4 ms·

SpiderOak tweeted three days ago [1] that it's replacing the warrant canary with a transparency report that'd be updated every six months. This is what the twe

SpiderOak tweeted three days ago [1] that it's replacing the warrant canary with a transparency report that'd be updated every six months. This is what the tweet said/says: [1] "We just released our most recent transparency report, available at https://spideroak.com/transparency/ https://spideroak.com/transparency/ . This will replace our #warrantcanary. The final version of the canary is available at https://spideroak.com/canary https://spideroak.com/canary . The transparency report will be updated every six months." The transparency report, updated a few days ago this month, shows zeros for every kind of request, which means there haven't been any kind of court orders for information from February to August 2018. [2] Are there still reasons to be concerned? I don't understand how they can list NSLs in the transparency report, since those are the ones with the gag orders necessitating legally confounding workarounds like a warrant canary. [1]: https://twitter.com/SpiderOak/status/1025488889564327936 https://twitter.com/SpiderOak/status/1025488889564327936 [2]: https://spideroak.com/transparency/ https://spideroak.com/transparency/

dannyw 8y ago
Before you receive a NSL, you do not have any gag orders. It is the gag order that prevents publication; not the law. So you can legally say you’ve received no NSLs; until you get a NSL.
- otp124 8y ago
  My understanding is they are served simultaneously, so you do not have that luxury.
  - eganist 8y ago
    If that were the case, the concept of a warrant canary would have died long ago in court. A gag order doesn't compel you to lie; it compels you not to talk about the topic in question. Removing a statement testifying to no NSL is in compliance with a gag order.
    - otp124 8y ago
      Wow, did you downvote me for adding to the conversation? Here are sources that disagree with you and align with my previous comment. You should provide sources next time. > A judge does not have to approve the NSL or an accompanying gag order. https://www.eff.org/issues/national-security-letters/faq https://www.eff.org/issues/national-security-letters/faq > The letters come with a life-long gag order, so businesses that receive such letters are prohibited from revealing to anyone, including customers who may be under investigation, that the government has requested records of transactions. https://www.wired.com/2010/08/nsl-gag-order-lifted/#ixzz0wcPM40Dg https://www.wired.com/2010/08/nsl-gag-order-lifted/#ixzz0wcP... > NSLs are almost exclusively served in secret alongside an indefinite gag order, which prevents anyone from disclosing the contents of the letter to anyone. https://www.zdnet.com/article/national-security-letters-everything-you-need-to-know/ https://www.zdnet.com/article/national-security-letters-ever... > Since the first national security letter (NSL) statute was passed in 1986 and then dramatically expanded under the USA PATRIOT Act, the FBI has issued hundreds of thousands of such letters seeking the private telecommunications and financial records of Americans without any prior approval from courts. In addition to this immense investigatory power, NSL statutes also permit the FBI to unilaterally gag recipients and prevent them from criticizing such actions publicly. This combination of powers — to investigate and to silence — has coalesced to permit the FBI to wield enormous power and to operate without meaningful checks, far from the watchful eyes of the judicial branch. Not surprisingly, this lack of checks has contributed to a dramatic expansion in the use of these tools across the country. Indeed, for the period between 2003 and 2006 alone, almost 200,000 requests for private customer information were sought pursuant to various NSL statutes. https://www.eff.org/issues/national-security-letters https://www.eff.org/issues/national-security-letters
      - jsight 8y ago
