AutoCanary: machine-readable, digitally signed warrant canary statements

https://firstlook.org/code/project/autocanary/

by danso • 11 years ago

39 33 11 years ago

SilasX2• 11 years ago

We've been over this before.

If you communicate, by any signal, including the lack of sending a signal, or any prearranged protocol, that you received a warrant when you were ordered not to talk about it, then you are in violation of the order.

No amount of technical trickery changes that; courts are run by humans.

The page includes a note about warrant canaries never having been tested in a court of law, but you shouldn't be hopeful.

nickpsecurity2• 11 years ago

I've been in the fight against corrupt government a long time and I totally agree. Winning in court means convincing a judge you were acting consistently with the law. Tipping people off about law enforcement action usually leads them to rule against you. Stopping stuff at the Patriot Act level means you need to be immune to such laws or have strong leverage on them outside the legal system.

There's no easy win in a police state where government holds most of the cards and can look at yours most of the time. It's why the public must change the laws first. Not holding my breath.

peteretep• 11 years ago

    >  courts are run by humans

Not only that, courts are run by humans who have the ability to imprison you indefinitely if they think you are disrespecting the spirit of their rulings

http://en.wikipedia.org/wiki/Contempt_of_court

MCRed• 11 years ago

Which is a violation of due process itself.

serf• 11 years ago

( in some regions, in certain courts of law, under certain conditions, maybe. )

Thankfully 'global laws' and 'global court' aren't a thing yet.

Let's not lump everyone into a big US/UK legal blackhole, please. The canary concept is valid for more than just a US based legal adversary.

SilasX2• 11 years ago

In no jurisdiction can you circumvent a gag order by working out a special omission or protocol that communicates the gagged information, as that would defeat the purpose of a gag order.

NeutronBoy• 11 years ago

I can't help but feel canary's are missing the 'spirit of the law' (I don't like calling it that, but the phrase fits) of the gag order, and will ultimately not stand up in court.

The gag order says you can't do anything to notify people that you're received one. By having the canary expire, you're alerting them. No questions, end of story.

I get the concept of 'they can't force you to sign a false document because of the First Amendment' line of thinking, but the gag orders themselves don't respect your constitutional rights, why would you expect it's different in regards to canaries?

downandout2• 11 years ago

Whether you would violate the order or not depends on the details. Removing a statement saying that you have not received a warrant/NSL would almost certainly violate the order. Similarly, if you have an automated program that creates the statements and you tell the program to stop producing the statements after receiving the order, that is also likely a violation because you are undertaking an act that was specifically designed to notify people about the order.

However, if you are manually creating the statement, failing to create a new statement is a different thing and most likely would not violate the order. The key difference here is doing nothing vs. acting in a way designed to violate the order.

ceejayoz• 11 years ago

I'd expect a court to treat that sort of attempt at getting around the order via technicality about as well as they treat the Sovereign Citizen folks. I'd also expect NSLs at this point to include language on warrant canaries.

woodman2• 11 years ago

First I'd consider it from the angle of legislator intent, instead of attributing compulsion to an abstract concept (law). The question is then much closer to reality: "Am I behaving in a way that pleases the legislators?" That is a very difficult question to answer, and the solution was to codify the wants of the legislators into laws :) Unsurprisingly the process of translating the desires from the minds of men (and a few women) onto paper does not completely eliminate logical defects that pretty much everybody hosts. So you end up with contradictory laws, our solution was to add another layer of human reasoning onto that - the judicial system. Anyway, playing the game of finding loopholes and ignoring the 'spirit of the law' is the only reasonable course of action. The alternative, restricting your behavior to what you think the legislators would approve of - well, that would be an incredibly terrible existence...

It would be an interesting project to translate our system of laws into Attempto Controlled English [0], while feeding the results into a logical reasoner. I don't think it would be long before you find serious flaws where the logic does not follow.

[0] http://en.wikipedia.org/wiki/Attempto_Controlled_English

mirimir• 11 years ago

There must be an administration team that's anonymous and hidden, both publicly and to each other. Obviously, there must be a setup for sharing and managing trust. The team sees all organizational email, and they handle the warrant canary collectively.

adevine• 11 years ago

Well, here's a somewhat analogous issue where the courts have decided differently. A 10b5-1 plan is set of rules set up by someone, like a company exec, to trade stock even if that person holds inside information at the time of the trade. That is, you could set up a plan that automatically sells 100 shares of stock per month. You can NOT change the rules of the plan while you have inside information.

