13 ms·
Current warrant canaries are useless, it's a one time fuse. We need new, better, recurring (i.e. monthly) warrant canaries of different types (common canaries,
by jakobdabo 10y ago
Current warrant canaries are useless, it's a one time fuse. We need new, better, recurring (i.e. monthly) warrant canaries of different types (common canaries, individual canaries for each user). I want something like this everywhere:
Jan 2016 - we haven't received any NSL
Feb 2016 - we haven't received any NSL concerning your account
Mar 2016 - we haven't received any NSL
Apr 2016 -
Jun 2016 - we haven't received any NSL
- CiPHPerCoder 10y agoWhy monthly and not daily? Or hourly?
- jakobdabo 10y agoI haven't put much thought into it, I guess it could be daily but hourly is overkill I think. Actually, this is an interesting startup idea - warrant canary as a service, with an API.
- kbenson 10y agoI think the point is that at some level of granularity, it's an announcement that you are currently working with the authorities, which is expressly forbidden in the NSL. There's some point at which a court will decide that you aren't complying, and stepping over that point is bad for your business. Since that point is very fuzzy, it's a dangerous thing to play around with.
- nickpsecurity 10y agoExactly. They could even order you to keep updating it. In the Lavabit case, the FBI asked and judge agreed to compel Levison's silence + lies if they got the key with reason being his business wouldnt suffer if customers were lied to about their privacy. That argument and a judge agreeing with it are worth remembering in discussions like these.
- deleted 10y ago[deleted]
- toomuchtodo 10y agohttps://canarywatch.org/ https://canarywatch.org/
- pg_is_a_butt 10y agohow could you possibly justify daily... as in, you need to know the day of... but knowing within the hour, so you can do whatever you would do with that data immediately isn't a better idea??? you obviously haven't thought about much, lady.
- greenokapi 10y agoI wonder what the legal limits on the granularity are, probably up for a lot of interpretation in a court.
- dublinben 10y agoBefore you receive an NSL, you have no limits. After you receive one, you may only report buckets (0-249, 250-499, etc.) on a quarterly basis.
- anonbanker 10y agoit is a disturbing commentary on our rights in society that we have to actually think about these things as a normal part of life. it is remarkable our ability and resolve to continue enforcing our rights in new and creative ways, but we should actually all recognize the fact that our right to privacy has been completely violated, as well as our right to self-incrimination.
- bostonpete 10y agoI believe the receipt of an NSL prohibits future announcements like that.
- Retric 10y agoThat's a great way to end up in prison. That said, civil disobedience has been used in the past to great effect.
- spiderfarmer 10y agoThat's a great way to end up in prison. It's like you're talking about an oppressive regime, but no, it's the USA. The land of opportunity, independence and above all, freedom. /s
- logicallee 10y ago>That's a great way to end up in prison easy there, cowboy, this isn't East Germany just yet. I think American authorities can tell the difference between what they do and the Stasi. As in, I actually, literally think they can tell the difference. Nobody will be ending up in prison for posting the above. Seriously. Show me a judge who'll do that. You don't get a 4-year philosophy degree before getting a JD in American law, and structurally answer to a constitution literally containing the words "Congress shall make no law ...abridging the freedom of speech, or of the press" which is the first amendment, and which has been judged and interpreted very carefully by 9 independent justices upholding Freedom for 220 years, while sending people to prison for publishing " Apr 2016 - " Not happening. Not in 2016, and not in 2020. People need some perspective here. EDIT: getting a lot of downvotes. Show me anyone who is in prison for publishing " Apr 2016 - " or any other similar warrant canary. You people need to stop throwing around "a great way to end up in prison" like that. I'm not defending the status quo, but the suggestion that anybody is going to prison for posting a warrant canary is too much, sorry. It diminishes the conversation and criticism around the actual status quo.
- knodi123 10y agoDepending on the intelligence and compassion of a judge is a great strategy. I'd bet that it works >50% of the time. But ask the legal counsel at a publicly traded company whether it's worth the gamble, and you'll get the same advice that the downvoters in here would give you, if they weren't in such a hurry.
- 10y ago
- matthewmarkus 10y agoI've always wondered if there is a side-channel that could be used instead of a warrant canary. More specifically, my understanding is that witnesses have Miranda Rights. Therefore, couldn't a company promulgate a process whereby they'll publicly solicit bids for legal counsel should they receive a NSL? If they start asking for bids, you can assume they've received a NSL. If not, then no NSL has been received. Any lawyers in the house? * Edited slightly for clarity.
- burkaman 10y agoI'm not a lawyer, but I think you almost definitely can't do that. The law is not an algorithm, at some point a human judge is going to decide if you've broken it. If the law says "you can't tell anyone" and you tell someone, you've broken the law. It doesn't matter if you told someone through the medium of a press release, or a predefined "unrelated (wink)" process.
- matthewmarkus 10y agoWell, I know if you're charged, you have a right to be represented by counsel of your choice under the 6th Amendment. https://en.wikipedia.org/wiki/Assistance_of_Counsel_Clause#Choice_of_counsel https://en.wikipedia.org/wiki/Assistance_of_Counsel_Clause#C... I wonder if that extends to witnesses not charged with a crime in some way. Or can you be denied counsel of your choice under questioning?!
