5 ms·

While commenters are mentioning that this particular method has not been tested in court, is there any reason to believe that it wouldn't work? Similar situatio

by sxp 13y ago

While commenters are mentioning that this particular method has not been tested in court, is there any reason to believe that it wouldn't work? Similar situations have happened before when a group loudly says "no comment" and this is interpreted as a confirmation. E.g. in the case of the leaks last week, Google, Facebook, MS, etc explicitly denied that they were involved in blanket government surveillance, but Verizon only said "no comment"[1] in an internal email about the phone metadata news story. If the government could actually force them to lie, then they would have issued an explicit denial like the other companies. Outside of spy fiction and conspiracy theories, I haven't seen any evidence that the government can legally force someone to lie (vs just a no comment) in order to cover up an NSL or FISA order. Is there any evidence that they would able to force a company using a warrant canary to issue a fake one or respond with anything other than "no comment" to direct questions from the media? http://www.buzzfeed.com/mattlynley/verizons-internal-memo-to-employees-on-the-nsa-surveillance http://www.buzzfeed.com/mattlynley/verizons-internal-memo-to...

mpyne 13y ago
If you say "No comment" and it leaves open more than 1 possibility then it would be unfair to ascribe any particular positive statement to that. On the other hand, if you're pre-arranged that you will simply fail to communicate something after a certain event then there is no doubt what statement has been made. A judge will see right through this if it's tried and probably impose contempt of court. If one were to try something like this it would be essential to broaden the scope enough that it couldn't be used to reference a specific gag order.
- pjbrow 13y ago
  Agree with the second half of this statement - this idea is too cute by half for the courts. Acts and omissions both have significance under the law, as does the context of acts and omissions. If the warrant canary convention was considered by the court as context for a statement, it is very likely the court would rule that a statement had been made. The only way around this would be to have an evidentiary mechanism by which a company can prove that it has no control over the canary. This gives rise to the old conundrum: it's logically impossible to prove a negative (although you might be able to under various burdens of proof like "balance of probabilities" or some such). Edit: Ultimately, legality turns on the statutory language of the provision in the Patriot Act that obligates businesses not to disclose (anyone know what it is?). The approach as originally proposed by by Steven Schear (http://tech.groups.yahoo.com/group/cypherpunks-lne-archive/message/5869 http://tech.groups.yahoo.com/group/cypherpunks-lne-archive/m...) was for the ISP to simply not answer a direct inquiry by a customer about whether or not a warrant has been served. The advantage of this approach is that it is far harder to provide evidence to the effect that not responding to the question in that context is a statement. The disadvantage is that a non-response might not provide certainty to the person who asked the question. Effectively, the more that a clear convention is formed around the "canary mechanism", the higher the risk that a court would hold conduct in association with the convention in breach of the statutory obligation not to disclose.
  - apw 13y ago
    Do you have a reference for "it's logically impossible to prove a negative"?
    - pjbrow 13y ago
      Yep, the logic text book that I learnt it from. Just google "inductive logic prove negative" to check out a few articles on it.
    - ernesth 13y ago
      In Intuitionistic Logic, you cannot rely on ad absurdum proofs (no law of excluded middle). However, people usually believe in classical logic where proving that something is false is easy: we just need to prove it is not true.
  - talaketu 13y ago
    Wikipedia leads me to the belief that "omission" will "give rise to liability when the law imposes a duty to act". More specifically: * "the omission is expressly made sufficient by the law defining the offense; or" * "a duty to perform the omitted act is otherwise imposed by law (for example one must file a tax return)." I don't know of any such law involving canaries.
- sxp 13y ago
  >A judge will see right through this if it's tried and probably impose contempt of court. If one were to try something like this it would be essential to broaden the scope enough that it couldn't be used to reference a specific gag order. [citation needed] Has there been a case where the judge forced a civilian to lie?
  - pekk 13y ago
    Contempt for communicating a message (by whatever means) is not the same as forcing to lie.
    - mokus 13y ago
      Does it make any difference that at the time the communication was committed to, the gag order was not in effect?
      - mpyne 13y ago
        Given that the whole point of the commitment to the communication was to evade a future gag order, I'm not sure what to tell you. It does sound like immovable object meets irresistable force, but it's a Catch-22 of the "cypherpunk's" own making. The court can't compel you to lie. The court can compel you to not communicate about a gag order, and enforce that with contempt of court. So if you don't choose to "lie" (since again, we all understand the purpose of the communication is not as a factual statement but rather to signal whether a gag order is received) they can still hold you accountable for it.
- Serow225 13y ago
  What about services providing public API functions like: getWarrantCurrentStatus(custID) // "No"/"No Comment"/"Yes" getWarrantLastChangeDateTime(custID) getWarrantPreviousStatus(custID) getWarrantHistoricalStatus(custID, DateTime) getWarrantResponseCurrentCount(custID, responseType) // accepts only "No Comment" or "Yes" getWarrantResponseHistoricalCount(custID, DateTime, responseType) // for all the above functions, a custID of 'MagicNumber' is the special customer ID of 'Anyone'.
mseebach 13y ago
> is there any reason to believe that it wouldn't work? Yes. The law generally isn't a binary automaton that can be "tricked" by a bit of clever catch-22 logic. Your canary is a one-bit communications channel. Removing it or ceasing to update it constitutes flipping the bit. That, obviously, is communication.
- Create 13y ago
  not if it decays by default (TOTP). I don't think ISP-s can be mandated to periodically refresh the hash.
  - mseebach 13y ago
    That's exactly what I'm saying I think they can. The courts, not being simple machines, care about the substance, not technicalities. You are ordered to not communicate X: If, due to previous arrangements made in bad faith, abstaining from performing a certain activity results in you communicating X, you have communicated X. It's not rocket science.
    - Create 13y ago
      just package the deal as a general service health status, which may or may not include certain operational events (you'd have to trust the ISP about the canary anyway).

