10 ms·

The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having

The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!" The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not. If you put a gag order on me and suggest trying me for contempt of court if I say anything and I think the value of me talking is greater than that of my freedom, I will speak up. If I can get around the gag order by using a warrant canary to implicitly say what I'm not allowed to say without being tried for being in contempt of court, then that's what I will do. Until the laws are rewritten to prevent the use of warrant canaries, there's nothing the courts can do about this. It's a valid loophole. There's little point in killing my family if everything I know is already out there in the wind. I can't do any more harm than has already been done. All you have is retribution. Our agencies often take a pretty dim view of retribution. Chances are, I'd just end up with a contempt of court charge and be thrown in jail, potentially indefinitely. But realistically, the damage is done. Once again, you can't unring a bell. There's little they can legally do to pursue my family, there would be political uproar. So beyond charging me, I imagine they'd be relatively safe.

fossuser 8y ago
I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request when there actually might have been.
- DannyB2 8y ago
  Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped updating something.
  - DanBC 8y ago
    > I didn't take any action to disclose anything. I simply stopped updating something. This might work if judges are fucking idiots.
    - DannyB2 8y ago
      See my post immediately above about if the warrant canary is in the company's public financial statements.
    - balabaster 8y ago
      This would conspiracy to commit wire fraud with a maximum sentence of 20 years and a $250,000 fine. They surely can't compel you to break the law, even to cover up a gag order? Of course, I'm not a lawyer and this is just conjecture on my part.
  - goto11 8y ago
    Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But since some of the dll's were also used in other parts of the OS, this version of Windows could not run. But they had complied with the ruling! Microsoft thought it was very unfair when they were ruled in contempt of court.
    - DannyB2 8y ago
      If the warrant canary is in the company's financial statements, is the judge going to now try to force the company to introduce inaccurate information into their public financial disclosures? The SEC might take a dim view of that. The company can take the 'can neither confirm nor deny' posture, and simply remove the warrant canary from public financial statements. Or leave the most recent accurate and dated one unchanged.
- mirimir 8y ago
  OK, what if you provided total read-only access, to everything on all of your machines, networks, communications and so on, to someone like me. Someone who you could trust 100%. And whose reputation depended on that. Someone who was totally anonymous (which I'm not, but I could have another persona that was). And someone with such deep backdoors into your stuff that they couldn't be evicted. And so it's that person who maintains the warrant canary. Or instead, it could be an ~undocumented feature of your outside counsel. Because you do have the right to outside counsel, I think, even regarding NSLs. Edit: For example http://www.cryptohippie.net/AnonAdmin.html http://www.cryptohippie.net/AnonAdmin.html
kelnos 8y ago
Retribution could serve a useful purpose to those in power: a warning to others who are considering doing what you've done.
jrochkind1 8y ago
You don't know if it's a "valid loophole" until it's tested in court. You could later find yourself under prosecution, and possibly eventually in jail and/or with a business-destroying fine. If you are willing to risk that, because you think "the value of talking is greater than that of your freedom" -- I think that's actually quite honorable and respectful! You could of course violate the terms of a sealed warrant or other enforced-confidential court order without a warrant canary too, although of course that goes from "we're not sure if I can get away with it", to "this is definitely going to be a really big legal battle, that _maybe_ I can come out of, if there's enough political uproar." Using a warrant canary _might_ end up being just as much legal jeopardy, we're just not sure.

fossuser 8y ago

I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request when there actually might have been.

DannyB2 8y ago
Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped updating something.
- DanBC 8y ago
  > I didn't take any action to disclose anything. I simply stopped updating something. This might work if judges are fucking idiots.
  - DannyB2 8y ago
    See my post immediately above about if the warrant canary is in the company's public financial statements.
  - balabaster 8y ago
    This would conspiracy to commit wire fraud with a maximum sentence of 20 years and a $250,000 fine. They surely can't compel you to break the law, even to cover up a gag order? Of course, I'm not a lawyer and this is just conjecture on my part.
- goto11 8y ago
  Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But since some of the dll's were also used in other parts of the OS, this version of Windows could not run. But they had complied with the ruling! Microsoft thought it was very unfair when they were ruled in contempt of court.
  - DannyB2 8y ago
    If the warrant canary is in the company's financial statements, is the judge going to now try to force the company to introduce inaccurate information into their public financial disclosures? The SEC might take a dim view of that. The company can take the 'can neither confirm nor deny' posture, and simply remove the warrant canary from public financial statements. Or leave the most recent accurate and dated one unchanged.
mirimir 8y ago
OK, what if you provided total read-only access, to everything on all of your machines, networks, communications and so on, to someone like me. Someone who you could trust 100%. And whose reputation depended on that. Someone who was totally anonymous (which I'm not, but I could have another persona that was). And someone with such deep backdoors into your stuff that they couldn't be evicted. And so it's that person who maintains the warrant canary. Or instead, it could be an ~undocumented feature of your outside counsel. Because you do have the right to outside counsel, I think, even regarding NSLs. Edit: For example http://www.cryptohippie.net/AnonAdmin.html http://www.cryptohippie.net/AnonAdmin.html

kelnos 8y ago

Retribution could serve a useful purpose to those in power: a warning to others who are considering doing what you've done.

jrochkind1 8y ago

You don't know if it's a "valid loophole" until it's tested in court. You could later find yourself under prosecution, and possibly eventually in jail and/or with a business-destroying fine. If you are willing to risk that, because you think "the value of talking is greater than that of your freedom" -- I think that's actually quite honorable and respectful! You could of course violate the terms of a sealed warrant or other enforced-confidential court order without a warrant canary too, although of course that goes from "we're not sure if I can get away with it", to "this is definitely going to be a really big legal battle, that _maybe_ I can come out of, if there's enough political uproar." Using a warrant canary _might_ end up being just as much legal jeopardy, we're just not sure.