Hacker News Reader

Comment by neilv | Hacker News Reader

I'm always anti-canary. Two scenarios:

* You're suddenly under governmental orders not to disclose X. You remove a canary that says not-X, effectively disclosing X, and this was obviously your exact and pre-meditated intent. You then have to find a lawyer who will help you argue to a judge and other officials that you're in the clear with this loophole.

* You have a canary that says not-X, as an assurance to some other party. X happens, but you're also told at the same time that the folk wisdom you heard on the Internet about canaries will not protect you. So you don't remove the canary. Now your canary is falsely assuring that other party, betraying whatever trust they put in you, perhaps to their detriment.

View on HN

This is fair given what Ethereum just did. But, IMO, that's not what I expect if someone says "warrant canary". Under the "original" sense of canaries, your scenarios wouldn't make sense. Unfortunately, this new, wrong interpretation of the original idea seems to have become more common.

The original idea was that on some regular cadence (say weekly), you actively post a (hopefully signed) message somewhere saying "I hereby attest that, as of <insert current date>, we have not received any warrants/subpeonas/etc and are not subject to any gag orders, etc. etc.". (eg, rsync.net's canary: https://www.rsync.net/resources/notices/canary.txt). You have to set it up so that someone has to actually go and do something for the updated canary to go up, so it's like a dead man's switch. If you ever stop posting those, that's the signal to users that something is up.

That approach is extremely robust legally. In the US at least, publicly posting a digitally signed message asserting something presumably important and valuable about your business that's knowingly a lie would be considered false advertising, wire fraud, etc. depending on the exact situation. The government has a lot of power to legally compel you to not do things that would otherwise be legal (eg, uttering the speech "we just got a subpeona for all of your data!"). What they absolutely cannot legally do is compel you to do something illegal. Eg, they can't make you commit wire fraud by actively lying to your customers about the services you provide. That's a very strong legal position and you wouldn't have a hard time getting a lawyer to back you up on it.

Basically, if your "canary" requires you to "take down" something, it's not a proper canary and, yeah, I wouldn't trust it to protect you from much.

That worked well for Joseph Nacchio.

Joseph Nacchio's case has nothing to do with canaries.

I know a little something about these kind of mechanisms.

Neither of your scenarios seem problematic:

"You then have to find a lawyer who will help you argue to a judge and other officials that you're in the clear with this loophole."

Presumably the same lawyer(s) you've already retained for the purpose of defending the canary (and other things). Defending the canary in court (under US 1A law regime) is the entire point.

Also note that in the de facto standard canary process[1] you don't remove the canary (as that would be a positive, intentional act of speech). You simply stop updating it.

"So you don't remove the canary."

Again, under no scenario do you remove the canary - you simply stop updating it.

[1] "Special note should be taken if these messages ever cease being updated, or are removed from this page."

Something I don't understand...

I imagine that canary questions sometimes come up in non-publicly-disclosed legal proceedings, as well as in the occasional extra-legal practice.

If that actually does happen, and canaries ever failed to stand up in them, then how many lawyers would ever be in a position to hear about those failures, such that the lawyer could competently advise clients how to use canaries successfully?

Would the lawyer have to have been the veteran top litigator who handled the situations that reached the ear of the ACLU, or who previously worked on those situations on behalf of some facet of government?

Or is there sufficiently binding official assurance from government that canaries done a certain way are OK, no matter what happens in some non-public meeting?

(BTW, I really like your company. Though, as much as its canary looked like probably a signal of principled old-school Internet techie values, it also looked like potentially a bit of a magnet for trouble, in business it might attract, and in who it might antagonize. The tech choices there seem be heavy on minimizing risk of IT drama, but the canary seemed to flirt with drama.)

> veteran top litigator who handled the situations that reached the ear of the ACLU

I think you assume that getting in contact with lawyers from the ACLU is much much harder than it is, either that or that the ACLU only gets involved in sufficiently high-profile cases but nonetheless false. If you're a company that deals with sensitive data and have a legitimate worry about getting NSLs you could probably get a meeting with the relevant legal/policy expert just by shooting them a polite email about it.

Experts in a particular niche field not wanting to talk about their passion, impossible challenge. "Wait, woah, you also care about this?! You wanna testify in the committee hearing for the bill our team is working on?"

I agree that getting in contact with the ACLU is easy. (I did it myself, when I was just a random city committee volunteer, and we were considering an issue that I figured the ACLU could help inform.)

My question was where would someone go to get counsel about canaries, from someone who knows how this actually works in practice, not only in the legal precedents that are public info. (After all, we are talking about situations involving gags.)

For example, I was guessing maybe there's someone at the ACLU who has heard of enough of the non-public to give good counsel. But asking.

Unstated, I was also wondering whether the folk wisdom that so many people repeat, and which some seem to rely upon, is informed by the expertise of the rare people in a position to know the full reality.

Even if it's true, it does sound like a stereotypical computer person's misunderstanding of how law works: "Aha! But this Constitutional interpretation says that government can't compel speech! Checkmate!" Hence, checking that.

This is why you sign the canary regularly, and then it just expires if you do nothing.

Although... I also don't see much use in them either, it seems everyone ends up complying with something eventually and so all canaries end up getting removed.

That doesn’t seem functionally different than removing the canary.

Things break all the time! Usually they get fixed, but sometimes you're just too busy to get around to it.

Removing the canary requires action. Not resigning a canary requires inaction.

I strongly doubt a judge will care to distinguish the two.

that would be compelled speech

Doubt all you want. Can you point to case law?

Why did you do this thing 2 weeks ago?

Why didn’t you do this thing 2 weeks ago that you were under no legal obligation to do?

Seems like a significant and valid distinction even if what they communicate to the intended audience is largely the same.

“Largely the same” because in the second case it would be possible that forgetting, or some other obstacle to resigning occurred.

That sounds like much more of a nuanced law question than a "are these the same". While they might be able to stop you telling the world, they might not be able to force you to perform actions that cause you to lie to the public

Not a lawyer, but I think the government has more ability to prevent you from doing something than forcing you to act. They can tell you to not remove the canary, and not tell anyone your logs are being monitored, but it is trickier for them to say you must re-sign this certificate.

IANAL, but I'd think that hurting your possible future defense is what you just said, and what people always say: that the premeditated intent is to violate a potential future gag, and that removing the canary (or not updating a cryptographic signature, or resetting to 0 the "__ days since last served a subpoena" notice) is a mechanism for that violation.

IMHO, that's kinda a weaselly trick, no matter how good the cause, and it might not stand up, not legally, nor in extra-legal practice.

In this case, they mentioned the involvement of a confidential state agency in the commit message, so it does not seem like there is a gag order per se, at least not a very broad one.

And to my knowledge, warrant canaries haven't been tested in U.S. courts, so the zeroth (and possibly most common) scenario would just be that you remove the canary and nothing happens to you, and the canary works as intended.

I bet there's a great organization that works on defending civil liberties in the digital world. It turns out they have an article on this, from a full decade ago. It also covers who else is using canaries, and existing, highly limited, precedent for compelled speech.

https://www.eff.org/deeplinks/2014/04/warrant-canary-faq

https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-...

Doing it with HTML, CSS, and an SVG icon seems odd. Having it in your privacy policy document or something similar seems more appropriate then you're just updating your privacy policy.

Reply on news.ycombinator.com