13 ms·

Apple hides a Patriot-Act-busting "warrant canary" in its transparency report

380 points by e1ven 13y ago

scott_karana 13y ago
This seems like a good way to work around the issue for now. Good on Apple indeed. Obviously, this is also going to be an escalating game, where the law is changed to accomodate for squelching reports like this, and the players will likewise adapt...
bdesimone 13y ago
The pushback from tech community in the form of these reports has been encouraging. That said, a little part of me dies when I realize the USA has become a government that censors something like the reporting of the quantity of requests. What's the justification? I'm genuinely curious.
- RyanMcGreal 13y ago
  > What's the justification? I'm genuinely curious. If you can't talk about a violation of your Constitutional rights, you can't fight it either.
  - thaumasiotes 13y ago
    I'm pretty sure the original question had the sense "why do they say they want to do this?", not "why do they want to do this?"
- pliny 13y ago
  >What's the justification It's along the lines of - if we're monitoring a service to catch terrorists or prevent terror attacks, it's counterproductive to alert the terrorists they're being monitored. Furthermore - if the people trust us enough to allow us to monitor these services (which is supposed to follow from there being laws enabling us to monitor these services [a]) then you must also trust us not to abuse the information we gain or to use it in any way that does not serve the interest of national security, so non-terrorists using the service aren't harmed by not knowing they're being monitored.
- ohazi 13y ago
  When the dirty laundry eventually gets aired, the official reasons are usually nonsensical assertions that allowing the public to know what our government is doing is somehow helping terrorists avoid detection and capture. I think many of the people who came up with this stuff know that a lot of it is questionably legal at best. The justification of these gag orders is therefore to hide the prevalence of the questionable behavior, allowing those responsible to continue what they're doing for as long as possible.
- geofft 13y ago
  To play devil's advocate for a bit, let's assume an America where the government never abuses its power and there are no criminals other than two terrorist cells, one in New York and one in DC, and neither of those cells knows how to make bombs because America has education and nobody else does. Both of these cells go to the public library and check out books on bombmaking and other mischief. They also ask the librarian, "Hey, have you had any requests for records under the PATRIOT ACT?" If they ever hear a "yes", no matter whether it's them or not, that cell shuts down and moves to another city, and the other cell continues its plot. Leaking even the one bit of knowledge of whether there was a request for anyone would make the investigation harder, and would allow the terrorists to escape and plot the destruction of our freedom elsewhere. Now, in the real America, the value of that one bit to an evildoer, when applied to an organization Apple's size, as opposed to the value of that one bit to measure PATRIOT ACT activity as part of government accountability, is a good question to ask.
  - ENGNR 13y ago
    The balance then is specific subpoenias for individuals authorised by a judge, with the individuals being informed after a reasonable period (say 9 months) which information was subpoenaed. The library could potentially even give anonymised information that might give reasonable suspicion, eg let us know when someone rents these books together and we'll go get a warrant. The sad thing is that the west currently has exactly this balance in place, but by pushing too hard everything is going to go underground or overseas. We're losing the exact capabilities we need to fight bad actors, thanks to the NSA's greed and short sightedness.
- crassus 13y ago
  The bureaucracy has its own species of logic.
xbryanx 13y ago
Couldn't the government make an argument that intentional removal of this language would be tantamount to violating the "gag order?" Would Apple be liable for lying about something that no one would ever know is a lie?
- encoderer 13y ago
  Anybody can make any argument they like. But while IANAL, that sounds like a tough sell to me.
  - dredwerker 13y ago
    IANAL either but now its publicised, I suspect they would be knowingly violating or at the very least they could be accused of it.
- Tomdarkness 13y ago
  Would not perusing it be an admission that they did in fact subject Apple to some kind of gag order?
  - deleted 13y ago
    [deleted]
    - eli 13y ago
      Lavabit wasn't a secret court, nor was the case kept closed for 15 years.
- baddox 13y ago
  Better yet, the government could just force Apple to continue claiming that they've never received a report.
- kneisley 13y ago
  I'm pretty sure the government can, and would, even go a step further and order that the language be left in the next filing, and even arrange written (and of course sealed) immunity for doing so. I certainly can't imagine that SEC reporting will ever be an effective roadblock to what the government considers national security.
gibwell 13y ago
For those asserting that removing the canary would constitute disclosure: what about stopping the report altogether?
brianpgordon 13y ago
Apple has not received 1 warrant. Apple has not received 2 warrants. Apple has not received 3 warrants. Apple has not received 4 warrants. Apple has not received 5 warrants. Apple has not received 6 warrants.
- aet 13y ago
  If the NSA intercepts data "near" Googles data centers, what's to believe they don't do that at Apple too? I'm really not worried about warrants and gag orders and all that. What about the fact that all (lots of) the traffic is being pulled straight off the fiber all over the place? Anyone with more technical background care to comment?
