Law & jurisdiction
What is Warrant canary?
A warrant canary is a regularly republished statement that a provider has not received a secret legal demand; its disappearance implies that one has arrived. It is only meaningful with a fixed schedule, a cryptographic signature and a recent external timestamp proving it could not have been pre-signed.
Why Warrant canary matters
It is only meaningful with a fixed schedule, a cryptographic signature and a recent external timestamp proving it could not have been pre-signed. Its legal status is largely untested.
Warrant canary in practice
When running a server with a warrant canary, you would monitor its publication schedule and verify each new statement carries a valid cryptographic signature and an external timestamp. Your practice would be to script the check, alert on a missed deadline, and treat a missing canary as an immediate legal event. A disappearance implies a demand has arrived. The cost of ignoring it is operational blindness: you keep serving traffic to users you can no longer assure of your silence. Getting it wrong means republishing a stale or unsigned canary, which defeats its evidentiary value entirely.
What people get wrong about Warrant canary
People think a warrant canary is a legal shield that prevents a secret demand from being enforced. It is not. It is an information channel: a statement that a demand has not arrived, published on a fixed schedule. If the demand does arrive, the canary disappears, and observers infer what happened. Mistaking it for a legal protection leads providers to treat it as optional, and the omission signals more than any reply.
Warrant canary — common questions
How do I verify a warrant canary?
Check the publication schedule: a fixed interval. Verify the cryptographic signature matches the public key. Confirm the timestamp comes from an external source, so it could not have been pre-signed. If any element is missing, treat the canary as unreliable.
What happens if a canary disappears?
A disappeared canary implies the provider received a secret legal demand, such as a national security letter or a gag order. Providers typically cannot disclose the demand itself, so the absence of the canary is the only signal. You should consider your data no longer protected by that provider's silence.
Where Warrant canary comes up
- What happens if you receive a subpoena or court order? We assess whether it is valid legal process from a court with jurisdiction over OnionVPS. If it is, we comply with exactly what is ordered and nothing beyo…
- What is a warrant canary and does it work? A warrant canary is a regularly updated statement that a provider has not received a secret legal demand. If the statement stops being updated, the reader …
- Is OnionVPS a legitimate hosting provider? OnionVPS is a registered Seychelles International Business Company operating since 2020, running its own AS200558 network with transit from Cogent, Lumen, …
- Which countries have no mandatory data retention? Panama, Seychelles, Belize, Costa Rica, Curaçao, Moldova and Georgia impose no general data-retention obligation on hosting providers. Switzerland's obliga…
- How do I contact support? Through the encrypted ticket desk in the control panel, by email to [email protected], or over Telegram and XMPP. Support is staffed 24/7/365 and the me…
More from law & jurisdiction
- KYC
- KYC is the set of identity-verification duties imposed on regulated financial institutions before providing services.
- No-KYC hosting
- No-KYC hosting is server hosting that requires no identity verification — no government ID, billing address, phone number or payment card.
- Offshore hosting
- Offshore hosting means placing a server in a jurisdiction other than your own, typically one outside the Fourteen Eyes alliances and outside EU data-retention rules.
- Five Eyes
- The Five Eyes is a signals-intelligence sharing alliance between the United States, United Kingdom, Canada, Australia and New Zealand.
- Fourteen Eyes
- The Fourteen Eyes is the widest of the signals-intelligence sharing groupings, comprising the Five Eyes plus Denmark, France, the Netherlands, Norway, Belgium, Germany, Italy, Spain and Sweden.
- MLAT
- An MLAT is a treaty through which one country formally requests another to gather evidence on its behalf.
- DMCA
- The DMCA is United States copyright statute whose notice-and-takedown procedure and safe harbour apply to service providers situated in the United States.
- Data retention
- Data retention laws require communications providers to store connection metadata for a defined period so that authorities can obtain it later.