Cloudflare Removes Warrant Canary: Thoughtful Post Says It Can No Longer Say It Hasn't Removed A Site Due To Political Pressure

from the tough-calls dept

Late last week, Cloudflare put up a fascinating and thoughtful blog post discussing (among other things) a change to its warrant canary list. As you hopefully know, a warrant canary is when a service provider makes a proactive statement about something it has supposedly never done. The idea is that if that statement disappears at a later date, one might reasonably infer that the company had been forced to do the thing it claimed it had not ever done -- and, additionally, that it had possibly been gagged from saying so. There are (somewhat reasonable) criticisms of warrant canaries, and to date, they're probably more well known for false alarms than any actual report of gagged pressured malfeasance.

Still, Cloudflare's public (so, not gagged) decision to delete a line from its warrant canary is interesting and worth thinking about. The original warrant canary from Cloudflare stated that the company hadn't done any of the following:

1. Cloudflare has never turned over our SSL keys or our customers SSL keys to anyone.
2. Cloudflare has never installed any law enforcement software or equipment anywhere on our network.
3. Cloudflare has never terminated a customer or taken down content due to political pressure.
4. Cloudflare has never provided any law enforcement organization a feed of our customers' content transiting our network.

Recently it added a few more and slightly modified the old ones, so that Cloudflare at the beginning of 2019 insisted that it had never done any of the following.

1. Turned over our encryption or authentication keys or our customers' encryption or authentication keys to anyone.
2. Installed any law enforcement software or equipment anywhere on our network.
3. Terminated a customer or taken down content due to political pressure*
4. Provided any law enforcement organization a feed of our customers' content transiting our network.
5. Modified customer content at the request of law enforcement or another third party.
6. Modified the intended destination of DNS responses at the request of law enforcement or another third party.
7. Weakened, compromised, or subverted any of its encryption at the request of law enforcement or another third party.

Now, you might notice that at the end of number three, there's an asterisk. That was done when Cloudflare kicked up quite a debate after it decided to remove Daily Stormer from its service. The asterisk was more or less a nod to the idea that things can be a bit more complicated than "political pressure." Cloudflare kicked off Daily Stormer because its CEO got sick of a bunch of neo-Nazis laughing and joking about Cloudflare for protecting them and keeping them online. Is that political pressure? Seems pretty subjective. Even Cloudflare's CEO, Matthew Prince, acknowledged this at the time, noting:

We're going to have a long debate internally about whether we need to remove the bullet about not terminating a customer due to political pressure. It's powerful to be able to say you've never done something. And, after today, make no mistake, it will be a little bit harder for us to argue against a government somewhere pressuring us into taking down a site they don't like.

The solution that Cloudflare came up with was to keep the line in there with the asterisk and an explanation. And now it's decided to remove the line entirely, as part of the decision earlier this year to remove 8chan from its service as well. However, it's still not an easy call, and the company wants you to understand the thought process it went through:

In August 2019, Cloudflare terminated service to 8chan based on their failure to moderate their hate-filled platform in a way that inspired murderous acts. Although we don’t think removing cybersecurity services to force a site offline is the right public policy approach to the hate festering online, a site’s failure to take responsibility to prevent or mitigate the harm caused by its platform leaves service providers like us with few choices. We’ve come to recognize that the prolonged and persistent lawlessness of others might require action by those further down the technical stack. Although we’d prefer that governments recognize that need, and build mechanisms for due process, if they fail to act, infrastructure companies may be required to take action to prevent harm.

And that brings us back to our warrant canary. If we believe we might have an obligation to terminate customers, even in a limited number of cases, retaining a commitment that we will never terminate a customer “due to political pressure” is untenable. We could, in theory, argue that terminating a lawless customer like 8chan was not a termination “due to political pressure.” But that seems wrong. We shouldn’t be parsing specific words of our commitments to explain to people why we don’t believe we’ve violated the standard.

