What Happened When The DEA Demanded Passwords From LastPass

forbes ^ | 10apr19 | Thomas Brewster Forbes Staff

[vannrox]

The government makes very few demands for data from password managers, but when it does it expects a lot, including login information, Forbes has learned.

In one case—the first documented government request to any major password manager—the Drug Enforcement Administration (DEA) demanded logins and physical and IP addresses, as well as communications between a user and LogMeIn, the owner of massively popular tool LastPass. It’s an encrypted vault for storing passwords. The DEA was seeking information related to a LastPass customer, Stephan Caamano, suspected of dealing drugs via the dark Web and Reddit, according to a search warrant detailing the request.

Passwords were not handed over, but LastPass did return IP addresses used by the suspect, alongside information about when Caamano’s LastPass account was created and when it was last used. According to the government’s application for the search warrant, filed at the end of January 2019: “Such information allows investigators to understand the geographic and chronological context of LastPass access, use, and events relating to the crime under investigation.”

[ProtectOurFreedom]

Thanks. I'm a long time user of LastPass and think it's a great tool. Here's a summary of what they did

• Police were able to bypass encryption on the suspect’s CyberPowerPC, where they discovered an extension app for LastPass. But as they didn’t have the master password, the police couldn’t get access to the account and the logins within.
• LastPass did not hand over passwords.
• LastPass did return IP addresses used by the suspect, alongside information about when Caamano’s LastPass account was created and when it was last used. According to the government’s application for the search warrant, filed at the end of January 2019: “Such information allows investigators to understand the geographic and chronological context of LastPass access, use, and events relating to the crime under investigation.”
• [LastPass spokesman said] "User passwords stored on LogMeIn's servers are only done so in an encrypted format. The only way they get decrypted is on the user’s side, and the way that happens—the decryption key—is the user’s master password (used to log into LastPass), which is never received by or available to LogMeIn/LastPass. In other words, we have no means of decrypting user password information on our side, and thus, we are unable to provide these passwords.”
• “It is the policy and position of LogMeIn [LastPass owner]that the company does not create such backdoors or decryption techniques to provide access to customer data.”
• Despite the limited data they can get, the cops are making demands of password managers. The Illinois case is just the first time the world has heard about it.

[Wuli]

It was not done in secret.

It was done with a warrant.

It was not a blanket warrant to see which fish the DEA could catch.

It was a single-person-specific warrant for information relative to that individual, given with grounds for reasonable suspicion of the individual. Nothing to see here.

If one really wanted to complain about unconstitutional invasion of privacy, then complain about two things regarding your financial information.

Case one. Complain about the fact federal law requires any financial institution in the U.S., of any kind, to report any movement of money that exceeds $10,000; ALL $10,000 plus moves of money MUST be reported to the federal government, period. There is no proof needed to be claimed that that money was part of anything illegal. Why? Well then the treasury, DOJ and IRS get to go on a fishing expedition in the mass of data - a fishing expedition as in “let’s see who we can catch for whatever we think APPEARS suspicious”. No warrants. No proof or suspicion of guilt. Just anything you might do financially that takes or moves more than $10,000, put in a money fish tank for the feds to go fishing in.

Case two. Or complain about the CFPB (Consumer Financial Protection Bureau - the brain child of Elizabeth Warren; the newest federal agency and one that has ZERO need of or accountability to Congress; it designs itself; it sets its own mission; it reports to no one; it determines its own budget and gets it funds directly from the federal reserve). And what was one of the early acts of the CFPB? It demanded (and received) that EVERY financial institution of every kind in the U.S. feed all of its financial transaction data, of any kind, into the CFPB - so it can go fishing in it. No warrants, no proof or suspicion of any guilt, just 100% of your private money affairs handed over to the federal government.

Both case one and case two should at least have as much court warrant involvement as was given the private data of the individual the DEA was investigating. Where does any GOP elected official complain about either case one or case two? Never. But you can bet your boots some of them will be complaining about what the DEA did WITH A WARRANT.