(Updated 2020-02-09 2418 UTC; see bottom)

This is a post I was wondering if I’d ever have to write; the time when I have to disconnect a customer ungracefully.

Earlier this week a spammer cropped up on Lavabit. This would have been a routine situation, except I haven’t had contact with Lavabit through support, abuse, or Ladar in quite some time. There is an SLA requirement per the peering Acceptable Use Policy (AUP), in this case 72 hours, to resolve spam issues. There are many ways to resolve it (locking malicious accounts, resetting passwords for compromised users, better filters). However, without any support contact, and the proprietor incommunicado, I faced a difficult decision.

If I do not disconnect a customer who causes an AUP problem, then Hacking & Coffee assumes the liability on our entire allocation with our BGP peers. I can’t risk the other customers, and general operations, when a situation like this arises.

With Ladar in an unknown status, and no other valid contact points for technical and AUP issues, the decision was made to disconnect the service when the 72 hour window expired.

I hope that the contacts turn back up, and I can turn back on the IP range but even after the disconnect I still have nothing but silence quite some time later (13 hours as of this writing; for comparison a router reboot would get an incident RFI within 30min at any time of day).

As not just the hosting provider, but also as a fellow Lavabit user, I sincerely apologize to all the users of Lavabit for this situation. Having done code review and other contributions to the project since it started to spin back up post-Snowden, I feel like a project I cared about just vanished. I haven’t been involved outside of hosting them under my business for some time, primarily due to other commitments, but I had always wanted the project to flourish and launch the DIME protocol clients.

In the event communication is not re-established with the Lavabit contacts, I’m not sure how to proceed with the user data. Typically when a customer moves out I simply shred the drives and recycle the machines, however in this situation I hope data distribution may be possible. The machines are still running, so if the best happens I can simply reactivate the IP allocation. However, I have started planning for the worst given my current lack of information from Lavabit staff.

Regards,

-Hon1nbo

Proprietor for Hacking & Coffee, LLC

Update: Contact!

Contact was finally made with Ladar and work is being done to restore service.