Dropsafe

by Alec Muffett

TIL: What a “Warrant Canary” is…

Twitter / bytemark: @ralpost You know we're not ….

[…]

Warrant_canary

A warrant canary is a method used by an Internet service provider to inform its customers that the provider has not been served with a secret government subpoena. Such subpoenas, including those covered under the USA Patriot Act, provide criminal penalties for revealing the existence of the warrant to any third party, including the service provider’s customers. A warrant canary may be posted by the provider to inform customers of dates that they haven’t been served a secret subpoena. If the canary has not been updated in the time period specified by the host, customers are to assume that the host has been served with such a subpoena. The intention is to allow the provider to inform customers of the existence of a subpoena passively, without violating any laws. The legality of this method has not been tested in any court.

The idea of using negative pronouncements to thwart secret warrants was first proposed by Steven Schear on the cypherpunks mailing list,[1] and was first implemented by public libraries in response to the USA Patriot Act.

The first commercial use of a warrant canary was by rsync.net. In addition to a digital signature, they provide a recent news headline as proof that the warrant canary was recently posted[2] as well as mirroring the posting internationally.[3]

⊞

Comments

3 responses to “TIL: What a “Warrant Canary” is…”

  1. Stephen Smoogen

    Sadly, the problem is that they will be told to lie and continue to post that they haven’t been served. This will be done under the same interpretation of the laws that authorizes the secret subpoena’s in the first place. The reasoning being that lieing about this is not a crime while not lieing would be.

    Reply
  2. Matthew Bloch (@matthewbloch)

    Order someone not to not tell is passive. Ordering someone to continue publishing a lie forever is a much bigger deal. Even if an authority tried the latter, there are scores of ways the ISP might be able to plead compliance to the letter of such a draconian warrant while giving the nod to those paying attention, it depends on the nature of the canary statement. We forgot one week. Whoops, we made some typos. We switched “today’s headlines” from The Times to Pravda.

    Of course there is still the rubber hose, blackmail and other reasons for an ISP to comply absolutely, but we just have to give you the strongest argument in advance as to why we’re not susceptible to those methods.

    Reply
  3. Wolf Baginski

    If the coded signal is obvious to the customers, can it be innocent in the eyes of a court? What works for a captured secret agent forced to send messages may not work here. The agent had nothing to lose. And, too often, the warning was ignored.

    There has to be more than one signal, I think. Should I start to follow Berlin Rules?

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts