Slashdot Mirror
Site Launches To Track Warrant Canaries
Trailrunner7 writes: In the years since Edward Snowden began putting much of the NSA's business in the street, including its reliance on the secret FISA court and National security Letters, warrant canaries have emerged as a key method for ISPs, telecoms, and other technology providers to let the public know whether they have received any secret orders. But keeping track of the various canaries scattered around the Web is difficult, so a group of legal and civil liberties organizations have come together to launch a new site to monitor the known warrant canaries.
The Canary Watch site is the work of the EFF, the Berkman Center for Internet and Society, and NYU's Technology Law and Policy Center and it works on a simple concept. The site maintains a list of all of the known warrant canaries and periodically checks each organization's site to see whether the canary is still there and then lists any changes to the status. Right now, Canary Watch lists 11 organizations, including Lookout, Pinterest, Reddit, and Tumblr.
"Canarywatch lists the warrant canaries we know about, tracks changes or disappearances of those canaries, and allows users to submit canaries not listed on the site. For people with interest in a particular canary, the site will show any changes we know about," Nadia Kayyali of the EFF said in a blog post.
The Canary Watch site is the work of the EFF, the Berkman Center for Internet and Society, and NYU's Technology Law and Policy Center and it works on a simple concept. The site maintains a list of all of the known warrant canaries and periodically checks each organization's site to see whether the canary is still there and then lists any changes to the status. Right now, Canary Watch lists 11 organizations, including Lookout, Pinterest, Reddit, and Tumblr.
"Canarywatch lists the warrant canaries we know about, tracks changes or disappearances of those canaries, and allows users to submit canaries not listed on the site. For people with interest in a particular canary, the site will show any changes we know about," Nadia Kayyali of the EFF said in a blog post.
What do people do when these canaries die? Are people expected to stop using these services when the canary dies? Is it an early warning to people who may have been the subject of a secret warrant? Is this supposed to get the masses angry/raise awareness to hopefully bring change?
I'm not trying to make an argument here, I'm legitimately confused as to the practical use of this tool outside an academic/theoretical scenario. What is the goal here?
It's been a year and a half.
How can I believe you when you tell me what I don't want to hear?
Don't forget Abe Vigoda!
Comment removed based on user account deletion
Say someone who receives a national security letter finds it posted completely anonymously to the internet. What can happen?
Only the State obtains its revenue by coercion. - Murray Rothbard
The warrant means they cannot communicate that they have been served.
So by not communicating that they have not been served, they have communicated that they have been served.
Surely this goes against what the warrant and lands them in some hot water.
Why does this method as in TFS allow them to bypass the warrant?
The proposed use of "canaries" will serve as a mechanism to tip terrorists that the government has compelled communications companies for their communications. This will result in terrorists moving to other services that the govenment won't be able to obtain. As a result the public will be at greater risk and EFF will have given aid to the enemy.
Tweet! Tweet!
The agencies that issue NSLs are the same agencies tracking everything that goes on via the internet. The list of suspects in such a case is short. Federal prison is not fun.
actually this begs an interesting serious ?: does anyone have any idea how these things are actually served? does the target get to keep a copy (hard or soft)? I have a hard time believing the various "constitution is kittle litter" agencies would be willing even to risk them leaking. I know someone (sibling of an in-law) who was the target of highly questionable, politically convenient federal investigation & neither he nor his lawyer were allowed to have copies of most of the "evidence" against him. they were only allowed to see it for limited times in an fbi office under supervision of agents (pretty similar to what senate described in cia/torture investigation).
I wouldn't be the least bit surprised if "due process" in serving these consists of ambushing the target, pulling them into a car/office & giving them 5 min to read/sign it w/o getting a copy, taking notes, etc
I haven't been served any court order. I haven't been ordered to not tell you that. It's pretty clear that I can't currently be in violation of an order that does not exist. Therefore, publishing a canary (prior to any court order) isn't illegal, the reasoning goes.