  - benihana 13y ago
    Because Google is in the business of aggregating, storing and analyzing huge amounts of customer data. Apple is not. Google is a much more attractive target for a spy agency trying to poach data from. Apple has gone on record saying they encrypt data and they don't store it in any recognizable form. I tend to believe that, as if it wasn't the truth, they wouldn't lie about it - they just wouldn't mention it. The fact that they would say that seems to indicate they're pretty confident it's true - if it turned out they were lying, the public backlash would be ruthless. So yeah, google's data is much more attractive.
    - Intermernet 13y ago
      "Apple has gone on record saying they encrypt data and they don't store it in any recognizable form. I tend to believe that, as if it wasn't the truth, they wouldn't lie about it - they just wouldn't mention it." Until very recently Adobe claimed the same. I'd be very careful about trusting such claims.
  - MichaelGG 13y ago
    With the interesting revelation of private fiber being tapped, I'd expect more companies to start encrypting if they haven't already. Google was sending information over unsecured circuits without encryption. I'd expect Microsoft and others will make an announcement. With MS's overly zealous security handling these days, I'd be slightly surprised to find out that they were transmitting in the clear outside their datacenter. If there were actual taps _inside_ the datacenters, like on top of racks and so on, that'd be quite the spectacle.
tlrobinson 13y ago
Has Apple explained how they're able to decrypt iPhones for law enforcement yet?
- nealyoung 13y ago
  There was an article on here about that a few months back. The main idea is that the passcode entry limit is enforced by the OS, so Apple is able to sign and use a custom OS that doesn't enforce the limit, then brute force the passcode from there.
- alexeisadeski3 13y ago
  Why did Apple agree to do such a thing? Were they legally compelled to do so, or did they up and decide that it was a good idea?
  - pyrocat 13y ago
    Why did Microsoft sabotage Skype so that governments could more easily intercept communications?
    - jsmeaton 13y ago
      Source?
      - mtgx 13y ago
        http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...
        jsmeaton 13y ago
        From your link: > Eight months before being bought by Microsoft, Skype joined the Prism program in February 2011. Article regarding the change to a centralized super node model[0]: > "It's pretty good for security reasons because then you don't rely on random people running random stuff on their machine," Now it may be due to the fact that the centralized super nodes provide intelligence agencies with better capabilities - but to claim "Why did Microsoft sabotage Skype so that governments could more easily intercept communications" is somewhat in-genuine. First, there's no evidence to suggest that Microsoft were the instigators in switching to a centralized model[1] (that I'm aware of). Secondly, to claim NSA interception as the primary reason is, at best, a guess. I'm angry at what the NSA is doing - especially since I'm not an American, and I'm not "protected" by any law. Microsoft appear to be the worst and most blatant offenders being discussed. But I don't think it helps the discussion when claims are exaggerated. It gives fodder to deniers and to the opposition to use your claims against other, more correct claims. [0]http://arstechnica.com/business/2012/05/skype-replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft/ http://arstechnica.com/business/2012/05/skype-replaces-p2p-s... [1]http://www.zdnet.com/skype-ditched-peer-to-peer-supernodes-for-scalability-not-surveillance-7000017215/ http://www.zdnet.com/skype-ditched-peer-to-peer-supernodes-f...
fleitz 13y ago
The claim could also be compliance not to disclose under 215. eg. The 'canary' is already a lie.
defen 13y ago
My not-a-lawyer read on the whole warrant canary thing is that it would never fly in front of a judge. In other words, anyone with two brain cells can see that, if there has in fact been a 215 order by the time the next report rolls around, then deliberately removing the warrant canary language is tantamount to revealing the order's existence, which is illegal. So warrant canaries, while seemingly clever, are actually pretty much worthless. You may as well just openly announce something, rather than try to be clever about it. Therefore, I am forced to come to the Kafkaesque conclusion that Apple only included this language because they already have been subject to a Section 215 warrant. Otherwise there's no reason to put the language in there at all, since it's useless.
- rsync 13y ago
  The feedback we have gotten in the 7 years that we have been running our warrant canary: http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt has been similar ... however I am certainly much, much more confident now that apple is running one ...
  - hannibal5 13y ago
    Apple has more subtle canary. Yours is totally obvious. The court will consider intention. If it can be shown that the wording was intentionally selected to work as warrant canary and has no other function, the case is clear. Your canary has clearly only one purpose: revealing the warrant while thinking you are smartass and get away with it.
    - dllthomas 13y ago
      How does this have a different purpose?
  - jlgreco 13y ago
    The reason I am confident in the rsync canary is that you are so proud of it. If a court were forcing you to keep updating it, I would expect you to talk about it less frequently and/or with less enthusiasm (how could a judge practically force somebody to be proud of their canary and talk about it on HN? I'm sure they could say "Keep talking about it often on social media!", but how could that actually be enforced?) I hope I didn't just give any potential judges any bad ideas...
PilateDeGuerre 13y ago
