There is also the possibility that we take your money for cloud storage and run away to Costa Rica without providing anything to you.

Or our ZFS filesystems are actually raid-5 ext2 volumes and we fake the snapshots.

Or one of the locations is just running in my basement.

There are all kinds of ways for a service provider to act in bad faith. In many ways, the warrant canary is an attempt to signal what kind of people we are and the manner in which we act in good faith.

Except all those are examples of acting in bad faith. The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure.

The only bad faith might be using warrant canaries knowing that they may still be able to be compelled legally to comply.

"The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure."

I personally (which is the only viewpoint that matters here) would consider falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith.

YMMV.

> falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith.

Except that in the case of the canary, there might be the very real threat of violence or jail time for you or your loved ones.

If it were me, I can see a world where I would do things I think are morally negative if it keeps me and my loves ones alive and out of jail, and I think many other people are the same.

> might be the very real threat of violence or jail time for you or your loved ones

I mean, hypothetically there could be. But in the real world, in some countries, you can be fairly sure that the rule of law will be followed.

Just take a look at this:

https://en.wikipedia.org/wiki/Unethical_human_experimentatio...

And these are just the ones we know about, and the page only pertains to experimentation.

You have to give some consideration to what "legal" even means when you're dealing with a government.

The last instance on that page occurred in the early 1970s. I never claimed the past was free of bad events. I said, prospectively, that a person could be relatively sure the rule of law would be followed on the subject of warrant canaries, in some countries.

> But in the real world, in some countries, you can be fairly sure that the rule of law will be followed

I think it's fairly clear we're talking about the US, and in this case everything is a secret. We have no idea what will happen, or if anything has happened in the past.

Obviously I can't prove the nonexistence of secret proceedings where people have been made to lie to the public. This is ever the domain of conspiracy theorists, because you can never really prove that no such thing has happened, to say nothing of proving it won't. Proving non-existence in general is a nearly impossible problem in the real world. But I think it's unlikely. People can feel free to let their irrational fears dominate their behavior if they want.

Wow, so you are saying you will go to jail if given the choice between that and not updating your warrant canary? Brava, but talk is cheap.

Of course they could compel you to keep it, the CIA has overthrown countries, performed psychological experiments on unwilling US citizens, they've sold crack and smuggled arms against Congress's wishes, the list goes on. There is nothing stopping a part of the US government from compelling a company to keep a warrant canary.

But that doesn't mean canaries are useless, they're just not protective if the US government has deemed it important enough to force it.

Love what you folks do. Keep up the hard work!

The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!"

The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not.

If you put a gag order on me and suggest trying me for contempt of court if I say anything and I think the value of me talking is greater than that of my freedom, I will speak up. If I can get around the gag order by using a warrant canary to implicitly say what I'm not allowed to say without being tried for being in contempt of court, then that's what I will do. Until the laws are rewritten to prevent the use of warrant canaries, there's nothing the courts can do about this. It's a valid loophole.

There's little point in killing my family if everything I know is already out there in the wind. I can't do any more harm than has already been done. All you have is retribution. Our agencies often take a pretty dim view of retribution. Chances are, I'd just end up with a contempt of court charge and be thrown in jail, potentially indefinitely. But realistically, the damage is done. Once again, you can't unring a bell.

There's little they can legally do to pursue my family, there would be political uproar. So beyond charging me, I imagine they'd be relatively safe.

I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function.

I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request when there actually might have been.

Maybe you don't actively do anything. It is the absence of action.

You don't REMOVE a warrant canary. You DO NOT update it.

As of date X we have not been forced to do BAD THING.

I simply stop updating X on the notice.

In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING.

I didn't take any action to disclose anything. I simply stopped updating something.

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished!

Judges do not think like that though.

Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But since some of the dll's were also used in other parts of the OS, this version of Windows could not run. But they had complied with the ruling!

Microsoft thought it was very unfair when they were ruled in contempt of court.

Does this mean that if you were screaming from the rooftops "I'VE DONE NOTHING WRONG" every day leading up to the gag order and then you stop screaming from the rooftops that you'll be in contempt of court?