by sxp 13y ago

mpyne 13y ago

If you say "No comment" and it leaves open more than 1 possibility then it would be unfair to ascribe any particular positive statement to that. On the other hand, if you're pre-arranged that you will simply fail to communicate something after a certain event then there is no doubt what statement has been made. A judge will see right through this if it's tried and probably impose contempt of court. If one were to try something like this it would be essential to broaden the scope enough that it couldn't be used to reference a specific gag order.

pjbrow 13y ago
Agree with the second half of this statement - this idea is too cute by half for the courts. Acts and omissions both have significance under the law, as does the context of acts and omissions. If the warrant canary convention was considered by the court as context for a statement, it is very likely the court would rule that a statement had been made. The only way around this would be to have an evidentiary mechanism by which a company can prove that it has no control over the canary. This gives rise to the old conundrum: it's logically impossible to prove a negative (although you might be able to under various burdens of proof like "balance of probabilities" or some such). Edit: Ultimately, legality turns on the statutory language of the provision in the Patriot Act that obligates businesses not to disclose (anyone know what it is?). The approach as originally proposed by by Steven Schear (http://tech.groups.yahoo.com/group/cypherpunks-lne-archive/message/5869 http://tech.groups.yahoo.com/group/cypherpunks-lne-archive/m...) was for the ISP to simply not answer a direct inquiry by a customer about whether or not a warrant has been served. The advantage of this approach is that it is far harder to provide evidence to the effect that not responding to the question in that context is a statement. The disadvantage is that a non-response might not provide certainty to the person who asked the question. Effectively, the more that a clear convention is formed around the "canary mechanism", the higher the risk that a court would hold conduct in association with the convention in breach of the statutory obligation not to disclose.
- apw 13y ago
  Do you have a reference for "it's logically impossible to prove a negative"?
  - pjbrow 13y ago
    Yep, the logic text book that I learnt it from. Just google "inductive logic prove negative" to check out a few articles on it.
  - ernesth 13y ago
    In Intuitionistic Logic, you cannot rely on ad absurdum proofs (no law of excluded middle). However, people usually believe in classical logic where proving that something is false is easy: we just need to prove it is not true.
- talaketu 13y ago
  Wikipedia leads me to the belief that "omission" will "give rise to liability when the law imposes a duty to act". More specifically: * "the omission is expressly made sufficient by the law defining the offense; or" * "a duty to perform the omitted act is otherwise imposed by law (for example one must file a tax return)." I don't know of any such law involving canaries.
sxp 13y ago
>A judge will see right through this if it's tried and probably impose contempt of court. If one were to try something like this it would be essential to broaden the scope enough that it couldn't be used to reference a specific gag order. [citation needed] Has there been a case where the judge forced a civilian to lie?
- pekk 13y ago
  Contempt for communicating a message (by whatever means) is not the same as forcing to lie.
  - mokus 13y ago
    Does it make any difference that at the time the communication was committed to, the gag order was not in effect?
    - mpyne 13y ago
      Given that the whole point of the commitment to the communication was to evade a future gag order, I'm not sure what to tell you. It does sound like immovable object meets irresistable force, but it's a Catch-22 of the "cypherpunk's" own making. The court can't compel you to lie. The court can compel you to not communicate about a gag order, and enforce that with contempt of court. So if you don't choose to "lie" (since again, we all understand the purpose of the communication is not as a factual statement but rather to signal whether a gag order is received) they can still hold you accountable for it.
Serow225 13y ago
What about services providing public API functions like: getWarrantCurrentStatus(custID) // "No"/"No Comment"/"Yes" getWarrantLastChangeDateTime(custID) getWarrantPreviousStatus(custID) getWarrantHistoricalStatus(custID, DateTime) getWarrantResponseCurrentCount(custID, responseType) // accepts only "No Comment" or "Yes" getWarrantResponseHistoricalCount(custID, DateTime, responseType) // for all the above functions, a custID of 'MagicNumber' is the special customer ID of 'Anyone'.

mseebach 13y ago

> is there any reason to believe that it wouldn't work? Yes. The law generally isn't a binary automaton that can be "tricked" by a bit of clever catch-22 logic. Your canary is a one-bit communications channel. Removing it or ceasing to update it constitutes flipping the bit. That, obviously, is communication.

Create 13y ago
not if it decays by default (TOTP). I don't think ISP-s can be mandated to periodically refresh the hash.
- mseebach 13y ago
  That's exactly what I'm saying I think they can. The courts, not being simple machines, care about the substance, not technicalities. You are ordered to not communicate X: If, due to previous arrangements made in bad faith, abstaining from performing a certain activity results in you communicating X, you have communicated X. It's not rocket science.
  - Create 13y ago
    just package the deal as a general service health status, which may or may not include certain operational events (you'd have to trust the ISP about the canary anyway).