Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

Post reply on HN
Print view View original

91–100 of 163 posts

Re: Cloudflare expands its government warrant canaries

#91

Post by cheeze »

rsync wrote: post #26
skrebbel wrote: post #22

Earlier quoted context omitted.

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

There is also the possibility that we take your money for cloud storage and run away to Costa Rica without providing anything to you. Or our ZFS filesystems are actually raid-5 ext2 volumes and we fake the snapshots. Or one of the locations is just running in my basement. There are all kinds of ways for a service provider to act in bad faith. In many ways, the warrant canary is an attempt to signal what kind of peopl…

Love what you folks do. Keep up the hard work!

Re: Cloudflare expands its government warrant canaries

#92

Post by crankylinuxuser »

rc_kas wrote: post #84
malnourish wrote: post #37

Earlier quoted context omitted.

They are actual politics, regardless of your or my beliefs. They vote, and if there are enough of them, someone will cater to them. To willfully ignore them is to ignore a sad reality, they will continue to grow unabated; to meaningfully engage them is to platform a disingenuous group (not to mention giving their beliefs acknowledgement). It seems to be a catch-22 to me.

The child porn guy also votes. Are you going to call that political too?

My now deceased great aunt married when she was 13 to a man of 33.

Now, we'd be screaming "PEDO" from the rooftops while calling for castration and prison, or even execution. What actually happened, was marrying when you were 13 as a female was the norm. It was OK. She had 4 children.. And if you asked her, had a wonderful life.

But in a fairly short time, social norms went from "Puberty means you're an adult, or darn near one" to 'pushing up the definitions of adulthood up to 21 year olds'. And in this case, the social norms were also backed by loads of well-meaning laws that end up being abhorrent in practice (how dare two 17 year olds sext pictures, but they can have as much sex as they want).

If you didn't learn from 2016, laws and words matter. A lot.

Re: Cloudflare expands its government warrant canaries

#93

Post by dragonwriter »

throwaway88643 wrote: post #90
joering2 wrote: post #66

Earlier quoted context omitted.

Whats the purpose? Most judges will understand what warrant canary is, and can simply ask them to continue signing it. Judge has the power to gag you, or force you to sign or continue doing something. Its very common in multi-scheme crimes where forcing one criminal to continue their criminal conduct is "greater good" for the sake of a whole investigation.

Surely if the criminal is an assassin, the judge wouldn’t order them to continue taking contracts for “the greater goood.”

They certainly won't order them to continue fulfilling contracts, but they might order them to continue accepting (and reporting) them.

Re: Cloudflare expands its government warrant canaries

#94

Post by throwaway88643 »

DannyB2 wrote: post #45
gonehome wrote: post #39

Earlier quoted context omitted.

I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request wh…

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

It’s like a dead-man switch. You can also set it so every few hours, you have to enter in a password to keep it up.

If you are held for questioning, most likely you won’t have access to a device to update it.

Re: Cloudflare expands its government warrant canaries

#95

Post by java-man »

Arnt wrote: post #29
skrebbel wrote: post #22

Earlier quoted context omitted.

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

Well, of course anyone can point a gun at your newborn baby. But a government agency have to comply with the law, and the law makes certain requirements on officers of companies. The details are complicated, but simplifying, if a company is publicly traded and someone whose title starts with V or C says something in public, then it has to be true. Three-letter government agencies can't both comply with the law and at…

... and break the law themselves.

Re: Cloudflare expands its government warrant canaries

#96

Post by dragonwriter »

balabaster wrote: post #87
dragonwriter wrote: post #83

Earlier quoted context omitted.

> wouldn't the act of compelling them to produce false declarations for the purpose of obtaining sales under false pretenses fall under conspiracy to commit (wire) fraud which is a federal crime? No, it would not, among other reasons because that is not the purpose.

Definitions stolen from Wikipedia: Conspiracy - In criminal law, a conspiracy is an agreement between two or more persons to commit a crime at some time in the future. E.g. the court (judge) and the seller. Fraud - wrongful or criminal deception intended to result in financial or personal gain... for example making untruthful claims for the purpose of continuing to sell a product under false pretenses. Mail and Wire…

> Can you elaborate as to how a compelled untruthful (electronic) declaration for the purpose of continuing to obtain sales of your product is NOT (wire) fraud?

