4 ms·

"Why not just have more than one canary if you're going to do it this way?" It's not entirely clear from the canary itself but the idea is that we will list al

by rsync 4y ago

"Why not just have more than one canary if you're going to do it this way?" It's not entirely clear from the canary itself but the idea is that we will list all (non secret) warrants in the signed message. Currently, the PGP signed message starts with the line: No warrants have ever been served to rsync.net, or rsync.net principals or employees. No searches or seizures of any kind have ever been performed on rsync.net assets, including: ... and if we were ever to receive a lawful warrant or notice, etc., we would then change that wording to reflect the date, service, location, etc. (in addition, presumably, to complying fully with this lawful order). So the warrant canary would continue to be updated, on schedule, but with a new listing of all warrants served in the signed message. On the other hand, if a NSL / secret / extrajudicial warrant were to be served we would be unsure of the correct course of action and would need to carefully consult our legal team, advisors, board of directors, etc. ... and that would take weeks. The warrant canary would become stale as we performed our due diligence and retained and received proper legal counsel.

tptacek 4y ago
I don't understand. What I perceive you to be saying here is that, if you receive a sealed search warrant, you're simply going to log the warrant in this document. But the warrant is going to require you not to log it. So, that's not so much a "warrant canary" as a "we're just going to defy the court" canary. I must be missing something!
- rsync 4y ago
  No, I am saying that if we receive a "normal" warrant we will log it in the canary in the signed portion. A normal warrant, or a "normal" order for search or seizure, etc., is not out of bounds in a free society - we will happily comply with such lawful orders which have proper jurisdiction, etc. We will also log them, publicly, as is our right. It just so happens that as of today we have never received such a warrant or order so the canary contains zero of them. However, if we receive a NSL or other such "gagged" orders then we will need to consult with our principals and legal counsel, directors, etc. and that takes time. The canary will surely expire as we perform that due diligence. See also, below, my characterization of the warrant canary not as a legal hack or nose-thumbing, but as a poison pill provision that we ingested 17 years ago.
  - tptacek 4y ago
    What will you do when you receive a sealed warrant? Sealed warrants to service providers in ordinary criminal cases are the common case I was talking about upthread. You will not be allowed by a court to log those orders when you receive them (you'll usually be able to log them when the case goes to trial).
    - rsync 4y ago
      I don't think service of a plain-jane sealed warrant is obstructed or hampered in any way by anything we do, or don't do, with the warrant canary. Therefore it's a very easy call to stop publishing the canary, keep running our business as usual, and then update the canary with the relevant (probably non-personal) details of the warrant we received once the dust has settled. Alternatively, our counsel, along with the jurisdiction involved, might find a satisfactory "we were served with a lawful warrant in blah blah District in Colorado" and nothing else that does not violate the seal. One gigantic advantage (among many) of running a very tightly held, lean business firm with no debt is that you can be patient.
      - tptacek 4y ago
        So, if I understand it, the plan is that you'll: 1. Receive an ordinary warrant in a criminal case, which will have non-disclosure language. 2. Take the canary down. 3. When, say, 6 months later, the case goes to trial and the warrant is unsealed, you'll put the canary back up, having logged the warrant.
        true_religion 4y ago
        From what I take it, the canary isn’t taken down. They simply do not update it. They can’t be compelled to update it, because that would be compelling them to lie in real time to their customers and the general public. National security can be used to make you stay silent, and cooperate by not hinting at secret material, but it can’t be used to force you to create and stand by a made up story.

by rsync 4y ago

tptacek 4y ago

I don't understand. What I perceive you to be saying here is that, if you receive a sealed search warrant, you're simply going to log the warrant in this document. But the warrant is going to require you not to log it. So, that's not so much a "warrant canary" as a "we're just going to defy the court" canary. I must be missing something!

rsync 4y ago
No, I am saying that if we receive a "normal" warrant we will log it in the canary in the signed portion. A normal warrant, or a "normal" order for search or seizure, etc., is not out of bounds in a free society - we will happily comply with such lawful orders which have proper jurisdiction, etc. We will also log them, publicly, as is our right. It just so happens that as of today we have never received such a warrant or order so the canary contains zero of them. However, if we receive a NSL or other such "gagged" orders then we will need to consult with our principals and legal counsel, directors, etc. and that takes time. The canary will surely expire as we perform that due diligence. See also, below, my characterization of the warrant canary not as a legal hack or nose-thumbing, but as a poison pill provision that we ingested 17 years ago.
- tptacek 4y ago
  What will you do when you receive a sealed warrant? Sealed warrants to service providers in ordinary criminal cases are the common case I was talking about upthread. You will not be allowed by a court to log those orders when you receive them (you'll usually be able to log them when the case goes to trial).
  - rsync 4y ago
    I don't think service of a plain-jane sealed warrant is obstructed or hampered in any way by anything we do, or don't do, with the warrant canary. Therefore it's a very easy call to stop publishing the canary, keep running our business as usual, and then update the canary with the relevant (probably non-personal) details of the warrant we received once the dust has settled. Alternatively, our counsel, along with the jurisdiction involved, might find a satisfactory "we were served with a lawful warrant in blah blah District in Colorado" and nothing else that does not violate the seal. One gigantic advantage (among many) of running a very tightly held, lean business firm with no debt is that you can be patient.
    - tptacek 4y ago
      So, if I understand it, the plan is that you'll: 1. Receive an ordinary warrant in a criminal case, which will have non-disclosure language. 2. Take the canary down. 3. When, say, 6 months later, the case goes to trial and the warrant is unsealed, you'll put the canary back up, having logged the warrant.
      - true_religion 4y ago
        From what I take it, the canary isn’t taken down. They simply do not update it. They can’t be compelled to update it, because that would be compelling them to lie in real time to their customers and the general public. National security can be used to make you stay silent, and cooperate by not hinting at secret material, but it can’t be used to force you to create and stand by a made up story.