- burkaman 10y agoI don't know, but even if you retain that right, it seems almost obvious that you don't have the right to publicly bid for counsel. Presumably the gag order would extend to any lawyer you contact.
- matthewmarkus 10y agoWell, if the counsel of your choice was predefined as the one that bid the lowest in an open auction, then why would you lose that right? Could the court further restrict that right down to the specific lawyer they want representing you? I do agree that the gag order would extend to any lawyer you contacted after the public bidding process concluded.
- rsync 10y agoThe rsync.net warrant canary has been issued monthly, with news headlines, for over ten years now.[1][2] We split it for each location - SanDiego/Denver/Zurich/HongKong. Further, the individual location canaries can be retrieved from the actual storage array itself - that is, you can just fetch it via sftp/scp/rsync/whatever from (whatever system your account is on). Finally, our canary is machine readable/parseable and nicely formatted. So much so that the maintainer of "Canary Watch" has told me that he wishes all warrant canaries followed our original format. Oh By[3] will have a similar canary soon, modeled exactly after the rsync.net warrant canary. [1] https://www.rsync.net/resources/notices/canary.txt https://www.rsync.net/resources/notices/canary.txt [2] http://blog.kozubik.com/john_kozubik/2010/08/the-warrant-canary-in-2010-and-beyond.html http://blog.kozubik.com/john_kozubik/2010/08/the-warrant-can... [3] https://0x.co https://0x.co
- res0nat0r 10y agoCan you comment on if you believe these to be actually effective? I don't see how when the USG says that you cannot divulge that you've received any type of NSL, they can easily say you must continue to act like you have in the past. I just don't see a court or a judge upholding a "cute" or "technical" workaround for something like this. Haven't there been rulings in the past where these aren't valid, ie just like the article above once you do get NSL's etc you must take them down or be at risk of non compilance?
- rsync 10y ago"Can you comment on if you believe these to be actually effective? I don't see how when the USG says that you cannot divulge that you've received any type of NSL, they can easily say you must continue to act like you have in the past." The entire basis of the warrant canary is that it's not simply asking me to stop doing something, but rather, a judge would have to order me to make false public statements. That's a tough thing to imagine - certainly on any continued basis. Even in that situation, how will they force a swiss national to update the swiss location ? There's no jurisdiction there. I don't see it as a technical workaround at all - it is completely non-technical. Can the government compel my speech ? Can the government compel me to make false statements ?
- tedunangst 10y ago"We did not, at 2:43pm on the 17th of July, receive a request for any information related to the account identified as jakobdabo." (Request actually received at 2:44pm.) That'll trick 'em for sure!
- zardeh 10y agoThat's illegal
- cbsmith 10y agoI imagine there are legal difficulties with being more transparent, but I will say Silent Circle's occasional failures to manage their canary well have made it an unreliable signal.
- rdl 10y agoThe original proposal for how to do warrant canaries is pretty valid (Steve Schear) -- basically they'd be a paid service, sort of like a bug bounty, and multiple canaries, very specific. They would be a revenue center, too. https://groups.yahoo.com/neo/groups/cypherpunks-lne-archive/conversations/topics/5869 https://groups.yahoo.com/neo/groups/cypherpunks-lne-archive/...
- hendersoon 10y agoTraditional warrant canaries are issued regularly, just as you described it. It would be fantastic to get more granular, at the account-level. That would be a cool differentiator for these hardcore privacy/security-oriented companies.
- rtkwe 10y agoNo company is going to do that. Doing that would get them in trouble with normal warrants much less NSLs.
- hendersoon 10y agoWhy? You send one email per user per month: "We didn't get any warrants that cover your account." Nothing to it.
- rtkwe 10y agoBecause that would get the company in trouble even a normal warrant to say nothing of the gag order on an NSL. It's too specific and tips off the exact people being investigated. The lawsuit the company would be hit with would be huge, expensive and a pretty straight forward loss.
- hendersoon 10y agoI don't see why. It's the exact same principle as standard warrant canaries.
- rtkwe 10y agoIt's the same rough idea except it goes from "we received at least one letter once about some user(s) on this site" to "we received a letter about YOU," that's a huge difference. Canaries aren't challenged currently partially because they give out so little information that it's really not worth the governments time to go after people. What the NSL gag really aims to prevent is to keep the people targeted by the NSLs from knowing that they're under investigation. If a company started doing canaries that applied down to a single person they'd be sued the first time they stopped sending one after getting a letter. Also I'm not entirely sure that even if a judge found that an NSL can't compel you to send a zombie canary that it follows that the company can't be fined or sanctioned for breaking the gag order.
- rtkwe 10y agoThe more information your canary provides the more likely it is you'll get charged with breaching the NSL gag order. Current canaries don't bring down the ire of the various 3 letter agencies partially because they provide such tiny amount of information. Canaries down to the individual user would definitely be in violation of the gag order on an NSL and ever bring a lot of trouble if you did it for normal warrants!