5 ms·

It could also just be a glitch as it appears it is a script that generates the .txt (and fetching external text / news as content). In NSLs, you are not allowe

by rvnx 4y ago

It could also just be a glitch as it appears it is a script that generates the .txt (and fetching external text / news as content). In NSLs, you are not allowed to reveal the existence of the request. Removing the warrant canary reveals the existence of the NSL. Sometimes courts also prohibit you from revealing that you gave away user account information to the police. In theory, using the (incorrect) logic of the canary warrant, you could publish a list of all user IDs and say "The police never requested the user information for these IDs below:", but this seems very gimmicky in front of a judge. At the end of the day, a company that is actually subjected to NSL wishes has very little reasons to remove a canary warrant. 1) They cannot be sued for lying in their canary warrant as this was a properly formed court request. 2) It is good marketing for them. 3) They risk significant criminal charges for no benefits. They really have no incentive to do so.

bhaney 4y ago
If it was a glitch, I'd expect that they'd have fixed it by now to avoid the implications and potentially lose customers over it. Surely over the course of the month+ that it's been missing, they would have noticed it or had it brought to their attention?
liamwire 4y ago
Given the way this warrant canary works, in that it’s published daily, wouldn’t the government instructing that you cannot opt to stop publishing the canary equate to compelling speech, and be a fairly clear path to a First Amendment violation? I ask this as a total outsider to both the United States, and US law.
- MacsHeadroom 4y ago
  Yes, and this is the entire premise of warrant canaries. The GP is wrong and you are correct. Disclaimer: IANAL
  - rtpg 4y ago
    Imagine you are a 5 year old child, and the judge is your parent. You think that this argument would work for them? Trying to logic bomb your way out of this is just asking for a summary judgement against you. It doesn't matter if it's not logically consistent, most rulings aren't! They will simply ignore this argument. The counter to the "compelled speech" argument is that the government is not the one that forced you to start doing warrant canaries! You started doing warrant canaries, the gov't wouldn't ask for a remedy of you putting up continued canaries. You put the onus on lying on yourself, and if you don't do it you'll just be charged with revealing the facts. Government demanding you to compel speech is not what would happen.
    - alex_sf 4y ago
      It's not a 'logic bomb'. US law sets a high bar for prior restraint, an even higher one for compelled speech, and has never compelled false speech as far as I'm aware. And no, most rulings are, in fact, logically consistent.
      - rtpg 4y ago
        I still contend that "compelled speech" is not what's happening when you get charged for publishing the existence of the NSL through a bed of your own making. Though I do agree that the feeling is very different compared to regulation of other commercial speech because of the ... lying aspect. If we take the inverse, and we are talking about prior constraint, I have a really hard time imagining courts not siding with the executive. There are so many more controversial things the courts side with on law enforcement, "do not tell people who we are investigating" feels like such an easy win (and honestly much more acceptable to the general public than anything). I feel like there's some fundamental argument here about negligence. In what way is the government responsible for you making a promise you can't keep to your customers? But... ultimately there's no "real" answer except what the case looks like when it gets in front of judges and how they feel about it. And I will admit arguing it's not compelled speech takes a hell of a lot more effort (even if I believe it's true!).
    - phpisthebest 4y ago
- orblivion 4y ago
  If compelling this speech is a First Amendment violation, wouldn't the prohibition on outright saying you got the warrant also be a First Amendment violation?
  - zoklet-enjoyer 4y ago
    Yes, it is
  - alex_sf 4y ago
    No. US law makes a distinction between 'prior restraint' and 'compelled speech'. Prior restraint is the government forcing you to _not_ say something. Compelled speech is the opposite, forcing you _to_ say something. Both have a high bar to meet, and meeting one does not mean you that you meet the other. In the case of compelled speech, I don't believe a US court has ever ordered someone to lie, which is what would be required here.
- rvnx 4y ago
  Concrete case: you are the owner of an encrypted chat app, let's say "WhatsSignalGram". Tomorrow, the government is asking you to capture messages of some users that are planning a terrorist attack. By default your app is not capturing these messages, but technically you could do it with a specific update. The lawyers already challenged the decision, they confirmed the request cannot be avoided. You end up pushing a backdoor targeting specific users ("a law enforcement custom update"). Court is explicitly asking you to not disclose the existence of this special update. As a business owner, why would you reveal it ? You'll go to jail (or struggle in court at least) for few years, have a horrible reputation and end up poor because your company is going to lose all its user base :/ This sounds like an insane decision. The users, upon learning you got backdoored are going to go away, because the competitors "Telegram", "WhatsApp", etc, they will not have removed their canary or they will simply not have claimed anything :) Perhaps on paper the law cannot force you, but if you don't comply you are cutting the branch you are sitting on. The alternative is just to leave the warrant canary and live happily after. Perhaps you even made the world better after all and actually prevented an attack.
  - alex_sf 4y ago