We remain committed to the principle that providing cybersecurity services to everyone, regardless of content, makes the Internet a better place. Although we’re removing the warrant canary from our website, we believe that to earn and maintain our users’ trust, we must be transparent about the actions we take. We therefore commit to reporting on any action that we take to terminate a user that could be viewed as a termination “due to political pressure.”

I think this was probably the right call, but I'm just as on the fence about it as Cloudflare itself seems to be. There are strong arguments in either direction. The one thing I will say, though, is that I appreciate Cloudflare's willingness to be transparent in this way, and publicly discuss the tough calls its making on things like this. That's something few other companies (especially those as large as Cloudflare) would do. Instead, they'd either hide the removal, or try to PR the issue to death with some vague and noncommittal explanation. This, on the other hand, is direct and quite understandable, even if you disagree with various parts of it.

Filed Under: infrastructure, political pressure, takedowns, warrant canary
Companies: cloudflare

Judge Tells Twitter Revealing Classified Stats Isn't Protected By 1st Amendment... But Says Twitter Can Challenge Classification

from the inching-forward dept

Back in late 2014, we wrote about Twitter suing the US government over whether or not it was allowed to publish just how many National Security Letters and FISA Court orders it receives in its transparency report. This came after a bunch of other tech companies had settled a similar lawsuit with an agreement that they could reveal certain "bands" of numbers, rather than the specific number. It still boggles the mind that merely revealing the number of NSLs and/or FISC orders received would create any problem for national security, but the government seems hellbent on keeping that information secret. Probably because they don't want the public to understand how widely this system is used to obtain info.

We had mentioned this case just a few weeks ago, noting that a bunch of companies had filed an amicus brief pointing out that it's unclear if they can even admit that they've never received such a request (i.e., it's possible that warrant canaries are illegal).

Meanwhile, the DOJ has been trying to get the entire case thrown out because that's what the DOJ does. Judge Yvonne Gonzalez Rogers has now given a mixed ruling denying some of the DOJ's motion, but granting a key part concerning Twitter's First Amendment claim. The good news, though, is that the issue there is at least partially procedural, allowing Twitter to try again.

Twitter had argued, of course, that it has a First Amendment right to publish this information. But the government -- and the judge -- noted in response that you don't have a First Amendment right to publish classified information if you are a party that is "subject to secrecy obligations."

Under Executive Order 13526, information may be classified by the “original classification authority determines that the unauthorized disclosure of the information reasonably could be expected to result in damage to the national security, which includes defense against transnational terrorism, and the original classification authority is able to identify or describe the damage.”...

The First Amendment does not permit a person subject to secrecy obligations to disclose classified national security information.

That said, the court notes that this is partially a procedural issue, because Twitter can (and perhaps should) first challenge whether or not the classification on those aggregate statistics is appropriate:

The Court agrees with the Government that Twitter has not alleged that the information is not properly classified by the Government. Count I challenges the FISA non-disclosure provisions as being prior restraints of indefinite duration, but the claim does not take into account the fact that a classification decision is necessarily limited in duration by its nature, as the Government asserts. Along those same lines, Count II’s as-applied challenge contends that the FISA nondisclosure provisions are unconstitutional, but does not account for the fact that the Government has refused to permit disclosure of the aggregate numbers on the grounds that the information is classified pursuant to the Executive Order (not because of any FISA order or provision).

Again, Twitter has conceded that the aggregate data is classified. In the absence of a challenge to the decisions classifying that information, Twitter’s Constitutional challenges simply do not allege viable claims.

In short: try again, but this time challenge whether or not the aggregate data is properly classified.

On the two other issues in the case, the DOJ lost both. First, it argued that since it was the FISA Court, and not the DOJ, that classified the statistics, the challenge should be under FISA's jurisdiction and not the court that it's in. The court here, disagrees, and points out that Twitter is not challenging a specific FISA ruling, but rather the aggregate data.

