The original idea was that on some regular cadence (say weekly), you actively post a (hopefully signed) message somewhere saying "I hereby attest that, as of <insert current date>, we have not received any warrants/subpeonas/etc and are not subject to any gag orders, etc. etc.". (eg, rsync.net's canary: https://www.rsync.net/resources/notices/canary.txt). You have to set it up so that someone has to actually go and do something for the updated canary to go up, so it's like a dead man's switch. If you ever stop posting those, that's the signal to users that something is up.

That approach is extremely robust legally. In the US at least, publicly posting a digitally signed message asserting something presumably important and valuable about your business that's knowingly a lie would be considered false advertising, wire fraud, etc. depending on the exact situation. The government has a lot of power to legally compel you to not do things that would otherwise be legal (eg, uttering the speech "we just got a subpeona for all of your data!"). What they absolutely cannot legally do is compel you to do something illegal. Eg, they can't make you commit wire fraud by actively lying to your customers about the services you provide. That's a very strong legal position and you wouldn't have a hard time getting a lawyer to back you up on it.

Basically, if your "canary" requires you to "take down" something, it's not a proper canary and, yeah, I wouldn't trust it to protect you from much.

Neither of your scenarios seem problematic:

"You then have to find a lawyer who will help you argue to a judge and other officials that you're in the clear with this loophole."

Presumably the same lawyer(s) you've already retained for the purpose of defending the canary (and other things). Defending the canary in court (under US 1A law regime) is the entire point.

Also note that in the de facto standard canary process[1] you don't remove the canary (as that would be a positive, intentional act of speech). You simply stop updating it.

"So you don't remove the canary."

Again, under no scenario do you remove the canary - you simply stop updating it.

[1] "Special note should be taken if these messages ever cease being updated, or are removed from this page."

I imagine that canary questions sometimes come up in non-publicly-disclosed legal proceedings, as well as in the occasional extra-legal practice.

If that actually does happen, and canaries ever failed to stand up in them, then how many lawyers would ever be in a position to hear about those failures, such that the lawyer could competently advise clients how to use canaries successfully?

Would the lawyer have to have been the veteran top litigator who handled the situations that reached the ear of the ACLU, or who previously worked on those situations on behalf of some facet of government?

Or is there sufficiently binding official assurance from government that canaries done a certain way are OK, no matter what happens in some non-public meeting?

(BTW, I really like your company. Though, as much as its canary looked like probably a signal of principled old-school Internet techie values, it also looked like potentially a bit of a magnet for trouble, in business it might attract, and in who it might antagonize. The tech choices there seem be heavy on minimizing risk of IT drama, but the canary seemed to flirt with drama.)

I think you assume that getting in contact with lawyers from the ACLU is much much harder than it is, either that or that the ACLU only gets involved in sufficiently high-profile cases but nonetheless false. If you're a company that deals with sensitive data and have a legitimate worry about getting NSLs you could probably get a meeting with the relevant legal/policy expert just by shooting them a polite email about it.

Experts in a particular niche field not wanting to talk about their passion, impossible challenge. "Wait, woah, you also care about this?! You wanna testify in the committee hearing for the bill our team is working on?"

My question was where would someone go to get counsel about canaries, from someone who knows how this actually works in practice, not only in the legal precedents that are public info. (After all, we are talking about situations involving gags.)

For example, I was guessing maybe there's someone at the ACLU who has heard of enough of the non-public to give good counsel. But asking.

Unstated, I was also wondering whether the folk wisdom that so many people repeat, and which some seem to rely upon, is informed by the expertise of the rare people in a position to know the full reality.

Even if it's true, it does sound like a stereotypical computer person's misunderstanding of how law works: "Aha! But this Constitutional interpretation says that government can't compel speech! Checkmate!" Hence, checking that.

Although... I also don't see much use in them either, it seems everyone ends up complying with something eventually and so all canaries end up getting removed.

IMHO, that's kinda a weaselly trick, no matter how good the cause, and it might not stand up, not legally, nor in extra-legal practice.

vs

Why didn’t you do this thing 2 weeks ago that you were under no legal obligation to do?

Seems like a significant and valid distinction even if what they communicate to the intended audience is largely the same.

“Largely the same” because in the second case it would be possible that forgetting, or some other obstacle to resigning occurred.

And to my knowledge, warrant canaries haven't been tested in U.S. courts, so the zeroth (and possibly most common) scenario would just be that you remove the canary and nothing happens to you, and the canary works as intended.

https://www.eff.org/deeplinks/2014/04/warrant-canary-faq

https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-...