Hacker News Reader

Hacker News

Comment by tomlongson | Hacker News Reader

Full thread

tomlongson

For those who aren't familiar, a NSL Canary is like a Warrant Canary, but for National Security Letters.

https://en.wikipedia.org/wiki/Warrant_canary

Australia just outlawed warrant canaries. Scary times.

View on HN

> Australia just outlawed warrant canaries. Scary times.

Assuming you accept the need for the non-disclosure requirements in some court orders and administrative subpoenas, wouldn't the decision to allow canaries be a legal mistake in the first place? (Albeit AFAIK one also made by the US Department of Justice)

The argument for the legality of canaries would have to rely on the distinction between the affirmative and negative disclosure. But it is very easy to imagine a service that scrapes sites with canaries and publishes an affirmative list of those which took theirs down recently (or in a given time interval). This completely subverts the argument.

Is it perhaps yet another case where the legal minds failed to account for the current (actually... two decades old) state of technology? Am I missing something?

But it is very easy to imagine a service that scrapes sites with canaries and publishes an affirmative list of those which took theirs down recently (or in a given time interval).

https://canarywatch.org/

Shouldn't that Reddit canary be dead, though?

https://canarywatch.org/reddit/

I see this language at that location:

Reddit released its transparency report for 2015 and the warrant canary language was missing.

Maybe that's an edit after your post. I agree that a silhouette of an expired canary lying on its back, wings spread awkwardly, tongue sticking out, eyes crossed, would make this communication more effective.

Yeah, that's odd. It's timestamped March 31st - perhaps it was serving a stale application level cache (I've not been to the site in a while, or so I thought). Now the canary-logo is taken down from the reddit listing on the front-page too.

I don't see how such a service would invalidate the argument; you could prevent that service from affirming it, but that shouldn't impact the original canary issuer.

And I don't think canaries are really a feature of current technology; seems like one could have simply posted a weekly newspaper ad with the same content.

> Assuming you accept the need for the non-disclosure requirements in some court orders and administrative subpoenas

You could distinguish between temporarily keeping particular orders a secret, permanently keeping them a secret, and permanently keeping secret even summary information about the number, kind, and scope of the orders (or what kind of matters they related to).

There's a better approach that depends on third-party scraping. You publish the canary on a schedule, but take it down as soon as it's been scraped. So there's nothing to take down when you get the warrant, NSL, etc.

Edit: And then you don't publish the canary as scheduled. Before you got the warrant, NSL or whatever, you were subject to no court order. So you were free to speak. After getting it, can you be compelled to speak falsely?

> After getting it, can you be compelled to speak falsely?

Why not? Given that secret warrants arguably already circumvent your right to face your accuser, this seems like a very small stretch.

IANAL: I don't believe that secret warrants 'trip' one's right to face their accuser, as that is a right for courtroom proceedings, which are significantly different from the warrants about which you speak.

My understanding is that, no, the government cannot compel you to speak falsely or, generally, to do other things you don't want to do.

As I understand it, this is related to the argument that Apple was using vs the FBI recently, that while the FBI could compel Apple to produce things in its possession (like Farook's iCloud backups) it could not compel Apple to do things like produce a custom version of iOS.

IANAL, but, this is mostly based on what I remember reading last year when the whole warrant canary idea first started getting publicized.

They have more guns than you do. They can compel you to do pretty much whatever.

Hypothetically, what would happen if somebody made them use their force in a very public, visible way (that is, refuse to comply, and post live video on multiple video sites)? How big of an operation can be kept secret by physical violence?

There wouldn't be some sort of black-ops, Bruce Willis style operation. You'd simply be someone being arrested by some FBI agents for violating federal law, and they could do that at noon on a Tuesday smiling to TV cameras if they wanted to.

But that would nullify the canary, no?

Well, canaries ought to be signed with GnuPG or whatever. But then, we're back to https://xkcd.com/538/ ;) But that would be harder against a corporation.

Practically there's no difference, the consequences of a canary or blowing the whistle is the same. But the interesting thing is canaries require the government to order someone to lie, whereas the other just compels them to not tell the truth.

To be fair, I've always thought that warrant canaries were extremely questionable legally. If the government can legally say "You're not allowed to spill the beans about this", then using a warrant canary is directly subverting that order.

As a result, I always assumed that anyone that had a warrant canary in place would get a court order to keep it up regardless.

I would be shocked if they stood up in court, and I don't find the outlawing of it any more disturbing than allowing secret warrants in the first place. (Although secret warrants are pretty damn disturbing.)

Theoretically an order compelling speech, especially false speech, scares courts more than prohibiting speech in certain circumstances, which happens frequently.

Is it merely theoretical? I read a bunch of opinions on the subject last year that definitely left the impression that there was some precedent here.

Sure, they can force you to keep the old one up.

But can they force you to put up a new one?

I may be wrong but in the Australian case it seems journalists are forbidden from creating a canary in the first place, they cannot say they did or did not receive a gag order. That's what I got from what I've read but not sure.

