> "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations."
That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by authorities taking over private keys and doing it themselves? Canaries appear to be pretty much untested in court.
It is believed to be unlikely that a court would compel a company's false speech to maintain a warrant canary.
> Have courts upheld compelled speech?
> Rarely. In a few instances, the courts have upheld compelled speech in the commercial context, where the government shows that the compelled statements convey important truthful information to consumers. For example, warnings on cigarette packs are a form of compelled commercial speech that have sometimes been upheld, and sometimes struck down, depending on whether the government shows there is a rational basis for the warning.
> Have courts upheld compelled false speech?
> No, and the cases on compelled speech have tended to rely on truth as a minimum requirement. For example, Planned Parenthood challenged a requirement that physicians tell patients seeking abortions of an increased risk of suicidal ideation. The court found that Planned Parenthood did not meet its burden of showing that the disclosure was untruthful, misleading, or not relevant to the patient’s decision to have an abortion.
Which is why even the EFF doesn't recommend dropping the canary immediately but instead going to court to seek vindication of the right to drop the canary before so doing.
The evidence shows (IMHO) it is likely the government has enough power to obtain your keys by force, issue a gag order, and take actions against your users before the case works its way through an appeal process. The only question is if you'll be willingly participating in the activity or if it'll happen while you're in lockup.
"Pete Ashdown, CEO of XMission, an internet service provider in Utah, knows. He received a Foreign Intelligence Service Act (FISA) warrant in 2010 mandating he let the feds monitor one of his customers, through his facility. He also received a broad gag order."
https://www.buzzfeednews.com/article/justinesharrock/what-is...
"My company, Lavabit ... [snipped, see URL for this background info paragraph]
But that wasn't enough. The federal agents then claimed that their court order required me to surrender my company's private encryption keys, and I balked. What they said they needed were customer passwords – which were sent securely – so that they could access the plain-text versions of messages from customers using my company's encrypted storage feature. (The government would later claim they only made this demand because of my "noncompliance".)"
https://www.theguardian.com/commentisfree/2014/may/20/why-di...
Are there any lawyers that could comment on this?
No, it would not, among other reasons because that is not the purpose.
Conspiracy - In criminal law, a conspiracy is an agreement between two or more persons to commit a crime at some time in the future. E.g. the court (judge) and the seller.
Fraud - wrongful or criminal deception intended to result in financial or personal gain... for example making untruthful claims for the purpose of continuing to sell a product under false pretenses.
Mail and Wire Fraud - Fraud by facilitated through the mail system or via electronic means.
Can you elaborate as to how a compelled untruthful (electronic) declaration for the purpose of continuing to obtain sales of your product is NOT (wire) fraud?
Not trying to be an ass, I'd just like to understand.
I'm saying—and I said this expressly in the post you responded to—that that isn't the purpose, which is the strongest reason it isn't criminal fraud.
Your initial purpose in the warrant canary was sales, sure, but the government wasn't involved in that and it wasn't (presumably) false.
The government order isn't for the purpose of sales.
Your compliance with that order is quite likely not for that purpose, either; it's to avoid the consequences of non-compliance (which is why it's compelled and not voluntary.)
So now that your warrant canary is false, you are making an untruthful statement supporting sales generation for your company, which is what makes it fraudulent; and in my mind at least, because you've been compelled to do so, that's conspiracy to commit fraud.
I guess they could argue that you weren't compelled to continue operating. You could have shuttered your business. So in that sense, I suppose if they made that argument, the fraud would be on your head and they'd get off on that technicality.
Law is a system that, to a certain degree, depends on reasonable people employing commonly accepted rules of logic and teleology. It is not a programming language that can be “tricked” by superficial attempts at “being clever”.
You made a true statement with the purpose of generating sales, and later a false statement with a different purpose. The fact that the two statements have the same content doesn't make the intent of one transfer to the other, or the falsity of one transfer to the other.
The required mental state for a crime must connect to the required act, not just a generally similar act at a different time.
