Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

Post reply on HN
Print view View original

151–160 of 163 posts

Re: Cloudflare expands its government warrant canaries

#151

Post by billpg »

Suppose I ran a business and regularly published a statement "As of (date) I have not done (thing)."

Now suppose I've been forced to do (thing) with the additional instruction not to reveal what I've done. Do I stop publishing that statement?

If I stop publishing, my customers are going to draw the worst possible conclusions, that they were the specific customer targeted. So, my existing customers start moving away and new customers are deterred from signing up.

Also, I'd probably get in trouble for revealing that I did (thing). Any protests I could make that I didn't technically reveal anything probably won't be effective.

On the other hand, if I keep publishing updated statements as if nothing happened, my customers keep paying and I don't have to be martyr.

What would you do?

Re: Cloudflare expands its government warrant canaries

#153

Post by zaarn »

TheLoneAdmin wrote: post #55
skrebbel wrote: post #22

Earlier quoted context omitted.

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

The government can issue a gag order on a specific subject. This prevents you from disclosing the existence of a subpoena. However, the opposite is not true. The government cannot compel speech. Sure, the government can take illegal actions... However, they cannot force someone to make an untrue statement.

Maybe they can't force you but you might still be found in contempt of court and jailed or fined large amounts of money.

Either option, force or contempt of court, isn't that well explored in the domain of cyber security yet, especially because the lack of updates on the warrant canaries are supposed to communicate something and the lack of updates would therefore also constitute communicating the presence of a warrant to outside parties.

Law isn't like logic puzzles.

Re: Cloudflare expands its government warrant canaries

#154

Post by zaarn »

throwaway88643 wrote: post #90
joering2 wrote: post #66

Earlier quoted context omitted.

Whats the purpose? Most judges will understand what warrant canary is, and can simply ask them to continue signing it. Judge has the power to gag you, or force you to sign or continue doing something. Its very common in multi-scheme crimes where forcing one criminal to continue their criminal conduct is "greater good" for the sake of a whole investigation.

Surely if the criminal is an assassin, the judge wouldn’t order them to continue taking contracts for “the greater goood.”

There is a difference between killing people and continuing to make cryptographic signatures that even the most densest of judges should recognize.

Re: Cloudflare expands its government warrant canaries

#155

Post by zaarn »

jake_the_third wrote: post #145
eastdakota wrote: post #113

Earlier quoted context omitted.

That’d be my read too. You can definitely be “too clever.” Laws aren’t like computer code. They’re interpreted by humans. And, if you’re “too cute” and violate the spirit of the law, you can quickly find yourself on the wrong side.

I think you're making a mistake. The primary intention behind warrant canaries isn't to shield you from legal retaliation, but to make it very hard to /legally/ force you to lie directly or by omission.

IMO it's questionable if a court in the US couldn't force you to continue signing it once they have the appropriate gag order, not signing the canary would be communicating to others you have a warrant with gag order and therefore not signing it would constitute speech which you aren't allowed to disclose as per gag order.

Re: Cloudflare expands its government warrant canaries

#156

Post by Sephr »

jrochkind1 wrote: post #99

Does anyone have a list of instances where a warrant canary was _succesfully_ used to signal government surveillance or other court order, that the company involved would have been otherwise legally forbidden to communicate? It's been at least a decade since the 'warrant canary' was proposed. We _know_ the government has been doing all sorts of things by sealed court order in that decade. I'm not sure it has proven u…

Riseup previously received an NSL and stopped updating their canary for a few months (only to resume later with new wording).

The NSL was most likely related to getting access to WikiLeaks' Riseup email address and to get r/w access to WikiLeaks' direct messages on Twitter. WikiLeaks had a Riseup email associated with their Twitter account.

Re: Cloudflare expands its government warrant canaries

#157

Post by testvox »

ceejayoz wrote: post #133
graedus wrote: post #77

Earlier quoted context omitted.

The appeal of the Warrant Canary design is that the operator simply has to take no action (i.e. not update the page) to signal that they've been contacted by law enforcement, in theory making it safer. It's still a risk though.

Taking no action can be illegal, as child neglect and negligent homicide demonstrate.

Yeah but here the action would be to make a false publication, which as discussed higher up the courts have been reluctant to force people to do.

Re: Cloudflare expands its government warrant canaries

#158

Post by unionpivo »

DannyB2 wrote: post #45
gonehome wrote: post #39

Earlier quoted context omitted.

I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request wh…

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

Be careful and speak with a layer first.

In my country (Slovenia), you would still be found in breach of the court order.

If court orders you not to reveal a certain item, and then you go and reveal it[1], at least here details of how you revealed it do not matter.

If you set up things in a way that you have to lie in order to comply with court order, that's your problem and not courts. Court will not compel you to lie. It will punish you for breaking a court order.

And that fact that you did it in advance in anticipation of such order, would only make matters worse for yourself. (willful disregard, or however it's translated)

[1]: Setting up a canary and then not updating it, is revealing it. Just because you went through convoluted means to do so, its the results that courts care about.

Re: Cloudflare expands its government warrant canaries

#159

Post by ijpoijpoihpiuoh »

pure-awesome wrote: post #148
ijpoijpoihpiuoh wrote: post #130

Earlier quoted context omitted.

> might be the very real threat of violence or jail time for you or your loved ones I mean, hypothetically there could be. But in the real world, in some countries, you can be fairly sure that the rule of law will be followed.

Just take a look at this: https://en.wikipedia.org/wiki/Unethical_human_experimentatio... And these are just the ones we know about, and the page only pertains to experimentation. You have to give some consideration to what "legal" even means when you're dealing with a government.

The last instance on that page occurred in the early 1970s. I never claimed the past was free of bad events. I said, prospectively, that a person could be relatively sure the rule of law would be followed on the subject of warrant canaries, in some countries.

Re: Cloudflare expands its government warrant canaries

#160

Post by ijpoijpoihpiuoh »

grecy wrote: post #150
ijpoijpoihpiuoh wrote: post #130

Earlier quoted context omitted.

> might be the very real threat of violence or jail time for you or your loved ones I mean, hypothetically there could be. But in the real world, in some countries, you can be fairly sure that the rule of law will be followed.

> But in the real world, in some countries, you can be fairly sure that the rule of law will be followed I think it's fairly clear we're talking about the US, and in this case everything is a secret. We have no idea what will happen, or if anything has happened in the past.

Obviously I can't prove the nonexistence of secret proceedings where people have been made to lie to the public. This is ever the domain of conspiracy theorists, because you can never really prove that no such thing has happened, to say nothing of proving it won't. Proving non-existence in general is a nearly impossible problem in the real world. But I think it's unlikely. People can feel free to let their irrational fears dominate their behavior if they want.
Post reply on HN