of  free articles. Subscribe to continue.
Real news can be honest, hopeful, credible, constructive.
海角大神 was founded in 1908 to lift the standard of journalism and uplift humanity. We aim to 鈥渟peak the truth in love.鈥 Our goal is not to tell you what to think, but to give you the essential knowledge and understanding to come to your own intelligent conclusions. Join us in this mission by subscribing.
QR Code to Why secure e-mail startup Lavaboom imploded
Read this article in
/World/Passcode/2015/0923/Why-secure-e-mail-startup-Lavaboom-imploded
QR Code to Subscription page
Start your subscription today
/subscribe