Warrant Canaries Beyond the First Amendment
Warrant canaries have emerged as an intriguing tool for Internet companies to provide some measure of transparency for users while also complying with national security laws, or so the argument goes.[1] How do they work? A warrant canary is a statement that an Internet company regularly publishes indicating it has not yet received a legal process that, if received, the company would be prohibited from disclosing.[2] Once such a legal process is received, the Internet company removes the statement, providing a kind of silent signal or warning.[3] Like the canaries in coal mines, the warrant canary is meant to warn users about the presence of a threat; here, it is not the presence of noxious gas, but overreaching government activities that may threaten rights.
Warrant canaries have been predominantly employed by Internet companies based in the United States — like Apple, Tumblr, Silent Circle, SpiderOak, and Pinterest — and typically appear in transparency reports about user data.[4] These American origins are not surprising, as warrant canaries are essentially designed for US law. While the US authorities may be able to “gag” or prevent Internet companies from talking about secretive legal processes they receive, [5] the theory is the First Amendment would prevent the government from compelling Internet companies from continuing to publish the warrant canary.[6] This is known as the First Amendment’s “compelled speech” doctrine. Though there is very little scholarship on point and no cases testing the theory, there is at least a reasonable argument for the legality of warrant canaries in the US, as one recent analysis has concluded.[7] The same cannot be said for the use of warrant canaries elsewhere. Why is this a problem? First, national security surveillance is today internationalized, particularly among close Western allies. The “Five Eyes” intelligence agency countries — the US, United Kingdom, Canada, New Zealand, and Australia — have a secret treaty that governs information sharing and surveillance cooperation as well as similarly secretive national security laws and processes.[8] There are also documented cases where these agencies have cooperated in order to flout domestic legal constraints on their surveillance activities.[9] Second, responding to similar transparency demands of users, Internet companies in these Five Eyes countries are now also considering employing warrant canaries.[10] Yet, despite the need, the legality of warrant canaries in any of these countries has yet to be explored. This comment aims to help fill that void — with an overview of warrant canaries’ potential legality in the Five Eyes countries. Unfortunately, that legality is questionable at best.
The warrant canary’s legal theory assumes legal or constitutional restraints on compelled speech, that is, the power of the state to force a citizen to say something as opposed to merely restricting speech. The government could not, for example, compel Apple to publish a false statement that it had never received an order under Section 215 of the USA Patriot Act, if it had. [11] In Canada, law enforcement and national security agencies like the Royal Canadian Mounted Police (RCMP), Canadian Security Intelligence Service (CSIS), and Canadian is the Communications Security Establishment Canada (CSEC) all have the power to obtain “gag” or non-disclosure orders for legal processes served on Internet companies.[12] But what of compelled speech? Freedom of expression is protected under section 2(b) in the Canadian Charter of Rights and Freedoms, and the Supreme Court of Canada has recognized that this includes “the right not to say certain things”[13] or, as put by the Ontario Court of Appeal, the right “not to express certain views.”[14] So, speech compelled by the government has been held to violate section 2(b) rights. But if a prima facie right violation is made out, the government can still argue, under section 1 of the Canadian Charter, that it is a reasonable limit — one that is “demonstrably justifiable in a free and democratic society.”[15] This is likely a problem for warrant canaries, as Canadian courts have proven quite deferential to government justifications for compelled speech, finding it a reasonable limit on section 2(b) rights in a range of contexts, including a compelled oaths,[16] union fees,[17] tobacco health warnings,[18] as well as an order forcing an employer to “say” only certain objective facts in a statement while restricting any speech that contradicted those facts.[19] Courts would likely find national security or “anti-terrorism” objectives compelling or pressing reasons to justify such limits. In Canada, there is some legal potential for warrant canaries, but it is shaky at best.