    The sort of banana republic that can generate a court order for you to do that is the same kind that would simply put a gun to your head instead. In the US, no court would order that type of equitable relief. But, pretending that's not the case: > As a business owner, why would you reveal it ? Because you have principles? Backed up with at least a little bit of spine? > You'll go to jail (or struggle in court at least) for few years, have a horrible reputation and end up poor because your company is going to lose all its user base ? It's not clear that you would go to jail. You can simply shutdown[1]. For those that actually care about privacy, your reputation would only increase. [1] https://www.theguardian.com/technology/2013/aug/08/lavabit-email-shut-down-edward-snowden https://www.theguardian.com/technology/2013/aug/08/lavabit-e...
    - deleted 4y ago
      [deleted]
    - steve_taylor 4y ago
- autoexec 4y ago
  > wouldn’t the government instructing that you cannot opt to stop publishing the canary equate to compelling speech We compel speech in companies all the time. We force them to disclose ingredients and add labels to their products. We force them to hand over financial information and employee records. Forcing them to lie is something I haven't seen though. I don't see how the government could be stopped from forcing a company to hand over their encryption keys and just continuing to publish the canary on the company's website themselves though.
  - alex_sf 4y ago
    > I don't see how the government could be stopped from forcing a company to hand over their encryption keys and just continuing to publish the canary on the company's website themselves though. The government could force the handover of encryption keys, with the caveat that if a set of keys controlled by the provider can compromise your security, it's a trash system. Forcing the existing canary to remain would be straightforward as well. Compelling false speech, i.e., continuing to publish a time-based canary, is a huge leap from either of those things.
- smallnamespace 4y ago
  I wonder if any companies have considered publishing warrant canaries as part of their public securities filings (for example, inserting it into the risk factors sections). There is a fairly reasonable argument one could make for doing so: - The company's value is tied to its reputation for securing its users' data - An NSL or similar would risk their users' security and the company's reputation - This will affect the value of the enterprise and therefore the existence of an NSL ought to be disclosed to investors However at the meta-level, this would be a substantial escalation since an order to continue publishing a canary is no longer just compelled lying, but compelled securities fraud, effectively pitting one branch of government (the national security apparatus) with another (the SEC).
  - LanternLight83 4y ago
    Thanks for sharing, I think this is a fascinating idea!
  - brookst 4y ago
    Too clever. As a logical solution to a set of mathematical constraints, yes. As a real world strategy, no.
  - deleted 4y ago
    [deleted]
Brian_K_White 4y ago
There must be some level of something to the idea that you can't be ordered to commit a crime, and so can't be ordered to lie, aka fraud, perjury, etc.
NegativeK 4y ago
> this seems very gimmicky in front of a judge. It's always felt like engineers thinking they're outsmarting a much more mature legal system with humans built-in to slap away foolish gotchas. The EFF seems to think warrant canaries would work, though, but under the premise that you can say "I've received some number of national security letters", just not "I've received this precise number of NSLs." That's an _entirely_ different line of thinking than every advocation of warrant canaries I've read.
- k2enemy 4y ago
  > It's always felt like engineers thinking they're outsmarting a much more mature legal system with humans built-in to slap away foolish gotchas. And then the engineers, unsatisfied with the messy world of human intervention, create a system without humans, where the "code is the contract" (ethereum). Then rapidly abandon that tenet at the first inconvenience and return to human discretion (DAO fork).
  - hosh 4y ago
    Because at the end of the day, non-fully-autonomous machinery are proxies for promises humans make to each other. (https://en.m.wikipedia.org/wiki/Promise_theory https://en.m.wikipedia.org/wiki/Promise_theory)
- rvnx 4y ago
  This crypto-nerd approach with the legal system reminded me of https://imgs.xkcd.com/comics/security.png https://imgs.xkcd.com/comics/security.png
  - kps 4y ago
    I would have called https://xkcd.com/1494/ https://xkcd.com/1494/
    - rvnx 4y ago
      Great finding! :)
alex_sf 4y ago
> They really have no incentive to do so. Other than, you know, doing the entire thing they are designed to do. Some people do, in fact, care about civil liberties.
LinuxBender 4y ago
How you describe it is very similar to how a senior legal counsel and a couple C-Levels described it to me when I suggested we create one. There are merits to the ability to challenge on compelled speech but no company will take that risk. If anything a company wants the government on its side and will not take such a risk even if it's in a grey area. This was in a publicly traded company so perhaps that is also a factor. I've seen a lot of back scratching both ways.
rsync 4y ago
"It could also just be a glitch as it appears it is a script that generates the .txt (and fetching external text / news as content)." I don't like this ... If you're publishing a warrant canary, updating it should be a manual process that a human is involved in. The whole point of the headlines and the baseball/basketball scores is to prove that the messaged weren't pre-generated and pre-signed in advance. What's the difference between pre-signing a stack of future canaries vs. script-generating them as time goes by ? Either way, you're muddying the negative-statement aspect of it ...

