AutoCanary: machine-readable, digitally signed warrant canary statements | Hacker News Reader

AutoCanary: machine-readable, digitally signed warrant canary statements

firstlook.org

39 pointsdanso33 comments

I can't help but feel canary's are missing the 'spirit of the law' (I don't like calling it that, but the phrase fits) of the gag order, and will ultimately not stand up in court.

The gag order says you can't do anything to notify people that you're received one. By having the canary expire, you're alerting them. No questions, end of story.

I get the concept of 'they can't force you to sign a false document because of the First Amendment' line of thinking, but the gag orders themselves don't respect your constitutional rights, why would you expect it's different in regards to canaries?

First I'd consider it from the angle of legislator intent, instead of attributing compulsion to an abstract concept (law). The question is then much closer to reality: "Am I behaving in a way that pleases the legislators?" That is a very difficult question to answer, and the solution was to codify the wants of the legislators into laws :) Unsurprisingly the process of translating the desires from the minds of men (and a few women) onto paper does not completely eliminate logical defects that pretty much everybody hosts. So you end up with contradictory laws, our solution was to add another layer of human reasoning onto that - the judicial system. Anyway, playing the game of finding loopholes and ignoring the 'spirit of the law' is the only reasonable course of action. The alternative, restricting your behavior to what you think the legislators would approve of - well, that would be an incredibly terrible existence...

It would be an interesting project to translate our system of laws into Attempto Controlled English [0], while feeding the results into a logical reasoner. I don't think it would be long before you find serious flaws where the logic does not follow.

[0] http://en.wikipedia.org/wiki/Attempto_Controlled_English

Well, here's a somewhat analogous issue where the courts have decided differently. A 10b5-1 plan is set of rules set up by someone, like a company exec, to trade stock even if that person holds inside information at the time of the trade. That is, you could set up a plan that automatically sells 100 shares of stock per month. You can NOT change the rules of the plan while you have inside information.

However, you CAN cancel plan orders even if you have inside info. For example, if you knew great news was coming, you could cancel a sell order. If I understand it, this is because courts have ruled that insider trading laws can only be applied when a trade occurs, not when one doesn't occur. IANAL so someone correct me if I'm wrong.

that is an interesting line of argument...but i think ultimately, the fight over the application of law isn't one which can be won over by sheer logic. Men in power who wish to manipulate the world for their own agenda will be able to do it, if the common folk don't care or fight back.

Whether you would violate the order or not depends on the details. Removing a statement saying that you have not received a warrant/NSL would almost certainly violate the order. Similarly, if you have an automated program that creates the statements and you tell the program to stop producing the statements after receiving the order, that is also likely a violation because you are undertaking an act that was specifically designed to notify people about the order.

However, if you are manually creating the statement, failing to create a new statement is a different thing and most likely would not violate the order. The key difference here is doing nothing vs. acting in a way designed to violate the order.

I'd expect a court to treat that sort of attempt at getting around the order via technicality about as well as they treat the Sovereign Citizen folks. I'd also expect NSLs at this point to include language on warrant canaries.

It hasn't been tested in court, but the government would have a hard time taking the position that you must continue producing statements that are false and may fraudulently induce others to engage in behaviors they otherwise wouldn't if you hadn't made the statement. I think under the scenario where you were manually producing statements and simply cease making them, you would at least have the strongest likelihood of surviving a challenge by the DOJ.

It might work if you published them in your SEC filings perhaps under risks, eg. The risk of being served a warrant

From what I've seen, the government has generally avoided engaging with folks in the Sovereign Citizen camp. And with that in mind, I agree with you - they'll do the same thing with this. As long as 99% of people comply, why would you risk the loss of power by setting a legal precedent - even if you've got a 99.999% chance of winning a battle in court.

There must be an administration team that's anonymous and hidden, both publicly and to each other. Obviously, there must be a setup for sharing and managing trust. The team sees all organizational email, and they handle the warrant canary collectively.

We've been over this before.

If you communicate, by any signal, including the lack of sending a signal, or any prearranged protocol, that you received a warrant when you were ordered not to talk about it, then you are in violation of the order.

No amount of technical trickery changes that; courts are run by humans.

The page includes a note about warrant canaries never having been tested in a court of law, but you shouldn't be hopeful.

    >  courts are run by humans

Not only that, courts are run by humans who have the ability to imprison you indefinitely if they think you are disrespecting the spirit of their rulings

http://en.wikipedia.org/wiki/Contempt_of_court

Which is a violation of due process itself.

