3 ms·

Can someone explain what a Warrant Canary is and why it needs to be removed? From my understanding, a Warrant Canary is a provision to disclose subpoena(s) tha

Can someone explain what a Warrant Canary is and why it needs to be removed? From my understanding, a Warrant Canary is a provision to disclose subpoena(s) that a company is not allowed to disclose and now SpiderOak is shutting down that provision?

wccrawford 8y ago
Canaries were used in coal mines to detect deadly gas. If your canary dies, it means you might have a problem. A warrant canary dies when a warrant is served. If a company has a statement that says "We have not been served a warrant as of X date" and they update it monthly, then they suddenly stop updating it or remove that statement, the canary has died. They might have been served with a warrant. It's also possible that the canary died of natural causes, of course. It could be that a lawyer told them it was a bad idea, or maybe a shift in management removed it. But there's no way to know.
- kilotaras 8y ago
  To expand on this. This is done as it is usually presumed the government can legally force your silence, but can't force you to say something (e.g we hadn't received secret warrant, last updated: Aug, 08)
  - cyphar 8y ago
    And to even further expand on it, the reason why they usually have a date is because it would be possible to argue that a company could be forced to keep an existing document on their website (since they aren't being forced to say something against their will, so much as being forced to not stop saying something they've already said). So the expiry is quite important in the function of a warrant canary. Although it should be noted that as far as I'm aware, warrant canaries haven't actually gone through the court system to determine if they are actually a legal way of circumventing gag orders. Not to mention that the legality of warrant canaries has mostly only been discussed by internet lawyers in relation to US laws -- in other jurisdictions they may not work at all (I've spoken to some Australian lawyers and they think that even the basis of the theoretical arguments don't apply in Australia). On the other hand, I don't know of any company that has actually used warrant canaries (and has "activated them" like Reddit did) which ended up being tried for violation of the NSL's gag order.
deleted 8y ago
[deleted]
tutts 8y ago
Miners used to bring canary birds with them when mining. If they hit poisonous gas, the canary would die before the miners, alerting them to the gas. The government can issue secret warrants to companies that they are not allowed to disclose, requiring them to hand over customer data. A warrant canary is a periodical statement from a company that they have not received such a warrant. The idea is that if they do receive a warrant, they will stop publishing the warrant, and the court can't compel them to.
deleted 8y ago
[deleted]
rocqua 8y ago
A warrant canary states "We have not complied with any subpoenas that disclosed user data". All that has to happen upon complying with a warrant that requires user data is to remove / not republish the canary. The idea being that a gag order cannot force you to speak, only prohibit you from speaking. Thus, a gag-order cannot force you to continue publishing a canary. Often, canaries have an 'expiry date' after which they will be republished. This is to avoid 'removing a document' as being interpreted as speech, and thus prohibited by gag order. Now spideroak had a canary with an expiration of 1 aug. They did not republish; and 3 days later, gave an explanation why. In this explanation they state they will switch to a slightly different, non-cryptographically signed document that is much like a warrant canary. The 3 day gap is most notable here. Spideroak states that the cryptographic signing wasn't useful because you need to trust the signers, who are the same people that publish on the website.

wccrawford 8y ago

Canaries were used in coal mines to detect deadly gas. If your canary dies, it means you might have a problem. A warrant canary dies when a warrant is served. If a company has a statement that says "We have not been served a warrant as of X date" and they update it monthly, then they suddenly stop updating it or remove that statement, the canary has died. They might have been served with a warrant. It's also possible that the canary died of natural causes, of course. It could be that a lawyer told them it was a bad idea, or maybe a shift in management removed it. But there's no way to know.

kilotaras 8y ago
To expand on this. This is done as it is usually presumed the government can legally force your silence, but can't force you to say something (e.g we hadn't received secret warrant, last updated: Aug, 08)
- cyphar 8y ago
  And to even further expand on it, the reason why they usually have a date is because it would be possible to argue that a company could be forced to keep an existing document on their website (since they aren't being forced to say something against their will, so much as being forced to not stop saying something they've already said). So the expiry is quite important in the function of a warrant canary. Although it should be noted that as far as I'm aware, warrant canaries haven't actually gone through the court system to determine if they are actually a legal way of circumventing gag orders. Not to mention that the legality of warrant canaries has mostly only been discussed by internet lawyers in relation to US laws -- in other jurisdictions they may not work at all (I've spoken to some Australian lawyers and they think that even the basis of the theoretical arguments don't apply in Australia). On the other hand, I don't know of any company that has actually used warrant canaries (and has "activated them" like Reddit did) which ended up being tried for violation of the NSL's gag order.

deleted 8y ago

[deleted]

tutts 8y ago

Miners used to bring canary birds with them when mining. If they hit poisonous gas, the canary would die before the miners, alerting them to the gas. The government can issue secret warrants to companies that they are not allowed to disclose, requiring them to hand over customer data. A warrant canary is a periodical statement from a company that they have not received such a warrant. The idea is that if they do receive a warrant, they will stop publishing the warrant, and the court can't compel them to.

deleted 8y ago

[deleted]

rocqua 8y ago

A warrant canary states "We have not complied with any subpoenas that disclosed user data". All that has to happen upon complying with a warrant that requires user data is to remove / not republish the canary. The idea being that a gag order cannot force you to speak, only prohibit you from speaking. Thus, a gag-order cannot force you to continue publishing a canary. Often, canaries have an 'expiry date' after which they will be republished. This is to avoid 'removing a document' as being interpreted as speech, and thus prohibited by gag order. Now spideroak had a canary with an expiration of 1 aug. They did not republish; and 3 days later, gave an explanation why. In this explanation they state they will switch to a slightly different, non-cryptographically signed document that is much like a warrant canary. The 3 day gap is most notable here. Spideroak states that the cryptographic signing wasn't useful because you need to trust the signers, who are the same people that publish on the website.