I'm assuming there were multiple accounts on this server. Depending on how the discovery request was worded, if the VIP's email address was removed or modified from the from / to headers of emails, one could reduce the set of emails that have to be handed over 'where the VIP was included in the conversation'. Or perhaps remove embarrassing email addresses that were cc'd/bcc'd on sent mail.

The danger is that another party to the chain still has a copy of the email that shows it in a different state then would be in the archive which would expose the subterfuge.

Perhaps it was that concern that resulted in deleting emails rather than modifying them, as perhaps destruction of records is far less of an issue then falsification of records.

Doesn't the election trump the security clearance process?

Compromising the account only gets them an encrypted blob -- only the client can decrypt it.

(Now, nothing says LastPass can't publish a subverted client, I've never heard how that is protected against).

Money laundering is obscuring where money came from. If you walk into a bank with $3M in cash, its going to be noticed. However, if you sell a ton of $Drug for $3M cash, and own a cash-heavy / inventory-light business such as a strip-club or casino, you inject the cash into that business over time with fake transactions and treat it as ordinary income. You pay taxes on it and to everyone it looks like you are operating a particularly successful business, and you have legit cash in the bank.

In this way you've obscured that the money came from an illicit deal and made it appear legitimate. Any business that can do a lot of turnover without a lot of inventory (as someone might notice if your bar is doing a ton of business but never buying inventory) is a candidate.

For larger non-cash sums you can do things with offshore fake businesses; make a 'startup' offshore, then sell it to another offshore entity and bank the cash / declare it on your taxes. The fact that it didn't really exist is hard for on-shore regulators to notice, and now you've got a bunch of legit taxes-paid cash in your wallet.

http://www.businessinsider.com... describes some more schemes.

'Resources are scare' was intended to be one of the brakes on pervasive surveillance -- it was historically hard to do, and required a good reason to follow someone around. Slapping up a camera requires far fewer resources so the bar naturally drops, and probably lower than it should.

Regarding the warranty; there is a difference between it breaking and intentionally breaking it. Buying a car 'as-is no warranty' does not mean the dealership can come in the middle of the night and snip a brake line because they don't like the selling price.

LastPass has a phone app that syncs to the cloud but can cache locally. It also has browser plugins for the machines where you are comfortable / able to install something locally.

RAID to protect against local storage failure (not a backup per se), ongoing CrashPlan backup for the desktops, AWS EBS Snapshots for the AWS volumes, and AWS Glacier copies of the really irreplaceable stuff (in addition to the prior). The Glacier components are gpg'd and .par2'd just in case there is some sort of bitrot in whatever storage mechanism they use.

A jury case can set precedent -- in a particular set of circumstances, the court case went a certain way. In future cases lawyers may reference this case when explaining how their side should win. See https://simple.wikipedia.org/w.... It may not be 'binding' and the details will determine how easy it is to equate future cases with this one, but it still goes into the legal record and you can be sure it'll be referenced if it is helpful to someones case.

I think the veracity of Wayback would be an issue at trial, and both sides would present their theories / subpoena the admins of Wayback, and the jury would have to decide if the content was reliable or not.

Sovereign Immunity is not a blank check. The FBI (or any other agency) cannot have the legal authority to trump the legal process by contract. That would allow them to trump discovery in any court case by constructing contracts that prevent disclosure.

"Your Honor, your order to produce the basis for the evidence against the plantiff is trumped by our contract with party X to not disclose that." Nope.

It would work if they actually don't have that information, not if they 'promised' not to disclose it.

As I understand it, chargebacks can happen if the transaction is disputed, but the vendor is not exposed to whether the customer can actually *pay*. The credit card company pays the vendor regardless of whether the customer pays their credit card bill.

The article indicates the bottom outlets are jammed, so it may not be possible without extensive repairs first.

Could they subpoena the signing key somehow?

Can you name the tool?

In any case, the system described is not a OTP.