Can the court compel you to continue with behaviour to cover something up?

Would that be akin to conspiracy to commit fraud or wire fraud if electronic? Wouldn't that make the court and thus the judge complicit in conspiracy to commit wire fraud?

I have a feeling a judge is not about to risk being disbarred for such behaviour.

Of course, I'm not a lawyer and this is purely conjecture on my part.

It doesn't matter if "screaming from the rooftops" seems to you _logically_ the same as a warrant canary. The courts tend to care about the _practical_ effect too. If the practical effect is to violate the gag order (because people were actually paying attention to you screaming from the rooftops, maybe), then... maybe? We aren't sure.

And dude, judges don't get disbarred even when they do CRAZY stuff. A judge getting disbarred (or even dis-judged) is _exceedingly_ rare.

A judge is _definitely_ not going to get disbarred for making a ruling _you_ think is irrational, but isn't actually inconsistent with any established case law, because it's not estabished yet.

Not even going to get _reprimanded_, let alone disbarred.

The U.S. just doesn't work how you think it works.

Has anyone been held in contempt of court for failing to update a warrant canary. I don't believe so. So it seems to be working?

Another poster pointed out that courts generally do not uphold orders to compel speech when that speech is untruthful. So a court order to untruthfully update a warrant canary will not likely survive a legal challenge.

Has anyone used a warrant canary to succesfully convey the information it's intended to _without_ being held in contempt? Is there a list somewhere?

If the warrant canary is in the company's financial statements, is the judge going to now try to force the company to introduce inaccurate information into their public financial disclosures? The SEC might take a dim view of that.

The company can take the 'can neither confirm nor deny' posture, and simply remove the warrant canary from public financial statements. Or leave the most recent accurate and dated one unchanged.

The judge can punish the company severely for breaking the law.

I’m guessing this depends on the judge? I was in traffic court and one of the lawyers argued that the statute did not explicitly say what his client did was illegal.

I don’t recall what it was, but he read the statute and explained the technicality and the judge agreed with him.

Part of the job of lawyers is to know the judges they interact with and what sorts of claims they'll take seriously and which ones they'll overrule. That has very little to do with the kind of immutable logic outsiders tend to try to read into the law.

Often, the law does treat action and inaction very differently. Eg: it’s illegal to poison your ailing grandparent, but legal to let them die by removing the feeding tube (because you are just “not feeding them anymore”).

Intent and spirit of the law matter more than the difference between action and inaction.

The law doesn’t care if you say “let’s put him out of his misery” before pulling out the feeding tube, even though it demonstrates a clear intent to kill.

Be careful and speak with a layer first.

In my country (Slovenia), you would still be found in breach of the court order.

If court orders you not to reveal a certain item, and then you go and reveal it[1], at least here details of how you revealed it do not matter.

If you set up things in a way that you have to lie in order to comply with court order, that's your problem and not courts. Court will not compel you to lie. It will punish you for breaking a court order.

And that fact that you did it in advance in anticipation of such order, would only make matters worse for yourself. (willful disregard, or however it's translated)

[1]: Setting up a canary and then not updating it, is revealing it. Just because you went through convoluted means to do so, its the results that courts care about.

It’s like a dead-man switch. You can also set it so every few hours, you have to enter in a password to keep it up.

If you are held for questioning, most likely you won’t have access to a device to update it.

> I didn't take any action to disclose anything. I simply stopped updating something.

This might work if judges are fucking idiots.

This would conspiracy to commit wire fraud with a maximum sentence of 20 years and a $250,000 fine.

They surely can't compel you to break the law, even to cover up a gag order?

Of course, I'm not a lawyer and this is just conjecture on my part.

See my post immediately above about if the warrant canary is in the company's public financial statements.

OK, what if you provided total read-only access, to everything on all of your machines, networks, communications and so on, to someone like me. Someone who you could trust 100%. And whose reputation depended on that. Someone who was totally anonymous (which I'm not, but I could have another persona that was). And someone with such deep backdoors into your stuff that they couldn't be evicted.

