Time For a Warrant Canary Metatag? 332
An anonymous reader writes "With the advent of national security letters and all the NSA issues of late perhaps the web needs to implement a warrant 'warrant canary' metatag. Something like this: <meta name="canary" content="2013-11-17" />. With this it would be possible to build into browsers or browser extensions a means of alerting users when a company has in fact received such a secret warrant. (Similar to the actions taken by Apple recently.)
The advantage the metatag approach would have its that it would not require the user to search out a report by the company in question but would show the information upon loading of the page. Once the canary metatag was not found or when the date of the canary grows older than a given date a warning could be raised. Several others have proposed similar approaches including Conor Friedersdorf in The Atlantic and Cory Doctorow's Dead Man's Switch." What problems do you see with this approach?
Re:The problem I see (Score:4, Informative)
Yup. from the unless-double-secret-probation-prohibits-canaries dept., pretty much.
Your post advocates a
... [craphound.com]
(*) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting NSLs. Your idea will not work. Here is why it won't work.
Precedent in other law systems (Score:5, Informative)
Same reason the British AA (Automobile Association, not alcoholics) were formed and (later) forced to change their ways.
The whole point of the AA was formed to inform members of police speed traps. Back in the days of red-flags in front of vehicles held by a man. If your were an AA member, and there were no police around, an AA employee would be required to salute you.
If, however, there was a police trap present, they would not. Absence of the salute was seen as just such a canary to warn you despite being a "non-action". Eventually it was ruled illegal and the AA and the RAC both become just "vehicle breakdown" companies
When it comes down to it, if a court / police can argue that they need you NOT to trigger the canary (by inaction or otherwise), they will find a way to make you do it. They already redirect your DNS if they steal your domain, what's to stop them updating the canary themselves apart from a minor technical issue? All it will do is just get your whole domain seized to make you compliant.
ESPECIALLY if the entire point of the canary is to indicate to people whether you are subject to a (potentially LEGAL) court order not to reveal that you're under such an order. Little difference between that and you phoning up your buddy to warn him that you were just busted and the cops have his address - it's seen as deliberate evasion of the law. Even if the message is "I **WON'T** text you at 5pm if I've been raided".
The simple fact, though, is that such warrants are not a problem when they are legal and above-board. The problem is when they are not. Skirting the legal grey area yourself is not the correct response to the agencies skirting the legal grey areas.
If all else fails, they'll just institute a law to stop you doing things like this.
Re:Authority to approve hosting expenses (Score:4, Informative)
You forgot 4) most foreign governments will do anything they can to please the USA and/or already have similar programs in effect.
Not to me mention the point made by several others that much of this surveillance is being done either without a warrant or with a warrant to your upstream provider rather than to you.
Re:It's not that easy - (Score:4, Informative)
They shouldn't have the right, but that doesn't mean they don't do it anyway [cnn.com].