I've been in the fight against corrupt government a long time and I totally agree. Winning in court means convincing a judge you were acting consistently with the law. Tipping people off about law enforcement action usually leads them to rule against you. Stopping stuff at the Patriot Act level means you need to be immune to such laws or have strong leverage on them outside the legal system.

There's no easy win in a police state where government holds most of the cards and can look at yours most of the time. It's why the public must change the laws first. Not holding my breath.

( in some regions, in certain courts of law, under certain conditions, maybe. )

Thankfully 'global laws' and 'global court' aren't a thing yet.

Let's not lump everyone into a big US/UK legal blackhole, please. The canary concept is valid for more than just a US based legal adversary.

In no jurisdiction can you circumvent a gag order by working out a special omission or protocol that communicates the gagged information, as that would defeat the purpose of a gag order.

In no jurisdiction can you be compelled to lie, either.

Not say something, yes (gag order).

Say something true, yes (or get a contempt of court charge).

Say something false, no.

As of May 2015 anyway.

No gagged information is transmitted when the canary is removed. It just means that a gag order has been received. What for? Can't say. Just that a gag order has been received.

If country X's laws are the problem, then the owners must not be citizens of X, the servers must not be in X, plaintext must not hit X, the jurisdiction of the organization must not be X, and preferably there's no import/export agreement for commercial activity in X. Knowing this, the companies that are merely changing jurisdictions or server locations shouldn't trick you into a false sense of security.

The only sure-fire way to do things is to (a) not become popular amongst targets in X or (b) don't do business in X whatsoever. I've met a number of chip designers and security engineers that have been doing (b) for a long time. I did that for foreign threats. Even if you practice these, your OPSEC and INFOSEC still must be good enough to stop the attackers they send.

No surprise some governments and companies are just eliminating electronics from security-sensitive areas. I think the Russians even use typewriters now for some things. Not that they don't have their own vulnerabilities. ;)

I'm curious, has the constitutionality of warrant gag orders ever been tested in court? How does the government's interest in a gag order trump my right of free speech?

This is a sincere question. It's one thing to be involved in a court case and have a gag order in place while a case is in progress. But here, I'm operating my business lawfully, and out of the blue, the government tells me what I can and can not say.

This is illegal in Australia, no bill of rights /constitution to safeguard anything so when the spineless maggots we have as our elected legislature say "warrant canaries are illegal" [1] then we are fucked, it's illegal, and the extremely long fight to convince the next batch of spineless maggots to vote the shit out of existence, begins.

1 - https://www.schneier.com/blog/archives/2015/03/australia_out...

In the spirit of what others have said, why not take it a step further? Say: "we have not received 1 request," "we have not received 2 requests" etc etc. Somehow, I think this won't work.

Or even: "The first byte of a message we are unable to deliver is not 0x00. The first byte of a message we are unable to deliver is not 0x01. The first byte..."

While we're playing games of semantics, we might as well have fun.

"A message we are unable to deliver is NOT 0xa89adf8d9a9c9a96899a9bdf9edfb19e8b9690919e93dfac9a9c8a8d968b86dfb39a8b8b9a8ddf8d9a8e8a9a8c8b969198..."

NSLs require that you report delayed data (on the order of a year, I think) and report only in broad ranges such as 0-249.

Using this might give you a warm feeling inside, but if anything, it has the potential to cause harm by providing confidence in an entity that is being compelled to continue issuing the canary.

"The legal theory behind warrant canaries is based on the concept of compelled speech. The First Amendment protects against this in most circumstances."

These things are pointless if they compel surrender of the key. Does anyone think even for a moment that "constitutional rights" will be considered?

What speaks against putting a system in place that makes it impossible to comply with a gag order? Maybe even technically impossible, e.g. backed by a hardware fuse that you'd need to break to comply with a search but by doing so making it impossible for you to sign another canary?

Or, say, you cooperate with someone overseas in a safe country that requires you to visit him every quarter to make the canary together?

How many organizations have warrant canaries by now? Of those, how many have let the canary expire, indicating a warrant was issued? If the answer is zero, which is more plausible: 1) that no such warrants have ever been issued, or 2) that they have, and warrant canaries have already failed the test in secret?

It's not zero, see Silent Circle.

What if there were a third-party polygraph service to sign the warrant canary statements? It would need to solve the problem of a remote polygraph since it would have to be located in another jurisdiction.

First the service would have to serve the problem that polygraphs are not working very well: http://en.wikipedia.org/wiki/Polygraph#National_Academy_of_S...

I'm kind of concerned about "mere instrumentality" being said by some prosecutor at some point in the future, here.

Reply on news.ycombinator.com