Apple’s “warrant canary” disappears
gigaom.com
gigaom.com
Imagine seeing a message every time you log into your Gmail account informing you that Google has never been compelled to surrender your private data to a law enforcement agency.
And as @chiph says, the canary doesn't really have to die after a secret warrant is served, it just needs to sing a different song: "Your data has not been disclosed to law enforcement for [ 179 ] days".
A startup that's trying to get some notoriety in a few months or even years can definitely do something like this. Apple, who has to plan on a longer time horizon and who probably enlists the soft power of the government on a regular basis, has to be more cautious.
When cars were first introduced, many towns across the UK viewed them as an opportunity to make money by fining the rich by setting obscenely low speed limits (think <20mph) with extraordinarily high fines. In response to this, the AA was formed to warn motorists of speed traps down the road.
This started to cut into profits, so the the government retaliated by charging and convicting an AA guy with "obstruction of justice". AA agents were therefore not allowed to inform motorists of speed traps.
The AA responded by changing their protocol. They would always salute passing motorists unless there was something wrong (aka, unless there was a speed trap). The absence of a salute indicated a speed trap, and the law could not force the AA to salute.
I'm not sure if this was ever challenged in court, but they were able to keep it up for several decades so it was never successfully challenged in court at least.
Edit: The AA could be considered sort of similar to the american AAA ("triple-A"). http://en.wikipedia.org/wiki/The_Automobile_Association http://www.theaa.com/aboutaa/history.html#tabview=tab1
And what kind of free society can force citizens to salute? "The government won't tolerate warrant canaries" makes intuitive sense because we have grown used to the courts throwing out all sensibility whenever there are computers involved, but the idea of the government compelling civilians to salute "in meatspace" seems blatantly beyond the pale.
I can hire a team of lawyers and finance people to set up a complex system of subsidiaries so that my company only realizes profit in a specific way in a specific jurisdiction to avoid taxes, and as long as we've all followed the letter of the law, there doesn't seem to be any problem with the 'spirit of the law'. In fact, entire companies of accountants, lawyers and business consultants exist solely to help other companies follow the letter of the law while avoiding the spirit of it.
What makes it so that laws regarding anything "tech" get to be written and interpreted so vaguely and widely (from warrant canaries to copyright issues etc) when rules for everything from finance to oil spills are narrowly defined and interpreted?
Luckily, in the US at least, it's possible for a few nerds to build a company (say, Dropbox) that's as financially valuable as some long-established government schmoozers but has never thought about regulatory issues. So the "young" tech companies like Microsoft, Apple, Google, Facebook, etc. are less capable lobbyists on average.
https://en.wikipedia.org/wiki/Warrant_canary
(it's somewhere in cypherpunks.venona.com but I don't know exactly which message. it's circa 1992)
The EFF has a nice FAQ on warrant canaries: https://www.eff.org/deeplinks/2014/04/warrant-canary-faq But the short version is nobody really knows if you could be forced to post one or not.
1) It wasn't a canary to begin with, so its removal means nothing.
2) There's no legal precedent for disclosing a Section 215 order by killing the canary, so Apple removed it before they received a Section 215 order. That way it doesn't disclose anything and Apple avoids legal liability.
3) Apple really did receive a Section 215 order.
Killing the canary does actually reveal the order, which violates at least the spirit of Section 215. Under the wrong circumstances, that could get you jail time.
On the other hand, making materially false statements after Sarbanes-Oxley can also get you jail time.
So yes, Apple could have realized that they had painted themselves into a corner that they really didn't want to be in. Having said all that, though, my money's still on 3).
Of course there's question as to whether the spirit of Section 215 is constitutional. It may be reasonable for the government to force you no to say something.
But can the government force you to knowingly make a false statement?
I'm inclined to doubt that they can. But they can keep you locked up for a decade while the case makes its' way to the Supreme Court.
There are no checks against their power-- no court, no congressional group, and no group of people is willing to regulate the "watchmen".
This is the default state of affairs, and it only changes when there is strong public outrage and pressure for the government to do their damn job of watching over the watchmen. Which is seriously screwed up.
