top | item 6679280

Apple hides a Patriot-Act-busting "warrant canary" in its transparency report

380 points| e1ven | 12 years ago |boingboing.net | reply

214 comments

order
[+] defen|12 years ago|reply
My not-a-lawyer read on the whole warrant canary thing is that it would never fly in front of a judge. In other words, anyone with two brain cells can see that, if there has in fact been a 215 order by the time the next report rolls around, then deliberately removing the warrant canary language is tantamount to revealing the order's existence, which is illegal. So warrant canaries, while seemingly clever, are actually pretty much worthless. You may as well just openly announce something, rather than try to be clever about it.

Therefore, I am forced to come to the Kafkaesque conclusion that Apple only included this language because they already have been subject to a Section 215 warrant. Otherwise there's no reason to put the language in there at all, since it's useless.

[+] jamesk_au|12 years ago|reply
> In other words, anyone with two brain cells can see that, if there has in fact been a 215 order by the time the next report rolls around, then deliberately removing the warrant canary language is tantamount to revealing the order's existence, which is illegal.

As a matter of logic, that is not necessarily correct.

The beauty of the warrant canary is that it takes advantage of the ambiguity that is inherent in unexplained omissions:

1. A person may choose not to continue publishing their canary because they have received a warrant. This scenario might impermissibly reveal the warrant's existence.

2. A person may choose not to continue publishing their canary at any time, for any reason, without explanation, even if they have previously said (a) they wouldn't discontinue the canary unless they received a warrant, and (b) they have not in fact received a warrant. This scenario doesn't reveal anything.

In most cases, it's impossible for a third party to distinguish between those scenarios, with the result that the person's decision to omit any further publication of the canary is equivocal, and does not necessarily convey anything about whether or not a warrant has been served.

There could be other circumstances that do allow a third party to distinguish between the above scenarios, and thereby convey information about the existence of a warrant - but I don't think what Apple has done goes that far. The position of rsync.net[1] is less clear.

Note: I have used 'warrant' here because I am referring to the general concept of a 'warrant canary', but the language of s 501 of FISA[2] (introduced by s 215 of the PATRIOT Act) is a bit different.

[1] http://www.rsync.net/resources/notices/canary.txt

[2] http://www.law.cornell.edu/uscode/text/50/1861

[+] haberman|12 years ago|reply
> My not-a-lawyer read on the whole warrant canary thing is that it would never fly in front of a judge. [...] So warrant canaries, while seemingly clever, are actually pretty much worthless.

"Worthless" is a pretty strong statement: do you have anything at all to corroborate your speculation in an area which you admit you have no expertise?

[+] patmcc|12 years ago|reply
I think the usual argument against your argument is that compelling silence is reasonably common in law, but compelling false testimony (and I'd argue that being forced to leave a false statement in a published document would be tantamount to that, especially if it was part of a corporation's various filings) is an entirely different matter.
[+] mutagen|12 years ago|reply
Is there public case history where an individual or corporation has been forced to publicly state untruth or false facts for the sake of national security or other state need?

With the warrant canary meme spreading, I wouldn't be surprised to find out that Section 215 warrants include warrant canary clauses. I'm curious about precedent and the legal arguements (pro and con) for doing so.

[+] Spooky23|12 years ago|reply
I agree that it's useless, with the exception of smaller organizations where the key players are involved with everything. In those, the risk of someone going "all Lavabit" and doing something dramatic are a deterrent.

All the government needs to do is give a gag order to the people processing the warrant. The folks putting the transparency report together will truthfully report that no such warrant exists, because they are unaware of it.

This isn't a big spy thing either -- if you've ever worked in a place where one or more executives or a business unit were subject to an investigation of some sort, this happens. The gag orders are there to avoid intentional or accidental disclosure to the custodian of the data in question, which could lead to tampering with or destruction of evidence. Its an uncomfortable situation that many email administrators have found themselves in for many years.

The scary thing about the Section 215 warrants from my perspective as an individual is the difficulty in disclosing things to counsel to get appropriate advice, broad scope and indefinite nature of the gag order. It was one thing when these laws were used to investigate KGB agents -- now you have orders of magnitude more of these things.

[+] simonh|12 years ago|reply
My understanding of this is that the last thing the NSA wants is to actually have to defend these notices in court, in public. Can you imagine Obama, or any president, having to defend forcing people to flat out lie to the public by retaining "No 215 here" notices when one has been received? That's not going to happen. By best guess is that Apple would be able to challenge being put in that situation by the 215 notice's terms effectively forcing them to self-incriminate.

Also Apple's statement that if they get a 215 they will fight it means they are significantly less likely to be served one. 215s work mainly through fear and doubt and picking on people without the resources to defend themselves.