I'm saying—and I said this expressly in the post you responded to—that that isn't the purpose, which is the strongest reason it isn't criminal fraud.

Your initial purpose in the warrant canary was sales, sure, but the government wasn't involved in that and it wasn't (presumably) false.

The government order isn't for the purpose of sales.

Your compliance with that order is quite likely not for that purpose, either; it's to avoid the consequences of non-compliance (which is why it's compelled and not voluntary.)

Re: Cloudflare expands its government warrant canaries

#97

Post by Sephr »

Here is my interpretation of Cloudflare's statements (and lack thereof) in their transparency report:

"We received 0-249 National Security Letters" = "We are subject to one or more National Security Letters with associated gag orders."

"Cloudflare has never installed any law enforcement software or equipment anywhere on our network." = "Someone other than us installed law enforcement software and equipment on our network, or we provide software interfaces used by law enforcement to comply with an NSL."

"Cloudflare has never turned over our encryption or authentication keys or our customers' encryption or authentication keys to anyone." = "Law enforcement may MitM Cloudflare customers' websites through first-party interfaces provided to comply with NSLs."

"Cloudflare has never weakened, compromised, or subverted any of its encryption at the request of law enforcement or another third party." = "Law enforcement may MitM Cloudflare customers' websites through first-party interfaces provided to comply with NSLs."

Re: Cloudflare expands its government warrant canaries

#98

Post by balabaster »

dragonwriter wrote: post #96
balabaster wrote: post #87

Earlier quoted context omitted.

Definitions stolen from Wikipedia: Conspiracy - In criminal law, a conspiracy is an agreement between two or more persons to commit a crime at some time in the future. E.g. the court (judge) and the seller. Fraud - wrongful or criminal deception intended to result in financial or personal gain... for example making untruthful claims for the purpose of continuing to sell a product under false pretenses. Mail and Wire…

> Can you elaborate as to how a compelled untruthful (electronic) declaration for the purpose of continuing to obtain sales of your product is NOT (wire) fraud? I'm saying—and I said this expressly in the post you responded to—that that isn't the purpose, which is the strongest reason it isn't criminal fraud. Your initial purpose in the warrant canary was sales, sure, but the government wasn't involved in that and it…

Your compliance with that order is not for that purpose. HOWEVER, your statement which was originally to generate sales went from being truthful to being untruthful.

So now that your warrant canary is false, you are making an untruthful statement supporting sales generation for your company, which is what makes it fraudulent; and in my mind at least, because you've been compelled to do so, that's conspiracy to commit fraud.

I guess they could argue that you weren't compelled to continue operating. You could have shuttered your business. So in that sense, I suppose if they made that argument, the fraud would be on your head and they'd get off on that technicality.

Re: Cloudflare expands its government warrant canaries

#99

Post by jrochkind1 »

Does anyone have a list of instances where a warrant canary was _succesfully_ used to signal government surveillance or other court order, that the company involved would have been otherwise legally forbidden to communicate?

It's been at least a decade since the 'warrant canary' was proposed. We _know_ the government has been doing all sorts of things by sealed court order in that decade. I'm not sure it has proven useful. I'm not sure the courts _would_ allow you to communicate via canary. The warrant canary disappearing can be a _mistake_ often enough, that even if we see one disappear, we don't know whether to lend it much credence.

Re: Cloudflare expands its government warrant canaries

#100

Post by jrochkind1 »

balabaster wrote: post #31
skrebbel wrote: post #22

Earlier quoted context omitted.

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!" The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not. If you put a gag order on me and suggest…

You don't know if it's a "valid loophole" until it's tested in court. You could later find yourself under prosecution, and possibly eventually in jail and/or with a business-destroying fine. If you are willing to risk that, because you think "the value of talking is greater than that of your freedom" -- I think that's actually quite honorable and respectful!

You could of course violate the terms of a sealed warrant or other enforced-confidential court order without a warrant canary too, although of course that goes from "we're not sure if I can get away with it", to "this is definitely going to be a really big legal battle, that _maybe_ I can come out of, if there's enough political uproar."

Using a warrant canary _might_ end up being just as much legal jeopardy, we're just not sure.

Post reply on HN