← Back to context

Comment by john_b

12 years ago

A number of people have pointed out that this method probably wouldn't hold up in courts because you are, in effect, communicating the existence of a NSL by ceasing to update the canary. And when courts consider the legal rights of a government body charged with fighting terrorism against the ill defined rights of a server owner to control the content of their server, the rights of the former are likely to trump those of the latter.

But since the purpose of this method is to effect civil disobedience, maybe the same end could be realized via different means. Hypothetically speaking, if a service provider kept a database of all NSLs received, but failed to strongly secure the database, leading to its access by an outside third party, this shouldn't constitute "communication". The database could perhaps be made accessible via a URL ("to enable remote workers to view and process NSLs" or some plausible justification) but protected by a weak password. An employee of that service provider could then secretly leak the password to a third party. Bad network security is not a crime, and unless the third party revealed that the password had been leaked, there would be no way to prove that it wasn't guessed or brute forced.