Slashdot Mirror
Cloudflare Expands Its Government Warrant Canaries (techcrunch.com)
An anonymous reader quotes a report from TechCrunch: When the government comes for your data, tech companies can't always tell you. But thanks to a legal loophole, companies can say if they haven't had a visit yet. These so-called "warrant canaries" -- named for the poor canary down the mine that dies when there's gas that humans can't detect -- are a key transparency tool that predominantly privacy-focused companies use to keep their customers aware of the goings-on behind the scenes. Where companies have abandoned their canaries or caved to legal pressure, Cloudflare is bucking the trend. The networking and content delivery network giant said in a blog post this week that it's expanding the transparency reports to include more canaries.
To date, the company: has never turned over their SSL keys or customers' SSL keys to anyone; has never installed any law enforcement software or equipment anywhere on their network; has never terminated a customer or taken down content due to political pressure; and has never provided any law enforcement organization a feed of customers' content transiting their network. Now Cloudflare's warrant canaries will include: Cloudflare has never modified customer content at the request of law enforcement or another third party; Cloudflare has never modified the intended destination of DNS responses at the request of law enforcement or another third party; and Cloudflare has never weakened, compromised, or subverted any of its encryption at the request of law enforcement or another third party. It has also expanded and replaced its first canary to confirm that the company "has never turned over our encryption or authentication keys or our customers' encryption or authentication keys to anyone." Cloudflare said that if it were ever asked to do any of the above, the company would "exhaust all legal remedies" to protect customer data, and remove the statements from its site. According to Cloudflare's latest transparency report out this week, the company responded to just seven subpoenas of the 19 requests, affecting 12 accounts and 309 domains. Cloudflare also responded to 44 court orders of the 55 requests, affecting 134 accounts and 19,265 domains. They received between 0-249 national security requests for the duration, but didn't process any wiretap or foreign government requests for the duration.
To date, the company: has never turned over their SSL keys or customers' SSL keys to anyone; has never installed any law enforcement software or equipment anywhere on their network; has never terminated a customer or taken down content due to political pressure; and has never provided any law enforcement organization a feed of customers' content transiting their network. Now Cloudflare's warrant canaries will include: Cloudflare has never modified customer content at the request of law enforcement or another third party; Cloudflare has never modified the intended destination of DNS responses at the request of law enforcement or another third party; and Cloudflare has never weakened, compromised, or subverted any of its encryption at the request of law enforcement or another third party. It has also expanded and replaced its first canary to confirm that the company "has never turned over our encryption or authentication keys or our customers' encryption or authentication keys to anyone." Cloudflare said that if it were ever asked to do any of the above, the company would "exhaust all legal remedies" to protect customer data, and remove the statements from its site. According to Cloudflare's latest transparency report out this week, the company responded to just seven subpoenas of the 19 requests, affecting 12 accounts and 309 domains. Cloudflare also responded to 44 court orders of the 55 requests, affecting 134 accounts and 19,265 domains. They received between 0-249 national security requests for the duration, but didn't process any wiretap or foreign government requests for the duration.
to be honest and truthful, and I place about as much trust in them as any of the big data players out there. That is, not much.
I suspect their canaries are more about marketing themselves as a company with strong morals than true morality.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Cloudflare is the largest protector of crime on the internet. They won't do a thing about it. DMCA notices go to /dev/nul as far as cloudflare is concerned.
People using it as a "free" CDN are fooling themselves as well, since the CDN hides the crime, it also means that if the ip's are blacklisted by an ISP for childporn, your site may suddenly become unavailable by some parts of the internet.
..."Don't be evil"
We all now how it ends!
"has never terminated a customer or taken down content due to political pressure"
They totally did, once as I recall, and Matt Prince back pedaled that like a MFer.
They are the goddamned beast. WHo does the beast give its SSL key to? Obvious front? impossible
Anyone know if there is a canary service, I mean I have a horrible memory. I'd never notice if they took something out of the site. Also, what are the limits to this? Could they have a page with say 500,000 lines of stuff saying "The government has never asked for information about company XYZ" and updating it for every customer. Or have a personalized page that only displays information in the customer portal such as "The government has never asked about you"?