Suppose later I do receive an NSL or court order. Can the government legitimately force me to lie and publish statements saying I haven't? Is there any law that gives the executive branch the authority to order us to lie? If so, is that law repugnant to the first amendment and therefore void? Those are two open questions, questiond that Twitter and the Obama administration are litigating right now. Twitter says the first amendment gives them the right to say they have not received any NSLs. The Obama administration says they have the right to prevent Twitter from saying that.
So, if they are told they can't indicate they received an NSL, and there is otherwise no proof the NSL was delivered due to lack of evidence aside from whatever the FBI has, then if someone were to leak that they received an NSL (or any other form of acknowledgement to this effect) then this by itself would require some further action by the FBI to arrest, rub out, or otherwise eliminate the person under some other reason to avoid revealing the contents or existence of the NSL?
It seems like being sent to unspeakable places is really the only option (scary, I know) since FPMITA (federal pound me...) would require a reasonably clear case against the person, and therefore require the FBI to cough up whatever reason they can? I know I know, they will just make shit up...but still.
You don't seriously believe that organizations that have broken just about every constitutional guarantee and law give a f*ck about this. This sounds more like an NSA honeypot for "troublemakers", plus a means of spreading disinformation.
In addition, it's also irrelevant; what are you going to do if they get a security letter? And if they don't, how do you know these agencies haven't used a backdoor and simply didn't need this kind of access?
So much for Hope and Change. Obama has been a huge disappointment.
What happens if the warrant canary site's warrant canary dies?
Will someone please think of the poor little birdies?
Posting it just confirms that you received it.
Tear it up and shred it, it is just a letter that has no power.
I consider NSLs to be unconstitutional
There is a quote from H.P. Lovecraft that is relevant here: "Do not call up what you can't put down."
Do nothing until you talk to a lawyer.
Talk to a lawyer whose only loyalty is to his client --- you --- and not the advocate for the EFF.
all very well until the gag warrant is worded to prevent you from removing the statement...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
So... I add a Canary to my site, and when I remove it, you launch an announcement in yours. Aren't we building together a distributed system which violates the explicit compulsory silence associated to the order? I mean, a canary is used because an explicit announcement is forbidden, so this system might constitute an explicit violation of the silence order, without the original user (the one who added the canary) even knowing. Is this correct? Are both parties liable?
Are the sites listed just canaries being monitored or notifications of removed canaries?
A way to give them a headache, is just to quietly not comply. Not post the national security letter, not shout anything from the rooftops, just refuse to do as you're told. They either have to punish you openly, drawing attention to what they were trying to do, or go full criminal and "cause something bad to happen to you" (which has risks of its own for them).
I have argued that once several, actually important people started to do this (e.g. silicon valley tech sector employees, or even execs), the government would quickly find out the headaches weren't worth it, and change policy - either to the better, or at least to more visible aggression. Don't underestimate the power of sand in the machinery.
xkcd is not in the sudoers file. This incident will be reported.
The only purpose of a Democrat President, and the reason to vote Democrat, is to prevent Republican Presidents from appointing Supreme Court Justices. The biggest anti-democracy cases and other anti-Constitutional rulings have typically been split 5/4. The five are the appointees of previous Republican Presidents, the four are two appointees each of Clinton and Obama. Even when "we" won 5/4, it's the four Democrat appointees and a single odd-duck Republican appointee versus the other four Republican appointees.
You need at least one more term to guarantee four Democrat appointees (RBG will retire/die soon), and at least another two terms to swing the majority away from Republican appointees. Then, and only then, can you hope to undo some of the damage that's been done by that Republican-appointed majority.
OTOH, if the Republicans get another President and control the next appointment (RBG's replacement), the court will be 6/3 and under their control for at least 20 years. By then... who knows how much damage they'll have done.
Science is all about firing a drunk pig out of a cannon just to see what happens.