No, but they can punish you for telling the truth. The fact that you'll be punished for lying does not negate the punishment for telling the truth, just as the fact that you'll be punished for telling the truth does not give you an excuse to lie.
So yes, if you are in a circumstance where pleading the 5th is allowed, then you may plead the 5th and therefore not comment. But in the case of a corporation, or in the case of circumstances where you may not plead the 5th, then you cannot escape punishment by asserting that you are in a catch-22.
The page that states this is http://lawcomic.net/guide/?p=2600, though the next couple of pages are relevant as well.
In the first six months of 2014, we received 250 or fewer of these requests. Though we would like to be more specific, by law this is the most precise information we are currently allowed to disclose.
http://www.apple.com/privacy/government-information-requests...
(Of course, I'm as responsible as anyone else for not noticing. I wonder if it would be possible to build a service to proactively check for their disappearance?)
Furthermore, this document (https://www.apple.com/privacy/docs/upd-nat-sec-and-law-enf-o...) provides credence to the possibility that the NSA requested information from Apple after the Nov. 5, 2013 release as that Jan 27th, 2014 release directly mentions that it replaces the previous notes.
(speculation ahead) This, along with the knowledge that the canary is now removed, implies that the NSA requests were the core difference in the numbers, in my opinion. This would place the time of NSA disclosures to sometime in late 2013-very early 2014, I would imagine.
The metadata in the PDF file says it was actually created on August 27th of this year.
Edit: ugh, hate when people edit after I already responded... It would literally be impossible for this canary missing to be over a year old. The news of the canary's existence didn't even break over a year ago (from my research).... I don't understand why this point is even debatable.
https://mobile.twitter.com/jeffjohnroberts/status/5126419288...
If true, that's quite heroic.
http://blog.cryptographyengineering.com/2012/04/icloud-who-h...
If you are referring to actually remotely retrieving information from a device: they could still fulfil request by pushing the targeted user a signed application update with a trojan.
As someone said in one of the other Apple PR topics: it's as much a political problem as a technical problem. Since Apple, Google, and Microsoft are able to push any update to devices, they can always be forced to put backdoors on devices.
I understand the concept, but discloses something you can't disclose. They can compel you to lie/not comment if asked, "Hey, Apple, did you get any of those National Security Letters".
Is there a clear cut loophole or is this something yet to be challenged?
While there's plenty of precedent for gag orders, there's not much case law for compelled false speech.
Until they have been served a warrant, they are not under a non-disclosure warrant. That's how the canary is legal.
> hey can compel you to lie/not comment if asked
No, no they cannot. They can prevent you from commenting, they can NOT compel you to lie.
Lying and not commenting are very, VERY different.
The Federal Government disgrees with you. Just one example:
https://www.google.com/webhp?#q=least%20untruthful%20manner%...
It has nothing to do with being compelled to lie by a court order. It has nothing to do with the Judicial system at all. It has nothing to do with lying vs. not commenting.
So no, it is not perfect. But it is better than nothing.
A legal system can't let law enforcement officials decide after the fact what's permitted and what isn't (that's the theory anyway; your actual experience may vary widely).
So if a law forbids you to tell something, but doesn't explicitly forbid you to not tell another thing, the non-telling of which could potentially reveal the thing that's supposed to stay secret, then you can claim that you technically obeyed the letter of the law, if not its spirit.
Apple might not care about Iran or other smaller countries, but how is it going to deal with big market like China, India, EU?
Still, all those requests will be by member states and involve different demands.
So, probably, even in the EU, they will say "FU!" to some and not to others.
I'd expect a governmental legal challenge...
Hopefully they would end up before SCOTUS and help defang the USA PATRIOT Act.
Fine them? Sure, they have billions.
They can't arrest the company... Is Cook going to jail? What is the actual threat here? You could argue that Apple has more power than many governments.
http://www.denverpost.com/business/ci_25845407/unrepentant-j...
You underestimate the power of governments.
http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/15...
How can you hope to defeat stuff like this in court if you can't survive the fines building up while you're waiting to see the process through?
I would still guess that they would try to move to another country rather than shutting down. I admit that it would be hard if not impossible.