Warrant canaries in New Zealand and Australia, two other Five Eyes countries, would face similar problems. In New Zealand, though the case law is not determinative, free speech protections under section 14 of the New Zealand Bill of Rights Act likely include a right “not to be compelled to say certain things.” [20] However, the New Zealand Bill of Rights Act also contains a “justification” provision (section 5) worded exactly like Canada’s, where limits on rights are constitutional if “demonstrably justified in a free and democratic society.” New Zealand courts also apply a legal test for this section drawn from Canadian case law — the same legal test that led to deferential results on compelled speech in Canada.[21] With little case law on point, it is very difficult to determine the legality of warrant canaries; at the very least, it would be a highly risky move for a New Zealand Internet company to attempt at this point. The situation in Australia is more certain — warrant canaries have little legal basis. There is no explicit or implied constitutional protection for freedom of expression, nor right against compelled speech, in the country, beyond narrow common law limits. The Australia High Court, as recently as 2012, issued a landmark decision on compelled speech, finding that a law imposing sweeping forms of compelled speech on private companies — in the form of government prescribed standard packaging and intrusive health warnings for tobacco products — entirely constitutional.[22] Notwithstanding the broad scope of the government compelled speech, this result was, in light of scant Australian constitutional protections for this type of speech, in little doubt from the beginning.[23]
Finally, law in the United Kingdom likewise offers little comfort for warrant canary and transparency advocates. Public authorities in the UK such as the Government Communications Headquarters (GCHQ) can serve secret legal processes with non-disclosure orders under the Regulation of Investigatory Powers Act (RIPA). Law enforcement can also compel Internet companies to produce encryption keys under Part III of RIPA, itself a form of compelled speech. Interestingly, a practice of “tipping off” — comparable to warrant canaries — has been used in relation to such key disclosures. Here, parties state that if they voluntarily revoke a key, they will always explain why; but if they are secretly required to “revoke” by public authorities, they will offer no explanation, tipping off others.[24] Neither these “tipping off” practices nor warrant canaries have been legally tested, however, and the law offers few protections. The UK Human Rights Act (1998) includes rights to freedom of expression under Article 10, but this right is explicitly “qualified” and can be limited for a host of state objectives, including “national security,” “territorial integrity,” “public safety,, and “prevention of disorder,” to name a few. These are the very objectives public authorities would likely cite to justify compelled speech in a national security investigation; they would also have explicit language to rely on for these limits in Article 10(2). What is more, “unwritten” common law speech protections are just as unhelpful. [25] Again, no clear legal basis exists for warrant canaries.
Internet companies today find themselves caught between growing user demands for transparency and government requirements that any secret national security requests made to those companies remain exactly that — secret. In this increasingly complex legal and regulatory space, warrant canaries offer a potentially innovative tool for greater transparency, but they may be, as Jonathan Zittrain has suggested, too clever by half.[26] Among the other countries in the Five Eyes intelligence alliance — all beyond the reach of broad US First Amendment protections — the legality of warrant canaries is murky and fraught with uncertainty; a risky venture for any Internet company to undertake.
———————-
[1] Warrant canaries first appeared with respect to FBI requests of libraries: Jessamyn West, The FBI, and Whether They’ve Been Here or Not, LIBRARIAN.NET (Sept. 9, 2013), http://www.librarian.net/stax/4182/the-fbi-and-whether-theyve-been-here-or-not/; Ben Johnson, A Canary in the Coal Mine… and In Your Mac, Marketplace Tech (May 13, 2014), http://www.marketplace.org/topics/tech/canary-coal-mine-and-your-mac
[2] Kurt Opsahl, Warrant Canary Frequently Asked Questions, , Electronic Frontier Foundation: Deep Links (Apr. 10, 2014), https://www.eff.org/deeplinks/2014/04/warrant-canary-faq
[3] Ibid.
[4] Ibid.
[5] Secret subpoenas under the Electronic Communications Privacy Act; Section 215 orders for bulk data under the Patriot Act; and Section 702 orders under the FISA Amendment Act, are part of this regulatory regime; legal processes that Internet companies receive accompanied by a “gag” or non-disclosure order. See Brennan Center for Justice, FACT SHEET: Are They Allowed to Do That? A Breakdown of Selected Government Surveillance Programs, New York University School of Law, http://www.brennancenter.org/sites/default/files/analysis/Government%20Surveillance%20Factsheet.pdf
[6] Opsahl, ibid.
