[HN Gopher] Rsync.net warrant canary
___________________________________________________________________
Rsync.net warrant canary
Author : losfair
Score : 215 points
Date : 2023-01-07 13:55 UTC (9 hours ago)
(HTM) web link (www.rsync.net)
(TXT) w3m dump (www.rsync.net)
| goshinda wrote:
| What if rsync.net are lying, and the only purpose of the warrant
| canary is to provide a false sense of trust?
|
| Be skeptical. This is almost certainly just a marketing ploy so
| potential customers feel like their data is safe and secure.
| karaterobot wrote:
| You're being downvoted, but I don't know why: If a warrant
| canary is removed, that may be a sign that the authorities are
| asking for your data. But, just because it hasn't been removed,
| that doesn't mean your data is safe. Perfectly reasonable
| position to take. Cynical, but cynicism is congruent with the
| whole concept of a warrant canary. Imagine, a company lying
| about protecting your data!
| ISL wrote:
| If they are lying, the warrant canary opens them up to a
| substantial lawsuit.
| hgsgm wrote:
| Doubtful. Have you seen any precedent?
| zymhan wrote:
| [flagged]
| eternalban wrote:
| I wonder about these bits of current news that is embedded in the
| signed message.
|
| Norway: https://imageio.forbes.com/specials-
| images/imageserve/60ce8f... (2021 - the Norway curve looks like
| it was headed to 80% but forecasters adjusted it to be in tandem
| with the other nations.)
|
| Tens of thousands view body of former Pope Benedict:
|
| https://www.theguardian.com/world/2020/aug/03/former-pope-be...
| (2020)
|
| North Korea's Kim sacks No. 2 military official
|
| This one is funny. A bit more 'unpredictable' than having "NK's
| Kim launches missiles towards Sea of Japan" I suppose.
|
| So my q, specially given AI, is are these 'current news' bits
| really unpredictable? And if the message is signed anyway (and we
| hope the key is not compromised) what other purpose does this
| serve beyond key rotation issues (and they don't rotate these pub
| keys, right?)
|
| p.s. If these bits are supposed to be as unpredictable as
| possible, then we should note that any matter related to trends
| in industrial, technical, political, and major religious
| organizations (the Vatican) arenas are the bread and butter of
| security services of state actors. The current bits should be
| things that can neither be creations of state actors (i.e. sock
| puppets in 4chan starting a trend) nor matters that they by
| definition are laser focused (such as industrial output of near
| peers).
| peterkelly wrote:
| Pope Benedict passed away on December 31 2022.
|
| The article you linked to is titled "Former pope Benedict XVI
| reported to be seriously ill" and predates his death by more
| than two years.
| rcxdude wrote:
| They're sufficiently unpredictable, especially the exact
| phrasing (and the sport scores), that they offer pretty good
| proof that the message was signed recently. I suspect it's
| mostly to show that they have not been lazy and prepared all
| the messages well in advance (which if they did could
| conceivable weaken the scheme somewhat). But I agree it's
| probably a minimal improvement in the usefulness of the canary.
| eternalban wrote:
| Let's say a state actor needs a window of 1 week to do some
| mischief. Just a couple of days to comprise network x. Assume
| the exploit is worth knocking off a known person, or creating
| a news worthy event. I think these bits give a false sense of
| security.
| delusional wrote:
| This doesn't really protect from a targeted attack of
| nation state dead set on keeping it a secret. That would be
| almost impossible. This is supposed to protect against the
| much more likely scenario that some government authority or
| government official decides to commit and overreach and
| order the disclosure of data and a gag order, but without
| the full support of the nations information agency.
|
| It's not supposed to guarantee Putin that the US hasn't
| seen his porn collection. It's supposed to tell me (a
| regular guy) that the government hasn't seen my vacation
| photos in secret.
| ctab wrote:
| The problem with sports scores is that it would be trivial to
| procedurally generate signed messages ahead of time for
| thousands of different team names and scores, and then select
| one that matches the eventual reality.
| pwg wrote:
| > If these bits are supposed to be as unpredictable as possible
|
| That isn't the purpose of the embedded headlines. They are to
| show that the canary file was not created and signed two years
| ago and only just now posted to the website.
|
| They serve the same purpose as what used to be used in movies
| and TV years ago for "kidnapping" story lines where a photo of
| the kidnapped person, holding up a current copy of some major
| newspaper, was sent to the person who was being asked to pay
| the ransom (or perform some other action) in order to secure
| release of the kidnapped individual. They show that the item in
| question is current and not prepared well in advance.
| eternalban wrote:
| That is understood. The life cycle of canary is n days, in
| this case apparently 7 days. Industrial output, economic
| stats, health of world figures, and Vatican whispers are
| precisely what a state intelligence agency is supposed to
| know before the general public. The idea is that the message
| embeds bits of information that were disclosed at a specific
| point in time and my point is that these types of bits are
| not that that unpredictable for the sort of adversary that
| necessitates canaries.
| dang wrote:
| Related:
|
| _The rsync.net Warrant Canary is now 15 years old_ -
| https://news.ycombinator.com/item?id=26960204 - April 2021 (13
| comments)
|
| _Rsync.net Warrant Canary (2006)_ -
| https://news.ycombinator.com/item?id=5899197 - June 2013 (50
| comments)
|
| _Rsync.net Warrant Canary_ -
| https://news.ycombinator.com/item?id=5837351 - June 2013 (1
| comment)
|
| _Show HN: The rsync.net Warrant Canary_ -
| https://news.ycombinator.com/item?id=4834362 - Nov 2012 (1
| comment)
|
| _Rsync.net Warrant Canary_ -
| https://news.ycombinator.com/item?id=702247 - July 2009 (46
| comments)
| giancarlostoro wrote:
| No updates since January 2nd, do they not update daily?
| ergonaught wrote:
| "rsync.net will also make available, weekly, a "warrant canary"
| in the form of a cryptographically signed message containing
| the following:"
|
| ...
| giancarlostoro wrote:
| Gotcha I guess I missed that
| neilv wrote:
| I'd actually prefer people _not_ do warrant canaries, and instead
| do conscientious periodic compliance reporting.
|
| Although a warrant canary sometimes suggests a very principled
| party (e.g., I first heard of _public librarians_ doing it,
| decades ago), at the same time, it seems probably
| counterproductive.
|
| For one example, as a customer of a service provider, I want them
| to be stable -- not potentially antagonizing those who could shut
| them down, nor getting involved in what (to me) seem like
| ambiguous technicalities over what they can and can't do.
|
| For another example, imagine you run a service in which you've
| committed to a warrant canary. But one day a warrant comes, and
| you realize it's gravely important for the canary not to die and
| tip off some genocidal warlord you didn't realize was a customer.
| Now you're violating the canary assurance to your other
| customers, which is an assurance that you should've anticipated
| you couldn't give.
|
| Alternative: Some of the modern compliance reporting by tech
| companies, about warrants/censorship/etc. seems less likely to
| cause showstopper problems, can convey more info, and is ongoing
| rather than single-shot.
|
| Of course there will be warrants and other compliances, for
| various jurisdictions, and conscientious periodic reporting seems
| to help with civic checks&balances.
|
| (BTW, I really like the idea of rsync.net and its hard-working
| founder, have pointed new customers to them, and have a TODO to
| move some stuff to them myself. The only proviso I've mentioned
| to people thus far is that there's an unclear bus factor.)
| SQueeeeeL wrote:
| >I'd actually prefer people not do warrant canaries, and
| instead do conscientious periodic compliance reporting.
|
| The whole point of warrant canaries is that you can literally
| be compelled to silence under US law when dealing with
| intelligence organizations. It is impossible to state
|
| "The FBI has requested our data, all our users reporting on
| police brutality might wanna get off our platform"
|
| It _might_ be legal to state "The FBI has never asked for our
| data", it might not, this hasn't been tested in court. They're
| not being hostile towards them, the CIA has literally arranged
| for multiple individuals to be assassinated, they should freak
| you out lol
| brookst wrote:
| Lots of companies report aggregate statistics[0]. I believe
| that's what parent was advocating.
|
| 0. https://www.documentcloud.org/documents/21046081-google-
| geof...
| SQueeeeeL wrote:
| Those documents are discussing warrants which don't have a
| gag order (I strongly believe, IANAL)
| brookst wrote:
| I don't believe gag orders preclude inclusion in a count
| like this, since that does not inform about the existence
| of a particular warrant. But I'd love to hear from
| someone more knowledgeable.
| neilv wrote:
| If we emulate the big kids, and only commit to do periodic
| compliance reporting only of what we can, when we can-- then
| we don't have to worry so much about stepping on the wrong
| toes.
|
| I'd guess in-house counsel could handle the day-to-day of
| this, looping in leadership when appropriate.
|
| That home government might also be a resource (not an
| adversary), such as if a difficult request comes from another
| government, and advice or diplomatic assistance is needed.