The Government does not identify any order of the FISC addressing, as a general matter, publication of aggregate data about receipt of legal process, the crux of the matter before the Court here. Likewise, Twitter’s Amended Complaint does not challenge any prohibition on disclosure in any individual FISC order, FISA directive, or NSL. Rather, Twitter contends that the Government’s reliance on the FISA non-disclosure provisions as a basis for prohibiting disclosure of aggregate data about legal process directed to Twitter violates the First Amendment. Nothing in the Amended Complaint would require the Court to interpret, review, or grant relief from any particular FISC order or directive.

The other DOJ argument was that Twitter did not have standing regarding the Espionage Act. Twitter, in its lawsuit, was seeking declaratory judgment that it is not running afoul of the Espionage Act in publishing such data. It did this because the DOJ had warned Twitter that publishing such data might violate the Espionage Act. Seems fairly straightforward, right? But the DOJ told the court that Twitter's concerns are "merely speculative" and thus it had no standing on this issue. The court isn't buying it:

The Court finds that the allegations here—that Twitter presented the draft Transparency Report it planned to publish to the Government and that the Government informed Twitter that it could not publish the information because it is classified—are sufficient to show an “imminent” injury to establish Twitter’s standing here. The Government’s contention that the threat of prosecution is low because there are other avenues of recourse for Twitter to challenge individual nondisclosure orders simply does not address the issue here, reporting of aggregate data. The motion to dismiss the Espionage Act claim on these grounds is DENIED.

Of course, it's the First Amendment claims that are the main show here -- and without them, the rest of the case is pretty limited. It seems likely that Twitter will file an amended complaint now, arguing that the classification was improper, but then it just becomes a fight over classification, and the government is pretty good about screaming "national security!!!!" at the top of its lungs whenever people challenge classification decisions. The alternative, of course, is that Twitter could appeal the First Amendment decision and see if the appeals court thinks the judge here got that part wrong. Either way, I imagine we'll find out soon.

Filed Under: doj, espionage act, first amendment, fisa court, fisc, national security letters, nsls, transparency, transparency report, warrant canary
Companies: twitter

Reddit's Warrant Canary On National Security Letters... Disappears

from the make-of-that-what-you-will dept

Well, here's something to speculate about. On Thursday, Reddit posted its latest transparency report concerning government requests for user information or content removal. This is the second such report, following its 2014 report. As one Reddit user quickly noted, the 2014 transparency report had something of a "warrant canary" concerning National Security Letters (NSLs): If you can't read that, it says:

As of January 29, 2015, reddit has never received a National Security Letter, an order under the Foreign Intelligence Surveillance Act, or any other classified request for user information. If we ever receive such a request, we would seek to let the public know it existed.

However, no such line is in the latest report. And, of course, that leads to plenty of speculation. Unfortunately, this tends to be the problem with non-standard warrant canaries. It might have disappeared due to a gag order around a NSL. Or it might have disappeared for other reasons. In fact, there is some argument that just posting such a warrant canary is not allowed under current law (which of course raises all sorts of First Amendment questions).

Reddit's CEO Steve Huffman responded in the comments in a manner that doesn't totally clear anything up at all:

Even with the canaries, we're treading a fine line. The whole thing is icky, which is why we joined Twitter in pushing back.

From there, he links to the amicus brief a bunch of internet companies filed in support of Twitter in its ongoing legal fight over the right to disclose surveillance requests. In that lawsuit, Twitter noted that the US government claimed that some information in its planned transparency report was "classified" and Twitter was not allowed to publish it.

In the amicus brief, which Reddit was a part of along with Automattic (Wordpress), CloudFlare, Wikimedia and more, it was pointed out that they're not even sure if it's legal to have that kind of warrant canary:

... this case poses a fundamental lingering question: to what extent do companies have a constitutional right to report truthful aggregate data about national security requests? Amici believe that there is no basis in law or policy for the government to prohibit recipients from disclosing the mere fact that they have or have not received a national security request, and from publishing an accurate, meaningful account of that statistic. And while the government has taken the position that it believes “[n]othing prevents a company from reporting that it has received no national security legal process at all,” ..., it remains unclear whether the First Amendment guarantees that disclosure, or whether a company that has received a national security request in the past could report zero for subsequent periods of time.