[7] See Naomi Gilens, Note: The NSA Has Not Been Here — Warrant Canaries as Tools for Transparency in the Wake of the Snowden Disclosures, SSRN (Apr. 2014), http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2498150
[8] Owen Bowcott, ‘Five Eyes’ surveillance pact should be published, Strasbourg court told, The Guardian (Sept. 9, 2014), http://www.theguardian.com/world/2014/sep/09/five-eyes-surveillance-pact-appeal-disclosure-human-rights
[9] Colin Perkel, Canadian spy agency withheld information from court to get warrants, judge says, The Toronto Star (Dec. 20, 2013), http://www.thestar.com/news/canada/2013/12/20/canadian_spy_agency_withheld_information_from_court_to_get_warrants_judge_says.html; Ewen MacAskill et al, Revealed: Australian spy agency offered to share data about ordinary citizens, The Guardian (Dec. 2, 2013), http://www.theguardian.com/world/2013/dec/02/revealed-australian-spy-agency-offered-to-share-data-about-ordinary-citizens; Glenn Greenwald et al, NSA shares raw intelligence including Americans’ data with Israel, The Guardian (Sept. 11, 2013), http://www.theguardian.com/world/2013/sep/11/nsa-americans-personal-data-israel-documents; Glenn Greenwald et al, NSA shares raw intelligence including Americans’ data with Israel, The Guardian (Sept. 11, 2013), http://www.theguardian.com/world/2013/sep/11/nsa-americans-personal-data-israel-documents;
[10] Alec Muffett, TIL: What a Warrant Canary Is…, Dropsafe Blog (Jun., 2013), http://dropsafe.crypticide.com/article/11532; Doctorow, ibid (suggesting warrant canaries for the U.K.).
[11] This is not an abstract thought experiment. See Iain Thomson, Apple’s Warrant Canary Riddle: Cock-Up, Conspiracy, or Anti-Google Point Scoring, The Register, (Sept. 20, 2014), http://www.theregister.co.uk/2014/09/20/apples_warrant_canary_is_either_cockup_conspiracy_or_the_antigoogle_selling_point/
[12] See Steven Penney, National Security Surveillance in an Age of Terror: Statutory Powers and Charter Limits, 48 Osgoode Hall LJ 247 (2010).
[13] Slaight Communications Inc. v Davidson, 1989 CanLII 92 (SCC), [1989] 1 SCR 1038 (Per Justice Lamar at para 95).
[14] Rosen v Ontario (A.G.) (1996), 1996 CanLII 443 (ON CA), 131 DLR (4th) 708, at para 16 (Ont CA).
[15] Section 1, Canadian Charter of Rights and Freedoms.
[16] McAteer et al. v. Attorney General of Canada, 2013 ONSC 5895 (CanLII), <http://canlii.ca/t/g0n32>
[17] Lavigne v. Ontario Public Services Employees Union et al. (1991), 1991 CanLII 68 (SCC), 81 D.L.R. (4th) 545 (S.C.C.).
[18] RJR McDonald Inc. v Canada (Attorney General), 1995 CanLII 64 (SCC), [1995] 3 SCR 199
[19] Slaight Communications Inc. v Davidson, 1989 CanLII 92 (SCC), [1989] 1 SCR 1038.
[20] As noted by one former Attorney General: Report of the Attorney General under the New Zealand Bill of Rights Act 1990 on the Sale of Liquor (Health Warnings) Amendment Bill.
[21] Ibid at 2.
[22] JT International v Commonwealth of Australia et al [2012] HCA 43. ABC News, High Court rejects plain package challenge, ABC.Net.Au (Aug. 15, 2012), http://www.abc.net.au/news/2012-08-15/high-court-rules-in-favour-of--plain-packaging-laws/4199768;
[23] Melinda Upton and Jessie Buchan, Australia: Australian High Court Rejects Challenge By Big Tobacco And Determines Plain Packaging Laws Are Constitutional And Valid, Mondaq (Nov. 17, 2012), http://www.mondaq.com/australia/x/206502/Constitutional+Administrative+Law/tobacco+plain+packaging
[24] Foundation for Information Policy Research, Key Revocation, Government Access to Keys and Tipping Off, FIPR Web, http://www.fipr.org/rip/BG_revoke.htm
[25] Cory Doctorow, How to foil NSA sabotage: use a dead man’s switch, The Guardian (Sept. 9, 2013), http://www.theguardian.com/technology/2013/sep/09/nsa-sabotage-dead-mans-switch (noting the UK “unwritten constitution” to be unclear on point).
[26] As quoted in: Ben Johnson, A Canary in the Coal Mine… and In Your Mac, Marketplace Tech (May 13, 2014), http://www.marketplace.org/topics/tech/canary-coal-mine-and-your-mac