Warrants are quite a quaint notion in an era of parallel construction and Room 641As. To talk of warrants today is like talking of rope in the house of a hanged man.
grecy 13y ago
What's the consequence for violating such a gag order anyway? I'm pretty sure Apple has the cash to pay any fine they can come up with, it's just a question of do they have the balls to try it.
- MichaelGG 13y ago
  Presumably they can mete out secret criminal punishments for violating national security, directly to whoever they gave the NSL to?
  - grecy 13y ago
    Surely Apple can hide behind corporate person-hood and just say "The corporation did it, not any person..."
  - csense 13y ago
    > mete out secret criminal punishments for violating national security, directly to whoever they gave the NSL to I've read that in the case of the NSA wiretaps, companies were directly threatened with having their executives sent to prison if the taps were disrupted or revealed.
  - rayiner 13y ago
    Citation?
    - MichaelGG 13y ago
      None. I'm just assuming if they sent a such a secret gag order it wouldn't be very effective if companies could just ignore it.
  - rsynnott 13y ago
    In previous cases, notably Qwest, they've had to go to court.
deleted 13y ago
[deleted]
kneisley 13y ago
I said in other comments that I certainly can't see this working. If it did work, why not just make a policy that says We'll keep a badge on your profile every day that we don't have an order that affects your records, but should we ever get such an order, of course we would take your badge away? I think Apple is just rightfully pissed, and maybe wants to be pushed into clearly lying to shareholders, or even put themselves in a position to be granted immunity for such an action.
dllthomas 13y ago
Put me on the "IANAL, but it seems to me that removing that language is just another way of disclosing, so if they do receive a request they cannot remove the language" bandwagon.
ris 13y ago
I wouldn't expect Apple to ever receive a 215 order. They'd just play ball before one was even needed, and so the canary can stay in place indefinitely.
- spiritplumber 13y ago
  Pretty much this.
downandout 13y ago
The law is a lot smarter than this. Any act that tends to disclose the existence of such an order, which could include the publishing of a revised transparency report in reaction to receipt of the warrant, could be construed by a judge as a violation of its confidentiality provisions. The law is very broad on this, and subject to interpretation by the judge. In short, warrant canaries are no different than taking out a billboard announcing receipt of the warrant. Both are overt acts intended to disclose the warrant, and both are illegal.
- kazagistar 13y ago
  Has this specifically been tested in court? It seems like some form of 1st amendment or 5th amendment case could be made against this...
  - hobs 13y ago
    Right, and since a judge likely hasnt ruled on this yet (at least in a non-secret court) the government would have to order that when they received the letter, or they could do it and then get slapped later. Just because a thing is potentially illegal doesnt mean you cant do it and fight it later, which is something a multinational company with xx billion dollars could sure and try.
    - rhizome 13y ago
      Even a schlub who decided they wanted to test the system would likely receive an embarrassment of legal talent volunteering to represent them pro-bono.
- Segmentation 13y ago
  Nothing will ever come of it. Warrant canaries are a cheap feel-good tactic for public relations. Even if served 215, Apple will continue to keep the warrant canary up, because it makes its customers feel safer, and because they're wise enough to know it would never fly with a judge. The public will continue to think Apple was never served 215, and there's absolutely no way we could ever disprove it.
scubaguy 13y ago
Isn't this sort of futile? Say Apple removes the section about "... never received an order under Section 215 of the USA Patriot Act" tomorrow. What does that tell us? That Apple did in fact receive such an order in the last 24 hours? Perhaps, or perhaps they were instructed to remove that part of the transparency report and Apple complied. And even if we do know that they received such an order, what does that tell us? Does that tell us that the US government is targeting someone using iClouds? Or maybe it tells us that the US government issued a pointless order just so they can void this so called "warrant canary". It tells us very little. Ultimately, unless corporations-as-persons have the right to speak freely about government orders it receives, we can only assume that everything transmitted through the Internet can be intercepted and given to the US government.
- rsynnott 13y ago
  > Perhaps, or perhaps they were instructed to remove that part of the transparency report and Apple complied. Making this effort in the first place is far more risky than disobeying an 'instruction' to remove it; the Patriot Act does not grant the government unlimited power, and they can't simply command its removal.
aeberbach 13y ago
The Apple statement is dated. Why must the "warrant canary" be removed if there should be a warrant in the future, when the statement is correct at the time of publication?
Thetawaves 13y ago
This is pretty much all bullshit. If you believe Apple hasn't been subject to an order of this kind already, you are a fool.
ericdykstra 13y ago
Just to take this to an extreme: what's there to stop the government from systematically killing Americans who voice opposition to the NSA spying? Assume a secret court decides that the NSA can arbitrarily label any American as a 'terrorist' and that killing terrorists without a trial is a-ok. Let's also assume that anyone who knows about this program and leaks the information about how it works to anyone else is a 'terrorist' in this system. That seems to be the same line of reasoning that the government is using for these gag orders (just taken to the most extreme case possible). There's no recourse to challenge any of this since none of the companies can talk about specifics of what they're compelled to do.