        I think that you are getting downvoted because people don't understand what you are trying to say. I don't understand it either. Yes, the NSL and gag order are effectively one and the same. However, the point of these "warrant canaries" is that they don't have to talk about the request to let people know that they have likely received one. They simply remove their existing statement that they have never previously seen one. The theory is that the government cannot compel you to continue to make a statement now that it is false and your removal doesn't technically constitute a disclosure of the NSL. AFAIK, this theory has never been tested in court.
  - dannyw 8y ago
    What I mean is: Before you have received any NSL, you are not bound by any gag order. (Because they come together). So, before you have received any NSLs, you can say you received 0 NSL. (I did not downvote you).
    - pas 8y ago
      But then you are basically compelled to lie, otherwise you'd violate the gag order. If the gag order would only prohibit the disclosure of the contents, then businesses could simply show the list of NSLs received (basically the date and time of when they got it and when they complied with it).
      - nashashmi 8y ago
        Umm. So what I am understanding is that statement 1 "I have not received any NSL" is a true statement 100% of the way and they can say it for as long as they do not receive any NSL. The moment they recv an NSL, they cannot say statement 1 anymore. So they say something different... not sure what that is.
        Uberphallus 8y ago
        They remove that statement. Basically people can know what happened running a diff between reports.
- newscracker 8y ago
  Right. That was my understanding too. But they’d have to remove that NSL section if they receive an NSL (assuming their honesty or desire to be so is not in question here) — as Lazare explained in another comment here. That’s almost the same as the canary, without the signing.
forkerenok 8y ago
My hunch is that they were indeed served with an NSL. The transparency report bullshit is an extra thing they've done to have mercy of NSA or whatever at the expense of confusing (quite) a few people (people mentioned that canary practice wasn't confirmed as illegal or legal by any court proceeding). One thing to realise is that they (AFAIR) never said they'd quit the business if they ever get served with an NSL.
Lazare 8y ago
> I don't understand how they can list NSLs in the transparency report Correct. You can list the ones you don't have, but not the ones you do. So to a first approximation, the transparency report will always say "0". Now, the theory behind a warrant canary is that the government can compel your silence but (maybe!) it cannot compel you to make false statements. And if that applies to NSLs and gag orders, and thus makes warrant canaries valid, it might apply to the transparency report too. And in that case maybe we can take the "0" at face value, and we can assume that they haven't received an NSL, but if they do they'll just silently drop that section from the transparency report. (Their warrant canary had some cryptographic signatures, but as far as I know, that's totally irrelevant. If a court decides to compel you to lie and say you haven't received a NSL when you have, then they can compel you to sign the canary too. If they opt not to compel speech, then they won't compel a false transparency report. The crypto is window dressing.) But while on paper it looks to me like the transparency report is probably just as meaningful as the canary, the ham-handed way they've announced it leaves me suspicious.
- thfuran 8y ago
  I don't think there's any way to change from having a warrant canary to not having the warrant canary, even if your new approach nominally conveys the same information, that isn't rather suspicious.
- qmarchi 8y ago
  Just to add on, the compelling of speech is made more difficult by the fact that the signing keys were held by people of three different nationalities, in three different countries. The US Government can't force someone to do something if they aren't a US citizen and not on their territory. Their best option is extradition, but that would raise more eyebrows than they'd want.
  - peterwwillis 8y ago
    Their best option is to simply ask the foreign government to do something to their own citizens on its behalf because they have evidence of some sort of potential criminal activity. Quid pro quo ensues, no extradition needed.

