TIL What a Warrant Canary Is

A warrant canary is a colloquial term for a regularly published statement that a service provider has not received legal process that it would be prohibited from saying it had received. Once a service provider does receive legal process, the speech prohibition goes into place, and the canary statement is removed. Source

In a nutshell, a “service provider” hoists a flag periodically that affirms they have not been subpoenaed for user information by a government agency. Often times these national security letters come with a gag order to not discuss the request. By not updating the warrant canary, or the canary disappearing, a provider can passively inform their users that an agency may have requested information and they’re now under a gag order. It’s a cute, and believed-to-be-legal way to inform users that their information may no longer be safe with the provider.

Canary Watch has even gone further and keeps an eye on any warrant canaries that are out there! Service providers watched on the site include reddit, tumblr, Adobe, and Cloudflare, among many others.

FCC to Help Protect Your Mobile Privacy

On my way to Prague last month, I decided to pick up May’s print volume of PC Today. Coincidentally, the entire volume was focused on security.

The first article that caught my attention was about the Federal Communications Commission’s plans to help the victims of phone theft. The article goes on to say, “… when a given phone is reported stolen, wireless carriers can remotely shut down that phone.” What does this mean for you, the consumer?

First of all, the FCC is attempting to protect victims of data and identity theft. However, more than likely your data will be long retrieved by the time you notice your phone is stolen and call the wireless provider.

Secondly, the article cites the FCC’s statistic that 40% of New York City robberies are that of mobile phones. However, I doubt that the majority of those were for the purpose of data theft but rather for the theft of the hardware itself.

If you’re concerned about the data and identity theft aspect of losing your phone, you can take several steps to mitigate that risk:

  1. Don’t store sensitive data on your phone. This is pretty common sense. You wouldn’t want your credit card information easily accessible, but who stores that on their phone anyway? What’s more common is saving e-mail passwords and allowing the thief to gain easy access to your personal, or even more sensitive corporate e-mails.
  2. Another layer of passwords, such as locking access to your phone with a 4 digit number, is another excellent way to deter thieves.
  3. Use the software that comes with your phone. Instead of relying on the wireless carrier to deactivate the phone, or even to support the feature, use software that is prepackaged. For example, Apple’s iPhone comes with a nifty feature called Find My iPhone that can help you erase all of the data remotely. The article did not specify whether the FCC was going to require this for all wireless carriers.

In the digital age of today, our eyes are glued to our mobile phones. Don’t become a victim of mobile theft and make sure to have that phone glued to your side.

How else do you think the FCC can help?

Check If You’re a Digital Pirate

With all of the SOPA talk this month, I figured an article on piracy was deserving. Being able to pinpoint users of pirated software is becoming easier and more accurate. For example, check out YouHaveDownloaded.com, a website that lists the torrents you may have downloaded in a certain time span. While the website is not perfect, for those who have static IP addresses, it can get pretty close and provide you a list.

In one article on CNET, it was mentioned that “someone in the home of French President Nicholas Sarkozy, a strong proponent of anti-piracy legislation, has been using BitTorrent to download pirated versions of music and movies.”

If the Stop Online Piracy Act passes in the United States, I’m sure technology to track torrents and other illegal downloads will improve. Consequently, imagine the privacy concerns I have for Internet users. This proof-of-concept website is scary enough!