Warrant canary

Library warrant canary relying on active removal designed by Jessamyn West

A warrant canary is a method by which a communications service provider aims to inform its users that the provider has not been served with a secret government subpoena. Secret subpoenas, including those covered under 18 U.S.C. §2709(c) of the USA Patriot Act, provide criminal penalties for disclosing the existence of the warrant to any third party, including the service provider's users.[1][2] A warrant canary may be posted by the provider to inform users of dates that they have not been served a secret subpoena. If the canary has not been updated in the time period specified by the host, users are to assume that the host has been served with such a subpoena. The intention is to allow the provider to warn users of the existence of a subpoena passively, without disclosing to others that the government has sought or obtained access to information or records under a secret subpoena. Warrant canaries have been found to be legal by the United States Justice Department, so long as they are passive in their notifications.[3][4][5]

United States secret subpoenas or national security letters originated in the 1986 Electronic Communications Privacy Act to be used only against those suspected of being agents of a foreign power.[6] This was revised in 2001 under the Patriot Act so that secret subpoenas can be used against anyone who may have information deemed relevant to counter-intelligence or terrorism investigations.[6] The idea of using negative pronouncements to thwart the nondisclosure requirements of court orders and served secret warrants was first proposed by Steven Schear on the cypherpunks mailing list,[7] mainly to uncover targeted individuals at ISPs. It was suggested for use by public libraries in 2002 in response to the USA Patriot Act.[8][9]

Australia outlawed the use of a certain kind of warrant canary in March 2015, making it illegal for a journalist to "disclose information about the existence or non-existence" of a warrant issued under new mandatory data retention laws.[10] It is unlikely a journalist could give a correct canary in this situation anyway, as under this legislation the agency obtaining the warrant is not compelled to inform the journalist of the warrant.[11]

Usage

The first commercial use of a warrant canary was by the US cloud storage provider rsync.net which began publishing their canary in 2006.[12] In addition to a digital signature, they provide a recent news headline as proof that the warrant canary was recently posted[13] as well as mirroring the posting internationally.[14]

On November 5, 2013, Apple became the most prominent company to publicly state that it had never received an order for user data under Section 215 of the Patriot Act.[15][16] On September 18, 2014, GigaOm reported that the warrant canary statement did not appear anymore in the next two Apple Transparency Reports, covering July–December 2013 and January–June 2014.[17] Tumblr also included a warrant canary in the transparency report that it issued on February 3, 2014.[18] The online cloud service Spider Oak implemented an encrypted warrant canary that publishes an "All Clear!" message every 6 months. Three PGP signatures from geographically distributed signers must sign each message — so if a government agency forced SpiderOak to update the page, they would need to enlist the help of all three signers.[19]

Previously, mobile security company Lookout had stated that it had not received any national security letters and had "not been required by a FISA court to keep any secrets that are not in this transparency report."[20]

In July 2014, US security researcher Moxie Marlinspike stated that "every lawyer we've spoken to has confirmed that [a warrant canary] would not work" for the TextSecure server.[21] In September 2014, Marlinspike added to this by stating that "[i]f it's illegal to advertise that you've received a court order of some kind, it's illegal to intentionally and knowingly take any action that has the effect of advertising the receipt of that order. A judge can't force you to do anything, but every lawyer I've spoken to has indicated that having a "canary" you remove or choose not to update would likely have the same legal consequences as simply posting something that explicitly says you've received something."[21]

Canarywatch was founded to provide a compiled list of all companies providing warrant canaries. Its mission is to provide prompt updates of any changes in a canary's state. It is often difficult for users to ascertain a canary's validity on their own and thus Canarywatch provides a simple display of all active canaries and any blocks of time that they were not active.[22][23]

In March 2015, after Australia outlawed warrant canaries, computer security and privacy specialist Bruce Schneier wrote in a blog post that "[p]ersonally, I have never believed [warrant canaries] would work. It relies on the fact that a prohibition against speaking doesn't prevent someone from not speaking. But courts generally aren't impressed by this sort of thing, and I can easily imagine a secret warrant that includes a prohibition against triggering the warrant canary. And for all I know, there are right now secret legal proceedings on this very issue."[24]

Companies and organizations with warrant canaries

The following is a list of companies and organizations with warrant canaries:

Companies and organizations who no longer have warrant canaries

The following is a list of companies and organizations whose warrant canaries no longer appear in transparency reports:

