Cloudflare’s Transparency Report for Second Half 2016 and a Disclosure for 2013
blog.cloudflare.com
blog.cloudflare.com
> Now that this gag order has been lifted, Cloudflare is able to publish a more accurate transparency report to its customers and constituents.
A _more_ accurate report, not necessarily a completely accurate report. May or may not imply that there are other gag orders still in force for the period. I wouldn't be surprised.
One question I have, they chose to voluntarily redact the customers account name in question for obvious reasons. But have they now informed the customer directly?
In any case, thanks Cloudflare for fighting this. I often feel a bit bad about using Cloudflare for my blog, as it exposes users to a potential layer of tracking. This makes me feel a little better.
We're not tracking your users.
Which is why the parent poster said "potential". You're not tracking, but you could be.
As far as you're allowed to admit by NSL's, you mean :-)
Intentions != Guarantees
It's not totally ideal. But I'm glad to hear you're trying your best.
These anti-democratic 'forces' always exist, and they empower themselves at the cost of the people shifting power to themselves and the state, and there is always an excuse, a reason. A history and established culture of checks and balances and rule of law is supposed to keep them in check.
In this case things are going wrong over an extended period of time accompanied with increasingly hysterical propaganda with no counter forces in play to correct this anomaly. I think the smugness and lack of spine from our generation will cost others heavily and it is gross negligence to continue to pretend this is not happening.
Aren't Senators or something exempt from this kind of record spying? So the gag order could at the very least be written to permit engaging with them. Of course not just any staffer but at least cloudflare would have had a reason to push harder to speak to someone.
And even then, when the law will have to change to address the Supreme Court rulings, the FBI will probably still push to basically ignore some of the Supreme Court decisions, already knowing they are unconstitutional. But if that can buy them an extra 5 years of abuses before the NSLs reach the Supreme Court again and the law has to change again, they are more than happy to play that cat and mouse game.
The GCHQ in the UK has been doing the same thing. By the time the previous surveillance law is declared illegal, they will have already passed a new surveillance law that would have to be challenged in court again, and on and on we go.
They did it when the data retention law was declared invalid by the CJEU and they made the Parliament quickly pass DRIPA in 2014 to "make it all legal again". And now the CJEU said DRIPA was invalid as well. But they had already passed the Investigatory Powers Act, which will likely have to be brought in court itself, too, to be made invalid.
By then they'll just pass an "amendment" to "make it legal again", even though it likely won't, because none of the mass surveillance "features" they want in these laws will ever be considered legal either by the CJEU or by the European Court of Human Rights. But they are also happy to play the cat and mouse game.
The EU also has the Charter of Fundamental Rights of the European Union. The final court for that is the European Court of Justice (or Court of Justice of the European Union) in Luxembourg. The ECJ is a EU organ, and appeals instance for violations of EU law in general. As such, since the ECHR is party of EU law by treaty, the ECJ also handles cases that involves the ECHR.
Once the UK leaves the EU, it will no longer be bound by judgements of the ECJ, but it will be bound by judgements of the ECHR.
The UK Human Rights Act sets out the obligations for the government with respect to the ECHR. The ECJ obligations I believe are indirect via the European Communities Act 1972, which gives EU law and treaties primacy over UK law.
Indirectly, leaving the EU does make it legally possible for the UK to withdraw from the ECHR, but that would still mean leaving the Council of Europe as well, but that's unlikely - it would put it in company with Kazakhstan, Belarus and the Vatican City as the only European states which are not CoE members (the Vatican is an observer).
If not, that's a good pressure point for a change in current legislation. I can't possibly imagine a scenario where disclosing the number of NSL would be a threat to national security.
But you have to wonder why the FBI simply doesn't use aliases for real people's names in any letters that they issue. Seems to be a safer alternative to asking that something is redacted later.
>Because of the gag order, I had to sit in silence, implicitly confirming the point in the mind of the staffer.
Please. He could have easily let her know about it without explicitly stating it.
What are they going to charge him with? Violation of the gag order by saying and doing nothing? That would only serve to ridicule the whole practice.
Gag orders seem to do exactly what they're supposed to: They scare people into compliance. Are there actually any cases where someone was charged for breaking a gag order?
What are they going to charge him with? Violation of the gag order by saying and doing nothing? That would only serve to ridicule the whole practice.
https://en.wikipedia.org/wiki/Warrant_canary
In September 2014,[18] US security researcher Moxie Marlinspike wrote that "every lawyer I've spoken to has indicated that having a 'canary' you remove or choose not to update would likely have the same legal consequences as simply posting something that explicitly says you've received something.
Lawyers clearly disagree with you.
Gag orders seem to do exactly what they're supposed to: They scare people into compliance. Are there actually any cases where someone was charged for breaking a gag order?
Of course they do. Jail-time & heavy fines are typical for court imposed gag orders. I don't know of any examples of NSL gag orders being broken, nor do I expect you'll find any volunteers that want to find out.
I don't think they ever want things like that to go to court, because proving that somebody gave away information implicitly can be very much impossible.
The "scare" part is all there is to gag orders, as far as implicitly disclosing information is concerned.
Report the gag order stolen. Make a photo with a one-time camera and post it from an open wifi using Tails or another Linux live distribution. Shred the data, burn the order, dispose the camera.
This can even be scripted easily to happen automatically when you're in range of the wifi, so you're not seen with the device.
There are a lot of ways to safely disclose gag orders if you really want to, especially if you work in IT.
It would have been interesting to see what action the FBI would have taken if a Congressional(?) staffer had become aware that the FBI's interpretation was different to the lawmakers.
It is certainly possible that the FBI would have been reluctant to pursue persecution in this case.