dannyw 8y ago

Before you receive a NSL, you do not have any gag orders. It is the gag order that prevents publication; not the law. So you can legally say you’ve received no NSLs; until you get a NSL.

otp124 8y ago
My understanding is they are served simultaneously, so you do not have that luxury.
- eganist 8y ago
  If that were the case, the concept of a warrant canary would have died long ago in court. A gag order doesn't compel you to lie; it compels you not to talk about the topic in question. Removing a statement testifying to no NSL is in compliance with a gag order.
  - otp124 8y ago
    Wow, did you downvote me for adding to the conversation? Here are sources that disagree with you and align with my previous comment. You should provide sources next time. > A judge does not have to approve the NSL or an accompanying gag order. https://www.eff.org/issues/national-security-letters/faq https://www.eff.org/issues/national-security-letters/faq > The letters come with a life-long gag order, so businesses that receive such letters are prohibited from revealing to anyone, including customers who may be under investigation, that the government has requested records of transactions. https://www.wired.com/2010/08/nsl-gag-order-lifted/#ixzz0wcPM40Dg https://www.wired.com/2010/08/nsl-gag-order-lifted/#ixzz0wcP... > NSLs are almost exclusively served in secret alongside an indefinite gag order, which prevents anyone from disclosing the contents of the letter to anyone. https://www.zdnet.com/article/national-security-letters-everything-you-need-to-know/ https://www.zdnet.com/article/national-security-letters-ever... > Since the first national security letter (NSL) statute was passed in 1986 and then dramatically expanded under the USA PATRIOT Act, the FBI has issued hundreds of thousands of such letters seeking the private telecommunications and financial records of Americans without any prior approval from courts. In addition to this immense investigatory power, NSL statutes also permit the FBI to unilaterally gag recipients and prevent them from criticizing such actions publicly. This combination of powers — to investigate and to silence — has coalesced to permit the FBI to wield enormous power and to operate without meaningful checks, far from the watchful eyes of the judicial branch. Not surprisingly, this lack of checks has contributed to a dramatic expansion in the use of these tools across the country. Indeed, for the period between 2003 and 2006 alone, almost 200,000 requests for private customer information were sought pursuant to various NSL statutes. https://www.eff.org/issues/national-security-letters https://www.eff.org/issues/national-security-letters
    - jsight 8y ago
      I think that you are getting downvoted because people don't understand what you are trying to say. I don't understand it either. Yes, the NSL and gag order are effectively one and the same. However, the point of these "warrant canaries" is that they don't have to talk about the request to let people know that they have likely received one. They simply remove their existing statement that they have never previously seen one. The theory is that the government cannot compel you to continue to make a statement now that it is false and your removal doesn't technically constitute a disclosure of the NSL. AFAIK, this theory has never been tested in court.
- dannyw 8y ago
  What I mean is: Before you have received any NSL, you are not bound by any gag order. (Because they come together). So, before you have received any NSLs, you can say you received 0 NSL. (I did not downvote you).
  - pas 8y ago
    But then you are basically compelled to lie, otherwise you'd violate the gag order. If the gag order would only prohibit the disclosure of the contents, then businesses could simply show the list of NSLs received (basically the date and time of when they got it and when they complied with it).
    - nashashmi 8y ago
      Umm. So what I am understanding is that statement 1 "I have not received any NSL" is a true statement 100% of the way and they can say it for as long as they do not receive any NSL. The moment they recv an NSL, they cannot say statement 1 anymore. So they say something different... not sure what that is.
      - Uberphallus 8y ago
        They remove that statement. Basically people can know what happened running a diff between reports.
newscracker 8y ago
Right. That was my understanding too. But they’d have to remove that NSL section if they receive an NSL (assuming their honesty or desire to be so is not in question here) — as Lazare explained in another comment here. That’s almost the same as the canary, without the signing.

forkerenok 8y ago

My hunch is that they were indeed served with an NSL. The transparency report bullshit is an extra thing they've done to have mercy of NSA or whatever at the expense of confusing (quite) a few people (people mentioned that canary practice wasn't confirmed as illegal or legal by any court proceeding). One thing to realise is that they (AFAIR) never said they'd quit the business if they ever get served with an NSL.

Lazare 8y ago

> I don't understand how they can list NSLs in the transparency report Correct. You can list the ones you don't have, but not the ones you do. So to a first approximation, the transparency report will always say "0". Now, the theory behind a warrant canary is that the government can compel your silence but (maybe!) it cannot compel you to make false statements. And if that applies to NSLs and gag orders, and thus makes warrant canaries valid, it might apply to the transparency report too. And in that case maybe we can take the "0" at face value, and we can assume that they haven't received an NSL, but if they do they'll just silently drop that section from the transparency report. (Their warrant canary had some cryptographic signatures, but as far as I know, that's totally irrelevant. If a court decides to compel you to lie and say you haven't received a NSL when you have, then they can compel you to sign the canary too. If they opt not to compel speech, then they won't compel a false transparency report. The crypto is window dressing.) But while on paper it looks to me like the transparency report is probably just as meaningful as the canary, the ham-handed way they've announced it leaves me suspicious.

thfuran 8y ago
I don't think there's any way to change from having a warrant canary to not having the warrant canary, even if your new approach nominally conveys the same information, that isn't rather suspicious.
qmarchi 8y ago
Just to add on, the compelling of speech is made more difficult by the fact that the signing keys were held by people of three different nationalities, in three different countries. The US Government can't force someone to do something if they aren't a US citizen and not on their territory. Their best option is extradition, but that would raise more eyebrows than they'd want.
- peterwwillis 8y ago
  Their best option is to simply ask the foreign government to do something to their own citizens on its behalf because they have evidence of some sort of potential criminal activity. Quid pro quo ensues, no extradition needed.