And thus, Reddit is now involved in a case over whether or not the very notion of a warrant canary itself is legal -- and that, alone, may be a reason why it chose not to include it this time around. And thus, we're still left with something of a guessing game. Of course, this is another reason why that lawsuit is so important. The level of transparency that platforms can provide to the public about how much governments (and the US government in particular) are demanding access to information is very, very important.

Filed Under: national security letters, nsls, transparency report, warrant canary
Companies: reddit

Let's Encrypt Releases Transparency Report -- All Zeroes Across The Board

from the now-let's-watch-if-anything-changes dept

We've talked a bit about the important security certificate effort being put together by EFF, Mozilla and others, called Let's Encrypt, which will offer free HTTPS security certificates, making it much easier to encrypt the web. They've been busy working on the project which is set to launch in a few months. But first... Let's Encrypt has released its first transparency report. Yes, that's right: before it's launched. As you might expect, there are a lot of zeros here: This is actually pretty important for a variety of reasons. First, it clearly acts as something of a warrant canary. And by posting this now, before launch and before there's even been a chance for the government to request information, Let's Encrypt is actually able to say "0." That may seem like a strange thing to say but, with other companies, the government has told them that they're not allowed to claim "0," but can only give ranges -- such as 0 to 999 if they separate out the specific government requests, or 0 to 249 if they lump together different kinds of government orders. Twitter has been fighting back against these kinds of rules, and others have argued that revealing an accurate number should be protected speech under the First Amendment.

Let's Encrypt is, smartly, getting this first report out there -- with all the zeroes -- before the government can swoop in and insist that it has to only display ranges. In other words, this is getting in before any gag order can stop this kind of thing. Smart move. It's also nice to see them break down all of the different possible types of orders, rather than lumping them into more general buckets. That's an important step that it would be nice to see others follow as well.

Filed Under: fisa orders, nsls, security certificates, surveillance, transparency, transparency report, warrant canary, warrants
Companies: let's encrypt

Encrypted Messaging Service Stops Answering 'Warrant Canary' Questions, Suggesting FBI, Others Are Seeking User Info

from the Golden-Key-Insertion-Team-now-onsite dept

It's beginning to look like a US-based encrypted communications platform may be headed for a Lavabit-esque future. As we're well aware, agencies like the FBI and NSA are firmly opposed to encrypted communications, which is something Surespot -- a text-messaging service -- offers.

Surespot has been in the news lately, thanks to terrorist groups utilizing encrypted services to keep their communications secret. UK's Channel Four looked into Surespot and found that 115 "ISIS-linked" people "appear" to have used the service in the "past six months." Because UK 4 wasn't able to get this information from Surespot directly (because Surespot doesn't store personally identifiable information or users' communications), it has only been able to infer this from messages on social media services that refer to Surespot.

What this means in terms of terrorists "flocking" to encrypted apps is still very vague, but there's no doubt any additional layers of secrecy are welcomed by those wishing to hide their communications. What 115 ISIS-linked users means in terms of an installed user base of at least 100,000 is also open for discussion, but it's quite obvious there are plenty of non-terrorists using the service as well.

But how long will the service stay afloat and uncompromised by national security agencies? The outlook isn't promising. George Maschke of Antipolygraph.org has been periodically sending emails to Surespot, unofficially acting as the service's warrant canary. For several months, his questions have been answered. But as of May 25th, he has still received no response to his canned questions.

In April 2015, I sent [service creator Adam] Patacchiola a similar set of questions but received no reply. I wrote again on 25 May 2015, asking:

1. Has 2fours received any governmental demand for information about any of its users?
2. Has 2fours received any governmental demand to modify the surespot client software?
3. Has 2fours received any governmental demand to modify the surespot server software?
4. Has 2fours received any other governmental demand to facilitate electronic eavesdropping of any kind?

If the answer to any of the above questions is yes, can you elaborate?

I have also attempted to contact [former co-owner Cherie] Berdovich and Patacchiola via the Surespot app itself but have received no reply. While its possible that they’ve simply tired of being pestered by me about government demands for information, I don’t think that’s the case and suspect they are under a gag order.