All this skullduggery is very effective when it's in the shadows or off stage, it's still actually a fairly marginal issue, but the more it gets pushed into the faces of ordinary voting Joes, the worse it gets for the spooks.

[+] sgentle|12 years ago|reply
I've always wondered about this. I can buy the idea that a judge would compel you to fake a written canary like this. But how far would they go?

What if you recorded a monthly video of yourself naked singing the national anthem with "I have not received any secret warrants under the patriot act" scrawled on your chest in lipstick?

Could a judge really compel you to do that?

[+] PeterisP|12 years ago|reply
IANAL, but there is significant difference.

As you say, both saying 'we just got a warrant' and not including the warrant canary language would be against that law.

However, you don't neccessarily have to obey all laws - a law can prohibit you from making a statement; but a law cannot compel you to make a statement - so the claim is that if your actions conflict with the law in this way, then (at that instance) application of this law is unconstitutional and your violation is acceptable.

[+] comex|12 years ago|reply
Even so, it's of almost no advantage to Apple to publish a false such statement out of the blue, and it's very unlikely anyone would be compelled to start a new canary, as opposed to maintaining an existing one, so I'd say it's almost certain the statement was true at the time it was made. I'd view this as mostly an attempt to test the waters.
[+] jamesrom|12 years ago|reply
Apple may be trying to set a new precedent here.

Or they are announcing that they will make the 215 order public, it doesn't matter how illegal it may be to do so, they are going to challenge it in the public arena.

Or, and I think this is most likely, they are just trying to deter getting served a 215 order.

To call it worthless is short-sighted.

[+] rsynnott|12 years ago|reply
> My not-a-lawyer read on the whole warrant canary thing is that it would never fly in front of a judge

I'm not sure that the US government would _really_ want to take Apple, of all people, to court. Currently, the general public is not particularly aware of this type of warrant; that would certainly change with the inevitable media circus.

> if there has in fact been a 215 order by the time the next report rolls around, then deliberately removing the warrant canary language is tantamount to revealing the order's existence, which is illegal.

The government could certainly try to make that point, but they'd have to go to court to do it.

[+] tombrossman|12 years ago|reply
And if we embrace the fact that this quickly becomes more and more Kafkaesque, and run with it? Company A has the statement on their front page, maybe somewhere unobtrusive like the footer: "We received one or more NSLs today for customer data" Now, should it ever become a true statement what then? Leaving it would be a crime. Removing it might also be a crime. What is poor Company A to do, Judge? We're just trying to comply with this law...
[+] if_by_whisky|12 years ago|reply
Isn't it illegal to intentionally lie on an SEC filing?
[+] darkarmani|12 years ago|reply
> then deliberately removing the warrant canary language

Is it considered "removing" when you are composing a new message from scratch? Besides, they can't force you to publish a transparency report can they? What if you just stop publishing them?

[+] anoncowherd|12 years ago|reply
> My not-a-lawyer read on the whole warrant canary thing is that it would never fly in front of a judge.

Note that freedom-raping insanity like those gag-orders should not fly in front of a judge either.

[+] joelrunyon|12 years ago|reply
Whether or not it flies in front of a judge isn't the point.

Isn't the point to be able to inform users when an NSL or something similar is actually issued & then fight it out in public?

Saying it "wont' work" from the start is counterproductive. If a law is broken - then you don't typically reform the law without breaking it in some way.

[+] jpalomaki|12 years ago|reply
If the court would decide that Apple has not been complying to the secrecy requirements, what would be the consequence? Would they be slapped with significant fine or would some executive end up in jail?
[+] moogleii|12 years ago|reply
I think you overestimate how unwilling companies are to skirt/bend the law, especially mega-corps.
[+] ericdykstra|12 years ago|reply
Just to take this to an extreme: what's there to stop the government from systematically killing Americans who voice opposition to the NSA spying? Assume a secret court decides that the NSA can arbitrarily label any American as a 'terrorist' and that killing terrorists without a trial is a-ok. Let's also assume that anyone who knows about this program and leaks the information about how it works to anyone else is a 'terrorist' in this system.

That seems to be the same line of reasoning that the government is using for these gag orders (just taken to the most extreme case possible). There's no recourse to challenge any of this since none of the companies can talk about specifics of what they're compelled to do.

[+] memracom|12 years ago|reply
Governments who have tried that in the past find that groups of civilians start systematically killing government agents, particularly police and security forces.

It's generally a bad idea to go that route because the government is effectively condoning illegal actions and others will adjust their behavior similarly. Rather like the streets with graffitti and broken windows that seem to attract crime.

Now some would say the the government has already condoned illegal spying behavior, but that is not the same thing. Some groups have taken it upon themselves to spy back on the government but I don't know of anyone who suggests killing people as a response to illegal spying.

