9 ms·

Seems like it would make sense for users to demand that any US based service includes a warrant canary, just like rsync.net's implementation. A global canary +

by kefs 13y ago

Seems like it would make sense for users to demand that any US based service includes a warrant canary, just like rsync.net's implementation. A global canary + separate canaries for individual accounts would also make sense. https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary http://rsync.net/resources/notices/canary.txt http://rsync.net/resources/notices/canary.txt

tirant 13y ago
There's an easy canary in this cases. I don't know how FBI/NSA notifications are received in the US. But you can communicate to your uses any FBI/NSA/LE notification before reading the content. Of course, the notification should be posted to a medium where you don't have further control over, so there's no way for you to remove the notification.
jaggederest 13y ago
I don't think canaries are effective. You can't get around a court order just by mental gymnastics, they'll hold you in contempt. I'd be happy to be proven wrong, but I suspect that they'd simply order you to keep updating the canary.
- kefs 13y ago
  I'm also unsure of their proven effectiveness, but how could they hold you in contempt for _not_ taking an action?
  - mikeash 13y ago
    I don't think it would be any different from holding you in contempt for doing something. The court notices that your inaction caused you to contravene a court order, and the court then holds you in contempt.
  - Karunamon 13y ago
    I have the same question. It's very odd for a court to compel positive action.
    - freehunter 13y ago
      An order to appear is a positive action where you can be punished for not doing something.
  - cschmidt 13y ago
    I'm sure they would argue that you weren't supposed to reveal that you were under an NSL, and that your inaction did reveal it, so you violated the terms. As the grandparent says, it probably just a cute legal trick that wouldn't impress a judge.
    - jlgreco 13y ago
      If it gets to the point that a judge is not impressed, at least the public has been warned.
      - IvyMike 13y ago
        The "judge is not impressed" means they would probably view it as the same as just warning the public directly, with equivalent penalties. And thus the canary is legally useless--if you're going to have the penalties of violating a national security order, might as well just do it in a straightforward manner.
        jlgreco 13y ago
        At this point, it is speculation that the judge would not be impressed. If anyone decided to test the theory, the public would be informed regardless.
        jongraehl 13y ago
        I agree, but your analysis is missing something: the canary-threatener may be secretly, without a public ruling, within the refresh interval, be convinced that if he doesn't keep updating (falsely) the canary, he'll go to jail. In other words, the precommitment to stop producing the canary signal isn't fully credible (though it seems much more likely to get the message out than a promise to actively say if something happens).
        patrickmay 13y ago
        The technical solution to that social problem (yeah, we know how well those work) is to set the refresh interval to be less than the time required to process a motion contesting the government's order to update the canary.
  - jaggederest 13y ago
    Usually contempt of court is used for not taking an action. Examples would be in situations where the court was attempting to compel journalists to reveal their sources, and contempt of congress during the House Unamerican Activities era for not revealing information they wanted.
- davorak 13y ago
  This would imply that the court can order you to lie to your customers. I think this is not the case. If there is any precedence for any US court requiring public citizen to lie I definitely want to know about it. If the courts are acting like they have this power then it will greatly change my perception of how the courts, NSA, and congress are currently acting.
  - rsync 13y ago
    Well, there is one last piece, and that is the geographically disparate canaries that we maintain. The question is not "can a US court compel XYZ US citizen to lie", it is "can a US court compel XYZ swiss citizen to lie". So you should take note, of course, if our warrant canary ceases to update. You should also take note if the US one updates but the swiss (or Hong Kong) one does not ... This is made easier as a local warrant canary is available to all account holders in their /tmp dir ... ssh username@rsync.net tail -200 /tmp/canary.txt Cheers!
  - jaggederest 13y ago
    They have in the past - there are definitely situations where you are required to lie, for example, when working on classified materials or covert operations.
    - davorak 13y ago
      Slightly different, that is an operative agreeing to be an operative with up front knowledge of what it entails. So the person lying has agreed to lie before being given the information or a mission. If you know a case where a person has been prosecuted for not lying rather then breaking an agreement I would still be interested. I am not sure what I think about your scenario off the top of my head but I do consider it different.
    - Flenser 13y ago
      You could choose to take a job where you are required to lie, but no-one can force you to take such a job.
evan_ 13y ago
This presumes that the host has an actual warrant filed against them. I assume that if the feds want data from a service which is ultimately hosted on Amazon they'll just go straight to Amazon.
lukifer 13y ago
The canary trick is roughly on par with "I was NOT served a letter on July 20, 2013, which did NOT say the following..." To be honest, I'm even a little nervous that something as innocuous as "I wish I could tell you more about the circumstances leading to the decision" could be seen as communicating the presence of an NSL indirectly, and lead to contempt of court.
jaekwon 13y ago
Is this relevant? http://securitywatch.pcmag.com/privacy/309277-judge-says-fbi-gag-orders-violate-first-amendment http://securitywatch.pcmag.com/privacy/309277-judge-says-fbi... and http://www.outsidethebeltway.com/judge-orders-google-to-comply-with-secret-fbi-demands-for-user-information/ http://www.outsidethebeltway.com/judge-orders-google-to-comp...