|
| No $5 wrenches nor soiled drawers necessary. No making
| assurances that you can't keep.
| patrakov wrote:
| > It might be legal to state "The FBI has never asked for our
| data", it might not, this hasn't been tested in court.
|
| My opinion (beware, IANAL): by itself, stating this once, or
| as many times as one wants, is definitely legal. What's not
| tested is whether it's legal to give the promise to make such
| statements in the future with predictable periodicity.
| danaris wrote:
| What, exactly, do you mean by "periodic compliance reporting"?
|
| If you mean reporting "we responded to X government subpoenas
| during this time," the whole point of a warrant canary is that
| the government can force you _not_ to reveal that.
|
| If your main concern is the instantaneous removal of the canary
| once they've actually been served an NSL or whatever, then a)
| that's assuming that such a canary _is_ , in fact, removed the
| moment they respond to such a government action, and b) seems
| to be positing fairly exotic situations, which are unlikely to
| be pertinent for the vast majority of cases where such a canary
| is being used.
| neilv wrote:
| Yes, I'm saying don't make yourself an adversary of your own
| government on this.
|
| And especially don't do it while predicating your entire
| strategy on a legal technicality game.
| danaris wrote:
| I think there's ample evidence that
|
| a) If this is something that's going to be a problem, it'll
| be because the government has made itself _your_ enemy, and
|
| b) the government's inability to compel speech is more than
| just a "legal technicality game".
| stetrain wrote:
| Warrant canaries are a response to government orders that
| prevent transparent compliance reporting.
|
| In the US at least the government can order you to not reveal
| the existence of a warrant. They cannot (in theory) compel you
| to state that you have not received any such warrants. Thus the
| canary.
|
| I agree that being able to report on these activities
| transparently, even if it is done with a delay, would be
| preferable. But my understanding is that to accomplish that
| would require legislative changes to the current system.
| tptacek wrote:
| The weird thing to me about this canary document and others like
| it is that they cover _all_ warrants, not just NSLs.
|
| Warrant canaries were a reaction to the NSL process, which is
| invariably (and, I guess, permanently?) gagged, and was seen as
| exceptional and in some sense extra-judicial. It would be
| newsworthy for a service to be NSL'd, and further evidence of
| dragnet surveillance programs sweeping up Americans.
|
| Ordinary search warrants and disclosure demands occur,
| presumably, all the time; they're issued by courts in individual
| felony cases, such as for drug conspiracies, child pornography,
| and white collar criminal conspiracies. Serious crime happens all
| the time; it's not really all that newsworthy for a warrant to
| issue in, like, an insider trading case.
|
| So, what does it tell us if this particular canary document was
| taken down? Perhaps the DOJ is working with the intelligence
| community to dragnet the service, or establish a durable norm of
| being able to transactionally extract records that will amount to
| the same thing as a dragnet. Or, maybe, just some random state
| court judge in Oklahoma decided it was likely that somebody's
| meth distribution business kept records in that service. One of
| those is interesting, the other not.
|
| Why not just have more than one canary if you're going to do it
| this way?
|
| It's been this way for a long time, and I'm just now having this
| thought, so it's equally likely that my take here is just faulty;
| if so, let me know.
| twiss wrote:
| Since the main purpose of the warrant canary is to be able to
| inform the public of being served one if they are gagged, I
| indeed think non-gagging warrants aren't super relevant for
| them, but it also doesn't matter much that they are included:
| the next warrant canary can simply say "we got a routine
| warrant, asking for X information; no other warrants have been
| served". Whether that is then interesting or not is up to the
| public to decide.
|
| In fact, if they _didn 't_ inform the public of regular
| warrants, only (indirectly, via the warrant canary) when they
| were gagged, it might incentivize the government to only serve
| regular warrants instead of NSLs, which surely isn't the
| intention.
|
| If regular warrants happen often, I guess they could make a
| separate mechanism to inform the public about them, but I guess
| it doesn't, so far? In any case, if they aren't gagging, they
| wouldn't need a canary to inform the public about them.
| tptacek wrote:
| OK, but now we're not "killing" the canary when we're served
| with a court order, we're training it to sing a different
| song. Part of the idea of a canary is that the simplicity of
| ceasing a continuous public assertion has more legal
| protections than simply violating a gag order would.
|
| At the point where you're _logging_ warrants, you 're not
| doing a canary, you're doing a transparency report. The
| transparency reports we read are, as I understand it, the
| product of negotiations between companies and the DOJ.
| twiss wrote:
| Sure. My assumption was that the "routine" warrants
| wouldn't have gag orders, but I might be wrong on that. But
| yeah, if it doesn't, the transparency report might be a
| better place to put it, and then it might make sense to
| make the warrant canary specific to warrants that aren't /
| can't be in there for one reason or another (gag orders or
| milder forms of coercion / negotiations).
|
| If they are gagging, multiple warrant canaries might work,
| but I think it becomes harder to argue that you aren't
| communicating anything if you stop publishing one but still
| publish the others. Taken to the extreme, you could have
| many canaries, for example one for every user ("there has
| been no warrant for your information"), and users might
| even appreciate that, but stopping with publishing a
| specific subset of them can communicate a lot of
| information.
|
| It also removes some of the plausible deniability ("maybe
| they just forgot to update the warrant canary") that comes
| with having only one, I think.
| [deleted]
| rsync wrote:
| This is correct.
|
| See my response to your parent, upthread.
|
| The canary already contains a list of all warrants we have
| ever received - _it just so happens that list is zero items
| long_.
| tptacek wrote:
| Can you relate to us the legal opinions you've gotten about
| using your "canary" as a transparency log?
| rsync wrote:
| I would characterize the legal opinions we have received
| as "wildly divergent".
|
| Some of the best discussion and counsel I have had took
| place during the EFF Canary Summit which was held at NYU
| in 2014. These disussions took place under Chatham House
| Rules, however, so I can't attribute it to anyone. Again,
| best characterized as "wildly divergent".
|
| Of note:
|
| rsync.net is, to a layperson, best described as a virtual
| safe deposit box. There are no abilities to publish,
| share or work collaboratively on data. In addition, an
| rsync.net account is _relatively expensive_. The kinds of
| activities that might attract a NSL or gagged order are
| naturally repulsed by these structural factors.
|
| It's also a good filtering mechanism for non-technical
| clients, but I'm drifting off-topic now ...
| rsync wrote:
| "Why not just have more than one canary if you're going to do
| it this way?"
|
| It's not entirely clear from the canary itself but the idea is
| that we will list all (non secret) warrants in the signed
| message.
|
| Currently, the PGP signed message starts with the line:
|
| _No warrants have ever been served to rsync.net, or rsync.net
| principals or employees. No searches or seizures of any kind
| have ever been performed on rsync.net assets, including:_
|
| ... and if we were ever to receive a lawful warrant or notice,
| etc., we would then change that wording to reflect the date,
| service, location, etc. (in addition, presumably, to complying
| fully with this lawful order).
|
| So the warrant canary would continue to be updated, on
| schedule, but with a new listing of all warrants served in the
| signed message.
|
| On the other hand, if a NSL / secret / extrajudicial warrant
| were to be served we would be unsure of the correct course of
| action and would need to carefully consult our legal team,
| advisors, board of directors, etc. ... _and that would take
| weeks_.
|
| The warrant canary would become stale as we performed our due
| diligence and retained and received proper legal counsel.
| tptacek wrote:
| I don't understand. What I perceive you to be saying here is
| that, if you receive a sealed search warrant, you're simply
| going to log the warrant in this document. But the warrant is
| going to require you not to log it. So, that's not so much a
| "warrant canary" as a "we're just going to defy the court"
| canary. I must be missing something!
| rsync wrote:
| No, I am saying that if we receive a "normal" warrant we
| will log it in the canary in the signed portion.
|
| A normal warrant, or a "normal" order for search or
| seizure, etc., is not out of bounds in a free society - we
| will happily comply with such lawful orders which have
| proper jurisdiction, etc.
|
| We will also log them, publicly, as is our right. _It just
| so happens_ that as of today we have never received such a
| warrant or order so the canary contains zero of them.
|
| _However_ , if we receive a NSL or other such "gagged"
| orders then we will need to consult with our principals and
| legal counsel, directors, etc. _and that takes time_.
|
| The canary will surely expire as we perform that due
| diligence.
|
| See also, below, my characterization of the warrant canary
| not as a legal hack or nose-thumbing, but as a poison pill
| provision that we ingested 17 years ago.
| tptacek wrote:
| What will you do when you receive a sealed warrant?
| Sealed warrants to service providers in ordinary criminal
| cases are the common case I was talking about upthread.
| You will not be allowed by a court to log those orders
| when you receive them (you'll usually be able to log them
| when the case goes to trial).
