What a Warrant Canary Is and What Its Silence Tells You

A warrant canary is a dated statement a provider republishes on a fixed schedule, declaring that it has received no legal process it would be forbidden to disclose. If such an order arrives, the company stops renewing the notice or quietly removes a line from it, and readers draw the conclusion the provider cannot spell out. The trick leans on an asymmetry in US law: a gag order can compel silence, but it arrives too late to forbid anyone from saying what they have never received.

From coal mines to library signs

The name borrows from miners' caged birds, which reacted to carbon monoxide before any worker felt it. American librarians used the idea against the Patriot Act with signs like "The FBI has not been here (watch very closely for the removal of this sign)", and in 2006 the storage host rsync.net turned the trick into a signed corporate notice with a fresh headline proving the posting date.

The legal bet behind a canary

The targets are national security letters, FISA court orders, and subpoenas served with a gag under the Electronic Communications Privacy Act. Because a gag binds only once an order is served, no law forbids reporting process never received. EFF argues that compelled silence differs from compelled false speech, which the First Amendment protects against; its warrant canary FAQ treats the idea as legal but untested in court, and advises a gap of at least a few months between a canary and the period it covers.

What a real canary contains

SpiderOak required, from 2014, three PGP signatures from signers in different places for its six-monthly canary, so no single subpoenaed office could refresh it on its own.

Reading a canary that went silent

History offers examples of every signal. Apple said in November 2013 it had never received a Section 215 order; the two reports covering July–December 2013 and January–June 2014 lacked the statement, and the press reported this in September 2014. Reddit deleted its canary in 2016, the year Riseup missed a renewal over sealed warrants, and in February 2024 the Ethereum Foundation removed its canary over a voluntary enquiry from a state authority with a confidentiality requirement.

Why the guarantee is weak

Many lawyers argue that letting a canary lapse may carry the same legal risk as announcing the order, and a secret warrant could explicitly forbid touching it. Australia banned disclosing even the non-existence of a Journalist Information Warrant in 2015, and the Canary Watch tracker stopped in May 2016 because every canary is formatted differently. Some lapses are just forgotten updates, so silence stays ambiguous.

Warrant canaries at VPN providers

Among consumer VPNs the practice is rare: of 543 services in the VPNRadarLab dataset, 22 say they publish a canary, 89 say they do not, and 432 say nothing. The ranking of VPNs with a published canary lists them. Our privacy score weights a canary at 1 point of 15, while an independent no-logs audit earns 3, because the audit checks what the servers actually keep. Several large providers swapped canaries for regular transparency reports, so a missing canary alone is not a warning sign.

Checking a signed canary in four steps

1. Compare today's date with the next update the notice promised.
2. Import the provider's public PGP key from a source you trust.
3. Verify it with gpg --verify on the file and its signature.
4. Diff the wording against an older archived copy.

Warrant canary FAQ

Is a warrant canary legal?

Probably, in the US, but the idea remains untested in court.

Can a government force a company to keep its canary up?

It could try, and the company could challenge such a gag in court. If the court sided with the government, the public would not learn of it for some time.

Does a missing canary mean my VPN was compromised?

Not on its own. Several solid providers never had one, and many lapses are just sloppy upkeep.

How is it different from a transparency report?

The report counts requests the provider may disclose. A canary hints at the gagged ones it may not mention.

Warrant canary in a nutshell

A canary is a dated, ideally PGP-signed notice that no gagged order has arrived, refreshed on a schedule and checked against a trusted key. It speaks through absence: silence means something changed without saying what. The scheme remains untested in court, and Australia has outlawed it for one warrant type, the Journalist Information Warrant. Weigh a VPN primarily on its audited no-logs record, with the canary as one extra signal.