Rsync.net Warrant Canary (2006)

http://rsync.net/resources/notices/canary.txt

by rsync • 13 years ago

40 50 13 years ago

kefs• 13 years ago

More info: https://en.wikipedia.org/wiki/Warrant_canary

ripperdoc• 13 years ago

Instead of the somewhat fuzzy method of dating via news, couldn't they combine this approach with that recommended by Errata Security to use bitcoin as a public ledger? http://erratasec.blogspot.com/2013/05/bitcoin-is-public-ledg...

interestinecom2• 13 years ago

Not everyone loves or wants any involvement with bitcoin

jlgaddis2• 13 years ago

The same could be said for PGP/GPG but that doesn't mean it couldn't be made useful for purposes like this.

rsync5• 13 years ago

Dating with news can be somewhat fuzzy, which is why we always take our news from the financial press, and attempt to datestamp with "material" information ... that is to say, news with a very high monetary value that the market is racing to receive.

You could (conceivably) make up plausible future stories, but not things like quarterly results, lawsuit outcomes, etc.

jewel• 13 years ago

Another good source of fixed-in-the-past yet unpredictable data is the closing price of a collection of stocks from the previous day. This would make verification easier to automate.

billpg• 13 years ago

I can't remember which show, but I remember watching a TV mystery with a picture of someone reading a newspaper as proof of someone being present on a certain day. Trouble was, the editor of the paper was in on the scam and ensured the headline would appear that day.

recursive• 13 years ago

It seems easier to verify news than a bitcoin transaction. I'd have no idea how to go about doing that.

xradionut3• 13 years ago

I don't see the usefulness. You can sign a lie cryptographically just as well as a fact.

Flenser2• 13 years ago

The government isn't allowed to force you to lie; they can force you to be silent. By updating this regularly it then becomes apparent when you have been forced into silence.

dllthomas5• 13 years ago

"The government isn't allowed to force you to lie"

Is that actually the case?

dspillett• 13 years ago

The government isn't allowed to

Argument lost right there.

As a UK resident my government is not legally permitted to take part in, or knowingly allow to occur on its territory, anything like "extraordinary rendition". "isn't allowed" made no difference in that case (and many other examples can be referenced for other governments including those of America) so we can't really expect it to in this or any other future case either.

benjohnson• 13 years ago

I know that the Government can force you to lie already - If you're American, go look at your milk container.

It will likely say something like "No rBST Artificial Hormones" and next to it it will say "No significant difference has been shown between milk derived from rbST-treated and non-rbST-treated cows."

That label is government mandated, and by law can't even be prefaced with something like "The following is Government mandated" or "We're forced to say."

This is a lie, because other parts of the government (not the FDA) have found material differences in the milk between untreated/treated cows.

AnIrishDuck5• 13 years ago

Can you cite any statutory or legal authority that states this? Because it strikes me as in the same vein as "a police officer has to tell you they're a member of the police"

xradionut3• 13 years ago

They don't have to force you into silence, they can force you thru duress not to be silent. All that is needed is some sort of incentive or leverage. (Keep up the good work citizen or ...)

If the actual system is robust enough to be a "dead-man" switch then you have to plan for "false positives/negatives" and have more than one person involved in the process in case of emergencies. This increases your social attack surface. Two people might be trusted if one is dead and didn't leave any evidence behind.

danielweber3• 13 years ago

If you put a gun to your own head by setting up a situation where you will have to lie to your customers in order to comply with a court order, you aren't likely to get much sympathy.

You can find these specific requirements for secrecy onerous and undemocratic, and I might even agree with you. But these "I'm not really violating the law" posts by non-lawyer geeks are boring. There are all sorts of reasons society can demand you not to make certain communications. If you stop communicating to make the communication, you are still doing the communication in violation of the law.

pchander3• 13 years ago

Why is there a 2006 date in the title?

rsync5• 13 years ago

This document was first published in 2006. We've been operating the warrant canary for just over 7 years now.

pchander3• 13 years ago

Wow, that's impressive. I'm surprised that date is not mentioned on the notice page (or on wikipedia).

mperham• 13 years ago

Feds: "Continue to update the canary or you disclosed the secret warrant and we throw you in prison."

rsync5• 13 years ago

Yes, but note that this is updated not just on our website, but on the storage arrays themselves - some of which are in Zurich and Hong Kong.

So the above scenario is a possibility, but then imagine the followup:

Feds to Zurich Canton: Tell swiss national X to update the warrant canary or ...

We have it spread out geographically for a reason.

takluyver• 13 years ago

If one government were to come knocking, could they order you to lie to other arms of your own business, so that they continue to update the canary because they don't know that a warrant was served?

Perhaps that's impractical, but I'm thinking about what would be needed to 'beat' the warrant canary system.

AnIrishDuck5• 13 years ago

You'll be forced to tell your overseas colleagues that you have received no such warrants, and they should update the canary to reflect that. Unless your architecture is set up so they would somehow immediately become aware of these warrants, there's no way they're even going to know they exist.

Legal "hacks" like this rarely work.

philiphodgen• 13 years ago

You might want to have your legal counsel look at the various reported cases involving asset protection trusts in the Cook Islands. In a situation such as yours I can easily see you cooling your heels in Federal prison on contempt of court charges. Your defense ("I cannot be held in contempt because it is impossible for me to comply" or perhaps "I told them to do it, but you know those silly Swiss, they ignored me") is unlikely to make a District Court judge happy. And I'm talking about REAL judges in REAL courts. I'm not talking about this Star Chamber bullshit that we live with now in the Land of the Free.

But you've probably looked at this and decided it is defensible.

c1c2c3• 13 years ago

How do I check the canary on a storage array?

wojt_eu• 13 years ago

"Attention! Today we have received no secret warrants cough cough

wink wink"

footoverhand• 13 years ago

It's a neat idea, but you'd still need to trust rsync.net. If you start with the assumption that you cannot ever trust them, then you can use them(if needed) as a 3rd party storage site for encrypted files.

zachrose• 13 years ago

As discussed in a previous HN thread, the courts might still see this as a notice that a warrant has been served, despite it being "said through not saying."

Has rsync.net had the opportunity to see these arguments play out?

AnIrishDuck5• 13 years ago

I really doubt this would play out well in court. As said before, judges take a dim view of legal "tricks" like this.

They won't be sympathetic to you putting yourself in a quandary where you're essentially requiring yourself to issue false statements. The order they issue will force you to update the canary, as refusing to would disclose the existence of the warrant.

rsync5• 13 years ago

Yes, but at the very least it elevates the process out of a simple rubber stamp court order. One way or another, we'd get our "day in court", even if you never hear about it, and that's worth something.

We are more optimistic about how such things would play out, but even in that worst case scenario, there's some value in slowing things down and forcing that review.

rsync5• 13 years ago

No, we haven't, and that was the reasoning behind the canary being posted on the individual storage arrays (not just individual foreign locations, but each individual storage array).

As of today, I know of no other firm running a warrant canary, and I don't think any of the librarians[1] were ever challenged with theirs. As with all of this, it is uncharted.

[1] http://en.wikipedia.org/wiki/Warrant_canary

mythz• 13 years ago

I think you should try to come up with a url convention that other sites can adopt similar to /favicon.ico

This is too deep to be followed: /resources/notices/canary.txt

What about something like /warrant-canary.txt ?

ndytjvb• 13 years ago

You could become a lifelogger and have a realtime webcam that shows you reading incoming mail.

Rsync.net Warrant Canary (2006)

Related Stories