3 ms·

Traditional warrant canaries are issued regularly, just as you described it. It would be fantastic to get more granular, at the account-level. That would be a

Traditional warrant canaries are issued regularly, just as you described it. It would be fantastic to get more granular, at the account-level. That would be a cool differentiator for these hardcore privacy/security-oriented companies.

rtkwe 10y ago
No company is going to do that. Doing that would get them in trouble with normal warrants much less NSLs.
- hendersoon 10y ago
  Why? You send one email per user per month: "We didn't get any warrants that cover your account." Nothing to it.
  - rtkwe 10y ago
    Because that would get the company in trouble even a normal warrant to say nothing of the gag order on an NSL. It's too specific and tips off the exact people being investigated. The lawsuit the company would be hit with would be huge, expensive and a pretty straight forward loss.
    - hendersoon 10y ago
      I don't see why. It's the exact same principle as standard warrant canaries.
      - rtkwe 10y ago
        It's the same rough idea except it goes from "we received at least one letter once about some user(s) on this site" to "we received a letter about YOU," that's a huge difference. Canaries aren't challenged currently partially because they give out so little information that it's really not worth the governments time to go after people. What the NSL gag really aims to prevent is to keep the people targeted by the NSLs from knowing that they're under investigation. If a company started doing canaries that applied down to a single person they'd be sued the first time they stopped sending one after getting a letter. Also I'm not entirely sure that even if a judge found that an NSL can't compel you to send a zombie canary that it follows that the company can't be fined or sanctioned for breaking the gag order.
        hendersoon 10y ago
        It's not "we received a letter about you". If they get a NSL, then they _don't_ post the canary. That's a key difference, between action and inaction, and it's what the whole thing rests on. Not that it's been tested in (non-secret) court.
        rtkwe 10y ago
        I'm saying that the reason warrant canaries haven't gotten companies in trouble yet is because they're so vague as to be practically useless and that revealing to a person that they were the target of an NSL, through either action or inaction, would probably be over the line legally. At the very least it'd be a massively expensive test case and the companies that have the money to pay for that have too much to lose on a case that isn't solid. It'll come down to the very technical legal question of action vs inaction that would probably wind up in the supreme court.

rtkwe 10y ago

No company is going to do that. Doing that would get them in trouble with normal warrants much less NSLs.

hendersoon 10y ago
Why? You send one email per user per month: "We didn't get any warrants that cover your account." Nothing to it.
- rtkwe 10y ago
  Because that would get the company in trouble even a normal warrant to say nothing of the gag order on an NSL. It's too specific and tips off the exact people being investigated. The lawsuit the company would be hit with would be huge, expensive and a pretty straight forward loss.
  - hendersoon 10y ago
    I don't see why. It's the exact same principle as standard warrant canaries.
    - rtkwe 10y ago
      It's the same rough idea except it goes from "we received at least one letter once about some user(s) on this site" to "we received a letter about YOU," that's a huge difference. Canaries aren't challenged currently partially because they give out so little information that it's really not worth the governments time to go after people. What the NSL gag really aims to prevent is to keep the people targeted by the NSLs from knowing that they're under investigation. If a company started doing canaries that applied down to a single person they'd be sued the first time they stopped sending one after getting a letter. Also I'm not entirely sure that even if a judge found that an NSL can't compel you to send a zombie canary that it follows that the company can't be fined or sanctioned for breaking the gag order.
      - hendersoon 10y ago
        It's not "we received a letter about you". If they get a NSL, then they _don't_ post the canary. That's a key difference, between action and inaction, and it's what the whole thing rests on. Not that it's been tested in (non-secret) court.
        rtkwe 10y ago
        I'm saying that the reason warrant canaries haven't gotten companies in trouble yet is because they're so vague as to be practically useless and that revealing to a person that they were the target of an NSL, through either action or inaction, would probably be over the line legally. At the very least it'd be a massively expensive test case and the companies that have the money to pay for that have too much to lose on a case that isn't solid. It'll come down to the very technical legal question of action vs inaction that would probably wind up in the supreme court.