In any case, increasing the use of force leads to escalation and escalation leads to an expanding spiral of destruction that quickly becomes uncontrollable. For an example of what happens then, read a book called "10 days in October" and think about whether the USA really wants to follow the Soviet example. In addition, the Soviets themselves have pretty much abandoned that approach which is the main reason why the dissolution of the Soviet Union was so peaceful. Wiser heads prevailed. Can the USA at least match that as the American Empire fades away?

[+] rayiner|12 years ago|reply
In some sense, there is nothing to stop the government from executing anyone it wants for no reason at all. Indeed, there is nothing to stop me from killing you or you from killing me, not unless you indulge the premise that "law" can stop someone from doing something they otherwise have the ability to do.

If you are willing to indulge that premise, then what stops the government from acting out your hypothetical is that it would be clearly illegal.[1] There is widespread misunderstanding about the basic nature of FISA. Yes, it's a secret court and that's bad, but it's a secret court with one power: to grant FISA warrants. Furthermore, the whole process pertains to something, foreign intelligence surveillance, that didn't require any judicial supervision at all prior to FISA.

[1] As opposed to what the NSA is doing now, which is just debatably illegal, and if actually illegal is only illegal at the edges. It doesn't sit well with technologists, but most of the things that inspire outrage, from surveilling foreign leaders to collecting phone metadata to getting e-mails pursuant to court orders are well within the bounds of the law as it's understood. Now, maybe we don't want the NSA to engage in these activities, but the fact that they do isn't a sign that they've totally disregarded the law and are ready to start executing people at random. They're clearly trying to work at the boundaries of things like the third party doctrine, but that's different from ignoring the law.

[+] bdesimone|12 years ago|reply
The pushback from tech community in the form of these reports has been encouraging. That said, a little part of me dies when I realize the USA has become a government that censors something like the reporting of the quantity of requests.

What's the justification? I'm genuinely curious.

[+] geofft|12 years ago|reply
To play devil's advocate for a bit, let's assume an America where the government never abuses its power and there are no criminals other than two terrorist cells, one in New York and one in DC, and neither of those cells knows how to make bombs because America has education and nobody else does.

Both of these cells go to the public library and check out books on bombmaking and other mischief. They also ask the librarian, "Hey, have you had any requests for records under the PATRIOT ACT?" If they ever hear a "yes", no matter whether it's them or not, that cell shuts down and moves to another city, and the other cell continues its plot.

Leaking even the one bit of knowledge of whether there was a request for anyone would make the investigation harder, and would allow the terrorists to escape and plot the destruction of our freedom elsewhere.

Now, in the real America, the value of that one bit to an evildoer, when applied to an organization Apple's size, as opposed to the value of that one bit to measure PATRIOT ACT activity as part of government accountability, is a good question to ask.

[+] RyanMcGreal|12 years ago|reply
> What's the justification? I'm genuinely curious.

If you can't talk about a violation of your Constitutional rights, you can't fight it either.

[+] ohazi|12 years ago|reply
When the dirty laundry eventually gets aired, the official reasons are usually nonsensical assertions that allowing the public to know what our government is doing is somehow helping terrorists avoid detection and capture.

I think many of the people who came up with this stuff know that a lot of it is questionably legal at best. The justification of these gag orders is therefore to hide the prevalence of the questionable behavior, allowing those responsible to continue what they're doing for as long as possible.

[+] pliny|12 years ago|reply
>What's the justification

It's along the lines of - if we're monitoring a service to catch terrorists or prevent terror attacks, it's counterproductive to alert the terrorists they're being monitored. Furthermore - if the people trust us enough to allow us to monitor these services (which is supposed to follow from there being laws enabling us to monitor these services [a]) then you must also trust us not to abuse the information we gain or to use it in any way that does not serve the interest of national security, so non-terrorists using the service aren't harmed by not knowing they're being monitored.

[+] crassus|12 years ago|reply
The bureaucracy has its own species of logic.
[+] downandout|12 years ago|reply
The law is a lot smarter than this. Any act that tends to disclose the existence of such an order, which could include the publishing of a revised transparency report in reaction to receipt of the warrant, could be construed by a judge as a violation of its confidentiality provisions. The law is very broad on this, and subject to interpretation by the judge.

In short, warrant canaries are no different than taking out a billboard announcing receipt of the warrant. Both are overt acts intended to disclose the warrant, and both are illegal.

[+] Segmentation|12 years ago|reply
Nothing will ever come of it.

Warrant canaries are a cheap feel-good tactic for public relations. Even if served 215, Apple will continue to keep the warrant canary up, because it makes its customers feel safer, and because they're wise enough to know it would never fly with a judge.

