A method based on secure assumptions
In some countries the law allows authorities to send secret warrants to companies like ISPs or VPN providers, forcing them to hand over customers’ logs. And before you think that these strict laws are exclusive to less fortunate countries, think again: our infamous Patriot Act is actually one of these laws. As a matter of fact, this is the reason why it’s common to see top-tier providers located in foreign countries: they are not subject to U.S. laws, but to the ones of the countries they’re based in, where laws are usually more permissive. Thus, they can evade these warrants alongside accompanying legal orders that prevent the affected company to directly warn customers about the ongoing investigation.
Warrant canaries are ‘released’ by VPN companies for this very reason. When displayed on a website that didn’t receive a secret subpoena by government agencies, they would usually tell something like ‘company X didn’t receive any legal notice for Y amount of time.’ However, if these warrant canaries simply disappear or stop being updated overnight, then it is safe to assume that the affected company received a secret notice and shall, therefore, be considered a ‘red zone’ until further notice. Interestingly, having a warrant canary placed on the site is entirely legal, because no law prohibits companies from reporting legal processes that they have not received.
With warrant canaries on their side users can easily – albeit indirectly – learn for how long their VPN provider has been left alone by government agencies. And, as Private Internet Access (PIA) fittingly stated, a warrant canary actually tells a lot about a company’s no-log policy.
The reverse of the medal
After many users were wondering whether PIA has a warrant canary or not, the company dedicated an interesting article to this topic, stating that they use no warrant canaries whatsoever as they don’t keep any user logs that they would be able to provide to authorities anyway. But if we reverse the answer of PIA, it becomes crystal clear that the presence of a warrant canary in a VPN service’s terms of use indicates that the company can indeed collect logs.
On the other hand, as PIA is a provider based in the U.S., many people take the company’s words with a pinch of salt, even though the company has a public court record that clearly states nothing is logged that can identify users. Additionally, PIA reminds doubters that it immediately terminated their operations in Russia when the country’s regime wanted to force the company to start logging users’ identities.
VPN providers with warrant canaries
Trust.Zone
According to the company, the warrant canary ensures the protection of customers in case Trust.Zone is “required by law to be silent about any searches, seizures of data or requirements to log any actions” of their clients. The canary is updated on a daily basis, with fresh news headlines to further prove it, meaning that users will know what to do in case Trust.Zone stops with the updates.
NordVPN
According to its own words, NordVPN was neither compromised nor it suffered any data breaches or received any secret warrants – at least at the time of writing. As in most cases of similar VPN providers, the warrant canary is updated every day, so visiting the company’s site on a daily basis for new updates is advisable.
SlickVPN
Leo S.
Sander D.
