Apple’s “warrant canary” disappears

https://gigaom.com/2014/09/18/apples-warrant-canary-disappears-suggesting-new-patriot-act-demands/

by panarky • 12 years ago

406 92 12 years ago

gigaom.com

ForHackernews• 12 years ago

Very interesting in light of this: https://news.ycombinator.com/item?id=8333258

jpmattia• 12 years ago

As well as this: https://news.ycombinator.com/item?id=8333595

mpweiher• 12 years ago

OK, so they had the canary. Received the warrant. Removed the canary...and re-engineered iOS 8 so that they are no longer technically able to comply with the warrant?

If true, that's quite heroic.

crazypyro4• 12 years ago

Have any of the other major tech companies had similar canary disappearances? I only ask because this is the first time I've heard of one actually being used by a tech company as a warning flare.

I'd expect a governmental legal challenge...

nl2• 12 years ago

Interesting and somewhat disappointing that it took a year for anyone to notice that it had disappeared. The appearance generated quite a lot of interest.

(Of course, I'm as responsible as anyone else for not noticing. I wonder if it would be possible to build a service to proactively check for their disappearance?)

crazypyro4• 12 years ago

I don't think it took anyone a year to notice it had disappeared. Where did you get that information? The report for the first half of 2013 where the original canary appeared wasn't even released as of a year ago. It was released Nov. 5, 2013.

Furthermore, this document (https://www.apple.com/privacy/docs/upd-nat-sec-and-law-enf-o...) provides credence to the possibility that the NSA requested information from Apple after the Nov. 5, 2013 release as that Jan 27th, 2014 release directly mentions that it replaces the previous notes.

(speculation ahead) This, along with the knowledge that the canary is now removed, implies that the NSA requests were the core difference in the numbers, in my opinion. This would place the time of NSA disclosures to sometime in late 2013-very early 2014, I would imagine.

dangrossman• 12 years ago

He probably thought the report missing the canary was published at the end of 2013 given that's the name of the report and the date in the filename. Understandable mistake.

The metadata in the PDF file says it was actually created on August 27th of this year.

UVB-76• 12 years ago

Gee, thanks for the hat tip...

https://news.ycombinator.com/item?id=8334058

idlewords• 12 years ago

Here, have a cookie: 🍪

gpmcadam• 12 years ago

Hey! I'm in Europe, so really you should have asked for my consent before offering me cookies over the web.

patcon• 12 years ago

Seems independant, but thank you for pointing it out regardless!

https://mobile.twitter.com/jeffjohnroberts/status/5126419288...

MrJagil• 12 years ago

I've asked this before to no avail, but what can the NSA possibly do if Apple refuses?

Fine them? Sure, they have billions.

They can't arrest the company... Is Cook going to jail? What is the actual threat here? You could argue that Apple has more power than many governments.

crazypyro4• 12 years ago

Fine them. Fine them more after fining them. Arrest executives. The powers of contempt of court are rather wide.

wiredfool• 12 years ago

That would make SEC filings a disclosure of surveillance.

duaneb• 12 years ago

The judicial powers of 'contempt of court' are some of the most powerful IN government. I have no doubt they can force Apple.

huhtenberg• 12 years ago

Putting pressure on individuals is the simplest, most logical and very effective option. So, yes, Cook getting charged with insider trading or tax evasion would fit right in.

lukifer• 12 years ago

They can certainly make life difficult for Apple and its executives; see what happened to Phil Nacchio of Qwest when he pushed back against surveillance requests.

http://www.denverpost.com/business/ci_25845407/unrepentant-j...

djur• 12 years ago

Is there any evidence for Nacchio's claims other than his say-so?

vonklaus• 12 years ago

That is the problem. No one knows what they can do. The conpany will certainly have no recourse.

sosborn• 12 years ago

You could argue that Apple has more power than many governments.

You underestimate the power of governments.

firemanx• 12 years ago

They can absolutely fine them, and if Yahoo's experience is any indication, fines for this kind of stuff are beyond what billions will cover:

http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/15...

How can you hope to defeat stuff like this in court if you can't survive the fines building up while you're waiting to see the process through?

SEJeff4• 12 years ago

As the nuclear option, the USG could simply force them to stop doing business in the US. That would effectively put them out of business and would never happen.

xamolxix2• 12 years ago

I am sure that people in other countries buy Apple products.

