Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

Post reply on HN
Print view View original

71–80 of 163 posts

Re: Cloudflare expands its government warrant canaries

#71

Post by balabaster »

jakejarvis wrote: post #48
rsync wrote: post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

Glad you guys included this part: > "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations." That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by autho…

Um... wouldn't the act of compelling them to produce false declarations for the purpose of obtaining sales under false pretenses fall under conspiracy to commit (wire) fraud which is a federal crime?

Are there any lawyers that could comment on this?

Re: Cloudflare expands its government warrant canaries

#72

Post by kelnos »

goto11 wrote: post #50
DannyB2 wrote: post #45

Earlier quoted context omitted.

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But s…

Has anyone been held in contempt of court for failing to update a warrant canary. I don't believe so. So it seems to be working?

Another poster pointed out that courts generally do not uphold orders to compel speech when that speech is untruthful. So a court order to untruthfully update a warrant canary will not likely survive a legal challenge.

Re: Cloudflare expands its government warrant canaries

#73

Post by sosorry44 »

oldgregg wrote: post #69

Could a company create a warrant canary for every user? Just a simple notice when you login to your account? If the premise of the canary is that they can force you to keep silent but can't compel you to speak, what would prevent a company from doing this?

What advantage does that have over a warrant canary for the entire site?

Re: Cloudflare expands its government warrant canaries

#75

Post by cco »

jjeaff wrote: post #57
rsync wrote: post #26

Earlier quoted context omitted.

There is also the possibility that we take your money for cloud storage and run away to Costa Rica without providing anything to you. Or our ZFS filesystems are actually raid-5 ext2 volumes and we fake the snapshots. Or one of the locations is just running in my basement. There are all kinds of ways for a service provider to act in bad faith. In many ways, the warrant canary is an attempt to signal what kind of peopl…

Except all those are examples of acting in bad faith. The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure. The only bad faith might be using warrant canaries knowing that they may still be able to be compelled legally to comply.

Of course they could compel you to keep it, the CIA has overthrown countries, performed psychological experiments on unwilling US citizens, they've sold crack and smuggled arms against Congress's wishes, the list goes on. There is nothing stopping a part of the US government from compelling a company to keep a warrant canary.

But that doesn't mean canaries are useless, they're just not protective if the US government has deemed it important enough to force it.

Re: Cloudflare expands its government warrant canaries

#76

Post by djakjxnanjak »

goto11 wrote: post #50
DannyB2 wrote: post #45

Earlier quoted context omitted.

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But s…

Often, the law does treat action and inaction very differently. Eg: it’s illegal to poison your ailing grandparent, but legal to let them die by removing the feeding tube (because you are just “not feeding them anymore”).

Re: Cloudflare expands its government warrant canaries

#77

Post by graedus »

dev_dull wrote: post #64
jcrites wrote: post #61

Earlier quoted context omitted.

The EFF has a FAQ about warrant canaries which addresses some of these topics: https://www.eff.org/deeplinks/2014/04/warrant-canary-faq It is believed to be unlikely that a court would compel a company's false speech to maintain a warrant canary. > Have courts upheld compelled speech? > Rarely. In a few instances, the courts have upheld compelled speech in the commercial context, where the government shows that the c…

I don’t think it would be forced directly. I think they’d put the company under a gag with threat of criminal punishment if they do anything to “signal” an investigation. Then an operator has to ask themself “is it worth risking jail time by updating this page?”

The appeal of the Warrant Canary design is that the operator simply has to take no action (i.e. not update the page) to signal that they've been contacted by law enforcement, in theory making it safer. It's still a risk though.

Re: Cloudflare expands its government warrant canaries

#78

Post by rsync »

jjeaff wrote: post #57
rsync wrote: post #26

Earlier quoted context omitted.

There is also the possibility that we take your money for cloud storage and run away to Costa Rica without providing anything to you. Or our ZFS filesystems are actually raid-5 ext2 volumes and we fake the snapshots. Or one of the locations is just running in my basement. There are all kinds of ways for a service provider to act in bad faith. In many ways, the warrant canary is an attempt to signal what kind of peopl…

Except all those are examples of acting in bad faith. The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure. The only bad faith might be using warrant canaries knowing that they may still be able to be compelled legally to comply.

"The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure."

I personally (which is the only viewpoint that matters here) would consider falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith.

YMMV.

Re: Cloudflare expands its government warrant canaries

#79

Post by kelnos »

3pt14159 wrote: post #38

Here is what I don't understand: On my website I can make every path resolve. I.e., I can have www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad Render a page that says: > I haven't been paid off by the Mossad Easy peasy. Then, if I take a grubby payment to fuck over a client (with an NDA, of course) I don't write about it, I just make that one path fail to resolve. It's writing by omission. This is why I'm ideo…

> But some information should not be shared and, at times, we need to allow the government to decide when.

I agree with the first part of your statement but not the second. I don't trust the government with that absolute power.

That's why we have an adversarial legal system: to challenge the government when we think they're doing wrong. Unfortunately, the government has effectively created a shadow legal system where challenges are ineffective. This is why things like warrant canaries are necessary, when the government tries to do an end run around checks on its power.

Re: Cloudflare expands its government warrant canaries

#80

Post by SahAssar »

LinuxBender wrote: post #42
3pt14159 wrote: post #38

Here is what I don't understand: On my website I can make every path resolve. I.e., I can have www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad Render a page that says: > I haven't been paid off by the Mossad Easy peasy. Then, if I take a grubby payment to fuck over a client (with an NDA, of course) I don't write about it, I just make that one path fail to resolve. It's writing by omission. This is why I'm ideo…

They are just good for business. No company is going to defy an order from a secret court or a NSL that states they are not to modify statements on their website until further notice. People will dispute the legality of such orders, but companies know how long they can be off the internet before going out of business. At least, that is based on conversations I have had with a corporate legal executive.

> order from a secret court or a NSL that states they are not to modify statements on their website until further notice

That's the point. The theory is that a NSL can compel you to not speak, but it can't compel you to speak. Not updating a canary is the latter, not the former.

If a canary isn't updated in the period it is expected to update it is considered "dead" or "tripped".

Post reply on HN