by rvnx 4y ago

bhaney 4y ago

If it was a glitch, I'd expect that they'd have fixed it by now to avoid the implications and potentially lose customers over it. Surely over the course of the month+ that it's been missing, they would have noticed it or had it brought to their attention?

liamwire 4y ago

Given the way this warrant canary works, in that it’s published daily, wouldn’t the government instructing that you cannot opt to stop publishing the canary equate to compelling speech, and be a fairly clear path to a First Amendment violation? I ask this as a total outsider to both the United States, and US law.

MacsHeadroom 4y ago
Yes, and this is the entire premise of warrant canaries. The GP is wrong and you are correct. Disclaimer: IANAL
- rtpg 4y ago
  Imagine you are a 5 year old child, and the judge is your parent. You think that this argument would work for them? Trying to logic bomb your way out of this is just asking for a summary judgement against you. It doesn't matter if it's not logically consistent, most rulings aren't! They will simply ignore this argument. The counter to the "compelled speech" argument is that the government is not the one that forced you to start doing warrant canaries! You started doing warrant canaries, the gov't wouldn't ask for a remedy of you putting up continued canaries. You put the onus on lying on yourself, and if you don't do it you'll just be charged with revealing the facts. Government demanding you to compel speech is not what would happen.
  - alex_sf 4y ago
    It's not a 'logic bomb'. US law sets a high bar for prior restraint, an even higher one for compelled speech, and has never compelled false speech as far as I'm aware. And no, most rulings are, in fact, logically consistent.
    - rtpg 4y ago
      I still contend that "compelled speech" is not what's happening when you get charged for publishing the existence of the NSL through a bed of your own making. Though I do agree that the feeling is very different compared to regulation of other commercial speech because of the ... lying aspect. If we take the inverse, and we are talking about prior constraint, I have a really hard time imagining courts not siding with the executive. There are so many more controversial things the courts side with on law enforcement, "do not tell people who we are investigating" feels like such an easy win (and honestly much more acceptable to the general public than anything). I feel like there's some fundamental argument here about negligence. In what way is the government responsible for you making a promise you can't keep to your customers? But... ultimately there's no "real" answer except what the case looks like when it gets in front of judges and how they feel about it. And I will admit arguing it's not compelled speech takes a hell of a lot more effort (even if I believe it's true!).
  - phpisthebest 4y ago
orblivion 4y ago
If compelling this speech is a First Amendment violation, wouldn't the prohibition on outright saying you got the warrant also be a First Amendment violation?
- zoklet-enjoyer 4y ago
  Yes, it is
- alex_sf 4y ago
  No. US law makes a distinction between 'prior restraint' and 'compelled speech'. Prior restraint is the government forcing you to _not_ say something. Compelled speech is the opposite, forcing you _to_ say something. Both have a high bar to meet, and meeting one does not mean you that you meet the other. In the case of compelled speech, I don't believe a US court has ever ordered someone to lie, which is what would be required here.
rvnx 4y ago
Concrete case: you are the owner of an encrypted chat app, let's say "WhatsSignalGram". Tomorrow, the government is asking you to capture messages of some users that are planning a terrorist attack. By default your app is not capturing these messages, but technically you could do it with a specific update. The lawyers already challenged the decision, they confirmed the request cannot be avoided. You end up pushing a backdoor targeting specific users ("a law enforcement custom update"). Court is explicitly asking you to not disclose the existence of this special update. As a business owner, why would you reveal it ? You'll go to jail (or struggle in court at least) for few years, have a horrible reputation and end up poor because your company is going to lose all its user base :/ This sounds like an insane decision. The users, upon learning you got backdoored are going to go away, because the competitors "Telegram", "WhatsApp", etc, they will not have removed their canary or they will simply not have claimed anything :) Perhaps on paper the law cannot force you, but if you don't comply you are cutting the branch you are sitting on. The alternative is just to leave the warrant canary and live happily after. Perhaps you even made the world better after all and actually prevented an attack.
- alex_sf 4y ago
  The sort of banana republic that can generate a court order for you to do that is the same kind that would simply put a gun to your head instead. In the US, no court would order that type of equitable relief. But, pretending that's not the case: > As a business owner, why would you reveal it ? Because you have principles? Backed up with at least a little bit of spine? > You'll go to jail (or struggle in court at least) for few years, have a horrible reputation and end up poor because your company is going to lose all its user base ? It's not clear that you would go to jail. You can simply shutdown[1]. For those that actually care about privacy, your reputation would only increase. [1] https://www.theguardian.com/technology/2013/aug/08/lavabit-email-shut-down-edward-snowden https://www.theguardian.com/technology/2013/aug/08/lavabit-e...
  - deleted 4y ago
    [deleted]
  - steve_taylor 4y ago
autoexec 4y ago
> wouldn’t the government instructing that you cannot opt to stop publishing the canary equate to compelling speech We compel speech in companies all the time. We force them to disclose ingredients and add labels to their products. We force them to hand over financial information and employee records. Forcing them to lie is something I haven't seen though. I don't see how the government could be stopped from forcing a company to hand over their encryption keys and just continuing to publish the canary on the company's website themselves though.
- alex_sf 4y ago
  > I don't see how the government could be stopped from forcing a company to hand over their encryption keys and just continuing to publish the canary on the company's website themselves though. The government could force the handover of encryption keys, with the caveat that if a set of keys controlled by the provider can compromise your security, it's a trash system. Forcing the existing canary to remain would be straightforward as well. Compelling false speech, i.e., continuing to publish a time-based canary, is a huge leap from either of those things.
smallnamespace 4y ago
I wonder if any companies have considered publishing warrant canaries as part of their public securities filings (for example, inserting it into the risk factors sections). There is a fairly reasonable argument one could make for doing so: - The company's value is tied to its reputation for securing its users' data - An NSL or similar would risk their users' security and the company's reputation - This will affect the value of the enterprise and therefore the existence of an NSL ought to be disclosed to investors However at the meta-level, this would be a substantial escalation since an order to continue publishing a canary is no longer just compelled lying, but compelled securities fraud, effectively pitting one branch of government (the national security apparatus) with another (the SEC).
- LanternLight83 4y ago
  Thanks for sharing, I think this is a fascinating idea!
- brookst 4y ago
  Too clever. As a logical solution to a set of mathematical constraints, yes. As a real world strategy, no.
- deleted 4y ago
  [deleted]

