Airbnb Law Enforcement Transparency Report | Hacker News Reader

Airbnb Law Enforcement Transparency Report

transparency.airbnb.com

75 pointsrezist80836 comments

> (in the case of certain types of national security-related requests in the United States like national security letters) from publicly acknowledging receiving it, such as in a transparency report like this one. (To date, we have not received a national security letter or other similar request that would limit our ability to disclose it here)

They have included a warrant canary

I like that they've done this. Are there examples of companies that have done this and users or the media noticed when they removed it?

http://arstechnica.com/tech-policy/2016/03/reddit-removes-wa...

Reddit did.

https://m.reddit.com/r/worldnews/comments/4ct1kz/reddit_dele...

Apple - https://gigaom.com/2014/09/18/apples-warrant-canary-disappea...

Just discovered that the original warrant canary (2005) was purportedly created by a librarian, being a sign in her library reading: “The FBI has not been here (watch very closely for the removal of this sign).”[0]

[0]: http://jolt.law.harvard.edu/articles/pdf/v28/28HarvJLTech525...

Why does everyone make such a huge deal about a warrant canary when LE is clearly aware of them and a true gag order would obviously preclude you from removing any such canaries?

Because it is not obvious that a gag order would preclude one from removing a warrent canarie.

There has been no test cases on the subject, and there are few instances of the court upholding compelled speech. Further, the precedents that we do have for compelled speech have been based on the compelled speach being truthful (as well as a legitimate government interest in compelling the speach).

This means that, irrespective of the law of the gag orders, one could make a very strong consitutional arguement for being allowed to remove the canary, and would have strong precedent.

Given that warrant canaries have already tripped, clearly it's not SOP for law enforcement to force warrant canaries to stay.

You should provide a reference, it would be helpful.

I'm surprised the government hasn't just sent a banal request to everyone along the lines of, "you are required to disclose every known space alien who uses your service and you are prohibited from disclosing this order."

Every service then has to kill its canary.

Probably because a warrant canary would never hold up in court and they just don't care.

No cases where a warrant canary was removed to signal the possible receipt of an NSL have been prosecuted. Either all those warrant canaries were removed for other reasons, or prior restraint is still unconstitutional enough to keep prosecutors at bay.

... or the organizations did not remove the warrant canaries because their attorneys told them that they would go to jail.

I'd like to know what legal theory would make it a crime to post a warrant canary.

They would consider it a violation of the National Security Letter.

At the time of posting, no security letter has been received. So it cannot violate a non-existent letter. If you assume that the letter could preclude you from removing the warrant, you just need a living canary. You post a new canary every day that you haven't received one. If it goes stale, you must have received a letter. There is no way that they can compel you to lie to the public and post a new canary after the letter.

Suppose you get an email from the boss saying, "singlow, remove the warrant canary script from cron. I just got out of a meeting with the Board, and they all agreed we need to inform the public that we've received this national security letter."

If you truly believe your argument, you wouldn't prosecute the boss even in the presence of this email. We all know anyone planning on using a warrant canary is intending to inform the public, so whether or not there's an email admitting it should be irrelevant if the action is legal. If you believe that the boss is not guilty, then you're consistent in your position.

Now, as a practical matter, you'd use an in-person meeting or telephone call or something. Or you'd at least use different wording. But the act itself would in principle still be illegal, even though there is no evidence to prosecute. And in that sense, a warrant canary could be a useful tool to allow one to get away with a crime that they consider unjust.

There would be no legal basis for such a prohibition, as there's no plausible national security endangerment were the request to be revealed.

Haven't you seen Men in Black?

Well, less ignore mass panic and such. It's always been US government policy not to talk about these things. Canadian and UK, too, apparently. So, it being classified mighg make it a no go.

However, I found this Quora answer to give pretty good justification on national security grounds for military scenarios:

https://www.quora.com/Why-is-the-government-afraid-of-reveal...

Warrant canaries make zero sense, the court would simply require you keep your warrant canary as part of its order.

From what I understand, the way canaries are supposed to work is, you keep publishing a document every day / week / whatever, that includes a phrase like "Today is 2016-09-02, and we have not received any national security letters or gag orders".

When you receive an NSL, you either publish a document including the phrase "Today is 2016-09-03." or else simply stop publishing that document and leave the one with the old date up, and let people draw their own conclusions.

Under this scheme, the court would have to compel speech on your part (force you to publish a new canary), but there's some precedent that might indicate that you can tell them to stuff it.

Courts can generally compel you to do things, especially things you don't want to do (otherwise the compelling bit is redundant). Also, from other people's writing on the subject, I gather that courts aren't all that keen on sophistry and schemes, especially those specifically invented to anticipate and circumvent a specific order from the court.

In the USA, courts generally can't compel you to speak. They do not have the power to force someone to utter or write words against their own free will. Forcing someone to continue publishing a statement saying that a warrant has not been received would be against understood Constitutional precedent.

Moxie Marlinspike: If it's illegal to advertise that you've received a court order of some kind, it's illegal to intentionally and knowingly take any action that has the effect of advertising the receipt of that order. A judge can't force you to do anything, but every lawyer I've spoken to has indicated that having a "canary" you remove or choose not to update would likely have the same legal consequences as simply posting something that explicitly says you've received something.

https://github.com/WhisperSystems/whispersystems.org/issues/...

Bruce Schneier: Personally, I have never believed this trick would work. It relies on the fact that a prohibition against speaking doesn't prevent someone from not speaking. But courts generally aren't impressed by this sort of thing, and I can easily imagine a secret warrant that includes a prohibition against triggering the warrant canary. And for all I know, there are right now secret legal proceedings on this very issue.

https://www.schneier.com/blog/archives/2015/03/australia_out...

At the very least, the issue isn't clear-cut, and there most certainly isn't constitutional precedent.

They absolutely can and they have, warrant canaries are pseudolegal nonsense. Judges do not tolerate such things.

In the report, they call the ratio of "Requests For Which At Least Some User Data Was Disclosed" to the "Total Requests" the "Compliance Rate". In this report it's 43.6% which implies that Airbnb is "out of compliance" with 56.4% of requests.

I wouldn't call that ratio the compliance rate because it a rejected request may be very justified from the standpoint of the business / customers privacy. "Disclosure ratio" seems like a more apt term.

If you interpret "compliance" as the noun form of the verb "to comply", it makes more sense. Compliant behavior, that is, "compliance", is not always positive.

I suppose it depends on what legal weight there is around the request. Depending on the legal situation, if a company is "out of compliance" they may be fined etc.

I have no idea what to do with or how to feel about this information. I'm sure plenty here will sooo... someone care to draw some conclusions?

Well, for starters, it sure looks like France has some problems.

Or it's the same group/people/individual hitting the same place again and again.

I'm kinda intrigued why there are `74` affected accounts (higher than any other country) for a single submission in India.

Probably something of the form "all persons that have stayed at $property during $time"?

Is there a formal requirement for an emergency request?

This is a helpful report. I'm always curious to know the number of requests, at least to the right order of magnitude.

Reply on news.ycombinator.com