No corporation has ever lied, so we have every reason to believe Cloudflare /s
It is only a matter of time until the lawmakers introduce laws that make these canaries unworkable and worthless.
That's a **LIE**. They took down a Nazi site due to political pressure.
Why should I believe *anything* they say at this point?
Why can't a business publish a whole table of warrant canaries, including each concerned stakeholder? Each customer could have an entry with their name or pseudonym. If a subpoena for Bob were received, the entry reading "We have received no subpoenas regarding Bob" would be removed, but John, Mary, and Mike would still have their entry.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
they received a "security letter" and were ordered to lie about their "warrant canaries".
"How about the canaries are just a tool to get good press, and CloudFlare is perfectly happy to roll over when they get a warrant without telling you?" HOW ABOUT YOU FUCKING PROVE YOUR ASSERTION?
HOW ABOUT YOU FUCKING SPELL OUT PROOF OF YOUR BULLSHIT CLAIM YOU TROLLING MORON. I'm not fucking INTERESTED in your unfounded opine, but if you have ANY REAL FOUNDATION, yes, spell it the fuck out.
Stop stalling.
https://notabug.org/themusicgo...
What software are you using, slashdot readers?
Oh, we never did any of this at the request of law enforcement or another third party. Only at our own discretion.
(sorry, couldn't resist)
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What on Earth made people believe courts in most jurisdictions couldnâ(TM)t just order a company to do X, that happens to include NOT touching the canary text?
They had a chance to make their moral stand, and they backed down.
( -a moral stand is when you defend assholes doing something legal, even when they are still being assholes- )
They don't use huawai so there cant be any spying going on in their networks anyway.
Everyone tells me it's just Chinese that spy, so they shouldn't need any canaries should they?
In Australia, it's illegal to make a statement about whether you have or haven't received certain kinds of warrants, because they don't have an equivalent to the US's first amendment. Couldflare appears to operate in Australia so I wonder how they plan to deal with that issue. I also suspect that Australian agencies would be willing to use the powers they have here to assist other Five Eyes governments.
That's a **LIE**. They took down a Nazi site due to political pressure.
Did they actually get rid of the customer, or did they merely say something along the lines of "you can't have this nazi stuff here, but you may still post cat videos". And for some unknown reason, the customer left despite not really having to. . .
Much of that post is pure bullshit. Cloudflare HAS terminated users for poltical reasons. The Daily Stormer termination was a personal requirest by Cloudflare's CEO himeself. I don't necessarily agree with the group but to say they don'ttake political positions is an outright lie.
As for the service itself, they and many others continued to deny SSL had been broken despite reports of it dataing back at least to Wikileaks first few releases. Fact is things like SNI and DNS still leak enough data that yes, technically they may not have provided the data directly but they don't NEED to. The networks they're on already do and you'll have no fucking idea either since they hide the origin servers. I'm not saying CDN's don't have a place but holy shit can we at least be realistic?
They censored the Nazi site. Win 1 for kooky wannabe Nazis due to Streisand Effect. Lose 1 for freedom of speech.
I'll be awful glad when they catch all the terrorists & we can have our rights back. ....any day now.
WRONG. It's not enough to prove they intend to disclose any information, which is the point and legal well of the NSL. The NSL is not a contract. Contract law could do what you describe but they'd have to agree to it.
Criminal law is specific and has thresholds even in the case of NSL enforcement.
Strategy 1: "As part of this investigation, we're going to need you to keep that canary updated. Legally, we can't compel you to cooperate. Not with a piece of paper, of course. However, we are still the CIA, so trust us when we say we're more than capable of implicating you in rape, disappearing you off a hiking trail or arranging for your unfortunate suicide if you don't comply. We understand each other, yes?"
Strategy 2: "Hey, you don't get paid much, and we hear your kid is sick a lot of medical issues. Here's $8,000,000. Use it to help him. All we ask for in return is your private signing keys. Go be with your son, we'll be able to keep that canary updated remotely from now on."
Canaries still involve too much trust in the government to not behave like thugs, as well as too much trust in individuals to resist temptation. Placing trust in what happens behind closed doors and within the inner workings of people's emotions seems foolish to me. Not all government agents work by the book. Not all citizens are above temptation. We're people, not programs. Don't expect predictability when you're dealing with the human equation.