The public will continue to think Apple was never served 215, and there's absolutely no way we could ever disprove it.

[+] kazagistar|12 years ago|reply
Has this specifically been tested in court? It seems like some form of 1st amendment or 5th amendment case could be made against this...
[+] xbryanx|12 years ago|reply
Couldn't the government make an argument that intentional removal of this language would be tantamount to violating the "gag order?" Would Apple be liable for lying about something that no one would ever know is a lie?
[+] brianpgordon|12 years ago|reply
Apple has not received 1 warrant.

Apple has not received 2 warrants.

Apple has not received 3 warrants.

Apple has not received 4 warrants.

Apple has not received 5 warrants.

Apple has not received 6 warrants.

[+] erichocean|12 years ago|reply
Can someone explain to me why we should trust Apple's declaration about Section 215?

It seems to me that, were they given a Section 215 order, said order would also additionally compel them to lie publicly about the receipt of the order itself, by having Apple explicitly say that they had not received any such order.

Frankly, the existence of courts that secretly compel citizens or companies to actively conceal and/or lie about the State's behavior seems to make every declaration of innocence by any person or business that can reasonably be expected to have been used by the State in that capacity suspect. Trust simply is not there no matter what they say or don't say, and I don't see how it can be given the actors involved and the legality of the situation.

I'd like to be wrong. Are there flaws in my reasoning here?

[+] scott_karana|12 years ago|reply
This seems like a good way to work around the issue for now. Good on Apple indeed.

Obviously, this is also going to be an escalating game, where the law is changed to accomodate for squelching reports like this, and the players will likewise adapt...

[+] joekrill|12 years ago|reply
Would love to hear from an ACTUAL LAWYER on this. Every single comment here seems to be be "IANAL, but", followed by some fairly confident ramblings about the legal aspects of this whole issue.
[+] kevinalexbrown|12 years ago|reply
Can the US government compel a private citizen to lie?

That seems like the crux of canaries to me. It's also one supreme court case that might be itself a kind of canary in the cole mine.

[+] PilateDeGuerre|12 years ago|reply
Warrants are quite a quaint notion in an era of parallel construction and Room 641As. To talk of warrants today is like talking of rope in the house of a hanged man.
[+] grecy|12 years ago|reply
What's the consequence for violating such a gag order anyway?

I'm pretty sure Apple has the cash to pay any fine they can come up with, it's just a question of do they have the balls to try it.

[+] ris|12 years ago|reply
I wouldn't expect Apple to ever receive a 215 order. They'd just play ball before one was even needed, and so the canary can stay in place indefinitely.
[+] Thetawaves|12 years ago|reply
This is pretty much all bullshit. If you believe Apple hasn't been subject to an order of this kind already, you are a fool.
[+] jameshart|12 years ago|reply
So someone inside Apple decides to post a warrant canary. Presumably -that person- have never been served with a 215 warrant. They ask around: anybody else been served with a 215 warrant? Of course, the answer to that question is always no - whether they have or not. So what does it really tell you, when a company puts out a warrant canary?
[+] scubaguy|12 years ago|reply
Isn't this sort of futile? Say Apple removes the section about "... never received an order under Section 215 of the USA Patriot Act" tomorrow. What does that tell us? That Apple did in fact receive such an order in the last 24 hours? Perhaps, or perhaps they were instructed to remove that part of the transparency report and Apple complied.

And even if we do know that they received such an order, what does that tell us? Does that tell us that the US government is targeting someone using iClouds? Or maybe it tells us that the US government issued a pointless order just so they can void this so called "warrant canary". It tells us very little.

Ultimately, unless corporations-as-persons have the right to speak freely about government orders it receives, we can only assume that everything transmitted through the Internet can be intercepted and given to the US government.

[+] rimantas|12 years ago|reply
Interestingly how nobody commented on "We would expect to challenge such an order if served on us." part.
[+] fleitz|12 years ago|reply
The claim could also be compliance not to disclose under 215. eg. The 'canary' is already a lie.
[+] biturd|12 years ago|reply
What if Apple, google, etcetera were to make the processes that these warrants ask for, part of a trigger.

As long as the warrant requests the same data or less than all the data, then performing those actions trigger an email to the user stating "A third party has requested access to your account.".

I would guess it would be best for these companies to add a few buttons to their internal tools to export user data. Then it's a part of their business process.

Many "third parties" can ask for and get your data legally. And letting them know is also legal. So there is a user value to this user feature.

Now, the next request goes from legal to top guy to tech guy to some guy who clicks a button in a browser.

[+] tlrobinson|12 years ago|reply
Has Apple explained how they're able to decrypt iPhones for law enforcement yet?