We split it for each location - SanDiego/Denver/Zurich/HongKong. Further, the individual location canaries can be retrieved from the actual storage array itself - that is, you can just fetch it via sftp/scp/rsync/whatever from (whatever system your account is on).

Finally, our canary is machine readable/parseable and nicely formatted. So much so that the maintainer of "Canary Watch" has told me that he wishes all warrant canaries followed our original format.

Oh By[3] will have a similar canary soon, modeled exactly after the rsync.net warrant canary.

[1] https://www.rsync.net/resources/notices/canary.txt

[2] http://blog.kozubik.com/john_kozubik/2010/08/the-warrant-can...

[3] https://0x.co

I just don't see a court or a judge upholding a "cute" or "technical" workaround for something like this. Haven't there been rulings in the past where these aren't valid, ie just like the article above once you do get NSL's etc you must take them down or be at risk of non compilance?

The entire basis of the warrant canary is that it's not simply asking me to stop doing something, but rather, a judge would have to order me to make false public statements. That's a tough thing to imagine - certainly on any continued basis.

Even in that situation, how will they force a swiss national to update the swiss location ? There's no jurisdiction there.

I don't see it as a technical workaround at all - it is completely non-technical. Can the government compel my speech ? Can the government compel me to make false statements ?

These are interesting questions, but I'm not at all sure the answer is not 'yes' to both of them, under the right circumstances.

The Fifth Amendment would not seem to imply (there's no criminal proceeding, and not necessarily any risk of self-incrimination) and the First Amendment, while applicable, would not necessarily prevent such a thing, in my estimation, if the circumstances were (in the government's estimation) sufficiently dire.

Alternatively, in some cases the USG could simply seize the domain name and/or server and serve up any content they wanted. See, e.g., Playpen. http://arstechnica.com/tech-policy/2016/01/after-fbi-briefly... Though presumably they could not do this if the site or service operator were not also implicated in some form of illegal activity.

That may be true, but it would remove any moral ambiguity for me and make it easy for me to stick to my principle. If a judge orders me to make a false public statement, I'll disobey, and accept the consequences. No further justification is needed.

What sufficiently dire circumstance can there be where a government would have the right to compel speech?

I think the 13th amendment would come into play here as well.

http://law2.umkc.edu/faculty/projects/ftrials/conlaw/compell...

"national security"

In what scenario would the government need to compel you to make false statements?

The law is already that if you receive a NSL, then you are not allowed to divulge that you've received one. If you do, then you may be prosecuted for breaking the law.

In the scenario involving warrant canaries, the only difference between just outright saying you've received an NSL vs removing the canary is the reliance on some 'technical workaround' where the removal of information is not considered speech and/or doesn't divulge the information.

The judge is not going to tell you that you have to lie to keep the information up. But they may tell you that if you break the law, by divulging (through whatever means) that you have received an NSL, that you will receive the appropriate punishment.

Yes, that's the point: If someone tells you not to provide the information needed to draw those conclusions, there may be consequences for providing that information.

It's pretty well established that they're legally allowed to prevent me from telling people that I am in a certain state. It's not a stretch that prearranged signals fall under that.

By compelling you to lie? When and where was that "pretty well established"?

As far as I'm aware, this hasn't been tested in court. However, given that courts have been pretty silent on the idea of secret laws and compulsory silences, if it did get there, I'd be shocked that courts didn't rule this way.

Maybe that's what happened here. That would be highly dismaying.

  That's a great way to end up in prison. 

easy there, cowboy, this isn't East Germany just yet. I think American authorities can tell the difference between what they do and the Stasi.

As in, I actually, literally think they can tell the difference. Nobody will be ending up in prison for posting the above. Seriously. Show me a judge who'll do that.

You don't get a 4-year philosophy degree before getting a JD in American law, and structurally answer to a constitution literally containing the words "Congress shall make no law ...abridging the freedom of speech, or of the press" which is the first amendment, and which has been judged and interpreted very carefully by 9 independent justices upholding Freedom for 220 years, while sending people to prison for publishing

" Apr 2016 - "

Not happening. Not in 2016, and not in 2020. People need some perspective here.

EDIT: getting a lot of downvotes. Show me anyone who is in prison for publishing " Apr 2016 - " or any other similar warrant canary. You people need to stop throwing around "a great way to end up in prison" like that.

I'm not defending the status quo, but the suggestion that anybody is going to prison for posting a warrant canary is too much, sorry.

It diminishes the conversation and criticism around the actual status quo.