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- rayiner 13y ago
  In some sense, there is nothing to stop the government from executing anyone it wants for no reason at all. Indeed, there is nothing to stop me from killing you or you from killing me, not unless you indulge the premise that "law" can stop someone from doing something they otherwise have the ability to do. If you are willing to indulge that premise, then what stops the government from acting out your hypothetical is that it would be clearly illegal.[1] There is widespread misunderstanding about the basic nature of FISA. Yes, it's a secret court and that's bad, but it's a secret court with one power: to grant FISA warrants. Furthermore, the whole process pertains to something, foreign intelligence surveillance, that didn't require any judicial supervision at all prior to FISA. [1] As opposed to what the NSA is doing now, which is just debatably illegal, and if actually illegal is only illegal at the edges. It doesn't sit well with technologists, but most of the things that inspire outrage, from surveilling foreign leaders to collecting phone metadata to getting e-mails pursuant to court orders are well within the bounds of the law as it's understood. Now, maybe we don't want the NSA to engage in these activities, but the fact that they do isn't a sign that they've totally disregarded the law and are ready to start executing people at random. They're clearly trying to work at the boundaries of things like the third party doctrine, but that's different from ignoring the law.
rhizome 13y ago
What's to stop Apple from simply leaving the canary up even though they're shoveling data out the back door? Is their transparency report legally binding?
- rsynnott 13y ago
  They could have issues with the SEC for intentionally lying in such a thing.
deleted 13y ago
[deleted]
jameshart 13y ago
So someone inside Apple decides to post a warrant canary. Presumably -that person- have never been served with a 215 warrant. They ask around: anybody else been served with a 215 warrant? Of course, the answer to that question is always no - whether they have or not. So what does it really tell you, when a company puts out a warrant canary?
kevinalexbrown 13y ago
Can the US government compel a private citizen to lie? That seems like the crux of canaries to me. It's also one supreme court case that might be itself a kind of canary in the cole mine.
crassus 13y ago
They should tell just a few trustworthy people (a la Glenn Greenwald) about a hard-to-find canary, so that the government can't easily pressure them into not using it.
- venomsnake 13y ago
  Wrong ... your own company should be the canary. You must have processes in place that make compliance without making stuff public extremely hard. Yes if the keys are in foreign national, the US still has some leverage but they would spend diplomatic capital only in very high profile cases.
erichocean 13y ago
Can someone explain to me why we should trust Apple's declaration about Section 215? It seems to me that, were they given a Section 215 order, said order would also additionally compel them to lie publicly about the receipt of the order itself, by having Apple explicitly say that they had not received any such order. Frankly, the existence of courts that secretly compel citizens or companies to actively conceal and/or lie about the State's behavior seems to make every declaration of innocence by any person or business that can reasonably be expected to have been used by the State in that capacity suspect. Trust simply is not there no matter what they say or don't say, and I don't see how it can be given the actors involved and the legality of the situation. I'd like to be wrong. Are there flaws in my reasoning here?
- asynchronous13 13y ago
  > Are there flaws in my reasoning here? Yes.
mtgx 13y ago
No warrant canary for FAA, unfortunately.
rimantas 13y ago
Interestingly how nobody commented on "We would expect to challenge such an order if served on us." part.
MatthiasP 13y ago
All this changes is that from now on Apple will always have a 'we did not receive a 215 warrant' in their transparency report, no matter if they got one or not.
biturd 13y ago
What if Apple, google, etcetera were to make the processes that these warrants ask for, part of a trigger. As long as the warrant requests the same data or less than all the data, then performing those actions trigger an email to the user stating "A third party has requested access to your account.". I would guess it would be best for these companies to add a few buttons to their internal tools to export user data. Then it's a part of their business process. Many "third parties" can ask for and get your data legally. And letting them know is also legal. So there is a user value to this user feature. Now, the next request goes from legal to top guy to tech guy to some guy who clicks a button in a browser.
marijn 13y ago
I expect Apple has been hit with such warrants already, and this phrase is nothing but simple PR talk happily misinterpreted by the overenthusiastic airheads at BoingBoing.
chris_wot 13y ago
The other way of letting everyone know about NSLs is to get an Australian to tell everyone about it.
Pitarou 13y ago
While the court can, of course, order Apple to keep the warrant canary intact, there are plenty of deniable ways to subvert that order. E.g. Apple can subtly signal that the canary was added after the rest of the report was prepared, by screwing up the page numbering or putting the canary in a separate appendix.
joekrill 13y ago
Would love to hear from an ACTUAL LAWYER on this. Every single comment here seems to be be "IANAL, but", followed by some fairly confident ramblings about the legal aspects of this whole issue.

