Hacker News Reader

Hacker News

Comment by sdoowpilihp | Hacker News Reader

Full thread

sdoowpilihp

Unfortunately, the disclosure of information via negation will almost certainly not hold up in a court of law.

View on HN

Fortunately, NSL gag orders themselves have not held up in a court of law either.

http://www.wired.com/threatlevel/2013/03/nsl-found-unconstit...

Twice: http://www.wired.com/threatlevel/2010/08/nsl-gag-order-lifte...

Instinctly, I would agree with you. As a counter-argument though, the gun industry has been able to pull off many legal hacks with similar spirit. See "bullet buttons", 80% lower receivers, or bump-firing attachments. These all got around the spirit of laws and are routinely done now. I don't see why the computer industry can't have their set of legal hacks.

The difference is that this doesn't get around the "spirit of the law", but directly acts in breach of it. They are essentially creating a heart beat, and using a break in that heart beat to signal that a certain event has taken place.

As best as I can tell, that is disclosing information.

If nothing else, a warrant canary would let you try an interesting defense. With the right participants, you can set things up so that if you receive an NSL then either:

a) you are able to signal that you did, or b) they compel you to lie and you then can press a "free exercise of religion" defense (this is where the 'right participants' part comes in; you'd have to be able to ensure the only people with the power to update the canary are (1) people that the NSL cannot be hidden from and (2) members of a religion that forbids lying).

Sounds interesting, let us know how it works out.

I'd love to have the opportunity to try it, but I'm not in a position where I'm likely to ever get an NSL in the first place.

Your second proposition would be fascinating to watch play out in the courts. If I had to make a guess, I would bet that ultimately, the individual would win out in what would probably go to the supreme court (at least in the US). By that time though, the NSL's would probably have served their purpose, and something else will have taken it's place.

>By that time though, the NSL's would probably have served their purpose, and something else will have taken it's place.

I don't think so. Generally, the way it works in the US court systems is you have to break the law before you can challenge it in court. This means that, regardless of the eventual decision, you would have already revealed the NSL (or removed the canary), and the question is where you allowed to.

I disagree. They'd probably just find other instances of you lying and say that your religion's prohibition on lying isn't that firm to begin with.

Same as if you claimed that, per your faith, you "have to" wear a yarmulke all the time, but it turns out you only wear it in courthouses that prohibit it.

If it's obviously a sham (like your yarmulke example) then sure - it shouldn't fly. They'd be right to point out "that isn't even your religion, and we have evidence X, Y, Z that proves it."

But if a person practices a religion imperfectly, to propose that their continued attempts to live by it are null and void? That's ludicrous. Moreover, it would also constitute the government telling you specifically how to practice your religion, which is to my mind even worse than forbidding it in the first place.

(EDIT: minor continuity fix)

I don't think you need to go to the religion clause. A well established part of freedom of speech is that you cannot be compelled to say something, and by not updating the canary, you would be saying it is true.

Also, it is (somewhat) well established in law that you cannot be compelled to break the law. If you are a company, it is illegal to lie and say, for example, you have not received NSL`s.

True. I like to believe that there are so many holes in those things that it's only a matter of time before they're struck down anyway, and any particular attack against them only has a small chance of ever even making it to court to be tested.

It's one thing to demand secrecy of people who are willingly agreeing to keep secrets so they can be issued a clearance. It's something entirely else to give secrets to an unwilling recipient who never agreed to keep them, and threaten to destroy their lives if they don't.

After reading and digesting rayiner's (and others') points elsewhere on this thread I realize the most likely approach the prosecution would take is to assert (c):

c) "You have signaled that you received an NSL and are therefore in violation. It's your own damn fault you were forced to choose between lying and breaking the law"

I doubt "freedom of religion" allows you to get away from any law. After all, if an atheist marries a Catholic, the marriage fails, and the atheist wants a divorce, I doubt the civil divorce could be held up by the catholic saying "My religion forbids divorce!"

I think being arrest for it would surely disclose it as well.

Perhaps they could be sued either way. If a company states on their website that "We do not do X", and then starts doing X they are left with two choices, leaving a false message up or taking it down.

If they leave it up, and the truth eventually comes out, could they be sued for misleading their shareholders?

If they take it down does that open them up to being sued by the government?

National Security Letters grant the recipient immunity from civil lawsuits if you comply in good faith. They think of everything!