I have argued that once several, actually important people started to do this (e.g. silicon valley tech sector employees, or even execs), the government would quickly find out the headaches weren't worth it,
Well, no. There are people like this in the news for suspicious-seeming suicides all the fucking time, and what's more, they seem to come in clusters. But nobody believes (for good or ill) that these are the results of coverups, even if they damned well look like it. And that raises the question, how would you get the truth? There's a whole apparatus in between it and you. So it seems like there's little sense in fretting about it...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
There could also be a note on every user's account where they are told that there have been no secret legal demands for their data. Then of course this would vanish if there was one.
Then there could even be a next next level canary where you could have a thing in your account profile that would have one canary for every single data seeking organization. Thus only certain ones would disappear. This would certainly scream first amendment among other generally unexplored legal area. But most importantly it would give people the ability they should have had all along which was to challenge any warrant both the companies and the individual. Right now people have been having trouble challenging this stuff in court because they couldn't "Prove" that they were a victim. This might cross that threshold of proof.
Minimally it would allow these massive companies to finally have a toehold in which to bring their legal teams into action and cause serious problems for these bozos who think that they have found an easy backdoor to violating our rights.
What's to stop the govt. issuing an NSL to each, thereby clearing the canaries?
Tear it up and shred it, it is just a letter that has no power.
Right. Enjoy your trip to prison if you truly believe that. The available case law does not support your opinion on this presently. I hope that chances but your assertion that "it is just a letter that has no power" is not presently supported by the facts.
I'm well aware that most large companies just comply, they don't care... I do, I consider NSLs to be unconstitutional, get a judge to issue a warrant and I'll be willing to comply.
I agree with you that they are (or should be) unconstitutional but that does not mean you can ignore them without consequences.
To which I would, very politely reply, "that might be true, I'm not a lawyer and honestly don't know. I'll have to consult with my lawyer and get back to you. Rest assured it is my intention to comply with the law, but I need to know what the law is first and my lawyer is the professional who advises me of that"
To which they would likely respond by putting you in a jail cell until such time as you were able to consult your lawyer and then proceed with the search with or without your help. Probably would charge you with obstruction of justice at a minimum.
On the other hand, I don't hand out business information to anyone who just walks into the door, at least not without a court order.
Laudable but not necessarily possible.
May I say... the whole idea of dealing with anyone from the government, be police or FBI, is to show respect for their position and for the law, I find that goes a long way towards having friendly conversations.
You're presuming the government representative will be friendly in return. They might but there are countless examples of them being anything but friendly.
The logical next step would be a new law, forbidding parties to make *any* statement whatsoever on NSLs, permanently.
And away are the canaries..
Or am i being pessimistic?
Currently the EFF's site is a dumbed-down mobile design that oddly, doesn't include a URL to the company's home page!
Check out https://canarywatch.org/spideroak/
I have no idea what spider oak is, and there's no easy way to get to their site from EFF's page.
If you don't comply with a lawful order, you're taking a pretty big risk. The publicity value of sending somebody who defies an NSL to prison would probably be worth revealing that there was an NSL in the first place.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
It seems more likely that they would "find" drugs or child porn or the like...
Remember the thing they say about loans? If you owe the bank $100 that's your problem. If you owe the bank $100 million, that's the bank's problem. Microsoft, Google, Oracle, they're pretty damn important to the US economy. Also, unrestricted executive power isn't entirely unopposed in government. If
The point of this is also that these orders, even if "lawful", give government a headache about how to enforce compliance. You can't just send Tim Cook to jail without an explanation. If Jeff Dean mysteriously turns up dead in a ditch somewhere, lots of people are going to get cold feet, and start asking themselves whether they want to be part of this anymore. The silicon valley elite have a lot of power to say no, more than they probably admit to themselves. Yes, there are risks, but it's not nearly as bad for them as less powerful people (e.g. Ladar Levison) face.
xkcd is not in the sudoers file. This incident will be reported.