[MWil]

That's a great observation and it depends on how you define "exposed." Since it's technically feasible to capture the information, perhaps even retroactively, it's certainly been sent to a third party (Lavabit) for retention but they have just chosen to voluntarily put blinders on when it comes to that information.

So the question is whether it requires actual exposure or exposure in the regular course of business.