| rsync wrote:
| I don't think service of a plain-jane sealed warrant is
| obstructed or hampered in any way by anything we do, or
| don't do, with the warrant canary.
|
| Therefore it's a very easy call to stop publishing the
| canary, keep running our business as usual, and then
| update the canary with the relevant (probably non-
| personal) details of the warrant we received once the
| dust has settled.
|
| Alternatively, our counsel, along with the jurisdiction
| involved, _might_ find a satisfactory "we were served
| with a lawful warrant in blah blah District in Colorado"
| and nothing else that does not violate the seal.
|
| One gigantic advantage (among many) of running a very
| tightly held, lean business firm _with no debt_ is that
| you can be patient.
| tptacek wrote:
| So, if I understand it, the plan is that you'll:
|
| 1. Receive an ordinary warrant in a criminal case, which
| will have non-disclosure language.
|
| 2. Take the canary down.
|
| 3. When, say, 6 months later, the case goes to trial and
| the warrant is unsealed, you'll put the canary back up,
| having logged the warrant.
| [deleted]
| llimos wrote:
| Is there a dashboard from some neutral third-party validating
| that everybody's current warrant canary is in fact valid? Who
| would spot it if it either a) stopped being updated b) had an
| invalid signature, or c) the headlines were not current?
| rsync wrote:
| EFF used to run a "Canary Watch"[1] website which is now
| defunct.
|
| In fact, EFF even held a "Canary Summit" at NYU in 2014 which I
| was invited to. It was only held that one year, however, and
| once Apple and other large firms discontinued their canaries
| all of the steam was seemingly lost ...
|
| [1] https://www.eff.org/deeplinks/2016/05/canary-watch-one-
| year-...
| greyface- wrote:
| The EFF and Calyx Institute used to run
| https://canarywatch.org/ for this, but shut it down at some
| point. AFAIK there's no such site now.
| jakobdabo wrote:
| I think this kind of warrant canary doesn't bring much value. It
| takes only one warrant to make this document historical. And then
| what?
|
| I wish every account had its own warrant canary.
| staindk wrote:
| I thought Reddit had a page with a bunch of canaries (pictures
| of canaries) on it, and their idea was to remove one at a time.
| Can't find that now so it must have been some other service.
|
| I think an elegant way for rsync to handle this would be to
| just move the page from ".../canary.txt" to ".../canary-2.txt".
|
| Sends the message that the first canary is dead, but leaves a
| second one up for the next warrant.
| coffeeblack wrote:
| Or they could host in a country where "secret warrants" don't
| exist.
| Nifty3929 wrote:
| Warrant canaries do not work, because they violate the spirit and
| law of what a gag or secret warrant means. No court would allow
| rsync to alert users this way without considering that a breach
| of the gag, just as if they said "hey we got a secret search
| warrant today."
| dvh wrote:
| Rsync will destroy key and nobody would be able to update
| canary. No new canary means canary is dead.
| AndrewDucker wrote:
| And then people will go to jail.
| Amorymeltzer wrote:
| In 2006 this was, via Wikipedia[1], "[t]he first commercial use
| of a warrant canary," although it was proposed in 2002 on
| usenet.[2]
|
| 1: https://en.wikipedia.org/wiki/Warrant_canary#Usage
|
| 2:
| https://web.archive.org/web/20131103121048/http:/groups.yaho...
| ShamelessC wrote:
| Short and informative, no citations needed, discusses
| interesting early internet lore... This is what a good
| hackernews comment looks like!
|
| edit: Yikes, remind me not to compliment people here. It
| boggles the mind how this could be seen as controversial. Did
| people assume sarcasm? I was being sincere. It is a good
| comment.
|
| double edit: back up to 0! Suppose I sounded a bit sarcastic.
| HaZeust wrote:
| The edit chains might be the rub of the downvotes, Shameless.
| merpnderp wrote:
| Couldn't a judge issue a warrant to take control of the keys
| needed to update the warrant thus sidestepping the first
| amendment prohibition on compelled speech? Everyone would think
| it is Rsync updating the canary, but it would be law enforcement.
| tobylane wrote:
| How would the judge's order update the website?
| WirelessGigabit wrote:
| Yes. That's the last paragraph.
| choeger wrote:
| I would argue that stopping to publish these statements is
| equivalent to announcing that some warrant has been served. So if
| the latter is a criminal offense, why should the former be legal?
| lifeisstillgood wrote:
| It's going to be a very difficult legal debate at some point in
| the future. And I bet there are a lot of constitutional lawyers
| salivating over it :-)
|
| If the government can compel you to hand over some information,
| well that's government. They can also injunct you not to tell
| people.
|
| But, can they compel you to lie, publically ? Can they compel
| you to not publish such canaries - just in case they want to
| compel you later on?
|
| And frankly, does it matter - is such a canary really just a
| form of social performance? If I don't want the US government
| to know something about me, I should stay the hell away from
| modern life, internet and so forth.
| ndsipa_pomu wrote:
| Which law would apply to someone that hasn't been served with a
| warrant and state that they haven't been served with a warrant?
| Until they are possibly served with a warrant, the publishing
| of such statements would be legal and protected under free
| speech (I guess, I'm not in the U.S.), and when served with a
| warrant, surely removing any statements about warrants would be
| a wise move to avoid prosecution for releasing information
| about it.
| [deleted]
| [deleted]
| rgbrenner wrote:
| Here's an article discussing it more in depth:
| https://www.yalelawjournal.org/forum/warrant-canaries-and-di...
|
| But the issue hasnt been settled in the courts. Twitter v Barr
| (2014) attempted to settle the issue, but the case was
| dismissed in 2020.
|
| Edit: https://www.courtlistener.com/docket/4181259/twitter-inc-
| v-b...
| buran77 wrote:
| The law can compel you to not disclose that you were server a
| warrant but *in theory it cannot compel you to explicitly make
| a statement, particularly if it's false I presume.
|
| *I say "in theory" because I understand that this was never
| tested in court and some big name law professors did not agree
| that this would stand up in a court of law. A judge would look
| at the spirit of the law that bans the warrant disclosure and
| consider that the entire setup of the warrant canary is aimed
| at breaking it. I tend to agree with this interpretation
| because any reasonable person would consider the whole design
| is aimed at breaking that law.
| brookst wrote:
| Courts are not supposed to look at the spirit of laws, but
| the letter.
|
| It would be a sad day for US justice if a judge ruled that
| every action was within the law but, because a reasonable
| person would conclude that the actions in aggregate were
| intended to circumvent a law, the defendant is guilty.
| fmajid wrote:
| (English) Common Law gives judges a wide latitude to
| decide, and in effect make law, as was the case with Roe v.
| Wade, in a way (Roman) Civil Law jurisdiction don't allow.
| Sometimes this goes in a liberal direction, sometimes the
| other way.
|
| I would not assume anything about warrant canaries, and
| would expect the FBI et al to get the judge who gave them a
| gag order to also issue a warrant canary falsification
| order at the same time. Most organizations would not have
| the werewithal to resist, or the fortitude of a Judy Miller
| or James Risen and their willingness to go to jail rather
| than reveal their sources (yes, I know Judy Miller is a
| warmongering sorry excuse for a journalist, but her stand
| in this respect is admirable).
| brookst wrote:
| Row v. Wade was not decided on anything like the
| purported logic making warrant canaries illegal. Roe v
| Wade found that the right to privacy includes medical
| decisions, or similar. That's a far cry from a criminal
| court finding a defendant guilty because they achieved an
| end that was supposed to be illegal but which no actual
| statute made illegal.
|
| Also gag orders aren't perpetual. If there were orders
| compelling businesses to lie, past examples would have
| come to light the same way we know gag orders exist.
| ISL wrote:
| How should a judge intrepret a typo?
| JumpCrisscross wrote:
| > _judge would look at the spirit of the law that bans the
| warrant disclosure and consider that the entire setup of the
| warrant canary is aimed at breaking it_
|
| The point of gag orders is to keep a criminal from destroying
| evidence while an investigation is underway. Having an
| individual warrant canary for every customer would defeat
| this purpose. A general canary doesn't appear to.
| feanaro wrote:
| The point is that the law is unjust, so why would people
| observe it? How does it serve the people to not be able to
| say you were compelled to share their personal information
| with what amounts to a bully?
| sschueller wrote:
| They have locations outside the US for example Zurich
| Switzerland. If they are served a secret warrant for data in
| that location I would want to know and I would legally have the
| right to know under Swiss jurisdiction.
| sokoloff wrote:
| What's the Swiss legal theory under which you have the right
| to know that someone else was served with a warrant?
| sschueller wrote:
| If my data is being accessed I have the right to know.
| There are no secret warrents in Switzerland.
|
| This is the whole contention with Microsoft Office 365
| being hosted in the EU and the CLOUD act.