Brian_K_White 4y ago

There must be some level of something to the idea that you can't be ordered to commit a crime, and so can't be ordered to lie, aka fraud, perjury, etc.

NegativeK 4y ago

> this seems very gimmicky in front of a judge. It's always felt like engineers thinking they're outsmarting a much more mature legal system with humans built-in to slap away foolish gotchas. The EFF seems to think warrant canaries would work, though, but under the premise that you can say "I've received some number of national security letters", just not "I've received this precise number of NSLs." That's an _entirely_ different line of thinking than every advocation of warrant canaries I've read.

k2enemy 4y ago
> It's always felt like engineers thinking they're outsmarting a much more mature legal system with humans built-in to slap away foolish gotchas. And then the engineers, unsatisfied with the messy world of human intervention, create a system without humans, where the "code is the contract" (ethereum). Then rapidly abandon that tenet at the first inconvenience and return to human discretion (DAO fork).
- hosh 4y ago
  Because at the end of the day, non-fully-autonomous machinery are proxies for promises humans make to each other. (https://en.m.wikipedia.org/wiki/Promise_theory https://en.m.wikipedia.org/wiki/Promise_theory)
rvnx 4y ago
This crypto-nerd approach with the legal system reminded me of https://imgs.xkcd.com/comics/security.png https://imgs.xkcd.com/comics/security.png
- kps 4y ago
  I would have called https://xkcd.com/1494/ https://xkcd.com/1494/
  - rvnx 4y ago
    Great finding! :)

alex_sf 4y ago

> They really have no incentive to do so. Other than, you know, doing the entire thing they are designed to do. Some people do, in fact, care about civil liberties.

LinuxBender 4y ago

How you describe it is very similar to how a senior legal counsel and a couple C-Levels described it to me when I suggested we create one. There are merits to the ability to challenge on compelled speech but no company will take that risk. If anything a company wants the government on its side and will not take such a risk even if it's in a grey area. This was in a publicly traded company so perhaps that is also a factor. I've seen a lot of back scratching both ways.

rsync 4y ago

"It could also just be a glitch as it appears it is a script that generates the .txt (and fetching external text / news as content)." I don't like this ... If you're publishing a warrant canary, updating it should be a manual process that a human is involved in. The whole point of the headlines and the baseball/basketball scores is to prove that the messaged weren't pre-generated and pre-signed in advance. What's the difference between pre-signing a stack of future canaries vs. script-generating them as time goes by ? Either way, you're muddying the negative-statement aspect of it ...