Introducing our Warrant Canary

News
1

We have introduced a publicly signed warrant canary for Joplin.

A warrant canary is a regularly updated statement confirming that, as of the stated date, the project has not received secret legal orders, gag orders, or demands requiring the introduction of backdoors into the software or its infrastructure.

The canary is:

  • Cryptographically signed using a dedicated OpenPGP key

  • Updated every 60 days

  • Published in plain text for independent verification

If the canary is not updated within its stated validity window, it should be considered expired.

You can view and verify the current canary here:

https://raw.githubusercontent.com/laurent22/joplin/refs/heads/dev/readme/canary.txt

With additional information on how it is generated and managed there:

This measure is intended to improve transparency and provide an additional signal to the community. It does not prevent legal orders, but it helps ensure that any material change in our legal status cannot occur silently.

22 Likes
2

This is great, thank you!

1 Like
3

What happens if the order directs you to update the canary? Being Devil’s advocate here.

2 Likes
4

I'm not a lawyer, but I don't think you can compel someone to do something?

5

In California, if I were a government attorney, I see no problem asking a judge to compel you do something to maintain what we call the “status quo” which could include updating any notification signals. But this probably would be in the province of the Department of Justice as federal laws would be applicable and hence, federal court jurisdiction. I really am unaware of any doctrine which would prevent such an interim remedy. I am not a lawyer, too, and I am not providing any advice, I’m just asking a question. I was lawyer for 40 years and I retired several years ago. With what I’m witnessing in jurisprudence in the United States, I’d say anything is possible and if you have an aggressive administration wanting to set policy, then you are talking about a protracted appellate procedure which could easily exceed $1 million. I would not place a lot reliance on your proposed canary system, hence people should be aware whatever they have on servers, public or private, is potential evidence and game for a temporary restraining order and/or preliminary injunction.

6

I wonder how that would work in practice though - how can they force someone to keep doing something every three months for the rest of their life?

1 Like
7

At least in the US, where I know you’re not based, that would constitute an illegal compulsion of speech

8

Well, if you ever have the misfortune to receive some order, your attorney (and he may have to have a security clearance which may mean not your regular attorney) will best advise you.

1 Like
9

I doubt it would be "for life", just until the fact that the data had been obtained would not prejudice the investigation.

I think the way it works is that the warrant states that you are placed under a duty not to disclose the existence of the warrant itself using a phrase such as "by any act or omission". A "warrant canary", as shown by its title alone, is a method of indicating that such a warrant has been served. Therefore by not publishing a valid "warrant canary" you would, by omission, have breached the warrant because it would make the existence of the warrant known.

IANAL, I am just trying to remember something I read a long time ago when the idea of "warrant canaries" first became popular.

Additionally, activate the "warrant canary" and BOOM the business is gone. It has declared itself compromised but it still cannot explain what or how much it had to divulge or why or to whom, without blatantly disobeying the warrant. It declares that potentially all users have had all their data seized even if it was for one file that customer x was known to have uploaded on a specific date at a specific time.

It's also quite a responsibility. You often hear of companies forgetting to renew their TLS certificates and the like. You cannot forget to renew a "warrant canary" and then say, "Ooops sorry!".

As I see it, the "warrant canary" is a self-destruct button for those whose business model requires them to have a self-destruct button. One which they are prepared to use at any cost both personally and as a company.

Remember a "warrant canary" is not a "fun" feature to have. This is serious stuff. We hear about warrants being abused with authorities being accused of too broad data grabbing or over-reach. However as far as those authorities are concerned a "warrant canary" is something used to unlawfully alert those under investigation, undermine an investigation and so potentially help them avoid being brought to justice. They will likely treat it as such.

Again, not a lawyer. Just someone who has been mulling this over since the topic was first created.

10

From my understanding of English law (but also IANAL and there’s multiple territories at play here);

Personally, I’d like to believe that you can’t be compelled to keep updating the canary. In the US there’s stronger laws around being coerced into speech, but generally in “common law” countries like e.g., the UK/US, Actus Reus (physical action) is an absolute requirement in criminality. You can’t be considered criminal in most situations by simply not doing something, even at extreme cases of e.g., watching someone dying in the street. There are exceptions where omissions come into play even there, but it’s limited to very specific “Duty of Care” scenarios that are outright exceptional from a legal POV.

If the laws were held up how they’re taught philosophically then, you couldn’t be held criminal through inaction unless there’s other laws at play which obligate you. So, for stuff like fraud, there could be crimes committed through omissions (e.g., failing money laundering checks). Or e.g., omitting to pay tax is a crime because there’s other laws that make it outright so, but since a Warrant Canary isn’t bound in legislation to begin with, I’d like to believe you can’t fail to omit updating it, but then maybe they’d abuse statements like “assisting suspected terrorism” to try bringing in other legal powers and pinning you down for anything that could stick.

Realistically I don’t think the government is entirely just regardless, I think Joplin legally is also French, where mainland Europe traditionally has different legal frameworks to e.g., UK/US and so confuses things even more.

Personally I’d encourage people to put faith in the maths behind encryption and explore enabling E2E rather than what the police and government may or may not do, because ultimately, the main issue with the law is the inconsistency in enforcing it, so while I’m here thinking “No, legally they shouldn’t be able to force you to update it”, I’m also thinking practically “The UK tried backdoor every iOs device in the world and the US already had the Snowden leaks”, ultimately, some departments are above the law as far as enforcement seems to go.

There’s a reason XKCD meme’d the five dollar wrench.