| d_watt wrote:
| Because compelling someone to actively do something is
| fundamentally different from restricting them from a future
| action, in the eyes of the law.
| bitwize wrote:
| What the Constitution says is not how the system actually
| works. The magic phrase "national security" means they can
| compel you to do as they please, and find you guilty without
| due process if you don't. Hell, the FBI is one of the largest
| CSAM distribution rings in the world, and they can simply
| "discover" CSAM on your computer if you don't knuckle under.
| Then you will be legit found guilty and morally discredited
| for the rest of your life.
|
| If the Feds really want to nail you -- to teach you a lesson
| and/or make an example out of you -- you're nailed.
| orangepurple wrote:
| They CP'd Paddock of Vegas
| mcculley wrote:
| You think they planted evidence? What makes you believe
| that?
| pc86 wrote:
| It's convenient for their particular brand of conspiracy
| theory.
| JasonFruit wrote:
| That's a lot of assumption. Why not let them answer for
| themselves?
| throwawaylinux wrote:
| This is true. Prominent conspiracy theorist Chuck Schumer
| warned people about this when he blew the whistle about the
| intelligence agencies having six ways from Sunday to get
| back at anybody who crosses them, even the president.
| celtoid wrote:
| "...the state system which has emerged in the United States
| is a constitutional deformation which menaces the freedom
| and well being of its citizenry, and Which poses a danger
| to world civilization. What is hanging in the balance in
| the last twenty-five years of this century is whether the
| people, scholars, lawyers and judges, and members of the
| government, can so organize their understanding and their
| political actions as to avert fascism or Bonapartism, a
| debilitating arms race that could end in the kind of horror
| from which there will be no redemption, and a decaying
| economic system which impoverishes Americans as well as
| people elsewhere."
|
| "Democracy Versus The National Security State" by Marcus
| Raskin, 1976
|
| https://scholarship.law.duke.edu/lcp/vol40/iss3/7/
| krplan wrote:
| [flagged]
| kasey_junk wrote:
| Assange is being held without bail during pre-trial
| motions in the UK because he jumped bail the last time he
| had bail. If they are making an example of him it's "if
| you jump bail you won't get it again".
| JumpCrisscross wrote:
| > _they can compel you to do as they please, and find you
| guilty without due process if you don 't_
|
| The Supreme Court has repeatedly ruled on compelled speech
| [1], most colourfully on the pledge of allegiance [2]. It's
| the theory Apple ran with in the San Bernardino case to
| avoid creating a decryption key [3]. A theory that was so
| successful the FBI pulled their case rather than risk a
| precedent for encryption.
|
| [1] https://en.m.wikipedia.org/wiki/Compelled_speech
|
| [2] https://en.m.wikipedia.org/wiki/West_Virginia_State_Boa
| rd_of...
|
| [3] https://en.m.wikipedia.org/wiki/FBI-
| Apple_encryption_dispute
| detrites wrote:
| A slight problem would be as soon it looked like such a legal
| precedent were about to be set, anyone publishing the
| statements would therefore be incentivised to cease publishing
| them while they still could legally.
|
| More succinctly, the legal precedent would compel people to
| "break the law".
|
| I'd argue such a conflicted legal outcome could only be
| resultant from unsound base principles.
| jffry wrote:
| You can argue that, but other people argue the other side. To
| my knowledge it hasn't been firmly tested in a US court yet.
|
| There are supreme court precedents finding that the first
| amendment prohibits the government from compelling speech,
| which is the legal theory for why warrant canaries are not
| equivalent to directly disclosing the NSL's existence:
| https://en.wikipedia.org/wiki/Warrant_canary
| jmbwell wrote:
| The former is legal, the thinking goes, because the government
| cannot force you to continue posting a warrant canary.
|
| Nobody can say, "you have this on your web site saying you have
| never received a warrant; here's a warrant, and by the way, you
| must also continue saying (now lying) that you have never
| received a warrant."
|
| The government can tell you to /stop/ posting a daily or weekly
| notice. It can say "here's a warrant; you may not tell anyone
| you have received this." In that case, you would be lying to
| say you had /not/ received it, and discussing whether you have
| received it or not received it at all can be prohibited. In
| which case, you would be obligated to remove or cease updating
| any statements related to a warrant.
| prirun wrote:
| I don't understand the value of a warrant canary: if it goes away
| or is not updated, what is the suggested action of users of the
| service? Is everyone supposed to leave? Because that ain't gonna
| happen, fortunately for the service.
|
| The bottom line to me is, encrypt your data before it leaves your
| control, and cross your fingers that whatever tool you used did
| it correctly. If the government wants to see which sites you are
| connecting to, it's easy enough for them to just ask Spectrum,
| Comcast, etc. So IMO, warrant canaries are useless.
| sowbug wrote:
| It's a kind of mutually assured destruction. It's not that
| "everyone" will leave. But the people the cops are targeting
| probably will. The tension reminds me of the
| Backpage/Craigslist Adult Services saga. Prostitution isn't
| legal in most of the US, but regardless of its legality, it
| will always exist. So, given the choice of having a place where
| they know prostitution is happening, and a place where they
| know it isn't, cops would prefer the former.
|
| Wild tangent follows. I promise it'll connect to the original
| thread.
|
| From a certain perspective, all discussions about personal
| rights are silly. Almost every free-speech case started with
| someone being an asshole. Fourth Amendment search & seizure
| cases almost always defend a person caught red-handed. Bitcoin
| is evil because it's used only for drugs and prostitution. And
| so on. Most of us live in a world where we don't ever need to
| assert our rights. As long as we're not an asshole, we don't
| have strange religious convictions, we aren't a journalist
| trying to expose outlandishness, we don't commit crimes, etc.,
| then we can live our whole lives as if the Bill of Rights
| didn't exist.
|
| The problem with that observation is that the borders
| describing acceptable conduct are defined by something, and
| that something is our personal rights. If the Bill of Rights
| didn't exist, then "acceptable conduct" would surely be a
| smaller set of actions. We'd have less freedom, and we'd all
| miss the things we couldn't do.
|
| So the fact that nearly all controversy about personal rights
| seems silly (including the "I don't care about privacy because
| I have nothing to hide!" argument) is extremely significant. If
| the average person thought these discussions were important,
| then society would already be feeling constrained by lack of
| freedom, and we'd be in bad shape -- dictatorship, surveillance
| state, etc. And if nobody discussed them at all, then we'd
| probably be in a state of chaos -- survival more important than
| freedom, etc. Having silly discussions about personal rights is
| probably right at the sweet spot. The only thing worse than
| believing Bitcoin is useless is living in a society where
| everyone believes it's essential!
|
| This is why it's OK to feel like a warrant canary is silly. You
| should. But you should also take very seriously the fact that
| you're able to feel it's silly. The moment you feel warrant
| canaries are important, it's too late for our society.
|
| (The word "silly" is mine, not yours, but I believe the
| sentiment is in the same neighborhood as your question.)
| heretoo wrote:
| What if the warrant canary is from the developers of the
| encryption software? See truecrypt -- assuming it was actually
| a warrant canary.
|
| Where "cross your fingers" is equivalent to the "warrant canary
| has not been revoked" when encryption is involved.
| prirun wrote:
| > What if the warrant canary is from the developers of the
| encryption software?
|
| That seems useful. Thanks!
| zamadatix wrote:
| None of these points really explain why a warrant canary can't
| have value it just explains why you in particular don't find
| value in it which isn't necessarily supposed to be surprising.
|
| Why is every user of a service supposed to care about something
| for it to have value in the service? Why is everyone supposed
| to agree on what level of connectivity obfuscation makes them
| feel comfortable? Why can't someone find value in simply
| knowing the government isn't monitoring how they use services
| without notice? If it has no impact on monitoring ability why
| would the government bother getting a warrant in the first
| place? Why can't someone be interested in knowing how pervasive
| invisible warrant requests are? Why should everyone equally be
| comfortable with just encrypting and calling it a day?
|
| Even though I don't really have any direct utility from a
| warrant canary (e.g. Reddit's warrant canary went away ~7 years
| ago and it didn't trigger any direct consequences with me using
| Reddit) I still find them useful and, knowing how relatively
| lax I am about privacy/security compared to many, I have no
| doubts many find direct use of them. For some other specific
| companies/services/projects though I could even see a warrant
| canary possibly having high direct value.
| prirun wrote:
| > I still find them useful
|
| I guess that's what I was asking, is why or how? I didn't say
| they don't have value as a fact, I said I don't understand
| the value. Why are they useful to you, ie, what would you do
| with this knowledge if your storage service had a warrant
| canary and stopped updating it?
| zamadatix wrote:
| For me personally this one "Why can't someone be interested
| in knowing how pervasive invisible warrant requests are?"
| is my primary use out of them as I think more transparency
| in government surveillance is a net good for society but
| the point of that larger section was, independent of
| individual conclusions, if you phrase the same type of
| questions you started with in a more open ended way you get
| plenty of reasons a warrant canary has value and those are
| all examples.
