Skip to content

Warrant canaries applicable to all DELVES Media Group organisations. Canaries are posted on the 15th and 28th days of each month.

Notifications You must be signed in to change notification settings

DELVES/Warrant-Canaries

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

18 Commits
 
 
 
 
 
 

Repository files navigation

Last Commit Twitter


Logo

DMG Warrant Canaries

Warrant canaries applicable to all DELVES Media Group organisations.
Learn more about us »

Table of Contents
  1. About
  2. What are warrant canaries?
  3. Can I verify a canary's authenticity?
  4. What should I do if the canary is missing?
  5. Current signers
  6. Acknowledgments

About

Many journalists worldwide have been subject to subpoenas to hand over information about their sources, combined with gag orders making it illegal to tell anyone that they have received such requests. These unlawful and unconstitutional legal processes infringe on the freedom of the press.

As a trusted source for information on current events, DELVES Media Group is committed to protecting its sources and audiences. We're launching the use of warrant canaries to inform our audiences about potential interferences in our work by government agencies and non-state actors. Our warrant canary helps our audiences whether we are under duress, have received a press super-injunction, DSMA notice/letter, subpoena, warrant or other legal compulsions that we would be prohibited from disclosing. If our company is subject to such a legal process, relevant notices in our warrant canary will disappear.

(back to top)

What are warrant canaries?

A warrant canary is a colloquial term for a regularly published statement that a service provider has not received legal process that it would be prohibited from saying it had received. Once a service provider does receive legal process, the speech prohibition goes into place, and the canary statement is removed.

Warrant canaries are often provided in conjunction with a transparency report, listing the process the service provider can publicly say it received over the course of a particular time period. The canary is a reference to the canaries used to provide warnings in coalmines, which would become sick before miners from carbon monoxide poisoning, warning of the danger.

~ Electronic Frontier Foundation

(back to top)

What should I do if the warrant canary itself or parts of it are missing for the current period?

If there is no warrant canary published at the designated dates or if parts of the canary appear to be removed, take caution when communicating with us or viewing our work. When under duress due to censorship tactics like gag orders, it may be impossible for us to communicate with our audiences or sources about what is going on. We encourage people that have noticed these anomalies to spread the word on social media platforms to give ourselves a voice when we can't speak.

(back to top)

Can I verify a canary's authenticity?

Yes! It's essential to verify a canary's authenticity to assess whether it was written by those who claim to have written it. All of our warrant canaries are PGP signed with the signatures in cleartext on the canary file.

How-to

To verify the signature of a canary, you'll need to install a package and complete a few simple steps. We recommend using Homebrew to install the required package.

  • gnupg
    brew install gnupg

Once gnupg is installed on your device, you'll need to import the public keys of all signers. Their fingerprints can be found here. Copy each fingerprint and run this command, replacing ADDFINGERPRINTHERE with the real fingerprint:

gpg --search-keys "ADDFINGERPRINTHERE"

You should get a result that looks something like this:

gpg: data source: https://keys.openpgp.org:443
(1)	Rick Astley <nevergonna@giveyou.up>
    256 bit EDDSA key ABCDEFGHIJKLMNOP, created: 2020-04-01
Keys 1-1 of 1 for "1234 5678 9012 3456 7890 1234 ABCD EFGH IJKL MNOP".  Enter number(s), N)ext, or Q)uit > 

You can see that the 1st result matches with one of our current signers so type 1 and hit enter to import the public key.

Now that the key has been imported, you can now download the warrant canary from our repository. Once it has been dowmloaded, run the following command, replacing the file path with the actual path where the canary is stored on your device:

gpg --verify /users/rickastley/Downloads/test.txt

If you recieve an output like this saying that there is a 'good signature', you have sucessfully verified that the canary is authentic.

gpg: Signature made Tue 15 Mar 17:32:23 2022 GMT
gpg:                using EDDSA key 123456789012345678901234ABCDEFGHIJKLMNOP
gpg: Good signature from "Rick Astley <nevergonna@giveyou.up>" [ultimate]

(back to top)

Current Signers

Hamzah Batha | C37F 68EA 48E1 5168 8AB1 192B A7D6 B1CC 0A01 AD4C

(back to top)

Acknowledgments

DMG's use of warrant canaries is part of an initiative supported by a coalition of nonprofits and institutions (listed below). The aim is for companies, organisations and service providers to publish warrant canaries to aid in the fight against illegal and unconstitutional national security processes, including National Security Letters and other secret court processes.

(back to top)

About

Warrant canaries applicable to all DELVES Media Group organisations. Canaries are posted on the 15th and 28th days of each month.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published