See also

References

  1. ↑ Nadine Strossen (2005), "Safety and freedom: Common concerns for conservatives, libertarians, and civil libertarians" (PDF), Harvard Journal of Law and Public Policy 29 (73), pp. 78–79, retrieved January 3, 2014
  2. ↑ Eunice Moscoso (August 17, 2003), "Subpoenas Fly In Hunt For Hidden Terrorists", Palm Beach Post, p. 1A
  3. ↑ Roberts, Jeff John (Feb 9, 2015). "Site will show if the U.S. has killed a “warrant canary”". GIGAOM. Retrieved March 5, 2015.
  4. ↑ Roberts, Jeff John (Oct 10, 2014). "Are “warrant canaries” legal? Twitter wants to save tech’s warning signal of government spying". GIGAOM. Retrieved March 5, 2015.
  5. ↑ Gillmore, Dan. "Google Can’t Tell You When the Government Wants Your Data. Here’s a Sneaky Solution.". Slate. Retrieved March 5, 2015.
  6. 1 2 Shaun Waterman (September 30, 2004), "Ashcroft: U.S. will appeal terror-law ruling", United Press International, retrieved January 3, 2014
  7. ↑ "Re: ISP Utility To Cypherpunks? Yahoo! Groups". Tech.groups.yahoo.com. October 31, 2002. Retrieved 2013-06-13.
  8. ↑ West, Jessamyn (2002). "Five Technically Legal Signs for Your Library". Librarian.net : avoiding the PATRIOT Act since 2001. Archived from the original on 2002-12-18. Retrieved 2013-11-14.
  9. ↑ Doctorow, Cory (September 9, 2013). "How to foil NSA sabotage: use a dead man's switch - Technology". The Guardian (UK). Retrieved 2013-11-14.
  10. ↑ Doctorow, Cory. "Australia outlaws warrant canaries". Boing Boing. Retrieved March 26, 2015.
  11. ↑ Hurst, Daniel. "Australia's new 'improved' data retention laws: how will they work?". Guardian Australia. Retrieved March 30, 2015.
  12. ↑ "An ISP that protects your data from the NSA". Reddit - May 26, 2006. Retrieved January 5, 2016.
  13. ↑ "rsync.net Warrant Canary". rsync.net. Retrieved June 12, 2013.
  14. ↑ Kozubik, John (August 6, 2010). "The Warrant Canary in 2010 and Beyond". Blog.kozubik.com. Retrieved 2013-06-13.
  15. ↑ Farivar, Cyrus (5 November 2013). "Apple takes strong privacy stance in new report, publishes rare "warrant canary"". ArsTechnica.com. Retrieved 5 November 2013.
  16. ↑ "Report on Government Access Requests" (PDF). Apple.com. November 5, 2013. Retrieved 2013-11-15.
  17. ↑ Roberts, Jeff John (2014-09-18). "Apple’s "warrant canary" disappears, suggesting new Patriot Act demands". Gigaom. Retrieved 2014-09-18.
  18. ↑ Collier, Kevin (4 February 2014). "The NSA could not care less about your Tumblr blog". The Daily Dot. Retrieved 13 February 2014.
  19. ↑ Kumparak, Greg (August 14, 2014). "SpiderOak Implements A Warrant Canary". TechCrunch. Retrieved 2014-09-28.
  20. ↑ "Transparency @ Lookout". Lookout.com. Retrieved 2013-11-05.
  21. 1 2 jondo (23 July 2014). "Provide a "warrant canary" for the TextSecure server". GitHub. Retrieved 21 June 2015.
  22. ↑ "Canary Watch: Activists create website to track & reveal NSA, FBI info requests". Russian Times. 6 February 2015. Retrieved 5 March 2015.
  23. ↑ "Canary Watch tracks government requests for your information online". Gizmag. 4 February 2015. Retrieved 5 March 2015.
  24. ↑ Schneier, Bruce (31 March 2015). "Australia Outlaws Warrant Canaries". Schneier on Security. Retrieved 21 June 2015.
  25. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 "Canary List". Canarywatch. Retrieved 21 June 2015.
  26. ↑ "AWildDuck Privacy Statement (Warrant Canary)". awildduck.com. Retrieved 17 November 2015.
  27. ↑ "CRYPSA Warrant Canary". crypsa.org. Retrieved 17 November 2015.
  28. 1 2 3 "VPN providers with extra layers of privacy - No Affiliates". privacytools.io. Retrieved 21 June 2015.
  29. ↑ "Transparency Report & Warrant Canary". GhostMail. 1 July 2015. Retrieved 28 August 2015.
  30. ↑ "Transparency report.". Invmail. n.d. Retrieved 19 October 2015.
  31. ↑ "Transparency Report". Peerio. n.d. Retrieved 25 November 2015.
  32. ↑ "Purism Warrant Canary". Purism. Purism. Retrieved 31 December 2015.
  33. ↑ Matthias (1 July 2015). "Transparency Report & Warrant Canary for the Secure Email Service Tutanota". Tutanota. Retrieved 22 August 2015.
  34. ↑ "Apple's "Warrant Canary" Has Died". Slashdot. 18 September 2014. Retrieved 16 September 2015.

External links

Look up warrant canary in Wiktionary, the free dictionary.
This article is issued from Wikipedia - version of the Wednesday, January 06, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.