How does that work for international companies who end up sued in non US jurisdictions?

Really? I'd like to learn more about this, do you have a source?

(aside: Sorry for the downvote, my finger slipped up :/)

IANAL, but it appears to depend under which legal authority the letter is issued (Verizon's was 50 U.S.C. 436). See the chart on page 15: http://www.fas.org/sgp/crs/intel/RL33320.pdf

The chart of page 15 of the document you linked says a 50 USC 436 covers "all financial information relating to consenting, identified employee" but wasn't it used to obtain customer information from Verizon? What am I missing here? Is what the document is describing just one possible use case?

Edit: typo

You're right; I misread it. It's 50 U.S.C. 1861. Sorry, I'm out of my depth.

Lol so am I that's why I wanted to clarify. Thanks for clearing that up

Well, has this been tried in court?

I wouldn't be surprised if this wasn't the case and yes, one part of the government makes you do it, and the other one sues you for it.

You are correct that a company could be sued for other things, such as lying. My point is that a warrant canary _does_ disclose information; specifically through implication. I am sure that in a court of law, given that an implication made by a warrant canary is reasonably obvious, it could be argued that the party in question was indeed attempting to disclose information prohibited by the gag order, and as such, is in breach of the gag order.

but its a deniable form of disclosure - you could argue that the ISP is trying to adhere to the gag order by lying to the customer that there hasn't been any subpoenas.

What the customer gets out of that lie is none of the concern of the ISP.

There is an aspect of deniability though it's weak, especially with something that is both updated at regular time intervals, and was otherwise reliably updated.

Maybe a better solution would be a system that generated an indicator with only a certain level of assurance that it is accurate, and have it err on the side of NOT giving false positives. This would have a built in level of deniability.

I wish it were as easy as that, but the thing is that there is always a human in the loop to design such a system, and that person does not have deniability. For instance, say that on days without subpoenas, bob@google flips a coin, and only updates the canary if it comes up heads. With a subpoena, he doesn't update the canary regardless of the coin flip. If I were a government prosecutor, I would simply subpoena bob@google and ask him under oath whether he ever disregarded the coin flip.

Of course, this all assumes that this disclosure even comes to the government's attention. But that's a calculated risk any canary-user will take.

That is where plausible deniability comes in to play. He could lie under oath, and it's still plausible that he is telling the truth.

The only play on the government's part at that point, as far as I can tell, would be to acknowledge that the NSL did exist in order to prove that he was lying. They likely would not do this though, as it defeats the purpose of the gag order.

Say I'm a hosting company. I doubt that the authorities can compel me to lie to my customers in the form of not terminating the canary. Moreover, I think I have every right to choose to terminate any running process on my machine. The implications of the "canary understanding" between me and my customer should have no bearing on those fundamental facts.

This is the common sense position, but nothing about it being common sense prevents them from telling you to do otherwise. These are people that justify their system with the system that remains otherwise unjustified.

I don't see what's common sense about it. You're just trying to do something indirectly that you can't do directly (communicating the existence of the NSL). I bet there is even an information-theoretic way of equating the two courses of action.

As I see it: Compelled to be silent is one thing. Compelled to lie is another.

To me, the notion that the second shouldn't be possible is common sense. I find it hard to express how little it surprises me that you do not share this perspective.

The gag order prevents you from communicating the existence of the NSL. Whether you do so by e-mail or smoke signal or elaborate semaphore (the canary in the article) is irrelevant. The gag order doesn't compel you to lie, except to the extent you contrive to set up a situation where your only two choices are to lie or reveal the existence of the NSL.

Not that I agree with gag orders attached to warrants, mind you. But saying that it's just "stopping a process running on my computer" not "communicating information" is just wrong from an information theoretic point of view. Lots of things can be used as a semaphore to communicate information. I bet in other contexts (say insider trading), you'd agree that it doesn't matter whether some CEO tipped off his buddy about insider information by carefully varying load on a server to modulate response times on a web page, thus communicating bits of information.

Unsurprisingly, it appears you are either confused or being purposely obtuse.

I do not doubt that they have constructed for themselves a legal scenario that allows them to command warrant canary operators to lie. On the contrary, I am suggesting that they have with all likelyhood done exactly that.

Who is confused? It is the canary operators that deliberately constructs for themselves a situation that offers only the choice between lying and complying with the gag order.