Getting on the bad side of the feds is pretty brutal.

I welcome any links you have that show otherwise.

Fine. Here is the onus on me to show this:

“Warrant canaries have never been tested in court, but no case law suggests that they are in any way illegal,” says Nate Cardozo of the Electronic Frontier Foundation. “In fact, existing law suggests that if a court were to examine a prohibition on warrant canaries, it would likely conclude that any such prohibition would run afoul of the First Amendment, even in the case of NSL and FISA requests.”

Source: https://gigaom.com/2014/10/10/are-warrant-canaries-legal-twi...

Now the onus is on anyone who disagrees with my referenced link, to show otherwise. Personally, I am fine with following the legal reading and guidance of the Electronic Frontier Foundation, and you should be too.

The Warrant Canary article Wikipedia says, summarizing its three references: "Warrant canaries have been found to be legal by the United States Justice Department, so long as they are passive in their notifications."

Please link to any court cases to the contrary.

1, you keep attempting to make my argument a straw man escalating the emotional impact of the consequences. First it's prison, now it's a bullet in the head. No one is claiming physical violence by the government other than you.

2, It's impossible to provide. Any case that lost would be secret due to national security reasons. You assert that this hasn't happened. Fine, believe what you wish. I assert that we don't know if it has happened or not. Because, again, we'd only know if the defendant "won".

>That's a great way to end up in prison

And I asked them to have a bit of perspective and not go off the deep end. You replied saying "However, a federal court case starts at 1.5 million to defend. Not many people have that in the bank. They can make you miserable for years. This has played a role in at least one person's suicide." I disagree that that is an outcome that will happen from ceasing to publish a warrant canary.

Nobody is going to do that over someone publishing 'Apr 2016 -'. Period.

And no, it's not impossible to provide evidence of this happening. Snowden leaked the secret program of surveilling hundreds of millions of Americans. You think someone couldn't leak a blog post about getting sued in secret court for publishing a 'Apr 2016 -' warrant canary? Really?

Let's have some perspective here.

I get it, you're an absence of evidence is evidence of absence guy. That's fine. We're prohibited from actually going and looking, so i think there's no way to tell one way or the other.

I don't think you can assign zero probability to prosecution for "April 2016 -". The whole weev debacle shows there can be a perfect storm of a bad person using something that's not legally rock solid that establishes case law. Apple can afford 1.5 million. Random startup by an ex drug dealer can't. And thus we get new case law.

Anyway. It has been fun to think about.

edit

I know it's bad form to talk about downvotes. logicallee has good points, i happen to disagree. Don't fall into the trap of downvoting them because you viscerally disagree with their opinion.

Seriously, of all the downvote abuse I've seen on HN, I think this is the worst. It's because of stuff like this that I think downvoting should be abolished. Stuff that breaks the rules should be flagged, and false flaggers should lose the privilege, and everything else should stand or fall on its own merit, according to the reader's judgment.

I miss the old (old) Slashdot meta-moderation system. If someone moderated a comment "Troll" merely because they disagreed with it, a meta-moderator (chosen at random from accounts with good karma) could fix it, anonymously. And if an account abused moderation, they could simply lose the privilege. And, of course, participants in a conversation couldn't moderate (still the case, I think). I still don't understand why Slashdot dumped that system, because it's the best I've ever seen anywhere on the Internet.

Any lawyers in the house?

* Edited slightly for clarity.

https://en.wikipedia.org/wiki/Assistance_of_Counsel_Clause#C...

I wonder if that extends to witnesses not charged with a crime in some way. Or can you be denied counsel of your choice under questioning?!

I do agree that the gag order would extend to any lawyer you contacted after the public bidding process concluded.

There is no clever loophole here, it's a very simple order. The law says "no [recipient] shall disclose to any person that the Federal Bureau of Investigation has sought or obtained access to information or records under this section." https://www.law.cornell.edu/uscode/text/18/2709

Here the definition of "disclose" is "whatever convoluted process you can think of".

Reading further, it does say you can talk to an attorney, but that doesn't mean you can make a Craigslist post asking for lawyers with experience in the Patriot Act.

https://supreme.justia.com/cases/federal/us/352/330/ (1957)

Further, it seems that Miranda only applies to custodial interrogations.

https://supreme.justia.com/cases/federal/us/384/436/ (1966)

I do think that if one is charged or restrained that the process might work. Of course, that's a pretty big escalation!

It seems like you're trying to hack in a domain that can't really be hacked, because it's not even very well defined. The spirit of the law is clear, I can't see any reason a judge would come down on your side of this. Prohibiting a bidding process does not restrict any of your rights.

