Uploaded February 2019 | Updated September 2026, 1 week ago
We rely on some digital services for critical functions around security and privacy. Trusting those services is paramount to their success and ours. But it can be difficult to trust when you don't know what's going on behind the scenes. Gag orders from the courts can amplify those trust issues. The idea of a warrant canary can help to ease your concerns about government and law enforcement snooping but it's far from a perfect solution.
CloudFlare recently added new warrant canaries to their transparency report. Others have also adopted the practice but is it effective? Does this tactic add value to a transparency report or just another seed of doubt?
How does this lack of awareness of what's going on behind the scenes affect your risk assessments? Your cybersecurity?
References:
- CloudFlare's explanation of why and how they use warrant canaries, blog.cloudflare.com/cloudflare-transparency-update-joining-cloudflares-flock-of-warrant-canaries-2
- Zack Whitaker covering the issue for TechCrunch, techcrunch.com/2019/02/26/cloudflare-warrant-canary
- Reuters story on Reddit deleting their canary 3 years ago, reuters.com/article/us-usa-cyber-reddit-idUSKCN0WX2YF
- the EFF's explanation of the issues at hand, eff.org/deeplinks/2014/04/warrant-canary-faq
- a great example of a transparency report from Microsoft, microsoft.com/en-us/corporate-responsibility/lerr
// MWM Y2 no. 016
We rely on some digital services for critical functions around security and privacy. Trusting those services is paramount to their success and ours. But it can be difficult to trust when you don't know what's going on behind the scenes. Gag orders from the courts can amplify those trust issues. The idea of a warrant canary can help to ease your concerns about government and law enforcement snooping but it's far from a perfect solution.
CloudFlare recently added new warrant canaries to their transparency report. Others have also adopted the practice but is it effective? Does this tactic add value to a transparency report or just another seed of doubt?
How does this lack of awareness of what's going on behind the scenes affect your risk assessments? Your cybersecurity?
References:
- CloudFlare's explanation of why and how they use warrant canaries, blog.cloudflare.com/cloudflare-transparency-update-joining-cloudflares-flock-of-warrant-canaries-2
- Zack Whitaker covering the issue for TechCrunch, techcrunch.com/2019/02/26/cloudflare-warrant-canary
- Reuters story on Reddit deleting their canary 3 years ago, reuters.com/article/us-usa-cyber-reddit-idUSKCN0WX2YF
- the EFF's explanation of the issues at hand, eff.org/deeplinks/2014/04/warrant-canary-faq
- a great example of a transparency report from Microsoft, microsoft.com/en-us/corporate-responsibility/lerr
// MWM Y2 no. 016
