Comment by sxp | Hacker News Reader

Comment by sxp | Hacker News Reader

While commenters are mentioning that this particular method has not been tested in court, is there any reason to believe that it wouldn't work? Similar situations have happened before when a group loudly says "no comment" and this is interpreted as a confirmation. E.g. in the case of the leaks last week, Google, Facebook, MS, etc explicitly denied that they were involved in blanket government surveillance, but Verizon only said "no comment"[1] in an internal email about the phone metadata news story. If the government could actually force them to lie, then they would have issued an explicit denial like the other companies.

Outside of spy fiction and conspiracy theories, I haven't seen any evidence that the government can legally force someone to lie (vs just a no comment) in order to cover up an NSL or FISA order.

Is there any evidence that they would able to force a company using a warrant canary to issue a fake one or respond with anything other than "no comment" to direct questions from the media?

http://www.buzzfeed.com/mattlynley/verizons-internal-memo-to...

If you say "No comment" and it leaves open more than 1 possibility then it would be unfair to ascribe any particular positive statement to that.

On the other hand, if you're pre-arranged that you will simply fail to communicate something after a certain event then there is no doubt what statement has been made. A judge will see right through this if it's tried and probably impose contempt of court. If one were to try something like this it would be essential to broaden the scope enough that it couldn't be used to reference a specific gag order.

Agree with the second half of this statement - this idea is too cute by half for the courts. Acts and omissions both have significance under the law, as does the context of acts and omissions. If the warrant canary convention was considered by the court as context for a statement, it is very likely the court would rule that a statement had been made. The only way around this would be to have an evidentiary mechanism by which a company can prove that it has no control over the canary. This gives rise to the old conundrum: it's logically impossible to prove a negative (although you might be able to under various burdens of proof like "balance of probabilities" or some such).

Edit: Ultimately, legality turns on the statutory language of the provision in the Patriot Act that obligates businesses not to disclose (anyone know what it is?). The approach as originally proposed by by Steven Schear (http://tech.groups.yahoo.com/group/cypherpunks-lne-archive/m...) was for the ISP to simply not answer a direct inquiry by a customer about whether or not a warrant has been served. The advantage of this approach is that it is far harder to provide evidence to the effect that not responding to the question in that context is a statement. The disadvantage is that a non-response might not provide certainty to the person who asked the question. Effectively, the more that a clear convention is formed around the "canary mechanism", the higher the risk that a court would hold conduct in association with the convention in breach of the statutory obligation not to disclose.

Wikipedia leads me to the belief that "omission" will "give rise to liability when the law imposes a duty to act". More specifically:

* "the omission is expressly made sufficient by the law defining the offense; or"

* "a duty to perform the omitted act is otherwise imposed by law (for example one must file a tax return)."

I don't know of any such law involving canaries.

Do you have a reference for "it's logically impossible to prove a negative"?

Yep, the logic text book that I learnt it from. Just google "inductive logic prove negative" to check out a few articles on it.

In Intuitionistic Logic, you cannot rely on ad absurdum proofs (no law of excluded middle). However, people usually believe in classical logic where proving that something is false is easy: we just need to prove it is not true.

>A judge will see right through this if it's tried and probably impose contempt of court. If one were to try something like this it would be essential to broaden the scope enough that it couldn't be used to reference a specific gag order.

[citation needed]

Has there been a case where the judge forced a civilian to lie?

Contempt for communicating a message (by whatever means) is not the same as forcing to lie.

Does it make any difference that at the time the communication was committed to, the gag order was not in effect?

Given that the whole point of the commitment to the communication was to evade a future gag order, I'm not sure what to tell you. It does sound like immovable object meets irresistable force, but it's a Catch-22 of the "cypherpunk's" own making.

The court can't compel you to lie. The court can compel you to not communicate about a gag order, and enforce that with contempt of court. So if you don't choose to "lie" (since again, we all understand the purpose of the communication is not as a factual statement but rather to signal whether a gag order is received) they can still hold you accountable for it.

What about services providing public API functions like:

getWarrantCurrentStatus(custID) // "No"/"No Comment"/"Yes"

getWarrantLastChangeDateTime(custID)

getWarrantPreviousStatus(custID)

getWarrantHistoricalStatus(custID, DateTime)

getWarrantResponseCurrentCount(custID, responseType) // accepts only "No Comment" or "Yes"

getWarrantResponseHistoricalCount(custID, DateTime, responseType)

// for all the above functions, a custID of 'MagicNumber' is the special customer ID of 'Anyone'.

> is there any reason to believe that it wouldn't work?

Yes. The law generally isn't a binary automaton that can be "tricked" by a bit of clever catch-22 logic.

Your canary is a one-bit communications channel. Removing it or ceasing to update it constitutes flipping the bit. That, obviously, is communication.

not if it decays by default (TOTP). I don't think ISP-s can be mandated to periodically refresh the hash.

That's exactly what I'm saying I think they can. The courts, not being simple machines, care about the substance, not technicalities. You are ordered to not communicate X: If, due to previous arrangements made in bad faith, abstaining from performing a certain activity results in you communicating X, you have communicated X. It's not rocket science.

just package the deal as a general service health status, which may or may not include certain operational events (you'd have to trust the ISP about the canary anyway).

Reply on news.ycombinator.com