| rsync wrote:
| "I don't understand the value of a warrant canary: if it goes
| away or is not updated, what is the suggested action of users
| of the service?"
|
| It really depends on how you use rsync.net.
|
| The stated purpose of our product is: An empty UNIX filesystem
| to do anything you'd like with.
|
| So ... if you are using a sophisticated tool like 'borg'[1] or
| 'restic' or 'duplicity' then no action would be necessary. Your
| data at rsync.net is garbage ciphertext that we do not hold a
| key to.
|
| On the other hand, you may, as many thousands of people do, use
| rsync.net as a dead simple SFTP/SCP endpoint[2] and just copy
| files there. In this case your threat model and exposure is
| very different - but presumably you realize that.
|
| Yes, you are thinking correctly when you describe your bottom
| line as:
|
| "... encrypt your data before it leaves your control ..."
|
| ... and we encourage all of our customers to approach it this
| way.
|
| [1] https://www.stavros.io/posts/holy-grail-backups/
|
| [2] https://rsync.net/products/sftp.html
| jaxn wrote:
| Go Grizzlies!
| dvdplm wrote:
| If a government agency issues a secret warrant, doesn't that
| imply rsync.net has to provide a valid canary at the right time
| as well? I don't get how this is useful.
| _Algernon_ wrote:
| Can courts compel people to enter passwords? How is forcing a
| signature with a specific GPG key different?
|
| If worst comes to worst, say "Sorry bro, lost the key in a
| boating accident, nothing I can do".
| jusssi wrote:
| If they're brave enough, they'll render themselves unable to
| sign the canary with the key they previously used (by
| "accidently" destroying it), and accept whatever punishment is
| headed their way because of that.
| brookst wrote:
| Switching from good faith legal dispute to bad faith
| technical argument and lying seems like a questionable
| strategy.
| hgsgm wrote:
| How is that bad faith? It's a technical enforcement of a
| commitment.
| brookst wrote:
| The implication was that they should intentionally
| destroy the key and falsely claim it was an accident.
| That is bad faith, and asking for trouble.
| javajosh wrote:
| Assuming people take the canary seriously, this is an
| interesting case where deleting one file is equivalent to
| shutting down the company.
| rsync wrote:
| Let us please be clear: rsync.net is _a real company_. We
| have a board of directors. We have outside advisors and legal
| counsel. We have shareholders.
|
| Did we, in fact, create a poison pill provision in 2006 with
| regard to legal service, etc., ? Yes, we did.
|
| Will this be a wild west data caper with dramatic conclusions
| and brave, desperate actions ? No, it won't be.
|
| If there's one thing you should know about rsync.net it's
| that it's a _very boring company_. We 're going to keep it
| that way.
| mananaysiempre wrote:
| Not a lawyer, but IIRC the theory was that generally speaking
| the bar for compelling you to lie is higher than that for
| compelling you to stay silent, even when those are equivalent
| information-theoretically. It's not clear if the legal exploit
| of a warrant canary has ever been tested in court.
| dannyw wrote:
| The Supreme Court has ruled that compelled speech (forcing
| someone to say something) is almost always a clear cut
| violation of the first amendment.
|
| There is no known case of US charging someone over a warrant
| canary.
|
| There have been plenty of warrant canaries that have ceased to
| be updated - e.g. Reddit, and more recently, Storj.
| tzs wrote:
| That would apply (probably) if the government put you under a
| gag order _and_ ordered you to keep updating your warrant
| canary.
|
| But what if they just put you under a gag order, and then
| when you stop updating the warrant canary they charge you
| with violating the gag order? Would that still fall under the
| compelled speech cases?
| funOtter wrote:
| Cases where compelled speech has been forced by the courts:
|
| 1. Forcing registered sex offenders to alert people in their
| neighborhood
|
| 2. Correcting misstatements
| phpisthebest wrote:
| Where in the US has number 1 been done? I am not aware of
| any places where the offender is required to alert people.
| Most commonly they need only to report to the local
| government/police who then may (and may be required) to
| publish that info.
|
| Often that is also often a condition of probation, meaning
| they are still under the authority of the courts and are
| still being "punished" by the system in leiu of prison.
| This is seen as the individual "giving up" some of their
| rights either by committing the offense or agreeing to the
| terms of probation instead of prison. This would also apply
| to #2.
|
| Neither one of those justification for infringement of the
| 1st amendment would apply in the cases of an NSL which are
| already on very very shaky legal ground and gag orders on
| them have been ruled constitutional in the past, currently
| they are only constitutional because a person getting an
| NSL now as the ability to appeal the NSL to a federal
| court, something that was previously missing
| LarryMullins wrote:
| Are there _any_ known examples of the US Government legally
| being able to compel a _lie_?
| Karellen wrote:
| For people who have become involved with national
| security issues, aren't they often required to deny being
| involved with national security issues if asked? Would
| that count?
| LarryMullins wrote:
| No I don't think it does. The paperwork they sign when
| they get their security clearances put those people in a
| special circumstance. American journalists, not having
| security clearances, are allowed to spill the beans on
| national secrets.
| bombcar wrote:
| For #1 you can do tons of things as condition for "early
| release" including warrantless searches so I suspect it's
| related to that.
| devman0 wrote:
| Forcing factual speech (such as disclosures, warnings,
| product information, truth-in-lending, etc) is a lot
| different than forcing someone to say something that isn't
| true.
| YetAnotherNick wrote:
| Could you refer the case?
| jkaplowitz wrote:
| So not yet compelling a lie.
| tptacek wrote:
| The better example here is warning labels. Presumably, part
| of the reasons warning labels are easily compelled by the
| government is that they involve commercial speech, which
| receives a lower degree of 1A scrutiny. But then, most
| warrant canaries fall into the same bucket; they're
| basically just an inverted warning label.
| jcranmer wrote:
| This is a colorable argument, but I think it's ultimately a
| pretty poor argument:
|
| First, freedom from compelled speech is not an inherently
| stronger (or weaker) freedom than freedom of speech. If the
| government can prevent you from saying something, then it can
| almost certainly prevent you from saying it by not not saying
| it.
|
| Second, national security is one of the most powerful legal
| trump cards in practice. The government saying that something
| is necessary for national security will be treated as fact by
| the court, no matter how much evidence there is to the
| contrary.
|
| Third, the purpose of freedom of speech is to protect freedom
| of expression. Speech that isn't expressive in nature has a
| much lower bar to clear for the government to be able to
| restrict it. Warrant canaries strike me as essentially
| commercial speech, which the government has pretty wide
| latitude to regulate.
| phpisthebest wrote:
| >>The government saying that something is necessary for
| national security will be treated as fact by the court, no
| matter how much evidence there is to the contrary.
|
| Citation please
|
| >> Speech that isn't expressive in nature has a much lower
| bar to clear for the government to be able to restrict it.
| Warrant canaries strike me as essentially commercial
| speech, which the government has pretty wide latitude to
| regulate.
|
| This case law around NSL have not been vary favorable for
| the government, Appeals courts have struck down the gag
| order provisions of the laws in the place, and are poised
| to do so again should a case come before them. The current
| make up the Supreme Court also leads me to believe they
| would not look favorably on Gag orders, though they would
| on the larger issue of National Security
| tptacek wrote:
| This is a circular argument. If the gag orders in
| question are struck, the canary doesn't do anything: you
| can just tell people you were served with the court
| order. But if the canary matters, that means we're
| dealing with a nondisclosure order that did, at least for
| the moment, survive strict scrutiny. Since there isn't a
| legal concept of "super strict scrutiny", that leaves the
| question of why people believe the canary will fare any
| better than the objection to the gag order.
| ncallaway wrote:
| I don't think so. I think there's a pretty significant legal
| difference between ordering someone not to say something, and
| ordering them to specifically publicly say something that's
| false.
|
| The former has been tested and is (for some reason) within the
| bounds of the first amendment. While forcing someone to
| publicly say something false almost certainly is outside the
| bounds of the first amendment.
| jwr wrote:
| I've always wondered whether this has any chance of holding up in
| court. I know it depends on jurisdiction, but at least in my
| region (EU/Poland), courts consider intent rather than a literal
| interpretation of laws. You can try to be oh-so-smart and
| implement a "canary" that doesn't get updated if you get a
| warrant, but the court would consider not updating the canary as
| the same thing as notifying people that a warrant has been
| served.
| badrabbit wrote:
| This whole thing I believe was a result of litigation with
| USGOV. Can the government entirely censor people acting
| onbehalf of a company from saying something? The answer was
| something like "It can prevent you from stating specific
| details but it cannot prevent you from making general
| statements on whether you have received a warrant or force
| speech by preventing you from taking down the canary" they even
| came up with a spefific granularity that you can state
| regarding the number of warrants you received.