And so it's that person who maintains the warrant canary.

Or instead, it could be an ~undocumented feature of your outside counsel. Because you do have the right to outside counsel, I think, even regarding NSLs.

Edit: For example http://www.cryptohippie.net/AnonAdmin.html

You don't know if it's a "valid loophole" until it's tested in court. You could later find yourself under prosecution, and possibly eventually in jail and/or with a business-destroying fine. If you are willing to risk that, because you think "the value of talking is greater than that of your freedom" -- I think that's actually quite honorable and respectful!

You could of course violate the terms of a sealed warrant or other enforced-confidential court order without a warrant canary too, although of course that goes from "we're not sure if I can get away with it", to "this is definitely going to be a really big legal battle, that _maybe_ I can come out of, if there's enough political uproar."

Using a warrant canary _might_ end up being just as much legal jeopardy, we're just not sure.

Retribution could serve a useful purpose to those in power: a warning to others who are considering doing what you've done.

Well, of course anyone can point a gun at your newborn baby. But a government agency have to comply with the law, and the law makes certain requirements on officers of companies. The details are complicated, but simplifying, if a company is publicly traded and someone whose title starts with V or C says something in public, then it has to be true.

Three-letter government agencies can't both comply with the law and at the same time force you to break the law.

Didn’t Snowden reveal that government agencies routinely break the law?

Indeed he did. He didn't reveal that they routinely compel random CxOs to do so, though.

... and break the law themselves.

Speaking from an engineering perspective, this is part of the reason I've never been comfortable with warrant canary or "extra-warrant" compromise canary.

Let's say you run some kind of service for which you offer privacy/security assurances, but, at some point, you're compelled in some extra-warrant way to violate those assurances. Or you're simply compelled by warrant, while also being compelled not to implicitly signal that by canary. Or you discover a compromise, previously without your knowledge, and are compelled not to disclose it.

I could easily imagine that many of the same official powers (public or secret), or de facto powers, that would enable the compelling wouldn't see the legal arguments of some lawyers as showstopper barriers to keeping the canary intact. If you think that kind of scenario is plausible, then touting a canary is arguably doing a disservice, from the start.

At least half of engineering is honesty and specification, so the introduction of a canary, in an environment in which you can't be sure you can comply with it, and perhaps can't disclose when you realize you definitely can't comply-- doesn't seem like good engineering.

If we're not sure we can honor canaries, then perhaps it's better not to do canaries at all -- and perhaps to instead specify our assurances better, including broad exceptions we anticipate we can't cover. Maybe lawyers and C-suite ultimately determine it makes sense to qualify the assurances with language like, "conceivably could be compelled by [particular government where company is based]" and "conceivably compelled not to disclose".

Personally, some of the hypotheticals are way outside my expertise (and stomach), and I'd rather focus only on engineering good solutions. But canary-type situations and assurances sometimes involve engineering, and sometimes we can foresee potential future problems that we should discuss with the appropriate people in our organization, before it becomes a problem. Then, hopefully we work with people who use all the information, from engineering and other sources, to do the best thing.

(BTW, I'm in the US, and I think, for example, that a practice of warrants is a very good thing, in principle, and I have some trust in the mechanisms and checks&balances of our system. I appreciate that different countries and people have different situations and perspectives, and that things are very complicated and imperfect, even in my own country.)

The government can issue a gag order on a specific subject. This prevents you from disclosing the existence of a subpoena. However, the opposite is not true. The government cannot compel speech.

Sure, the government can take illegal actions...

However, they cannot force someone to make an untrue statement.

Maybe they can't force you but you might still be found in contempt of court and jailed or fined large amounts of money.

Either option, force or contempt of court, isn't that well explored in the domain of cyber security yet, especially because the lack of updates on the warrant canaries are supposed to communicate something and the lack of updates would therefore also constitute communicating the presence of a warrant to outside parties.

Law isn't like logic puzzles.

The idea (and reality) is that government entities in democracy tend to follow the law.

Trying to invent schemes to defend against the breakdown of the rule of law is sort of like buying insurance against the world ending.