380 points by e1ven 13y ago

This seems like a good way to work around the issue for now. Good on Apple indeed. Obviously, this is also going to be an escalating game, where the law is changed to accomodate for squelching reports like this, and the players will likewise adapt...

bdesimone 13y ago

The pushback from tech community in the form of these reports has been encouraging. That said, a little part of me dies when I realize the USA has become a government that censors something like the reporting of the quantity of requests. What's the justification? I'm genuinely curious.

RyanMcGreal 13y ago
> What's the justification? I'm genuinely curious. If you can't talk about a violation of your Constitutional rights, you can't fight it either.
- thaumasiotes 13y ago
  I'm pretty sure the original question had the sense "why do they say they want to do this?", not "why do they want to do this?"
pliny 13y ago
>What's the justification It's along the lines of - if we're monitoring a service to catch terrorists or prevent terror attacks, it's counterproductive to alert the terrorists they're being monitored. Furthermore - if the people trust us enough to allow us to monitor these services (which is supposed to follow from there being laws enabling us to monitor these services [a]) then you must also trust us not to abuse the information we gain or to use it in any way that does not serve the interest of national security, so non-terrorists using the service aren't harmed by not knowing they're being monitored.
ohazi 13y ago
When the dirty laundry eventually gets aired, the official reasons are usually nonsensical assertions that allowing the public to know what our government is doing is somehow helping terrorists avoid detection and capture. I think many of the people who came up with this stuff know that a lot of it is questionably legal at best. The justification of these gag orders is therefore to hide the prevalence of the questionable behavior, allowing those responsible to continue what they're doing for as long as possible.
geofft 13y ago
To play devil's advocate for a bit, let's assume an America where the government never abuses its power and there are no criminals other than two terrorist cells, one in New York and one in DC, and neither of those cells knows how to make bombs because America has education and nobody else does. Both of these cells go to the public library and check out books on bombmaking and other mischief. They also ask the librarian, "Hey, have you had any requests for records under the PATRIOT ACT?" If they ever hear a "yes", no matter whether it's them or not, that cell shuts down and moves to another city, and the other cell continues its plot. Leaking even the one bit of knowledge of whether there was a request for anyone would make the investigation harder, and would allow the terrorists to escape and plot the destruction of our freedom elsewhere. Now, in the real America, the value of that one bit to an evildoer, when applied to an organization Apple's size, as opposed to the value of that one bit to measure PATRIOT ACT activity as part of government accountability, is a good question to ask.
- ENGNR 13y ago
  The balance then is specific subpoenias for individuals authorised by a judge, with the individuals being informed after a reasonable period (say 9 months) which information was subpoenaed. The library could potentially even give anonymised information that might give reasonable suspicion, eg let us know when someone rents these books together and we'll go get a warrant. The sad thing is that the west currently has exactly this balance in place, but by pushing too hard everything is going to go underground or overseas. We're losing the exact capabilities we need to fight bad actors, thanks to the NSA's greed and short sightedness.
crassus 13y ago
The bureaucracy has its own species of logic.

xbryanx 13y ago

Couldn't the government make an argument that intentional removal of this language would be tantamount to violating the "gag order?" Would Apple be liable for lying about something that no one would ever know is a lie?

encoderer 13y ago
Anybody can make any argument they like. But while IANAL, that sounds like a tough sell to me.
- dredwerker 13y ago
  IANAL either but now its publicised, I suspect they would be knowingly violating or at the very least they could be accused of it.
Tomdarkness 13y ago
Would not perusing it be an admission that they did in fact subject Apple to some kind of gag order?
- deleted 13y ago
  [deleted]
  - eli 13y ago
    Lavabit wasn't a secret court, nor was the case kept closed for 15 years.
baddox 13y ago
Better yet, the government could just force Apple to continue claiming that they've never received a report.
kneisley 13y ago
I'm pretty sure the government can, and would, even go a step further and order that the language be left in the next filing, and even arrange written (and of course sealed) immunity for doing so. I certainly can't imagine that SEC reporting will ever be an effective roadblock to what the government considers national security.

gibwell 13y ago

For those asserting that removing the canary would constitute disclosure: what about stopping the report altogether?

brianpgordon 13y ago

Apple has not received 1 warrant. Apple has not received 2 warrants. Apple has not received 3 warrants. Apple has not received 4 warrants. Apple has not received 5 warrants. Apple has not received 6 warrants.

