Law & jurisdiction

What is Warrant canary?

Definition

A warrant canary is a regularly republished statement that a provider has not received a secret legal demand; its disappearance implies that one has arrived. It is only meaningful with a fixed schedule, a cryptographic signature and a recent external timestamp proving it could not have been pre-signed.

Why Warrant canary matters

It is only meaningful with a fixed schedule, a cryptographic signature and a recent external timestamp proving it could not have been pre-signed. Its legal status is largely untested.

Warrant canary in practice

When running a server with a warrant canary, you would monitor its publication schedule and verify each new statement carries a valid cryptographic signature and an external timestamp. Your practice would be to script the check, alert on a missed deadline, and treat a missing canary as an immediate legal event. A disappearance implies a demand has arrived. The cost of ignoring it is operational blindness: you keep serving traffic to users you can no longer assure of your silence. Getting it wrong means republishing a stale or unsigned canary, which defeats its evidentiary value entirely.

What people get wrong about Warrant canary

People think a warrant canary is a legal shield that prevents a secret demand from being enforced. It is not. It is an information channel: a statement that a demand has not arrived, published on a fixed schedule. If the demand does arrive, the canary disappears, and observers infer what happened. Mistaking it for a legal protection leads providers to treat it as optional, and the omission signals more than any reply.

Warrant canary — common questions

How do I verify a warrant canary?

Check the publication schedule: a fixed interval. Verify the cryptographic signature matches the public key. Confirm the timestamp comes from an external source, so it could not have been pre-signed. If any element is missing, treat the canary as unreliable.

What happens if a canary disappears?

A disappeared canary implies the provider received a secret legal demand, such as a national security letter or a gag order. Providers typically cannot disclose the demand itself, so the absence of the canary is the only signal. You should consider your data no longer protected by that provider's silence.

More from law & jurisdiction

KYC
KYC is the set of identity-verification duties imposed on regulated financial institutions before providing services.
No-KYC hosting
No-KYC hosting is server hosting that requires no identity verification — no government ID, billing address, phone number or payment card.
Offshore hosting
Offshore hosting means placing a server in a jurisdiction other than your own, typically one outside the Fourteen Eyes alliances and outside EU data-retention rules.
Five Eyes
The Five Eyes is a signals-intelligence sharing alliance between the United States, United Kingdom, Canada, Australia and New Zealand.
Fourteen Eyes
The Fourteen Eyes is the widest of the signals-intelligence sharing groupings, comprising the Five Eyes plus Denmark, France, the Netherlands, Norway, Belgium, Germany, Italy, Spain and Sweden.
MLAT
An MLAT is a treaty through which one country formally requests another to gather evidence on its behalf.
DMCA
The DMCA is United States copyright statute whose notice-and-takedown procedure and safe harbour apply to service providers situated in the United States.
Data retention
Data retention laws require communications providers to store connection metadata for a defined period so that authorities can obtain it later.