In Association with
What is a warrant canary?
In general, people don’t often like surprises, and would rather have an advance warning prior to an event. This becomes especially true when it is an adverse or even dangerous event.
Decades ago, coal miners would bring a canary with them, to gain advance notice if the air quality in the mine had deteriorated. When the canary had become sick or even died from the noxious fumes, the miners would use this information from the now proverbial “Canary in the coal mine” to evacuate to the surface before they succumbed to the fatal gasses. Now with that background, we can get to the task at hand.
What is a warrant canary?
The term ‘Warrant canary’ gets used for a routine statement that gets published from a service provider that has not been served a legal process. The service provider goes through the effort of publishing this statement, as if and when they have been served a legal process, they would not be able to share the message that they were served, as it would be prohibited. Therefore, the statement gets issued prior that they are not served, and the absence of it indicates that they were served, and this functions as the workaround to this.
It is worth taking a look at an example of a warrant canary statement. They often go something like “This company has not installed to date any law enforcement monitoring software or equipment on our network anywhere.” By seeing this regularly, the user is assured of their privacy while connected to the network. Conversely, when the statement goes away, it is an indication that the network is being monitored.
What is a transparency report?
In addition to the warrant canary statement on the website, a closely related tool to be aware of is the transparency report. This is a published report that comes from the organization, and comes out at regular intervals. In this report is information on requests by law enforcement, and in some cases how content was modified, such as by a removal or block as a result of this intervention by the government.
The astute user should also be on the lookout in this transparency report for the removal of the warrant canary statement. This then indicates that the network is being monitored by a government agency.
What is a national security letter?
The national security letter (NSL) is an intelligence request from a governmental agency that gets sent to a network provider. The recipient is required, under the guise of national security, to keep the receipt of such a letter as a secret, through the associated gag order on this information.
The intelligence agency is looking for information, and therefore wants to go through its investigative process as efficiently and unencumbered as possible, without the target of the investigation being aware that they are being looked at.
Also be aware that an NSL is limited in what it can request through this process, as things like the body of an email as this would be the content of a communication cannot be found out through the NSL process. Similarly, a phone conversation, or the characters of a text message are also off limits.
Is a warrant canary legal?
While the gag order goes into place once the request for information through the NSL arrives, prior to that, the service provider is not prohibited from indicating their lack of receipt of such intelligence requests. Therefore, for the service provider to put its warrant canary statement, both on its website, and also in its transparency report is quite legal.
Can there be a backdoor to encryption?
Encryption is a process to protect the data stored or transmitted, so that a password or key is required to decode it. A common example of this is when a storage device, such as a hard drive, is encrypted so that the stored data cannot be read by someone who gains access to the drive, without also having the encryption key.
In at least some cases, a government has requested that the service provider has put a backdoor into the encryption process. This backdoor then functions as a method for the government to gain access to then be able to decrypt the encrypted storage device. Having such a backdoor makes the encryption process inherently not secure, as then someone can access the backdoor whenever they want some info.
Why go through all of this?
Over the last two decades or so, there have been increasing concerns over privacy on the internet. This has been related to warrantless requests for information by the National Security Agency that started as a result of 9/11 in 2001. However, it quickly and exponentially grew into mass surveillance by the NSA of all domestic communication, of ordinary citizens with monitoring by the government of all communication through the fiber optic network. Given this, folks have increasingly turned to more private methods of communication, such as encrypted messaging to avoid this NSA dragnet of information, and also using a VPN when online.
Conclusion
With the government getting grabby with user’s data over the last two decades, warrant canaries have become an important tool to attempting to preserve user’s privacy. It is predicated on that a service provider will not be compelled to lie about the status of receiving a governmental lawsuit. With this information, users can then be empowered to choose a service provider that will keep their info secure, and indicate if they have been served with an information request from a governmental agency.
Users should also be sure to have an awareness of a transparency report, and that this also a related tool, that incorporates the warrant canary info into it. Furthermore, with the knowledge of storage encryption with the possibility of an open backdoor, users have good information for the protection of their privacy when online.