(Of course, the government compelling your action by force means it cannot be prosecuted as a crime of yours, because when the government induces a crime you would not otherwise have committed by threats, that's called “entrapment”.)
> and in my mind at least, because you've been compelled to do so, that's conspiracy to commit fraud.
No, aside from the fact that you don't have a false statement made with the required purpose to start with, the fact that you are compelled by the government doesn't make a conspiracy.
> I guess they could argue that you weren't compelled to continue operating. You could have shuttered your business. So in that sense, I suppose if they made that argument, the fraud would be on your head and they'd get off on that technicality.
No, they’d get off because their power to issue and enforce non-disclosure directives with NSLs, etc., is an express power granted in law.
Or our ZFS filesystems are actually raid-5 ext2 volumes and we fake the snapshots.
Or one of the locations is just running in my basement.
There are all kinds of ways for a service provider to act in bad faith. In many ways, the warrant canary is an attempt to signal what kind of people we are and the manner in which we act in good faith.
The only bad faith might be using warrant canaries knowing that they may still be able to be compelled legally to comply.
I personally (which is the only viewpoint that matters here) would consider falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith.
YMMV.
Except that in the case of the canary, there might be the very real threat of violence or jail time for you or your loved ones.
If it were me, I can see a world where I would do things I think are morally negative if it keeps me and my loves ones alive and out of jail, and I think many other people are the same.
I mean, hypothetically there could be. But in the real world, in some countries, you can be fairly sure that the rule of law will be followed.
https://en.wikipedia.org/wiki/Unethical_human_experimentatio...
And these are just the ones we know about, and the page only pertains to experimentation.
You have to give some consideration to what "legal" even means when you're dealing with a government.
I think it's fairly clear we're talking about the US, and in this case everything is a secret. We have no idea what will happen, or if anything has happened in the past.
But that doesn't mean canaries are useless, they're just not protective if the US government has deemed it important enough to force it.
The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not.
If you put a gag order on me and suggest trying me for contempt of court if I say anything and I think the value of me talking is greater than that of my freedom, I will speak up. If I can get around the gag order by using a warrant canary to implicitly say what I'm not allowed to say without being tried for being in contempt of court, then that's what I will do. Until the laws are rewritten to prevent the use of warrant canaries, there's nothing the courts can do about this. It's a valid loophole.
There's little point in killing my family if everything I know is already out there in the wind. I can't do any more harm than has already been done. All you have is retribution. Our agencies often take a pretty dim view of retribution. Chances are, I'd just end up with a contempt of court charge and be thrown in jail, potentially indefinitely. But realistically, the damage is done. Once again, you can't unring a bell.
There's little they can legally do to pursue my family, there would be political uproar. So beyond charging me, I imagine they'd be relatively safe.
I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request when there actually might have been.
You don't REMOVE a warrant canary. You DO NOT update it.
As of date X we have not been forced to do BAD THING.
I simply stop updating X on the notice.
In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING.
I didn't take any action to disclose anything. I simply stopped updating something.
Judges do not think like that though.
Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But since some of the dll's were also used in other parts of the OS, this version of Windows could not run. But they had complied with the ruling!
Microsoft thought it was very unfair when they were ruled in contempt of court.
Can the court compel you to continue with behaviour to cover something up?
Would that be akin to conspiracy to commit fraud or wire fraud if electronic? Wouldn't that make the court and thus the judge complicit in conspiracy to commit wire fraud?
I have a feeling a judge is not about to risk being disbarred for such behaviour.
Of course, I'm not a lawyer and this is purely conjecture on my part.
And dude, judges don't get disbarred even when they do CRAZY stuff. A judge getting disbarred (or even dis-judged) is _exceedingly_ rare.
A judge is _definitely_ not going to get disbarred for making a ruling _you_ think is irrational, but isn't actually inconsistent with any established case law, because it's not estabished yet.
Not even going to get _reprimanded_, let alone disbarred.
The U.S. just doesn't work how you think it works.
Another poster pointed out that courts generally do not uphold orders to compel speech when that speech is untruthful. So a court order to untruthfully update a warrant canary will not likely survive a legal challenge.
