Their expectations of others reflect poorly on themselves.
And even so, it still doesn't change the fact that it would have turned all their business claims into giant lies, possibly even exposing them to suits for false advertising, etc.
That is a meaningless distinction. It is the difference between having to type a large number of characters (not even that large -- how hard is it to capture a password?), or a small number of characters. Lavabit, as designed, could access any user's email the moment that user logged in. That is obvious to anyone who understands what encryption is. It is an inherent vulnerability in every system that does what Lavabit/Hushmail/etc. do.
"And even so, it still doesn't change the fact that it would have turned all their business claims into giant lies, possibly even exposing them to suits for false advertising, etc."
If Lavabit advertised itself as an email service that cannot read your email, then that suit could have happened regardless, because the claim is untrue. If, on the other hand, it was advertised as a service that will not read your email and that protects your email while it is stored, that is different and would not have been affected by their cooperation with the FBI's demands.
The 'not complying' is only a side effect, and is more so tantamount to a refusal to do work for the government in opposition to lavabit's own business promises. I'm not sure the government in any instance has a right to compel work to meet their specified ends.
Imagine a mail service that operated solely as a Tor hidden service and required all users to use PGP --- for instance, by checking the contents of mail messages to ensure they were encoding them, and rejecting them if they weren't. That's a service that might reasonably make a promise not to cooperate with a court order.
Lavabit didn't have that system and instead had to make a difference promise: that they would shutter the enterprise before cooperating with a court. And so they did.
There are costs of doing business and one of the costs is the ability to comply with lawful court orders. You are completely wrong about the government lacking the means to compel compliance.
Edit: To tone that down a bit, "Moral Mazes" by Robert Jackall is an excellent although academic work on the ways in which corporate and government ethics differ from commonly espoused personal ethics. I find it a valuable key to trying to understand attitudes toward conscientious leakers such as Snowden. I am implying a value judgment, but realize the details are complex.
Generally: I think that when the core promise of your business is that you'll do everything you can to resist incursions on user privacy, then yes, it should be pretty common for those promises to be scrutinized.
I'm sure it's that too, but I've currently got it checked out as an interlibrary loan serving as my bedtime reading, and I'm finding it really insightful. But perhaps this is because I'm starting from a point of bewilderment as to what motivates most people to act as they do.
> a more intellectually credible way of saying "the whole system is out of order!"
But the miracle is that rather than being out of order, the system mostly works, and tends to keep working. What I like about the book is that it strives to explain the situation from the inside as a mostly coherent belief system, rather than critiquing it from outside as untenable.
At best Lavabit only ever provided security between logins i.e. when the data is "at rest." Any claims of security beyond that are, to be polite, overstated.
Hence the need to develop systems for which the first "no" is the only "no": "no, we don't have the client-side encryption keys, and there's no way for us to give them to you, nor is there any way for you to surreptitiously insert them into the Open Source client software without being noticed, nor are we obligated to accept your patches introducing security holes which will effectively destroy our entire business/project credibility".
It needs to be more difficult to use your project as a tool for surveillance than it is to personally compromise a specific end-user system.
(That's not to say we shouldn't pursue legislative solutions eliminating the requests in the first place: we need to fight surveillance capabilities on both fronts, legal and technical.)
And, to really make it secure, you need to go outside of the smtp world, because all smtp has some amount of meta-data that gets transmitted in the envelope. And that meta-data can be just as damning as the contents of the messages.
I don't expect there to really ever be a truly secure email service, unfortunately.
http://s3.documentcloud.org/documents/801182/redacted-pleadi...
"shall furnish agents from the Federal Bureau of Investigation, forthwith , all information, facilities, and technical assistance necessary to accomplish the installation and use of the pen/trap device."