|
| But if I was the gov, I would go to your webhost or colo
| provider first, the gag order would prevent them from telling
| the subject like rsync.net and the search warrant would allow
| access to read and tamper with code and data. This is why GPG
| signing is great, private keys won't be on devices you don't
| physically control if you do it right. And also why you
| shouldn't trust native encryption of cloud providers like
| iCloud where ultimately you are not managing the private key
| directly.
| rsync wrote:
| "You can try to be oh-so-smart and implement a "canary" that
| doesn't get updated if you get a warrant, but the court would
| consider not updating the canary as the same thing as notifying
| people that a warrant has been served."
|
| The warrant canary is always thought of as a gimmick or a
| "legal hack" or a "smartypants" construct ... but this is the
| wrong way to think about it.
|
| The warrant canary is a _poison pill provision_.
|
| rsync.net is a real company. We have a proper board of
| directors and outside advisors. We have legal counsel. We have
| shareholders.
|
| We could not possibly respond to any kind of warrant -
| extrajudicial or otherwise - without careful consultation with
| all of these stakeholders. That takes time and that means the
| canary will expire.
|
| So it's wrong to think of this as an act of defiance at the
| time of service - that ship has long since sailed (2006).
|
| Instead, it has shifted the landscape of warrant service,
| irrevocably, in advance.
| tptacek wrote:
| The idea that you'll take the warrant down because it has
| "expired" during your "deliberation" of a warrant is logic an
| order of magnitude cutesier than that of the warrant canary
| itself. Further, it cuts against the legitimacy of a warrant
| canary: the canary is defensible (if it's defensible) because
| it's expressive, and restraints on expression about
| government actions are subject to strict scrutiny. Here,
| you're saying that there isn't anything expressive at all
| about your canary being removed; you're simply not exerting
| the effort required to maintain it.
|
| That's not expression; that's like being told you have to put
| a notice on the front door of your business, and trying to
| avoid it by saying "I wasn't disagreeing with the notice, I
| just haven't had time to put it up". Yeah, they're going to
| shut your restaurant down.
|
| I agree with your take across the thread that this is mostly
| moot because of the nature of your business; I think the
| discussion of whether warrant canaries work is interesting,
| but the question of whether rsync.net is going to have to
| resist government searches is not, like, a major controversy.
| You're just not going to get searches at all, because you're
| not that kind of company.
| LarryMullins wrote:
| About a century ago in the UK, the Automotive Association (AA)
| did a similar thing.
|
| Lots of towns were setting up speed traps to catch speeding
| motorists, with very low speed limits, so the AA paid uniformed
| boys on bicycles to find the speed traps and flag down
| motorists to warn them before they reached the speed trap. This
| practice was legally challenged as obstructing the police, so
| the AA inverted the scheme. They instead paid boys on bicycles
| to salute motorists by default, except when there was a speed
| trap. If you saw the uniformed AA boy standing by the side of
| the road and he _wasn 't_ saluting you, you knew there was
| something wrong ahead.
|
| The idea was that the law might be able to ban saluting to warn
| motorists of the police, but the law couldn't ban _not_
| saluting to warn motorists. The law couldn 't compel a salute.
| Evidently this worked, because the AA kept up the practice for
| a few more decades, before eventually discontinuing the
| practice in the 60s.
| philwelch wrote:
| I'm not a lawyer, but that's a double-edged sword because then
| the feds would be opening up questions about the
| constitutionality of the gag order in the first place. These
| secret national security warrants are still a thing in part
| because nobody has successfully challenged them in court. It's
| possible that if the government wants to argue that taking down
| a warrant canary constitutes violation of the gag order, the
| court could ultimately rule that the gag order itself is an
| unconstitutional prior restraint on constitutionally protected
| free speech.
| pbhjpbhj wrote:
| So the law, presumably, says 'you can't tell people you've
| received a warrant' (or a national security letters?)?
|
| Surely this convoluted scheme is still telling people you've
| received a warrant??
|
| Has there been caselaw on this?
| jffry wrote:
| You are correct that it is a convoluted scheme, but the goal of
| warrant canary users is to deliberately create a situation
| where their first amendment rights would be infringed by
| attempts to vigorously enforce the laws around NSL gag orders.
|
| What isn't firmly tested in court is this specific application
| of the idea that the first amendment protects against compelled
| speech, although there have been other similar cases (see the
| Wiki article [1])
|
| [1] https://en.wikipedia.org/wiki/Warrant_canary
| devwastaken wrote:
| Feds always get what they want. You cannot afford to appeal
| to the supreme court, both financially and because non
| cooperation will cause you to receive retaliation. FBI has
| made it so an accusation of a crime can easily become a
| conspiracy, and a conspiracy felony is more prison time than
| cooperation for most non-violent crime. This is why big gov
| is fascism, they can do whatever they want. You'll never see
| the court documents.
| tptacek wrote:
| The problem with this analysis is that First Amendment rights
| were already successfully infringed with the gag order that
| necessitated the canary, which itself has to meet the
| (maximal) strict scrutiny standard; in other words, there's
| no prima facie reason to believe that the legal argument
| defending the canary would fare any better than the legal
| argument objecting to the gag order.
|
| There are subtle and/or complicated reasons to believe the
| canary would work! I'm not here to make the case that
| canaries are invalid, only to establish that among legal
| experts, this is not a settled issue.
| philwelch wrote:
| I think there may be a useful distinction here between
| prior restraint and compelled speech. If you post the
| statement "we have not received a gagged warrant since
| January 3 2023" and you receive a gagged warrant on January
| 4 2023, does the government really have the power to compel
| you to post the statement "we have not received a gagged
| warrant since January 5 2023" the next day? You don't even
| have to take down the January 3 canary; just leave it up
| long enough that people get suspicious that you haven't
| updated it.
| elcritch wrote:
| > The problem with this analysis is that First Amendment
| rights were already successfully infringed with the gag
| order that necessitated the canary, which itself has to
| meet the (maximal) strict scrutiny standard
|
| Has the supreme court actually ruled on the
| constitutionality of gag orders? Until then it's not
| completely settled that it's despite rulings in lower
| courts.
| tptacek wrote:
| These specifically, not that I know of. But gag orders in
| general? Nebraska Press v. Stuart, 3 part test: harm to
| the person being gagged, least restrictive means, and
| effectiveness of the order. That was in a press case,
| where the burden is much higher on the government than in
| these cases.
|
| Specific gag orders can and have failed in appeals!
|
| The problem with this argument as it pertains to warrant
| canaries is that defeating the gag order also defeats the
| purpose of the warrant canary. The question we're begging
| here is: if the gag order survives strict scrutiny, why
| won't the order to keep the canary up?
| hgsgm wrote:
| I don't understand this meme, which is absurdly popular.
|
| "Not updating a warrant canary" isn't the crime here.
| "Creating a warrant canary" is the crime, as it's an action
| whose only purpose is to violate a gag order.
| ncallaway wrote:
| > Creating a warrant canary" is the crime, as it's an
| action whose only purpose is to violate a gag order.
|
| There is no gag order. That's the point.
|
| Are you suggesting that _any action_ that might violate
| _any future order_ is a crime? If so, what do you base that
| on?
|
| If not, since there is no order before them, are you
| suggesting there is a specific statute that they are
| violating? If so, which one?
|
| If not, what would make this behavior criminal?
| merpnderp wrote:
| If we have to pick between the first amendment and the
| courts helping to secretly enforce what are quite often
| shady laws, how should a people born to the Enlightenment
| choose?
| _fat_santa wrote:
| > "Not updating a warrant canary" isn't the crime here.
| "Creating a warrant canary" is the crime, as it's an action
| whose only purpose is to violate a gag order.
|
| It walks a really fine line IMO. The way I see it is it
| works in two ways:
|
| * When you create one, you're not referencing a current gag
| order, but rather an imaginary future one. If creating one
| is a crime then doing just about anything (deleting an
| email or throwing away a letter) is also a crime because
| you can be destroying evidence in a potential future case
| or investigation not brought yet.
|
| * Once this warrant is issued, then your run into this case
| where any associated gag order is "one way". That is the
| government can order you not to disclose the warrant but
| they cannot compel you to lie and update the canary to
| reflect that you still have not gotten one yet.
|
| INAL.
| pas wrote:
| conspiracy to circumvent the patriot act doesn't have to
| be tied to any particular court order.
| _fat_santa wrote:
| Ok so for example I deleted a confirmation email that
| Delta sent me for a flight I had yesterday. Suppose for
| some reason the US Govt opens some investigation into my
| travel, should I be charged with conspiracy to destroy
| evidence since I should have "known" that I "might" be
| investigated.
|
| No that would be silly and there would be no way to prove
| malicious intent. You could make a million arguments for
| a canary in the same way.