If the issue was being forced to continue with the canary then there is a solution for that just use as a canary, before you received any order: We have received a gag order!

And when you do receive a gag order what are they going to do? Make you remove that? Keeping it seems as a direct violation of that order.

I like the section from Moxie in that article. Did anyone check if this is lawful to begin with? I mean, if you can't tell that you were asked for private data, can you 'tell' by now saying that you weren't asked for private data?

Just to be safe: Any NSL is crap. Braindead. I'm not trying to support that BS. This is among the worst possible ideas a government can come up with and belongs in the realm of (referring to recent posts) Turkey at the moment.

But IF they exist for some reason, is a canary really working? Isn't this just another 'The government cannot crack my password' argument, missing the lead pipe way..?

This seems like one of those better to ask for forgiveness than permission kind of things. What NSLs thrive on the most is lack of attention. Anything that brings more high profile is something the NSA would prefer to avoid, lest case law gets more clarified around them.

If you follow the source there's a section stating that according to EFF having a warrant canary should not be a problem:

https://github.com/WhisperSystems/whispersystems.org/issues/...

What EFF wrote says more to me than Moxie saying 'every lawyer I've spoken to'. Which lawyers? In what context? What was said?

> Which lawyers? In what context? What was said?

Sounds like we need a lawyer canary.

> Australia just outlawed warrant canaries. Scary times.

Outlawing warrant canaries per se is not scary at all. They're a method of communicating information that has been deemed to be forbidden, so it's just a way of preventing the rules-lawyering method of still conveying that info. The overreach of such things in the first place is the scary part, not the stuff around canaries themselves.

The focus should be on getting rid of the overreach of these things, not on preserving a loophole.

Agree 100%: "You mean I can't circumvent the plain meaning of a court order through information-theoretic trickery? Truly, fascism is upon us."

There is no "court order". That's the whole point of a warrant canary. A fact is asserted when there is absolutely nothing preventing you from asserting that fact.

Do you want to restrict everyone's speech just in case, or force them to lie? Those are the choices.

The warrant comes with an order prohibiting you from communicating its presence. That prohibits any means, no matter how cleverly informed by information theory, from communicating that information.

It only forces them to lie if they deliberately take means to force themselves into a lie. "I have not received any warrants that I'm legally allowed to discuss with you."

Forcing people to lie is bad.

It doesn't need to "trickery". It could be as simple as someone asking if you've received any warrants, and just not answering.

The government shouldn't have the ability to compel people to lie, that's the issue. As far as I know they don't have that ability, and there is nothing illegal about this.

They can compel people to lie already with the NSL - it just depends on how the question is phrased. "Removing a warrant canary" is no different to staging a question from someone that is "Say 'no comment' if you've received an NSL". In both cases, the absence of a response has been set up to convey the forbidden information.

It's not illegal to answer "no" if asked whether you have received a national security letter, and neither is it illegal to answer "no comment" if asked whether you have received a national security letter. Nor, further, is it illegal to respond with silence.

Having once given a legal, true answer to the question "have you received a national security letter", a person can later give a different legal, true answer to the same question, or can later choose to respond with silence.

Otherwise, you are asserting that the feds may do more than merely forbid the recipient of an NSL from talking about it, and actually have the authority to force the recipient of an NSL to lie about it.

I sure hope that isn't true. If it is, I'm not sure any of this matters, because we're all fucked already. I cannot conceive of any legitimate justification for allowing any government to have such a power.

How deep is the rabbit hole?

Reddit should remove the π symbol on their website, as if Pi itself disappeared.

"We can't talk about Pi."

Or bleem [0]

[0] http://www.strangehorizons.com/2000/20001120/secret_number.s...

I remember several mods of r/darknetmarkets posting that they received NSL's forwarded from actual reddit admins.. Not sure if that post is still available though.

Are you referring to https://www.reddit.com/r/DarkNetMarkets/comments/30tudk/psa_... ? That was a normal subpoena (without a gag order), not a NSL.

Yes, but they still could have been accompanied by gag orders despite not being a NSL. There are several categories of administrative subpoenas which can have them, and which could have been plausibly used in my case - the financial ones, for example, due to the Bitcoin/money laundering nexus.

> Australia just outlawed warrant canaries. Scary times.

Australia outlawed warrant canaries for journalism warrants (warrants for journalists when they investigate someone). I'm fairly sure that law doesn't apply to all other kinds of warrants.

Ridiculous times too, when all of this gathering of data is predicated on a flawed assumption that it won't just be creating more noise in the attempts to predict terrorism. We've switched from one wasteful, illegal, and noisy method (kidnapping and torture) to invading privacy.

I'd love to see efficacy proven, just once.

Isn't an NSL by definition a non-noisy, targeted method? I'm going off of the widely known methodology for getting data from a U.S. company, FAA 702, popularly known as "PRISM".

Do you have any links describing NSLs being part of a noisy, dragnet operation?

No, I'm working under the assumption that the NSL was a first step in mass collection.

Reply on news.ycombinator.com