AnimalMuppet3• 12 years ago

I know of at least one instance where executives of a medical device company tried to ignore the FDA, and said executives got marched out the door in handcuffs. If the FDA can do that, I'm pretty sure the NSA can...

aetherson• 12 years ago

It turns out you can fine people arbitrary amounts of money. There is no amount of money that Apple can have that the government can't think of a bigger number than.

rtkwe2• 12 years ago

The can request any fine amount they want. The Yahoo fine schedule would have been billions within a couple months iirc because it included a doubling clause every few weeks that the order wasn't complied with.

tkinom• 12 years ago

I wonder what happen if Russian, China, India, Japan, EU all demanding same level of access to Apple's data.

Apple might not care about Iran or other smaller countries, but how is it going to deal with big market like China, India, EU?

Argorak• 12 years ago

"The EU" will probably never demand access to Apple's data. The EU usually passes legislation that has to be adapted by all member states (where, usually, the EU decision is the minimum that the states have to implement, some do even implement more).

Still, all those requests will be by member states and involve different demands.

So, probably, even in the EU, they will say "FU!" to some and not to others.

chiph• 12 years ago

Under what conditions would the warrant canary statement reappear? I'm thinking of those workplace safety signs: "This corporation has operated for [ 179 ] days without a Section 215 warrant being served"

higherpurpose• 12 years ago

Relevant story: http://www.wired.com/2014/09/apple-iphone-security/

panarky3• 12 years ago

Possible explanations:

1) It wasn't a canary to begin with, so its removal means nothing.

2) There's no legal precedent for disclosing a Section 215 order by killing the canary, so Apple removed it before they received a Section 215 order. That way it doesn't disclose anything and Apple avoids legal liability.

3) Apple really did receive a Section 215 order.

AnimalMuppet3• 12 years ago

About 2):

Killing the canary does actually reveal the order, which violates at least the spirit of Section 215. Under the wrong circumstances, that could get you jail time.

On the other hand, making materially false statements after Sarbanes-Oxley can also get you jail time.

So yes, Apple could have realized that they had painted themselves into a corner that they really didn't want to be in. Having said all that, though, my money's still on 3).

admax88q• 12 years ago

Killing the canary does actually reveal the order, which violates at least the spirit of Section 215.

Of course there's question as to whether the spirit of Section 215 is constitutional. It may be reasonable for the government to force you no to say something.

But can the government force you to knowingly make a false statement?

mirhagk• 12 years ago

I'm not familiar with US law to really say much, but under Canadian law it'd be illegal for a company to keep the canary if they received a section 215, and I presume it'd be the same in the US. I wonder if this would overwrite that law, and provide them with the ability to lie in their transparency report.

derefr• 12 years ago

Is there any case where something else would take precedence in case of conflict with a Section 215 order? Lying under oath when being sworn into an office of state, perhaps?

johnhess• 12 years ago

Could a lawyer or someone with familiarity with warrants like these explain how a "warrant canary" is legal?

I understand the concept, but discloses something you can't disclose. They can compel you to lie/not comment if asked, "Hey, Apple, did you get any of those National Security Letters".

Is there a clear cut loophole or is this something yet to be challenged?

panarky3• 12 years ago

The EFF has a good FAQ on the legal considerations for warrant canaries.

While there's plenty of precedent for gag orders, there's not much case law for compelled false speech.

https://www.eff.org/deeplinks/2014/04/warrant-canary-faq

kllrnohj2• 12 years ago

I understand the concept, but discloses something you can't disclose.

Until they have been served a warrant, they are not under a non-disclosure warrant. That's how the canary is legal.

hey can compel you to lie/not comment if asked

No, no they cannot. They can prevent you from commenting, they can NOT compel you to lie.

Lying and not commenting are very, VERY different.

zephjc• 12 years ago

Ah, the old "lie of omission" gambit.

gohrt• 12 years ago

Lying and not commenting are very, VERY different.

The Federal Government disgrees with you. Just one example:

https://www.google.com/webhp?#q=least%20untruthful%20manner%...

TheLoneWolfling• 12 years ago

In general, it is far easier to (legally) force a company to not announce something than to force them to announce a lie.