There's good reason to believe this is true. A recent plea agreement by a 17-year-old Virginia native charged with providing material support to ISIS (via instructions on how to use Bitcoin to provide anonymous donations) specifically mentions Surespot.

In or about late November or early December 2014, the defendant put RN [co-conspirator] in touch with an ISIL supporter located outside of the United States via Surespot in order to facilitate RN's travel to Syria to join and fight with ISIL.

I have sent the same questions to Surespot but am not expecting to receive any answers. It seems pretty clear that the government is seeking information about Surespot's users. Whether or not it will make an attempt to obtain this information en masse, as it did with Lavabit (by demanding the site's SSL key), remains to be seen. Surespot only retains usernames. [As pointed out by Antipolygraph.org's George Maschke, Surespot DOES store more than just usernames.] Surespot doesn't store much in terms of personal info, but does retain enough that frequent contacts could be outed and account holders could be identified through registration methods (email addresses, etc.) Everything else -- including encryption keys -- is stored by the users, either locally or at their chosen cloud service. Messages are end-to-end encrypted, meaning Surespot itself cannot see the contents.

What the government could do is try to force the company into creating a shared master key, which would allow agencies to decrypt messages. The FBI -- which has been most vocal about "going dark" -- may not be able to do this at present, but it is working towards being granted the legal power to do so.

FBI officials now want Congress to expand their authority to tap into messaging apps such as WhatsApp and Kik, as well as data-destroying apps such as Wickr and Surespot, that hundreds of millions of people — and apparently some militants — have embraced precisely because they guarantee security and anonymity.

At this point, Surespot has nothing to hand over to government agencies. But its silence suggests these agencies are asking all the same.

Filed Under: encrypted messages, fbi, isis, warrant canary
Companies: lavabit, surespot

Sign Of The Times: Warrant Canary Management Software Is Now A Thing

from the but-don't-even-think-about-monetizing-it dept

Warrant canaries -- regularly-updated public statements that an organization has not been served with a secret government subpoena -- are not a new idea, but it's interesting to observe how they are still evolving. As Mike noted in an article that appeared in November 2013, they were originally suggested for libraries, and then were picked up by major Internet companies like Apple. Now there's a move into the world of publishing. The Intercept’s parent company, First Look Media, has just unveiled its first warrant canary:

Status: All good
Period: April, 2015

During this period, First Look Media Inc. has received:

Zero National Security Letters
Zero Foreign Intelligence Surveillance Court orders
Zero gag orders that prevent us from from stating that we have received legal process seeking our customers' information

Lynn Oberlander
General Counsel, Media Operations
First Look Media, Inc

As The Intercept article announcing this move points out, there is a site called Canary Watch, which keeps track of warrant canaries. That's one sign of the increasing normalization of the idea. Another is the release of new software from First Look called AutoCanary:

AutoCanary is a desktop program for Windows, Mac, and Linux that makes the process of generating machine-readable, digitally signed warrant canary statements simpler.

Here's how it works:

Choose one person in your organization (probably your General Counsel) to be responsible for signing warrant canary statements. This person must have a PGP key.

Choose how often you wish to issue canary statements (available options include weekly, monthly, quarterly, and semi-annually).

Set a recurring event with a reminder in your calendar to sign your canary statement. This is important: failing to publish your canary statement on time could result in automated alarms ringing. If your canary stops tweeting, it may lead your users to believe you’ve received a gag order when you haven’t.

Create a page on your website to publish your warrant canary message

That's hardly a complicated process, but it's good to see First Look making it even easier with AutoCanary, especially since the software has been released as open source, along with pdf-redact-tools, "a set of tools to help with securely redacting and stripping metadata from documents before publishing." Partly as a result of this move, we can probably expect to see many more warrant canaries being published in the future.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: government orders, surveillance, transparency, warnings, warrant canary

Did Apple Keep Or Remove Its Warrant Canary Concerning PATRIOT Act Requests?

from the unclear dept

Last fall, we wrote about how Apple has placed a warrant canary in its first ever Transparency Report, noting:

Apple has never received an order under Section 215 of the USA Patriot Act. We would expect to challenge such an order if served on us.