The company can take the 'can neither confirm nor deny' posture, and simply remove the warrant canary from public financial statements. Or leave the most recent accurate and dated one unchanged.
I don’t recall what it was, but he read the statute and explained the technicality and the judge agreed with him.
In my country (Slovenia), you would still be found in breach of the court order.
If court orders you not to reveal a certain item, and then you go and reveal it[1], at least here details of how you revealed it do not matter.
If you set up things in a way that you have to lie in order to comply with court order, that's your problem and not courts. Court will not compel you to lie. It will punish you for breaking a court order.
And that fact that you did it in advance in anticipation of such order, would only make matters worse for yourself. (willful disregard, or however it's translated)
[1]: Setting up a canary and then not updating it, is revealing it. Just because you went through convoluted means to do so, its the results that courts care about.
If you are held for questioning, most likely you won’t have access to a device to update it.
This might work if judges are fucking idiots.
They surely can't compel you to break the law, even to cover up a gag order?
Of course, I'm not a lawyer and this is just conjecture on my part.
And so it's that person who maintains the warrant canary.
Or instead, it could be an ~undocumented feature of your outside counsel. Because you do have the right to outside counsel, I think, even regarding NSLs.
Edit: For example http://www.cryptohippie.net/AnonAdmin.html
You could of course violate the terms of a sealed warrant or other enforced-confidential court order without a warrant canary too, although of course that goes from "we're not sure if I can get away with it", to "this is definitely going to be a really big legal battle, that _maybe_ I can come out of, if there's enough political uproar."
Using a warrant canary _might_ end up being just as much legal jeopardy, we're just not sure.
Three-letter government agencies can't both comply with the law and at the same time force you to break the law.
Let's say you run some kind of service for which you offer privacy/security assurances, but, at some point, you're compelled in some extra-warrant way to violate those assurances. Or you're simply compelled by warrant, while also being compelled not to implicitly signal that by canary. Or you discover a compromise, previously without your knowledge, and are compelled not to disclose it.
I could easily imagine that many of the same official powers (public or secret), or de facto powers, that would enable the compelling wouldn't see the legal arguments of some lawyers as showstopper barriers to keeping the canary intact. If you think that kind of scenario is plausible, then touting a canary is arguably doing a disservice, from the start.
At least half of engineering is honesty and specification, so the introduction of a canary, in an environment in which you can't be sure you can comply with it, and perhaps can't disclose when you realize you definitely can't comply-- doesn't seem like good engineering.
If we're not sure we can honor canaries, then perhaps it's better not to do canaries at all -- and perhaps to instead specify our assurances better, including broad exceptions we anticipate we can't cover. Maybe lawyers and C-suite ultimately determine it makes sense to qualify the assurances with language like, "conceivably could be compelled by [particular government where company is based]" and "conceivably compelled not to disclose".
Personally, some of the hypotheticals are way outside my expertise (and stomach), and I'd rather focus only on engineering good solutions. But canary-type situations and assurances sometimes involve engineering, and sometimes we can foresee potential future problems that we should discuss with the appropriate people in our organization, before it becomes a problem. Then, hopefully we work with people who use all the information, from engineering and other sources, to do the best thing.
(BTW, I'm in the US, and I think, for example, that a practice of warrants is a very good thing, in principle, and I have some trust in the mechanisms and checks&balances of our system. I appreciate that different countries and people have different situations and perspectives, and that things are very complicated and imperfect, even in my own country.)
Sure, the government can take illegal actions...
However, they cannot force someone to make an untrue statement.
Either option, force or contempt of court, isn't that well explored in the domain of cyber security yet, especially because the lack of updates on the warrant canaries are supposed to communicate something and the lack of updates would therefore also constitute communicating the presence of a warrant to outside parties.
Law isn't like logic puzzles.
Trying to invent schemes to defend against the breakdown of the rule of law is sort of like buying insurance against the world ending.
https://www.rsync.net/resources/notices/canary.txt
"The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[1]
[1] https://en.wikipedia.org/wiki/Warrant_canary