Based on spez's language, is it safe to assume that a NSL has indeed been received? That's my interpretation (and it seems that of other reddit commentors too).
"I've been advised not to say anything one way or the other." [1]
when asked whether he withdrew the canary voluntarily. The comment directly beneath sums it up:
"In case anyone is still confused or in disbelief, this is where he confirmed it. He really can't say it any more clearly without teasing the law to go after him."
[1] https://www.reddit.com/r/announcements/comments/4cqyia/for_y...
There's two situations here: Either the gov't doesn't care that you say you got an NSL (without specifics on time/subject), or they do care.
If they do care, discussion with judge:
- Did you say you got an NSL, despite there being a gag order?
- Well I didn't not say anything
- You had previously had a communication strategy set up to communicate when you would get an NSL
- ...
- So you did say it.
Case where the gov't doesn't care that you mention you got one (given you hide the time/subject through delays):
- Why did you do all the crazy stuff to tell people instead of just telling people?
- It was funner this way
Is the canary really a legal defence? I can only imagine that no, it isn't. At best it lets you imply that you got an NSL even if you didn't (oops we removed it from the template). At worst you're facing the same legal issues as before
The government has no responsibility to assist you in self-perpetuating logic puzzles.
That being as it is, the distinction is between compelling someone to nondisclosure and compelling someone to active deception. I imagine that's a tough battle in court, particularly if it's part of a service agreement between a company and its customers. Compelling continued publication of the canary would extend well beyond 'gagging' the company and would force it to commit what is essentially contract fraud.
And by the point where the gag order comes into force, it's too late; you can't comply with it in a way where you aren't compelled to lie, a power that the gag order does not possess. That's the point of the canary; you have preemptively removed from yourself the ability to fully comply. Which is entirely legal.
Gag orders aren't retrocausal. Either it's fundamentally illegal to say that you haven't received a gag order, or gag orders can force you to lie, or canaries work. One of those three options must hold.
I mean, yes, in a general sense, it's notable, but it doesn't tell me how often it has happened or who the target is, so there's no personal value nor any substantial value from a civil liberties perspective because it doesn't tell us all that much.
They never will be able to tell down to the person level. Those would definitely violate the gag order, which if you're willing to violate why go through the mess of a canary. Similarly the government is very particular about reporting just how often they're received. Testing that is a huge gamble on the lawsuit that would be filed when you get too precise for the government's tastes.
Better yet, make each canary in the form of an original haiku.
Month 1:
reddit.com
has not to date received
an NS letter
Month 2:
This, our company
As of the time this appears
Has not been silenced
Month 3:
Our routine remains
A haiku for you from us
On the month's first day
In fact, when I first heard of warrant canaries, that's how I expected that they would work.
At the same time, companies should not be forced to try and circumvent the law with cute tricks. Preventing companies from informing their users/customers that their privacy has been breached by a 3-letter-agency should be illegal.
We shouldn't be arguing about the legality of canaries, we should be arguing about the legality of gag orders. Arguing pro canaries is fighting a losing battle; it's fighting the symptoms instead of the cause.
In the example of insider trading, it was NEVER legal for you to give inside information. So stopping your Haiku is legal, but the discussion when you agreed "sell your stock when my Haiku ends" was not.
"No NSL Letter has been given for data to users with the 1st letter being P" "No NSL Letter has been given for data to users with the 2nd letter G" etc etc. Publishing 200 haikus a month like this would surely go against the gag order (since you could reveal the username like this).
I think at one point common sense comes int play
There's two situations here: Either the gov't doesn't care
that you say you got an NSL (without specifics on
time/subject), or they do care.
If 100% of canaries were removed a month later, canaries would be pretty information-free, because the removal of a canary would just mean a canary was added a month earlier.
And it would be a simple matter to send a spy to use coffee shop wifi to post some bomb making instructions or something similar. Hypothetically.
One reason canaries are likely to be legal is that the government can work around them.
Of course, agreeing ahead of time to participate in this network could be interpreted as "communicating" (see other discussions here).
It's an incredibly complex issue that your screenplay doesn't quite capture.
There is a legal difference: compelled speech is especially and obviously unconstitutional in the US, in contrast to a restriction on what you can say.
You do still, as you point out, need to be willing to put the law to the test. Presumably Reddit has received legal advice that it's okay to take that risk in this case.
Makes it a bit easier to see what's going on.
Once is all it takes, from that point forward you can't fully trust anything they say about their privacy / security.
The only real questions are: is this an april fools? And does it matter?
"Hey George, did you hear Reddit has a canary now too. Ok, add it to the list. Pick a user there and issue an NSL. And don't forget about Google and FB this month as well, they are about to reset theirs".
Putting oneself in the shoes of such an actor this is a rational approach to take.
Can be done by re-interpreting what is happening -- "we are not issuing bogus NSLs to troll them, we are fighting terrorism and these sites deliberately shelter and protect terrorists and other criminals. We want to periodically issue NSLs to establish protocols and methods so we can more effectively protect our country and do our work".
So it has to be story which will look good on paper and workers will tell themselves without feeling like they are doing something illegal.
Another way is to do it as a side-effect of something else -- say "we decided to double our efforts to track down drug dealers on these sites, therefore we'll put 2x more people on it and they will conduct research and open new cases and so on". So simply by allocating more resources to the "problem" they'll ensure any of these large sites will simply get a constant stream of NSLs without explictly writing that down as "we are busting the canaries" as a goal anywhere.
edit: There appears to be a bug in the reddit context code, here's the original root comment that sparked the discussion: https://www.reddit.com/r/announcements/comments/4cqyia/for_y...
... What? A canary? Oh, right ...
No; it's just pining for the volcanoes.
Surely that's a very, very bad thing.
I really was capable of seeing nuance, once.