In case you haven't been keeping track, the Section 215 orders are so called "business records" requests. It's the basis for the orders to Verizon demanding metadata on all calls. It's not the whole PRISM program, which details more specific requests for content and metadata. A "warrant canary" is pretty much exactly what it sounds like. Since these requests come with gag orders, you can get out in front of them by saying ahead of time that you haven't received one. Then, if it disappears, people have reason to believe that you did get such a request and just can't talk about it anymore.

Jeff John Roberts, over at GigaOm, has noticed that updates to Apple's Transparency Reports didn't appear to have that same warrant canary, leading to speculation that perhaps Apple had received just such a Section 215 order. However, it's not clear if that's true. Christopher Soghoian has pointed out that the transparency reports do include some similar language:

To date, Apple has not received any orders for bulk data.

And, contrary to Roberts' reporting, Section 215 is not the basis for PRISM, which we already knew Apple is a part of, but rather for bulk data collection of "business records." So if it hasn't received "any orders for bulk data," then it still seems likely that it hasn't received a 215 order, but it's not entirely clear. As Soghoian notes: "There is a lesson to be learned here: once you post a warrant canary, it needs to stay in the same place and use the same language."

Of course, it's possible that Apple is actually signalling something different here. Perhaps it truly has not received a 215 order, but it did get pressured from the DOJ not to use the original warrant canary language. That would explain the change in wording, though would still raise some serious questions about the legality of such a demand from the DOJ.

Filed Under: bulk data, patriot act, warrant canary
Companies: apple

Apple Puts Dead Man's Switch About Not Receiving PATRIOT Act Requests In Its Transparency Report

from the well,-look-at-that... dept

It's a bit late, but it appears that Apple has finally caught up with Google, Twitter, Microsoft, Facebook and Yahoo, as tech companies that have issued "transparency reports" about government requests for data (and, in some cases, for takedowns). The first Apple Transparency Report is pretty similar to the transparency reports issued by those other companies. As with the others, the US government only allows "ranges" of information to be released about certain kinds of reports, rather than exact numbers. And, of course, no companies are yet allowed to reveal the details of Section 702 orders -- which are a part of the PRISM program. The various companies are suing the government over that one.

Some people have noted that Apple seems to get fewer requests than some other companies, but that doesn't seem like an apples-to-apples comparison, since Apple's main business is hardware, and its online services are much more limited and targeted than those other companies. But, there is one interesting tidbit in the report. Way down at the end it says the following:

Apple has never received an order under Section 215 of the USA Patriot Act. We would expect to challenge such an order if served on us.

Now, Section 215 of the PATRIOT Act is the so-called "business records" or "tangible things" clause, which is used to demand all the metadata from the various telcos (who appear to be happy to hand it over without complaint). There's been no indication so far that the government has used 215 on the tech companies. PRISM all relates to Section 702 of the FAA, which the lawsuit mentioned above is about. And, of course, there are reports of the NSA using Executive Order 12333 to justify hacking into servers overseas, without companies even knowing about it. So, you can argue that whether or not any Section 215 orders were served on Apple is somewhat meaningless.

But... it appears that Apple has put this in the report as a sort of dead man's switch, such as Cory Doctorow suggested a few months ago: for companies that have not received any such type of order, if they announce that publicly on a regular basis, if the next time they release a report it's not in there, it becomes clear that they have received such an order, even if they're gagged about it. This is also known as a warrant canary, and was originally suggested for libraries -- who were afraid of Section 215 from the very beginning (early on, it was often referred to as the library clause), as people expected the feds to use it to spy on people's library records.

While given the other programs this may not seem like a big deal, it's nice to see Apple taking this particular step, even if small, to effectively protest against the 215 gag orders.

Filed Under: dead man's switch, patriot act, prism, section 215, section 702, transparency, warrant canary
Companies: apple