Slashdot Mirror
Time For a Warrant Canary Metatag?
An anonymous reader writes "With the advent of national security letters and all the NSA issues of late perhaps the web needs to implement a warrant 'warrant canary' metatag. Something like this: <meta name="canary" content="2013-11-17" />. With this it would be possible to build into browsers or browser extensions a means of alerting users when a company has in fact received such a secret warrant. (Similar to the actions taken by Apple recently.)
The advantage the metatag approach would have its that it would not require the user to search out a report by the company in question but would show the information upon loading of the page. Once the canary metatag was not found or when the date of the canary grows older than a given date a warning could be raised. Several others have proposed similar approaches including Conor Friedersdorf in The Atlantic and Cory Doctorow's Dead Man's Switch." What problems do you see with this approach?
They would force you to keep the "all-clear" signal with guns pointed at your head? That might be a problem.
The person adding the metatag rotting in a federal prison?
SJW: Someone who has run out of real oppression, and has to fake it.
do not work.
like, what the flying fucktonmeister fuck? why do you think it would be exempt from the "don't tell the victim of surveillance" rules because it's a metatag?
best you can do is close down the service. that is it! and even then you'll have to fight in court!
world was created 5 seconds before this post as it is.
I'm not really sure what problem this solves, or how the outcome would change if the canary "died."
We're well-aware that many companies are required to produce information via FISA court orders, national security letters, or other means. What we don't know-- in many cases-- is how often, what information is obtained, by whom, and for what purpose. The "canary" doesn't answer any of the unknowns, except that a particular company received at least one such order, which is of extremely limited value (if of any at all).
I've heard similar proposals before, and it seems very murky from a legal standpoint. With a highly automated system like this meta tag, I think most judges wouldn't have a problem deciding that you violated the terms of a secret warrant by not updating it. The proposal I heard was to try to circumvent this by making the "canary" something more complicated -- imagine that, every day that you didn't receive a secret warrant, you went to some location in your city, took a photo, and posted it on your webpage. Could a judge then force you to keep doing so? Or even more extreme -- every day that you don't receive a warrant, you run a 10K. Could a judge force you to keep running? Or keep going to work? Or keep self-mutilating in some way? At what point are a person's basic liberties more important than the secrecy of the warrant?
My guess would be that in any of these instances, no judge would rule that you must keep updating the canary. However, I'd imagine that they might rule that you broke the law by setting up the canary in the first place. Of course, there's an obvious problem with that -- as long as you never get a secret warrant, you clearly couldn't be prosecuted for violating one. So it's a weird situation where an action that is otherwise legal, becomes retroactively illegal upon receiving a secret warrant. It's a bit of a mindfuck.
weinersmith
They would force you to keep the "all-clear" signal with guns pointed at your head?
There's a way to hack around this by exploiting a Civil War-era constitutional amendment. The company announces in advance, through the canary meta element or another : "If we receive one of several requests, $NAME and $NAME and $NAME will leave the company's employment." I don't see how the government can compel a private employer to compel an employee to continue working for the employer without it being deemed "involuntary servitude" in violation of the employees' Thirteenth Amendment right to quit. So if a certain set of employees is suddenly working for a different company, it's more likely than not that the company has received a classified order to violate a customer's privacy.
Same reason the British AA (Automobile Association, not alcoholics) were formed and (later) forced to change their ways.
The whole point of the AA was formed to inform members of police speed traps. Back in the days of red-flags in front of vehicles held by a man. If your were an AA member, and there were no police around, an AA employee would be required to salute you.
If, however, there was a police trap present, they would not. Absence of the salute was seen as just such a canary to warn you despite being a "non-action". Eventually it was ruled illegal and the AA and the RAC both become just "vehicle breakdown" companies
When it comes down to it, if a court / police can argue that they need you NOT to trigger the canary (by inaction or otherwise), they will find a way to make you do it. They already redirect your DNS if they steal your domain, what's to stop them updating the canary themselves apart from a minor technical issue? All it will do is just get your whole domain seized to make you compliant.
ESPECIALLY if the entire point of the canary is to indicate to people whether you are subject to a (potentially LEGAL) court order not to reveal that you're under such an order. Little difference between that and you phoning up your buddy to warn him that you were just busted and the cops have his address - it's seen as deliberate evasion of the law. Even if the message is "I **WON'T** text you at 5pm if I've been raided".
The simple fact, though, is that such warrants are not a problem when they are legal and above-board. The problem is when they are not. Skirting the legal grey area yourself is not the correct response to the agencies skirting the legal grey areas.
If all else fails, they'll just institute a law to stop you doing things like this.
With the advent of national security letters and all the NSA issues of late perhaps the web needs to implement a warrant 'warrant canary' metatag
"The web" doesn't implement anything. You do.
The exposure of a warrant in violation of a court order will land you in jail.
The judge won't give a damn about how cleverly you went about it --- until you come up for sentencing, of course.
Don't host anything in the USA. Don't use USA-based cloud services. Don't do business with USA companies. At my employer's, the national R & D institute of a smaller European country, we already don't anymore. Business keeps on going as usual. We live as if the USA would not exist. Can we be subject to surveillance, or eavesdropped upon ? Of course. But we are out of the legal hassle. As simple as that.
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
European.
It is dangerous to be right when the government is wrong.
Sigh, gag order compels company to not communicate something. It does not really matter what cute scheme you are going to think up, you are still liable. Actually this idiocy with canary metatag would probably cause harsher penalty as it plainly shows that you planned to violate any gag order you were served.
like, what the flying fucktonmeister fuck? why do you think it would be exempt from the "don't tell the victim of surveillance" rules because it's a metatag?
Because laws are rarely written to cover every variation that could possibly circumvent them.
People regularly take advantage of this until legislation is written to patch the loopholes.
There might be less wiggle room because "national security," but there is undoubtedly room to maneuver.
And as TFA mentioned, the issue of government compelled speech is much thornier than government compelled silence.
I'd love to see the Supreme Court argument on why the government can compel you to continue digitally signing a certificate that says the government is not spying on you (even when they really are).
[Fuck Beta]
o0t!
It's not quite as simple as requiring you to leave the tag in place. The way the tag is supposed to work is that it tells you a date on which they had not recieved such requests, and if the date gets stale then you can reasonably suppose that they have since that time. The secret court would thus have to not just compel you to leave it, but to also continue updating. This is why Apple's approach is so interesting: it's going to precipitate a court case to determine whether they can be coerced into providing materially false information to the SEC.