> Afterwards, Levison wrote that after being contacted by the FBI, he was subpoenaed to appear in federal court, and was forced to appear without legal representation because it was served on such short notice; in addition, as a third party, he had no right to representation, and was not allowed to ask anyone who was not an attorney to help find him one.

https://en.wikipedia.org/wiki/Lavabit

I just don't think it makes sense to look for a loophole here. That's not really how the legal system works, especially in these kinds of national security cases. If you make some conscious decision at some point that ends up informing people of a NSL, that's disclosure. There's no way around it. Setting up a system beforehand probably makes things worse, since you're proving that you fully understand the purpose of your actions and the spirit of the law.

I particularly like the above structure because it separates the hiring of the firm from the disclosure of the NSL to the firm. In fact, you might choose to never actually disclose the NSL to the hired firm! Since the firm doesn't necessarily know the reason they're being engaged, they're not making a disclosure either.

I imagine an organization like the EFF could make it a policy to publicly disclose when they've been hired or terminated by a client.

I find it all very interesting...

I've worked at EFF for a long time and I don't believe EFF could adopt such a policy as a matter of prudence -- or legal ethics. I can tell you that there are many reasons that lawyers will regard the existence of conversations, client intake, consultations, and representation relationships as confidential. In fact, they see that as an important principle of legal ethics.

You can see some discussions of the confidentiality of the fact of legal representation as a matter of legal ethics at

https://www.google.com/#q=legal+ethics+"fact+of+representati...

Many times, EFF has to talk to clients and prospective clients about matters that, for a variety of reasons, it's not EFF's place to make public. Just as a start, it's important that people feel comfortable talking to our lawyers when they have questions about their rights in a particular situation, whether or not we end up going to court for that person, and knowing that the matter won't end up in the press or be revealed to other parties as a result of those conversations. Lawyers can also become subject to protective orders issued by courts specifically instructing them not to reveal information about a case.

Legal matters are sometimes embarrassing. Many people who've been sued, arrested, indicted, investigated, subpoenaed, or who anticipate a possibility that one of those things may happen, aren't necessarily keen to draw any further attention to the situation. Often, people involved in legal issues are quite anxious and distressed about what's happened to them. Sometimes people ask lawyers for help dealing with other people's improper disclosure of personal, private information, and naturally don't want their lawyers to draw more public attention to what's happened.

And people who are considering filing a lawsuit, giving information to a journalist, launching a new product, introducing or changing a corporate policy, or responding in some way to a government request, among other things, may have various acknowledged and alleged duties and responsibilities to other people. Announcing or implying that a particular legal case, issue, or situation exists or that a person is taking legal advice on a certain matter could have significant repercussions. It could lead to claims that someone has breached a duty of confidentiality, or it could damage personal or business relationships.

This isn't an exhaustive list of reasons that lawyers will keep confidential the fact of representation or the fact that a prospective client has sought legal advice (whether or not the lawyer ends up representing that client on an ongoing basis), but hopefully it helps to illustrate that this is something that lawyers take seriously as an ethical matter.

"We, corporation X, hereby declare as a matter of public record that our counsel of choice in any criminal proceeding pertaining to a NSL is the EFF. This notice constitutes prior informed consent to any advertisement featuring us as a client of the EFF should we chose to retain them."

https://groups.yahoo.com/neo/groups/cypherpunks-lne-archive/...

Actually, this is an interesting startup idea - warrant canary as a service, with an API.

There's some point at which a court will decide that you aren't complying, and stepping over that point is bad for your business. Since that point is very fuzzy, it's a dangerous thing to play around with.

It would be fantastic to get more granular, at the account-level. That would be a cool differentiator for these hardcore privacy/security-oriented companies.

Canaries aren't challenged currently partially because they give out so little information that it's really not worth the governments time to go after people. What the NSL gag really aims to prevent is to keep the people targeted by the NSLs from knowing that they're under investigation. If a company started doing canaries that applied down to a single person they'd be sued the first time they stopped sending one after getting a letter.

Also I'm not entirely sure that even if a judge found that an NSL can't compel you to send a zombie canary that it follows that the company can't be fined or sanctioned for breaking the gag order.

Not that it's been tested in (non-secret) court.

At the very least it'd be a massively expensive test case and the companies that have the money to pay for that have too much to lose on a case that isn't solid. It'll come down to the very technical legal question of action vs inaction that would probably wind up in the supreme court.