| remram wrote:
| If you had reason to believe that the particular email
| will be called for in a court, and that is the reason you
| are deleting it, then it is definitely a crime yes.
| jefftk wrote:
| Are you saying that you think it's currently illegal for
| rsync to be making this claim?
|
| Or that if they ever receive a gag order then their earlier
| action was retroactively illegal?
| fmajid wrote:
| There's plenty of compelled speech in a commercial context.
| Just one example: look at your bottle of milk. It probably
| says "made with milk from cowsnot treated with rBST hormone",
| but the FDA also compels them to say effectively "not that
| there is anything wrong with rBST".
| Red_Leaves_Flyy wrote:
| I'd love to read a qualified and accomplished lawyers take
| on the pedantic differences between your example and the
| subject at hand.
| devman0 wrote:
| There is an argument that compelled factual speech (such as
| disclosures, warnings, safety, ingredient information,
| "truth in lending", etc) is different than compelling
| someone to say something that isn't true.
| lotsofpulp wrote:
| > but the FDA also compels them to say effectively "not
| that there is anything wrong with rBST".
|
| Source?
|
| Edit, found this. Wonder why this reasoning is not used for
| false implications in all the other labeling for
| supplements, vitamins, herbal, and organic food.
|
| Even for milk, there is "A2" milk sold next to regular milk
| implying that A2 is somehow more nutritious, but it is not
| required to say "A1 milk has not been shown to be any worse
| than A2".
|
| https://www.govinfo.gov/content/pkg/FR-1994-02-10/html/94-3
| 2...
|
| > Because of the presence of natural bST in milk, no milk
| is ``bST-free,'' and a ``bST-free'' labeling statement
| would be false. Also, FDA is concerned that the term ``rbST
| free'' may imply a compositional difference between milk
| from treated and untreated cows rather than a difference in
| the way the milk is produced. Instead, the concept would
| better be formulated as ``from cows not treated with rbST''
| or in other similar ways. However, even such a statement,
| which asserts that rbST has not been used in the production
| of the subject milk, has the potential to be misunderstood
| by consumers. Without proper context, such statements could
| be misleading. Such unqualified statements may imply that
| milk from untreated cows is safer or of higher quality than
| milk from treated cows. Such an implication would be false
| and misleading.
|
| >FDA believes such misleading implications could best be
| avoided by the use of accompanying information that puts
| the statement in a proper context. Proper context could be
| achieved in a number of different ways. For example,
| accompanying the statement ``from cows not treated with
| rbST'' with the statement that ``No significant difference
| has been shown between milk derived from rbST-treated and
| non-rbST-treated cows'' would put the claim in proper
| context. Proper context could also be achieved by conveying
| the firm's reasons (other than safety or quality) for
| choosing not to use milk from cows treated with rbST, as
| long as the label is truthful and nonmisleading.
| panarky wrote:
| I was struck by the negativity and fatalism of these
| comments, because in my memory we've discussed warrant
| canaries, and rsync's in particular, on HN many times over
| the years.
|
| In my memory the comments used to be more positive about
| both the effectiveness of canaries and about the sheer
| cleverness, ingenuity and spirit of fighting back against
| tyranny.
|
| I wondered what happened to the HN hive mind over the
| years, has it become more deferential to the authoritarian
| state, more accepting of the erosion of essential freedoms
| in exchange for ostensible safety, more dismissive of
| clever hacks?
|
| But then I read a thread from 13 years ago:
| https://news.ycombinator.com/item?id=702247
|
| While there's a noticeable positive sentiment, many of the
| skeptical comments of today could have been copied verbatim
| from July, 2009.
|
| So perhaps my memory is faulty.
| TMWNN wrote:
| >I wondered what happened to the HN hive mind over the
| years, has it become more deferential to the
| authoritarian state, more accepting of the erosion of
| essential freedoms in exchange for ostensible safety,
| more dismissive of clever hacks?
|
| >But then I read a thread from 13 years ago:
| https://news.ycombinator.com/item?id=702247
|
| >While there's a noticeable positive sentiment, many of
| the skeptical comments of today could have been copied
| verbatim from July, 2009.
|
| The difference is that in 2009 and now a Democrat is in
| the White House, so those who are convinced that "their
| side" can't do anything wrong are more willing to accept
| the authoritarian state.
|
| Look at the Warrant Canary Wikipedia page. Would Jessamyn
| West--associated so closely with Metafilter, a site that
| basically self-destructed because its hivemind became so
| self-reinforcing as to immediately shun anyone at any
| variance with it in a way that would make a Maoist
| struggle session conductor proud--have created her sign
| for libraries if George W. Bush had not been president at
| the time? I doubt it.
| aliqot wrote:
| Laws never said anything about what you stop saying, in this
| context.
| smcl wrote:
| I think courts often encounter people who have clever
| interpretations of laws, but who then get a bit of a rude
| awakening when their "Air Bud" style workaround gets slapped
| down when it meets a surly judge who has no time for their
| shit. Obviously not a lawyer, so I don't know whether this is
| one of these, whether it's something yet to be tested in
| court or whether Warrant Canaries are already accepted as
| valid.
| aliqot wrote:
| You must be referencing a court case where a modern warrant
| canary has ended with the perp in jail. Who might that be?
| You prefaced with "I think", but spoke with quite steadfast
| certainty, surely this piqued your interest for a reason.
| smcl wrote:
| No, nothing specifically related to Warrant Canaries but
| some law podcasts I listened to - ALAB and Mic Dicta for
| example - have referenced this phenomenon a few times.
| It's usually a tech bro or sovereign citizen with a novel
| interpretation of a law that ends up failing when they
| eventually have to try to argue their case it in court.
| brookst wrote:
| Just because some legal strategies are batshit crazy
| sovcit nonsense doesn't mean _all_ legal strategies are.
|
| See: Apple vs FBI in San Bernardino.
| smcl wrote:
| True, and it's been elaborated elsewhere that these have
| already been tested in the supreme court. But you have to
| admit that without that precedent, it _does_ seem a
| little bit cheeky - "oh the law says I can't do X, well
| it doesn't say I can't simply not do inverse(X)" :)
| brookst wrote:
| For a funny / not funny example, see the attempts to ban
| analogs of illegal drugs. The whole research chemical
| thing is a result of the need to legislate exactly what's
| illegal.
| jeltz wrote:
| Sure, but warrant canaries sound like sovereign citizen
| stuff.
| mcbits wrote:
| Supreme Court decisions can sound like sovcit stuff when
| they reference English common law, the Magna Carta, etc.
| Warrant canaries are just intended to exploit a
| technicality. There are a lot of technicalities in law
| that authoritarians don't like.
| tptacek wrote:
| It's true, warrant canaries are not as implausible as
| sovcit arguments.
| Tuna-Fish wrote:
| The is substantial precedent that the US constitution
| prevents the government from compelling speech, litigated
| all they way to supreme court. This isn't some sovcit-level
| workaround, there is actual legal theory behind it.
|
| It is important to note that the more "low-effort" style of
| warrant canary, or simply posting a static page that says
| that you have not been served a warrant, is probably _not_
| safe. Taking the page down is possibly an action you can be
| legally prevented from doing. However, that 's not what
| rsync.net is doing. They are specifically posting a new one
| every week, because no court or authority can compel them
| to post one if they don't want to under US law.
| [deleted]
| SAI_Peregrinus wrote:
| Then why does every food product have a "nutrition facts"
| label, mandated by the FDA, if said mandate is
| unconstitutional? Either some compelled speech is
| constitutional, or Nestle hasn't bothered to litgate it
| (strains credibility), or all the food manufacturers
| think that American consumers care enough about having
| the nutrition facts that they'd have a competitive
| disadvantage if they removed them (even less credible).
|
| Edit: My point is that "compelled speech" isn't the
| issue, it's "compelled false speech" vs "compelled
| silence", either of which infringes on the right to free
| speech in some way.
| tptacek wrote:
| Further, if this actually gets litigated, it seems pretty
| likely that the DOJ will argue that the government isn't
| compelling "false" speech, so much as the canary's owners
| deliberately created a situation where compliance with a
| lawful compulsion to silence would require them to lie;
| that they more or less "banked" a lie, and then tried to
| pin that on the government when it was time to make the
| withdrawal.
|
| (That's not to say this argument, or any canary argument,
| would avail; who the hell knows, should be our watchwords
| in this matter.)
| tptacek wrote:
| The government compels speech like, all the time. Can you
| cite this substantial precedent you're referring to? The
| cancer warning label on my couch wants to have words.
| twiss wrote:
| https://www.reuters.com/article/us-otc-speech/when-the-
| gover... says:
|
| > On Friday, the 9th U.S. Circuit Court of Appeals joined
| a slowly emerging consensus among the federal circuits,
| holding that governments have the right to mandate
| corporate speech "if the information in the disclosure is
| reasonably related to a substantial governmental interest
| and is purely factual."