So no, it is not perfect. But it is better than nothing.

bambax• 12 years ago

IANAL (and not an American citizen to begin with!) but most laws are formal, that's how they're compatible with "freedom". For a law to forbid you to do something, it has to describe what actions are exactly forbidden, in a fairly precise language.

A legal system can't let law enforcement officials decide after the fact what's permitted and what isn't (that's the theory anyway; your actual experience may vary widely).

So if a law forbids you to tell something, but doesn't explicitly forbid you to not tell another thing, the non-telling of which could potentially reveal the thing that's supposed to stay secret, then you can claim that you technically obeyed the letter of the law, if not its spirit.

kwhite• 12 years ago

Is there any reason why a company could not apply the same concept of a warrant canary on a user-by-user basis?

Imagine seeing a message every time you log into your Gmail account informing you that Google has never been compelled to surrender your private data to a law enforcement agency.

panarky3• 12 years ago

Why stop with users? Every email, web search, Lyft ride, Dropbox file, Facebook post and Grindr encounter could get its own canary: "This message has never been disclosed to law enforcement".

And as @chiph says, the canary doesn't really have to die after a secret warrant is served, it just needs to sing a different song: "Your data has not been disclosed to law enforcement for [ 179 ] days".

https://news.ycombinator.com/item?id=8336323

qq662• 12 years ago

Courts and legislatures don't look too kindly upon flagrant violations of the spirit of the law. They view it as an end-run around their power. Although it happens slowly, loopholes do get shut (cf. Aereo).

A startup that's trying to get some notoriety in a few months or even years can definitely do something like this. Apple, who has to plan on a longer time horizon and who probably enlists the soft power of the government on a regular basis, has to be more cautious.

rtkwe2• 12 years ago

Applying that to the individual user level is probably too specific to slip past gag orders like this more general language is.

lifeformed• 12 years ago

Then you download a 3rd party plugin that hides the message, and displays a big warning if it's missing.

res0nat0r• 12 years ago

Mainly because the .0000001% if apple users who actually care about this vs. the amount of work to implement isnt worth it business wise.

rdl• 12 years ago

Steve Schear's original proposal for the warrant canary was per-user, and you'd actually pay to maintain/check it.

https://en.wikipedia.org/wiki/Warrant_canary

(it's somewhere in cypherpunks.venona.com but I don't know exactly which message. it's circa 1992)

eli• 12 years ago

I suspect that's exactly the argument the government will make when a warrant canary case eventually makes its way to court. That taken to its logical conclusion it renders all gag orders ineffective.

The EFF has a nice FAQ on warrant canaries: https://www.eff.org/deeplinks/2014/04/warrant-canary-faq But the short version is nobody really knows if you could be forced to post one or not.

gizmo686• 12 years ago

The issue I see is what options the court has to break your canary. The general arguement for a canary is that: A) the government cannot infringe on your freedom of speach without cause (so it is legal prior to the request), and B) the government cannot force you to lie (so it is legal to remove the cannary after the request). However, with a per user cannary, once the request has been made, the court might be able to order you to remove the canary from all users to protect the legitamite government interest of maintaing secrecy about who is being targeted.

maresca• 12 years ago

Perhaps this is the reason for all of the security updates in iOS 8.

rrggrr• 12 years ago

As explained by Apple:

In the first six months of 2014, we received 250 or fewer of these requests. Though we would like to be more specific, by law this is the most precise information we are currently allowed to disclose.

http://www.apple.com/privacy/government-information-requests...

staunch• 12 years ago

Apple should just declare that they have been subject to Section 215. Given how many users Apple has it can't reasonably be argued that such a disclosure would be a danger to national security.

Hopefully they would end up before SCOTUS and help defang the USA PATRIOT Act.

nnnnni• 12 years ago

Well, Apple does basically have enough money to buy the entire US Government...

tlrobinson• 12 years ago

What's your definition of "the US government"? Does it include the hundreds of trillions of dollars worth of oil, minerals, land, etc?

stevewepay• 12 years ago

So now what? Now that the canary has disappeared, is there no other information that can be transmitted to us? It feels like it's a binary signal that just got set permanently, so there's no more information we can glean from it.

Apple’s “warrant canary” disappears

Related Stories