Yes, so? I have not disputed that.

The situation is constructed by the canary operator; the legal situation, the justification for commanding the canary operator to lie, is not constructed by the canary operator. As much as they would like to be, the canary operator is not in a position to dictate how the laws are written and interpreted.

If the canary operator were in a position to construct the legal situation, then there would be no cause for concern. However they are not, and cannot be.

So? The "so" is that it's the canary operator's deliberate actions that turn the "being compelled to stay silent" into a "being compelled to lie."

"I bet in other contexts (say insider trading), you'd agree that it doesn't matter whether some CEO tipped off his buddy about insider information by carefully varying load on a server to modulate response times on a web page, thus communicating bits of information."

Ah, but what if the CEO is just taking a long time to reply to emails from friends, because he is very busy preparing for some huge business move -- is it insider trading if one of those friends sets up an options position that profits from increased volatility? This gets down to the difference between a side channel (inadvertent) and a covert channel (deliberate). The distinction does not matter from an information theoretic point of view; the same information is communicated in either case.

Information theory is basically irrelevant here, as is any formal logic -- I would think that someone with your legal background would understand that logic and the interpretation of the law do not always coincide. You can easily create a paradox by making the canary be a daily notification sent to each customer informing them that they are the target of an NSL, which may be logically problematic but is completely irrelevant in court. I also think a company could have a reasonable defense if the fact that a customer is under surveillance were revealed by a side channel e.g. an observable increase in latency, despite the clear information theoretic argument that that such a side channel "communicates" the surveillance to a customer.

> I also think a company could have a reasonable defense if the fact that a customer is under surveillance were revealed by a side channel e.g. an observable increase in latency, despite the clear information theoretic argument that that such a side channel "communicates" the surveillance to a customer.

If the intent was to communicate, I don't see how the fact that it's a side channel is relevant.

Yeah but now you need to work to prove intent. A company can make a good defense that the side channel was unintentional, especially if they never bothered to tell their customers what to look for (someone would eventually figure it out on their own, if the latency difference was noticeable). It could happen without the company's management or legal team even knowing; a developer could just hide a subtle scalability bug in the wiretapping system, so that a large number of wiretap requests triggers the side channel (take a look at the Underhanded C Contest if you doubt that such a bug can be easily hidden in even a small codebase).

>You can easily create a paradox by making the canary be a daily notification sent to each customer informing them that they are the target of an NSL, which may be logically problematic but is completely irrelevant in court.*

Now that, that is genius.

They judge won't have to compel you to lie. He'll simply instruct you not to communicate with your customers in any way about the warrant. If you cancel the canary and your customers find out about the warrant, the judge won't care how you dressed it up.. he told you not to communicate a fact, and you did.

You can't game your way around that.. the court will care about outcome, not method.

If you say they didn't hear about it from you? They can figure it out any which way. You simply issued a statement that you neither confirm nor deny you have been served. If you put an ad in the newspaper every day and then do not do it when subpoenaed, you are at fault for not putting the ad?

There are at least two questions to consider. (1) Is your argument reasonable? (2) Is your argument legally compelling? It is important not to conflate these two questions.

Oh, if they don't know how anyone found out then that's another issue.. but if tehy are made aware that you placed this ad daily and stopped after you were ordered to not reveal that you had been subpoenad.. your intent is very clear cut as far as a judge is concerned.

But you never 'cancel' a canary unless you foolishly set up an automated one: you update it or you don't. Someone telling me to 'not communicate' by actively lying (by updating the canary) is at least getting creative at language. Maybe that will be the outcome, I don't know. All kinds of crazy things are the law.

You're missing the point though. The judge won't tell you not to lie. He'll tell you not to communicate a fact to people. If you already had a system to communicate that fact to people in a novel way, and you use it to do so, you have violated the judges order. It doesn't matter that you notified them by silence or whatever.

maybe, maybe not point is, it is a very effective idea for civil disobedience

It's effectiveness is not proven one way or another, as it has not been implemented by many people, or tested in a court of law. At best, it's a novel hack.

sure, wasn't saying it was.. and you just committed the same indiscretion. a hack is only a hack if it does something.

let's say it is a potentially very effective idea for CIVIL DISOBEDIENCE..

emphasis due to you kind of missing the point - arguing about the legality of such a thing is pure misdirection imho

Reply on news.ycombinator.com