aet 13y ago
If the NSA intercepts data "near" Googles data centers, what's to believe they don't do that at Apple too? I'm really not worried about warrants and gag orders and all that. What about the fact that all (lots of) the traffic is being pulled straight off the fiber all over the place? Anyone with more technical background care to comment?
- benihana 13y ago
  Because Google is in the business of aggregating, storing and analyzing huge amounts of customer data. Apple is not. Google is a much more attractive target for a spy agency trying to poach data from. Apple has gone on record saying they encrypt data and they don't store it in any recognizable form. I tend to believe that, as if it wasn't the truth, they wouldn't lie about it - they just wouldn't mention it. The fact that they would say that seems to indicate they're pretty confident it's true - if it turned out they were lying, the public backlash would be ruthless. So yeah, google's data is much more attractive.
  - Intermernet 13y ago
    "Apple has gone on record saying they encrypt data and they don't store it in any recognizable form. I tend to believe that, as if it wasn't the truth, they wouldn't lie about it - they just wouldn't mention it." Until very recently Adobe claimed the same. I'd be very careful about trusting such claims.
- MichaelGG 13y ago
  With the interesting revelation of private fiber being tapped, I'd expect more companies to start encrypting if they haven't already. Google was sending information over unsecured circuits without encryption. I'd expect Microsoft and others will make an announcement. With MS's overly zealous security handling these days, I'd be slightly surprised to find out that they were transmitting in the clear outside their datacenter. If there were actual taps _inside_ the datacenters, like on top of racks and so on, that'd be quite the spectacle.

tlrobinson 13y ago

Has Apple explained how they're able to decrypt iPhones for law enforcement yet?

nealyoung 13y ago
There was an article on here about that a few months back. The main idea is that the passcode entry limit is enforced by the OS, so Apple is able to sign and use a custom OS that doesn't enforce the limit, then brute force the passcode from there.
alexeisadeski3 13y ago
Why did Apple agree to do such a thing? Were they legally compelled to do so, or did they up and decide that it was a good idea?
- pyrocat 13y ago
  Why did Microsoft sabotage Skype so that governments could more easily intercept communications?
  - jsmeaton 13y ago
    Source?
    - mtgx 13y ago
      http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...
      - jsmeaton 13y ago
        From your link: > Eight months before being bought by Microsoft, Skype joined the Prism program in February 2011. Article regarding the change to a centralized super node model[0]: > "It's pretty good for security reasons because then you don't rely on random people running random stuff on their machine," Now it may be due to the fact that the centralized super nodes provide intelligence agencies with better capabilities - but to claim "Why did Microsoft sabotage Skype so that governments could more easily intercept communications" is somewhat in-genuine. First, there's no evidence to suggest that Microsoft were the instigators in switching to a centralized model[1] (that I'm aware of). Secondly, to claim NSA interception as the primary reason is, at best, a guess. I'm angry at what the NSA is doing - especially since I'm not an American, and I'm not "protected" by any law. Microsoft appear to be the worst and most blatant offenders being discussed. But I don't think it helps the discussion when claims are exaggerated. It gives fodder to deniers and to the opposition to use your claims against other, more correct claims. [0]http://arstechnica.com/business/2012/05/skype-replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft/ http://arstechnica.com/business/2012/05/skype-replaces-p2p-s... [1]http://www.zdnet.com/skype-ditched-peer-to-peer-supernodes-for-scalability-not-surveillance-7000017215/ http://www.zdnet.com/skype-ditched-peer-to-peer-supernodes-f...

fleitz 13y ago

The claim could also be compliance not to disclose under 215. eg. The 'canary' is already a lie.

defen 13y ago

My not-a-lawyer read on the whole warrant canary thing is that it would never fly in front of a judge. In other words, anyone with two brain cells can see that, if there has in fact been a 215 order by the time the next report rolls around, then deliberately removing the warrant canary language is tantamount to revealing the order's existence, which is illegal. So warrant canaries, while seemingly clever, are actually pretty much worthless. You may as well just openly announce something, rather than try to be clever about it. Therefore, I am forced to come to the Kafkaesque conclusion that Apple only included this language because they already have been subject to a Section 215 warrant. Otherwise there's no reason to put the language in there at all, since it's useless.

rsync 13y ago
The feedback we have gotten in the 7 years that we have been running our warrant canary: http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt has been similar ... however I am certainly much, much more confident now that apple is running one ...
- hannibal5 13y ago
  Apple has more subtle canary. Yours is totally obvious. The court will consider intention. If it can be shown that the wording was intentionally selected to work as warrant canary and has no other function, the case is clear. Your canary has clearly only one purpose: revealing the warrant while thinking you are smartass and get away with it.
  - dllthomas 13y ago
    How does this have a different purpose?
- jlgreco 13y ago
  The reason I am confident in the rsync canary is that you are so proud of it. If a court were forcing you to keep updating it, I would expect you to talk about it less frequently and/or with less enthusiasm (how could a judge practically force somebody to be proud of their canary and talk about it on HN? I'm sure they could say "Keep talking about it often on social media!", but how could that actually be enforced?) I hope I didn't just give any potential judges any bad ideas...

