back

Warrant Canaries

Image Some services you use may operate a warrant canary. There are pros and cons to using one. It is an implicit way to inform users if the service has been served with a subpoena.

The idea of a canary comes from a little while ago. I think it is fitting to use it in the way it is used today.

A mechanism to test for unsafe conditions, originating from the use of canaries in coal mines to detect poisonous gases or cave-ins. If the canary died, it was time to get out of the mine.

Due to a gag order being served alongside a subpoena, this means the operators of a service have to comply with providing information they can collect on their users and they are not allowed to tell them. A warrant canary that is signed is posted at set times they have declared with the current date, a recent news article, etc. If they do not post a good, updated message at that time, the users know they have been served with a subpoena despite a gag order being placed on them (or at least something else has gone wrong).

In the US, there are many places where speech is censored and there are places where there is compelled speech such as writing the correct ingredients on the packaging of products. However, there is no case for compelled untrue speech. Legally, the US government cannot force you to sign an untrue warrant canary. Technically, if you keep your keys secure, they cannot do it either. In reality however, I think this xkcd comic is quite fitting. Warrant canaries are also not great if the people operating the service prefer to lie to their users to not lose a large portion of their income and also not great if the servers for the service have been pwned by the government or another adversary without the service operators knowledge.

For some service operators, they do not feel a need to operate a warrant canary because the laws they need to follow do not include things such as gag orders. Some service operators do not operate one even when they probably should and you should therefore understand anything you give them may be given over to authorities when they request it. This isn’t the worst thing in itself but you should understand the deal you have with the service provider.

Using a warrant canary isn’t a magic bullet for all problems including regarding warrants but it is at least a half solution to a problem service operators face when they are pushed to betray the trust of the users of their service.