Everybody's still talking about Bezos and the Washington Post this week, and I get it, a guy who built an online bookstore now owns a 136 year old newspaper for $250 million out of pocket money, that's a wild sentence to type. But there's a smaller story that happened basically the same week that I can't stop thinking about, and I haven't seen many people connecting it to anything.
On Thursday, Lavabit just... turned itself off. If you don't know Lavabit, it was a small encrypted email provider out of Texas, maybe 400,000 users, mostly known this year for one particular subscriber whose name I probably don't need to type out. Ladar Levison, the guy who ran it, put up a cryptic message on the homepage saying he was suspending operations rather than "become complicit in crimes against the American people," and that he legally couldn't say more about why. No warning to users beforehand that I could find, no export tool, nothing. You just woke up Thursday and your inbox was gone.
Then Friday, Silent Circle (the encrypted comms company started by Phil Zimmermann, the guy who wrote PGP back in the 90s) shut down their Silent Mail product too, and they were pretty explicit that Lavabit's disappearance is what pushed them to do it immediately instead of migrating people out slowly. Their reasoning, paraphrasing: email as a protocol can never really be secure end to end because of how it's built, metadata leaks no matter what you do, and they'd rather kill the product than get put in a position where they have to hand something over and lie to their own customers about it.
I want to sit with that for a second because I think it's a genuinely different kind of tech story than we usually get. Companies don't normally shut down a working, presumably profitable product as a form of protest. Usually it's the opposite, a company folds under legal pressure quietly and nobody outside the courtroom ever finds out. Levison basically chose bankruptcy and a gag order over compliance. That's not a business decision, that's closer to a hunger strike.
Here's my honestly kind of embarrassing confession: I've been telling people for two years that running your own mail server at home is pointless paranoia, that Gmail's spam filtering and uptime are worth the tradeoff, that nobody's reading your boring emails about fantasy football anyway. I still mostly believe that second part. But this week made the abstract argument concrete in a way it wasn't before. It's not really about whether anyone's reading your specific emails. It's that the moment a company holding your data gets a piece of paper with the right letterhead on it, you have zero say in what happens next, and increasingly you won't even be told it happened. Levison shutting the whole thing down instead of quietly complying is, weirdly, the most reassuring possible outcome, because it means the alternative (quiet compliance) is apparently common enough that walking away felt like the only honest move left.
I dug my old Sheevaplug out of a drawer this weekend just to see if it still boots (it does, barely, and it sounds like a dying hard drive because it basically is one). I'm not about to become the guy running his own IMAP server off a plug computer in a closet, my wife would leave me and honestly she'd be right to. But I did finally set up PGP keys for the first time since college, mostly out of guilt, and sent myself one (1) encrypted test email that took eleven minutes and two tries to decrypt correctly. Not exactly a triumphant return to cypherpunk living.
What I keep coming back to is how quiet all of this still is outside of tech circles. My coworker who is otherwise a smart, plugged-in person hadn't heard about Lavabit at all when I brought it up at lunch, and when I explained it she just said "wait, they can do that?" Yeah. They can do that. The interesting question this week isn't really about one newspaper changing owners, it's about how many of the other Lavabits are out there quietly making the opposite choice and just never telling anyone.