However, you CAN cancel plan orders even if you have inside info. For example, if you knew great news was coming, you could cancel a sell order. If I understand it, this is because courts have ruled that insider trading laws can only be applied when a trade occurs, not when one doesn't occur. IANAL so someone correct me if I'm wrong.

chii• 11 years ago

that is an interesting line of argument...but i think ultimately, the fight over the application of law isn't one which can be won over by sheer logic. Men in power who wish to manipulate the world for their own agenda will be able to do it, if the common folk don't care or fight back.

djoldman• 11 years ago

In the spirit of what others have said, why not take it a step further? Say: "we have not received 1 request," "we have not received 2 requests" etc etc. Somehow, I think this won't work.

goodside• 11 years ago

Or even: "The first byte of a message we are unable to deliver is not 0x00. The first byte of a message we are unable to deliver is not 0x01. The first byte..."

plorg• 11 years ago

While we're playing games of semantics, we might as well have fun.

"A message we are unable to deliver is NOT 0xa89adf8d9a9c9a96899a9bdf9edfb19e8b9690919e93dfac9a9c8a8d968b86dfb39a8b8b9a8ddf8d9a8e8a9a8c8b969198..."

striking• 11 years ago

NSLs require that you report delayed data (on the order of a year, I think) and report only in broad ranges such as 0-249.

nickpsecurity2• 11 years ago

If country X's laws are the problem, then the owners must not be citizens of X, the servers must not be in X, plaintext must not hit X, the jurisdiction of the organization must not be X, and preferably there's no import/export agreement for commercial activity in X. Knowing this, the companies that are merely changing jurisdictions or server locations shouldn't trick you into a false sense of security.

The only sure-fire way to do things is to (a) not become popular amongst targets in X or (b) don't do business in X whatsoever. I've met a number of chip designers and security engineers that have been doing (b) for a long time. I did that for foreign threats. Even if you practice these, your OPSEC and INFOSEC still must be good enough to stop the attackers they send.

No surprise some governments and companies are just eliminating electronics from security-sensitive areas. I think the Russians even use typewriters now for some things. Not that they don't have their own vulnerabilities. ;)

rdl• 11 years ago

I'm kind of concerned about "mere instrumentality" being said by some prosecutor at some point in the future, here.

getpost2• 11 years ago

I'm curious, has the constitutionality of warrant gag orders ever been tested in court? How does the government's interest in a gag order trump my right of free speech?

getpost2• 11 years ago

This is a sincere question. It's one thing to be involved in a court case and have a gag order in place while a case is in progress. But here, I'm operating my business lawfully, and out of the blue, the government tells me what I can and can not say.

areed• 11 years ago

What if there were a third-party polygraph service to sign the warrant canary statements? It would need to solve the problem of a remote polygraph since it would have to be located in another jurisdiction.

sgift• 11 years ago

First the service would have to serve the problem that polygraphs are not working very well: http://en.wikipedia.org/wiki/Polygraph#National_Academy_of_S...

madez• 11 years ago

What speaks against putting a system in place that makes it impossible to comply with a gag order? Maybe even technically impossible, e.g. backed by a hardware fuse that you'd need to break to comply with a search but by doing so making it impossible for you to sign another canary?

Or, say, you cooperate with someone overseas in a safe country that requires you to visit him every quarter to make the canary together?

DavidSJ• 11 years ago

How many organizations have warrant canaries by now? Of those, how many have let the canary expire, indicating a warrant was issued? If the answer is zero, which is more plausible: 1) that no such warrants have ever been issued, or 2) that they have, and warrant canaries have already failed the test in secret?

icebraining• 11 years ago

It's not zero, see Silent Circle.

GoodIntentions• 11 years ago

Using this might give you a warm feeling inside, but if anything, it has the potential to cause harm by providing confidence in an entity that is being compelled to continue issuing the canary.

"The legal theory behind warrant canaries is based on the concept of compelled speech. The First Amendment protects against this in most circumstances."

These things are pointless if they compel surrender of the key. Does anyone think even for a moment that "constitutional rights" will be considered?

techdragon• 11 years ago

This is illegal in Australia, no bill of rights /constitution to safeguard anything so when the spineless maggots we have as our elected legislature say "warrant canaries are illegal" [1] then we are fucked, it's illegal, and the extremely long fight to convince the next batch of spineless maggots to vote the shit out of existence, begins.

1 - https://www.schneier.com/blog/archives/2015/03/australia_out...

AutoCanary: machine-readable, digitally signed warrant canary statements

Related Stories