Don’t have a canary: Why Silent Circle dropped its warrant warning page

When you don’t keep customer data to begin with, the warrant canary is redundant.

Sean Gallagher – Jul 6, 2016 2:25 pm | 35

The Silent Phone app from Silent Circle is encrypted end-to-end, so there's really no call for a canary.

News reports that Silent Circle, the commercial encrypted voice-over-IP service company that manufactures the security-focused Blackphone, had removed its "warrant canary" webpage have apparently created some confusion. Things only got fuzzier since the company counsel stated that the page’s removal was a “business decision” and not the result of a warrant being served against the company for customer data. But the explanation for that decision, made more than a year ago with no fanfare, is actually very simple: Silent Circle's customers don't care. In fact, the warrant warning might have been a liability with some of Silent Circle's core customers, who might be more likely to be serving a warrant than receiving one.

Many of Silent Circle’s customers are in the government and corporate sector. "Our customer base is generally not concerned with law enforcement," Vic Hyder, Silent Circle's chief strategy officer, explained to Ars. "They use Silent Circle to protect their business activities from criminals and competition for the most part."

As Ars reported when we tested the original Blackphone and the Blackphone 2, the Silent Phone service definitely keeps customer security at the core. It provides end-to-end encrypted voice, video, and text messaging, and the service doesn’t provide any way for the Switzerland-based company to monitor or log the contents of messages, much as Apple’s iMessage service can’t. In addition to a layer of SSL encryption between the two ends of a call or message stream, Silent Phone applies another layer of encryption based on an exchange of keys. As a result, once the call or message thread is established, all of the data is protected between devices. In cases of calls from Silent Phone to an unsecured phone, the call is encrypted all the way to Silent Circle’s access point to the switched public phone network.

But as an added provision of privacy, Silent Circle used to provide this “warrant canary” page on its site. The page theoretically allowed the company to bypass gag orders regarding Foreign Intelligence Surveillance Act warrants and National Security Letters. By deleting or modifying the page’s statement on whether the company had received warrants for customer data, the company could discreetly signal to customers if it had received one.

According to Hyder, the warrant canary was ultimately more of a liability than it was worth. "The main reason [we cut it] is it was of little benefit to our enterprise customers, with whom we have contracts," he told Ars. "We cannot, literally, provide access to the encrypted data whether messages or voice. Neither do we log service usage, and the only other information we maintain is customer data primarily for billing purposes. The canary was an unnecessary maintenance requirement which we shut down nearly two years ago, I believe."

Hyder reiterated general counsel Matt Neiderman’s statement, saying, "we have not received any warrants and we do not expect any since we have so little information available."