|
| The latter requirement does not seem to be held in the
| case of compelling rsync to post an updated warrant
| canary claiming not to have received a warrant if they
| have.
|
| Furthermore, in the case of cancer warnings, the actual
| law is phrased as:
|
| > No person in the course of doing business shall
| knowingly and intentionally expose any individual to a
| chemical known to the state to cause cancer or
| reproductive toxicity without first giving clear and
| reasonable warning to such individual
|
| so, it's not so much compelled speech "out of the blue",
| rather it's a requirement of doing business. There are
| other ways the business can comply with the law, such as
| not including the chemical in the product. In the case of
| warrant canaries, I'd be surprised if there's a similar
| law requiring them to be posted to do business.
| account-5 wrote:
| I have to agree with you. Freeman of the land come to mind.
|
| I think the danger here is the interpretation of the
| prohibition on telling people you've been served with a
| secret warrant.
|
| Whilst you seemingly can't force someone to do something
| the fact that not doing that thing is effectively telling
| people you've been served a warrant is grounds at least to
| take you to court.
|
| I can only imagine this canary process being manual, if it
| were automated I'm unsure it could be considered speech
| (obvs: IANAL).
|
| Until tested in court it's up in the area.
| aliqot wrote:
| Comparing warrant canaries to sovereign citizens is
| disrespect almost to the degree of caricature.
| account-5 wrote:
| I'm not comparing them, in that paragraph I'm commenting
| on the parents comment about people being slapped down by
| surly judges. That's why is in the first paragraph on its
| own.
| smcl wrote:
| I think you're taking non-US[0], non-lawyers speculating
| about US law a little bit too seriously. I mean it could
| be argued that we shouldn't even be commenting if we
| don't know, but where's the fun in that? It's Hacker
| News, not Lawyer News :)
|
| [0] - or at least I'm non-US
| _Algernon_ wrote:
| If you force somebody (who's not even the defendent, just a
| witness in the case) to (cryptographially) sign a message
| of your own choosing, why not just take the shortcut of
| forcing the defendant to sign whatever confession you want
| them to? Much easier, quicker and cheaper than these fancy
| workarounds.
| hooverd wrote:
| Unfortunately surly judges also do things like impose a
| trial tax for daring not to take a plea deal. The legal
| system gets to play Calvinball.
| pbhjpbhj wrote:
| Yes, I've seen this (in UK, but can't think off-hand of an
| example) where the judge says "yeah, no" to someone trying
| to be clever.
| pc86 wrote:
| "I've seen this in a completely different jurisdiction
| but don't remember even a single specific" is not a
| particularly compelling counterargument.
| smcl wrote:
| I don't think this thread had the tone of an argument at
| all. If there were two people seriously butting heads
| going back and forth on something, yeah sure. But pulling
| a [Citation Needed] on some people who aren't experts but
| want to have a sincere and pretty civil discussion feels
| a bit much.
| bombcar wrote:
| Especially since the UK has way more of a "legal
| precedent" style of law than the US constitutional
| system.
| hgsgm wrote:
| You mean "common law"? US Constitutional law is deeply
| based on "legal precedent".
| [deleted]
| ndsipa_pomu wrote:
| The only way that warrant canaries could be successfully
| outlawed would be to have laws that apply retroactively or
| possibly outlaw anyone from any discussion of warrants at any
| time (with the exception of officers of the law - would make
| their job difficult).
|
| The issue is that people post a warrant canary before they have
| any warrant served, so it'd be a strange situation of being
| legal before receiving a warrant and then suddenly
| transitioning to illegal. Maybe one way round it would be to
| make it illegal to change any procedures upon receiving a
| warrant so that they would be forced to continue posting
| warrant canaries that are then false.
| tptacek wrote:
| I don't know why you think this is the case, but I haven't
| read any analysis of canary legality that pivots on ex-post-
| facto laws. As I understand it, the question comes down to: a
| court order requiring a company to maintain its warrant
| canary will amount to compelled false speech (compelled
| speech happens already, compelled false speech is unique to
| this situation) and will as such be subject to the strict
| scrutiny standard. The case against warrant canaries: the gag
| order itself is already subject to strict scrutiny, and
| people who post warrant canaries have gone out of their way
| to put themselves in a situation where they will need to make
| false statements. The case for canaries: compelled false
| statements are more intrusive than a gag order and will
| receive, somehow, more scrutiny.
|
| It's not simple and it isn't resolved in law.
| coffeeblack wrote:
| Good point. It always reminds me of the "crypto nerd" xkcd.
|
| https://xkcd.com/538/
| lifeisstillgood wrote:
| What's the kings, wizards postscript about?
| rst wrote:
| Headlines from the date of the canary; including them
| demonstrates that the canary was produced and signed on or
| after the date indicated, not before. See "notes" at the
| bottom.
| Y_Y wrote:
| I wonder if they have a contingency for when a global health
| emergency stops all professional sports matches.
| rsync wrote:
| The canary is edited and signed, manually, _by an actual
| human_ every Monday morning.
|
| I have high confidence that the individual tasked with this
| can quickly think of another unpredictable metric with
| which to datestamp the canary.
| adamckay wrote:
| There's three news headlines for the day to also
| demonstrate the message was written and signed on the
| declared day.
| Hackbraten wrote:
| They could state just that fact, which still serves to
| prove the point.
| Y_Y wrote:
| But that's something you could prepare now, or if you
| need specifics then at the start of the new plague. Then
| subsequent releases won't be proven to have been created
| within the prior week.
| pc86 wrote:
| Then they just post something else to make it obvious. I
| mean seriously, come on. Just because you can come up
| with an incredibly specific and unlikely scenario in
| which _this exact thing_ wouldn 't work doesn't mean
| anything. They just stop doing that exact thing.
| stetrain wrote:
| Do you have an example of other information that could be
| included to validate that the message was not generated
| and signed in advance?
| lalopalota wrote:
| Any other current events headline from major news
| sources.
|
| Closing stock price of multiple stocks.
|
| This week's powerball numbers.
|
| Count of babies born in several hospitals on a specific
| day.
| bombcar wrote:
| The latest bitcoin block hash.
|
| The current nytimes headlines.
|
| The most recent close of the largest stock markets.
|
| The last power balls numbers.
|
| Most of those would be valuable in their own right if you
| had foreknowledge.
| [deleted]
| tasuki wrote:
| But why would they do that?
|
| I understand that in this scenario we trust rsync.net and
| are afraid of secret warrants. If rsync.net wanted to
| deceive is, they could do that by... just lying? What
| incentives do they have to pregenerate these messages?
| garblegarble wrote:
| They're scores from sports matches on that day, to show the
| statement was not signed prior to the listed date
| upofadown wrote:
| What is the specific attack addressed here? A secret cache of
| canaries generated before the destruction of the secret key
| material?
|
| If we can't trust rsync.net to not do that then how can we
| trust them to actually stop producing canaries after the gag
| order? Is it something to do with how they are produced?
| to11mtm wrote:
| > What is the specific attack addressed here? A secret
| cache of canaries generated before the destruction of the
| secret key material?
|
| It is to prevent 'pregenerated' message. Also increases the
| entropy of the message vs just a simple date change.
|
| > If we can't trust rsync.net to not do that then how can
| we trust them to actually stop producing canaries after the
| gag order?
|
| Elsewhere in thread it was discussed that, legally
| compelling someone NOT TO say something is somewhat easier
| than compelling them TO say something.
|
| As an interesting theory, if they were somehow 'compelled'
| by a court order to say they were OK for X weeks, they
| could just pregen the next X weeks without headlines, which
| would possibly be another way for the canary to squawk.
| aliqot wrote:
| Folks, keep your warrant canary short. 1 paragraph statement of
| intent, date, maybe a headline, signature. That's it.
| themulticaster wrote:
| Do you suggest there is any security benefit of a short canary?
| Or is it just about keeping a canary simple and comprehensible
| even for non-technical users?
| aliqot wrote:
| If you'd like you may provide a rebuttal for whichever you
| feel strongest about
| haswell wrote:
| You haven't provided any argument to rebut, only an
| assertion.
|
| On the surface, there appears to be no actual canary-
| specific value to keeping the text short. If you have a
| specific reason you disagree, feel free to bring that
| argument forward.
| unsignednoop wrote:
| If rsync devs cared about brevity then we might of had a decent
| syncing client
| rgbrenner wrote:
| rsync.net and rsync the open source project aren't related,
| afaik/afict. At the very least, no one at rsync.net has been
| the maintainer or original dev of rsync. Rsync either doesnt
| enforce their trademark, or rsync.net has an agreement with
| the project.
| anecdotal1 wrote:
| They definitely are not related
| queuebert wrote:
| rsync.net works well with borg, fwiw.
___________________________________________________________________
(page generated 2023-01-07 23:01 UTC)