PilateDeGuerre 13y ago

Warrants are quite a quaint notion in an era of parallel construction and Room 641As. To talk of warrants today is like talking of rope in the house of a hanged man.

grecy 13y ago

What's the consequence for violating such a gag order anyway? I'm pretty sure Apple has the cash to pay any fine they can come up with, it's just a question of do they have the balls to try it.

MichaelGG 13y ago
Presumably they can mete out secret criminal punishments for violating national security, directly to whoever they gave the NSL to?
- grecy 13y ago
  Surely Apple can hide behind corporate person-hood and just say "The corporation did it, not any person..."
- csense 13y ago
  > mete out secret criminal punishments for violating national security, directly to whoever they gave the NSL to I've read that in the case of the NSA wiretaps, companies were directly threatened with having their executives sent to prison if the taps were disrupted or revealed.
- rayiner 13y ago
  Citation?
  - MichaelGG 13y ago
    None. I'm just assuming if they sent a such a secret gag order it wouldn't be very effective if companies could just ignore it.
- rsynnott 13y ago
  In previous cases, notably Qwest, they've had to go to court.

deleted 13y ago

[deleted]

kneisley 13y ago

I said in other comments that I certainly can't see this working. If it did work, why not just make a policy that says We'll keep a badge on your profile every day that we don't have an order that affects your records, but should we ever get such an order, of course we would take your badge away? I think Apple is just rightfully pissed, and maybe wants to be pushed into clearly lying to shareholders, or even put themselves in a position to be granted immunity for such an action.

dllthomas 13y ago

Put me on the "IANAL, but it seems to me that removing that language is just another way of disclosing, so if they do receive a request they cannot remove the language" bandwagon.

ris 13y ago

I wouldn't expect Apple to ever receive a 215 order. They'd just play ball before one was even needed, and so the canary can stay in place indefinitely.

spiritplumber 13y ago
Pretty much this.

downandout 13y ago

The law is a lot smarter than this. Any act that tends to disclose the existence of such an order, which could include the publishing of a revised transparency report in reaction to receipt of the warrant, could be construed by a judge as a violation of its confidentiality provisions. The law is very broad on this, and subject to interpretation by the judge. In short, warrant canaries are no different than taking out a billboard announcing receipt of the warrant. Both are overt acts intended to disclose the warrant, and both are illegal.

kazagistar 13y ago
Has this specifically been tested in court? It seems like some form of 1st amendment or 5th amendment case could be made against this...
- hobs 13y ago
  Right, and since a judge likely hasnt ruled on this yet (at least in a non-secret court) the government would have to order that when they received the letter, or they could do it and then get slapped later. Just because a thing is potentially illegal doesnt mean you cant do it and fight it later, which is something a multinational company with xx billion dollars could sure and try.
  - rhizome 13y ago
    Even a schlub who decided they wanted to test the system would likely receive an embarrassment of legal talent volunteering to represent them pro-bono.
Segmentation 13y ago
Nothing will ever come of it. Warrant canaries are a cheap feel-good tactic for public relations. Even if served 215, Apple will continue to keep the warrant canary up, because it makes its customers feel safer, and because they're wise enough to know it would never fly with a judge. The public will continue to think Apple was never served 215, and there's absolutely no way we could ever disprove it.

scubaguy 13y ago

Isn't this sort of futile? Say Apple removes the section about "... never received an order under Section 215 of the USA Patriot Act" tomorrow. What does that tell us? That Apple did in fact receive such an order in the last 24 hours? Perhaps, or perhaps they were instructed to remove that part of the transparency report and Apple complied. And even if we do know that they received such an order, what does that tell us? Does that tell us that the US government is targeting someone using iClouds? Or maybe it tells us that the US government issued a pointless order just so they can void this so called "warrant canary". It tells us very little. Ultimately, unless corporations-as-persons have the right to speak freely about government orders it receives, we can only assume that everything transmitted through the Internet can be intercepted and given to the US government.

rsynnott 13y ago
> Perhaps, or perhaps they were instructed to remove that part of the transparency report and Apple complied. Making this effort in the first place is far more risky than disobeying an 'instruction' to remove it; the Patriot Act does not grant the government unlimited power, and they can't simply command its removal.

aeberbach 13y ago

The Apple statement is dated. Why must the "warrant canary" be removed if there should be a warrant in the future, when the statement is correct at the time of publication?

