Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

61–70 of 163 posts

Re: Cloudflare expands its government warrant canaries

#61
post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

Glad you guys included this part: > "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations." That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by autho…

The EFF has a FAQ about warrant canaries which addresses some of these topics: https://www.eff.org/deeplinks/2014/04/warrant-canary-faq

It is believed to be unlikely that a court would compel a company's false speech to maintain a warrant canary.

> Have courts upheld compelled speech?

> Rarely. In a few instances, the courts have upheld compelled speech in the commercial context, where the government shows that the compelled statements convey important truthful information to consumers. For example, warnings on cigarette packs are a form of compelled commercial speech that have sometimes been upheld, and sometimes struck down, depending on whether the government shows there is a rational basis for the warning.

> Have courts upheld compelled false speech?

> No, and the cases on compelled speech have tended to rely on truth as a minimum requirement. For example, Planned Parenthood challenged a requirement that physicians tell patients seeking abortions of an increased risk of suicidal ideation. The court found that Planned Parenthood did not meet its burden of showing that the disclosure was untruthful, misleading, or not relevant to the patient’s decision to have an abortion.

Re: Cloudflare expands its government warrant canaries

#62
post #46
post #45

Earlier quoted context omitted.

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

> I didn't take any action to disclose anything. I simply stopped updating something. This might work if judges are fucking idiots.

This would conspiracy to commit wire fraud with a maximum sentence of 20 years and a $250,000 fine.

They surely can't compel you to break the law, even to cover up a gag order?

Of course, I'm not a lawyer and this is just conjecture on my part.

Re: Cloudflare expands its government warrant canaries

#63
post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

Glad you guys included this part: > "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations." That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by autho…

If you’re an international organization and that comes out, prepare to be sued for fraud in other countries.

Re: Cloudflare expands its government warrant canaries

#64
post #61

Earlier quoted context omitted.

Glad you guys included this part: > "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations." That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by autho…

The EFF has a FAQ about warrant canaries which addresses some of these topics: https://www.eff.org/deeplinks/2014/04/warrant-canary-faq It is believed to be unlikely that a court would compel a company's false speech to maintain a warrant canary. > Have courts upheld compelled speech? > Rarely. In a few instances, the courts have upheld compelled speech in the commercial context, where the government shows that the c…

I don’t think it would be forced directly. I think they’d put the company under a gag with threat of criminal punishment if they do anything to “signal” an investigation. Then an operator has to ask themself “is it worth risking jail time by updating this page?”

Re: Cloudflare expands its government warrant canaries

#65
post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

Glad you guys included this part: > "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations." That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by autho…

> That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by authorities taking over private keys and doing it themselves? Canaries appear to be pretty much untested in court.

The evidence shows (IMHO) it is likely the government has enough power to obtain your keys by force, issue a gag order, and take actions against your users before the case works its way through an appeal process. The only question is if you'll be willingly participating in the activity or if it'll happen while you're in lockup.

"Pete Ashdown, CEO of XMission, an internet service provider in Utah, knows. He received a Foreign Intelligence Service Act (FISA) warrant in 2010 mandating he let the feds monitor one of his customers, through his facility. He also received a broad gag order."

https://www.buzzfeednews.com/article/justinesharrock/what-is...

"My company, Lavabit ... [snipped, see URL for this background info paragraph]

But that wasn't enough. The federal agents then claimed that their court order required me to surrender my company's private encryption keys, and I balked. What they said they needed were customer passwords – which were sent securely – so that they could access the plain-text versions of messages from customers using my company's encrypted storage feature. (The government would later claim they only made this demand because of my "noncompliance".)"

https://www.theguardian.com/commentisfree/2014/may/20/why-di...

Re: Cloudflare expands its government warrant canaries

#66
post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

Whats the purpose? Most judges will understand what warrant canary is, and can simply ask them to continue signing it. Judge has the power to gag you, or force you to sign or continue doing something. Its very common in multi-scheme crimes where forcing one criminal to continue their criminal conduct is "greater good" for the sake of a whole investigation.

Re: Cloudflare expands its government warrant canaries

#67

Earlier quoted context omitted.

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!" The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not. If you put a gag order on me and suggest…

Retribution could serve a useful purpose to those in power: a warning to others who are considering doing what you've done.

Re: Cloudflare expands its government warrant canaries

#68

Earlier quoted context omitted.

Glad you guys included this part: > "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations." That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by autho…

> That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by authorities taking over private keys and doing it themselves? Canaries appear to be pretty much untested in court. The evidence shows (IMHO) it is likely the government has enough power to obtain your keys by force, issue a gag order, and t…

I only read the part you quoted, but I don’t see anything about a warrant canary?

Re: Cloudflare expands its government warrant canaries

#70

Here is what I don't understand: On my website I can make every path resolve. I.e., I can have www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad Render a page that says: > I haven't been paid off by the Mossad Easy peasy. Then, if I take a grubby payment to fuck over a client (with an NDA, of course) I don't write about it, I just make that one path fail to resolve. It's writing by omission. This is why I'm ideo…

> www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad

Well, it doesn't resolve for me... The only conclusion is that you've been paid off by the Mossad.

Post reply on HN