by kefs 13y ago

tirant 13y ago

There's an easy canary in this cases. I don't know how FBI/NSA notifications are received in the US. But you can communicate to your uses any FBI/NSA/LE notification before reading the content. Of course, the notification should be posted to a medium where you don't have further control over, so there's no way for you to remove the notification.

jaggederest 13y ago

I don't think canaries are effective. You can't get around a court order just by mental gymnastics, they'll hold you in contempt. I'd be happy to be proven wrong, but I suspect that they'd simply order you to keep updating the canary.

kefs 13y ago
I'm also unsure of their proven effectiveness, but how could they hold you in contempt for _not_ taking an action?
- mikeash 13y ago
  I don't think it would be any different from holding you in contempt for doing something. The court notices that your inaction caused you to contravene a court order, and the court then holds you in contempt.
- Karunamon 13y ago
  I have the same question. It's very odd for a court to compel positive action.
  - freehunter 13y ago
    An order to appear is a positive action where you can be punished for not doing something.
- cschmidt 13y ago
  I'm sure they would argue that you weren't supposed to reveal that you were under an NSL, and that your inaction did reveal it, so you violated the terms. As the grandparent says, it probably just a cute legal trick that wouldn't impress a judge.
  - jlgreco 13y ago
    If it gets to the point that a judge is not impressed, at least the public has been warned.
    - IvyMike 13y ago
      The "judge is not impressed" means they would probably view it as the same as just warning the public directly, with equivalent penalties. And thus the canary is legally useless--if you're going to have the penalties of violating a national security order, might as well just do it in a straightforward manner.
      - jlgreco 13y ago
        At this point, it is speculation that the judge would not be impressed. If anyone decided to test the theory, the public would be informed regardless.
        jongraehl 13y ago
        I agree, but your analysis is missing something: the canary-threatener may be secretly, without a public ruling, within the refresh interval, be convinced that if he doesn't keep updating (falsely) the canary, he'll go to jail. In other words, the precommitment to stop producing the canary signal isn't fully credible (though it seems much more likely to get the message out than a promise to actively say if something happens).
        patrickmay 13y ago
        The technical solution to that social problem (yeah, we know how well those work) is to set the refresh interval to be less than the time required to process a motion contesting the government's order to update the canary.
- jaggederest 13y ago
  Usually contempt of court is used for not taking an action. Examples would be in situations where the court was attempting to compel journalists to reveal their sources, and contempt of congress during the House Unamerican Activities era for not revealing information they wanted.
davorak 13y ago
This would imply that the court can order you to lie to your customers. I think this is not the case. If there is any precedence for any US court requiring public citizen to lie I definitely want to know about it. If the courts are acting like they have this power then it will greatly change my perception of how the courts, NSA, and congress are currently acting.
- rsync 13y ago
  Well, there is one last piece, and that is the geographically disparate canaries that we maintain. The question is not "can a US court compel XYZ US citizen to lie", it is "can a US court compel XYZ swiss citizen to lie". So you should take note, of course, if our warrant canary ceases to update. You should also take note if the US one updates but the swiss (or Hong Kong) one does not ... This is made easier as a local warrant canary is available to all account holders in their /tmp dir ... ssh username@rsync.net tail -200 /tmp/canary.txt Cheers!
- jaggederest 13y ago
  They have in the past - there are definitely situations where you are required to lie, for example, when working on classified materials or covert operations.
  - davorak 13y ago
    Slightly different, that is an operative agreeing to be an operative with up front knowledge of what it entails. So the person lying has agreed to lie before being given the information or a mission. If you know a case where a person has been prosecuted for not lying rather then breaking an agreement I would still be interested. I am not sure what I think about your scenario off the top of my head but I do consider it different.
  - Flenser 13y ago
    You could choose to take a job where you are required to lie, but no-one can force you to take such a job.

evan_ 13y ago

This presumes that the host has an actual warrant filed against them. I assume that if the feds want data from a service which is ultimately hosted on Amazon they'll just go straight to Amazon.

lukifer 13y ago

The canary trick is roughly on par with "I was NOT served a letter on July 20, 2013, which did NOT say the following..." To be honest, I'm even a little nervous that something as innocuous as "I wish I could tell you more about the circumstances leading to the decision" could be seen as communicating the presence of an NSL indirectly, and lead to contempt of court.

jaekwon 13y ago

Is this relevant? http://securitywatch.pcmag.com/privacy/309277-judge-says-fbi-gag-orders-violate-first-amendment http://securitywatch.pcmag.com/privacy/309277-judge-says-fbi... and http://www.outsidethebeltway.com/judge-orders-google-to-comply-with-secret-fbi-demands-for-user-information/ http://www.outsidethebeltway.com/judge-orders-google-to-comp...