Thetawaves 13y ago

This is pretty much all bullshit. If you believe Apple hasn't been subject to an order of this kind already, you are a fool.

ericdykstra 13y ago

Just to take this to an extreme: what's there to stop the government from systematically killing Americans who voice opposition to the NSA spying? Assume a secret court decides that the NSA can arbitrarily label any American as a 'terrorist' and that killing terrorists without a trial is a-ok. Let's also assume that anyone who knows about this program and leaks the information about how it works to anyone else is a 'terrorist' in this system. That seems to be the same line of reasoning that the government is using for these gag orders (just taken to the most extreme case possible). There's no recourse to challenge any of this since none of the companies can talk about specifics of what they're compelled to do.

deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
rayiner 13y ago
In some sense, there is nothing to stop the government from executing anyone it wants for no reason at all. Indeed, there is nothing to stop me from killing you or you from killing me, not unless you indulge the premise that "law" can stop someone from doing something they otherwise have the ability to do. If you are willing to indulge that premise, then what stops the government from acting out your hypothetical is that it would be clearly illegal.[1] There is widespread misunderstanding about the basic nature of FISA. Yes, it's a secret court and that's bad, but it's a secret court with one power: to grant FISA warrants. Furthermore, the whole process pertains to something, foreign intelligence surveillance, that didn't require any judicial supervision at all prior to FISA. [1] As opposed to what the NSA is doing now, which is just debatably illegal, and if actually illegal is only illegal at the edges. It doesn't sit well with technologists, but most of the things that inspire outrage, from surveilling foreign leaders to collecting phone metadata to getting e-mails pursuant to court orders are well within the bounds of the law as it's understood. Now, maybe we don't want the NSA to engage in these activities, but the fact that they do isn't a sign that they've totally disregarded the law and are ready to start executing people at random. They're clearly trying to work at the boundaries of things like the third party doctrine, but that's different from ignoring the law.

rhizome 13y ago

What's to stop Apple from simply leaving the canary up even though they're shoveling data out the back door? Is their transparency report legally binding?

rsynnott 13y ago
They could have issues with the SEC for intentionally lying in such a thing.

deleted 13y ago

[deleted]

jameshart 13y ago

So someone inside Apple decides to post a warrant canary. Presumably -that person- have never been served with a 215 warrant. They ask around: anybody else been served with a 215 warrant? Of course, the answer to that question is always no - whether they have or not. So what does it really tell you, when a company puts out a warrant canary?

kevinalexbrown 13y ago

Can the US government compel a private citizen to lie? That seems like the crux of canaries to me. It's also one supreme court case that might be itself a kind of canary in the cole mine.

crassus 13y ago

They should tell just a few trustworthy people (a la Glenn Greenwald) about a hard-to-find canary, so that the government can't easily pressure them into not using it.

venomsnake 13y ago
Wrong ... your own company should be the canary. You must have processes in place that make compliance without making stuff public extremely hard. Yes if the keys are in foreign national, the US still has some leverage but they would spend diplomatic capital only in very high profile cases.

erichocean 13y ago

Can someone explain to me why we should trust Apple's declaration about Section 215? It seems to me that, were they given a Section 215 order, said order would also additionally compel them to lie publicly about the receipt of the order itself, by having Apple explicitly say that they had not received any such order. Frankly, the existence of courts that secretly compel citizens or companies to actively conceal and/or lie about the State's behavior seems to make every declaration of innocence by any person or business that can reasonably be expected to have been used by the State in that capacity suspect. Trust simply is not there no matter what they say or don't say, and I don't see how it can be given the actors involved and the legality of the situation. I'd like to be wrong. Are there flaws in my reasoning here?

asynchronous13 13y ago
> Are there flaws in my reasoning here? Yes.

mtgx 13y ago

No warrant canary for FAA, unfortunately.

rimantas 13y ago

Interestingly how nobody commented on "We would expect to challenge such an order if served on us." part.

MatthiasP 13y ago

All this changes is that from now on Apple will always have a 'we did not receive a 215 warrant' in their transparency report, no matter if they got one or not.

biturd 13y ago

What if Apple, google, etcetera were to make the processes that these warrants ask for, part of a trigger. As long as the warrant requests the same data or less than all the data, then performing those actions trigger an email to the user stating "A third party has requested access to your account.". I would guess it would be best for these companies to add a few buttons to their internal tools to export user data. Then it's a part of their business process. Many "third parties" can ask for and get your data legally. And letting them know is also legal. So there is a user value to this user feature. Now, the next request goes from legal to top guy to tech guy to some guy who clicks a button in a browser.

marijn 13y ago

I expect Apple has been hit with such warrants already, and this phrase is nothing but simple PR talk happily misinterpreted by the overenthusiastic airheads at BoingBoing.

chris_wot 13y ago

The other way of letting everyone know about NSLs is to get an Australian to tell everyone about it.

Pitarou 13y ago

While the court can, of course, order Apple to keep the warrant canary intact, there are plenty of deniable ways to subvert that order. E.g. Apple can subtly signal that the canary was added after the rest of the report was prepared, by screwing up the page numbering or putting the canary in a separate appendix.

joekrill 13y ago

Would love to hear from an ACTUAL LAWYER on this. Every single comment here seems to be be "IANAL, but", followed by some fairly confident ramblings about the legal aspects of this whole issue.