Sure, both scenarios I describe are illegal. Has that ever stopped a CIA investigation before?
As I have said, this has nothing to prove with intent to disclose, it has to do with the fact that not maintaining a canary such that it expires effectively *IS* disclosure.
If you can show how a warrant canary dying is not entirely equivalent to any other form of disclosure that happens to only be applicable if someone else knew what to look for, then illustrate how, instead of simply repeating your point about the NSL and contract law endlessly.
As I said... one could potentially disclose through semaphores, or sign language, or using ancient Aztec symbols... but it's all still disclosure. The fact that perhaps only a subset of the population will even know what the heck it actually indicates is irrelevant.
File under 'M' for 'Manic ranting'
It's a form of legal trickery that appears to work. Usually, legal loopholes are iffy because judges tend to disregard them, but this seems to have legs.
I haven't received a government request for information about you as of February 26, 2019. That's a true statement, and it's not really possible to suppress it legally. I can keep updating the date indefinitely. The government can't crack down on that, because any infringement on free speech has to have an overriding reason, and there's no reason to suppress it for an organization not under investigation. This is similar to establishing document retention policies when nobody's asking for the documents.
It's unfortunately easy for the government to tell me I can't say something about a particular legal action. Selling the courts on the idea that the government has the right to force me to lie is going to be a lot harder.
So, what legal mechanism is going to stop this? Canaries are legal under normal circumstances. The government has some legal means to make you say nothing, and that's exactly what you're doing. If I had something saying I'd never received a National Security Letter on my website and took it down when I got one, that's doing something, and the courts can decide I can't do that. If I maintain a canary with a date. I just do nothing. I'd have to be legally compelled to lie in order to not have the canary tell everyone. There really isn't a legal way to stop a canary from functioning. A court can issue a gag order saying I can't do anything, but that's exactly what I'm doing with the canary.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
The Daily Stormer found itself another host, which shows that freedom of speech still works.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
If they say that you are not to disclose to anyone that the investigation is happening, because canaries would be one way to disclose such information, their utilization (or more specifically, their expiration) could still be considered deliberate disclosure, because you are still wilfully altering some operational policy (that keeps the canary alive) which effectively communicates information that you are supposedly forbidden to communicate. This would be particularly troublesome if you had already previously explicitly communicated to the public that such a change in operational policy, if it were to ever occur, would only be brought about by such investigation. If you had never made such a statement, I think you may have a bit more wiggle room, but in all honesty, without such a statement, I'm not sure why one would bother with a warrant canary in the first place.
File under 'M' for 'Manic ranting'
1998, my browser is AWeb running on an Amiga 3000 stuffed full of various upgrades, biatch.
Just curious: are both sides talking out their ass, or have judges ever actually ruled on this?
"[Cloudflare] has never terminated a customer or taken down content due to political pressure."
What about the Daily Stormer?
https://blog.cloudflare.com/why-we-terminated-daily-stormer/
Daily Stormer's account was terminated.
https://blog.cloudflare.com/why-we-terminated-daily-stormer/
First, there's no law against putting canaries up before you get a secret request.
Second, the government cannot force you to lie. That's been true for about forever. Under some circumstances, the government can force you to say certain things, but not to lie.
By having a canary, you aren't telling anyone that you've got a secret request. You're just not telling anyone you don't have. This can have strong implications.
So, again, what legal mechanism is going to stop this?
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Of course not.
Also true, but if you've contrived your circumstances beforehand so that only way you can avoid communicating that you're being investigated if or when it happens to you is to lie, is that the government's fault?
Not by merely having a canary in the first place, no.... but by deliberately permitting it die where you otherwise would not have, particularly if you had ever previously announced that such a change in operation would be an indication of that situation, you *ARE*, in fact, telling people about the existence of the request when the canary dies, just as certainly as if you had communicated that information through natural language.
If a secret request comes with a penalty for communicating the existence of the request to anyone else, it doesn't matter how you do it... the fact that you did it would still be an infraction. The changing of some internal policy (ie, letting a canary die) to alert people outside of an organization to the situation is nothing more or less than a covert signalling system, and as far as I can see, the only reason you'd get away with it is if nobody else happened to perceive it that way.
File under 'M' for 'Manic ranting'