What Is a Warrant Canary and How VPN Companies Use Them
Patrick Bushe
November 16, 2024 · 5 min read
A warrant canary is a statement a company publishes saying it has not received certain secret government orders. If the statement disappears or stops being updated, readers can guess that something changed, even if the company is legally barred from saying so.
Why they exist
Some government orders, such as US National Security Letters, come with gag orders that forbid the company from revealing them. A company can't announce "we received one", but it may be able to stop saying "we haven't". The name comes from the canaries miners once carried: when the bird stopped singing, it was a warning.
How VPN companies use them
- A page, often in the transparency or legal section, stating that the company hasn't received secret orders, searches or requests to hand over data.
- A date, and a promise to update it regularly, such as monthly or quarterly.
- Often a digital signature, so you can check the company really published it.
- Sometimes a recent news headline in the text, to prove it wasn't written in advance.
How to check one
- Check the date. A canary that's overdue for an update is itself a warning sign, or just neglect.
- Compare the wording with older versions in the Wayback Machine. A quietly removed sentence matters.
- If it's signed, verify the signature with the company's published key.
The limits
- Legally untested. Whether a government can force a company to keep publishing a false canary hasn't been clearly settled in court.
- Narrow. It covers only the kinds of orders it lists.
- After the fact. It tells you something happened, not what or to whom.
- Easy to publish. A canary is a promise, not proof.
What matters more than a canary
- A no-logs policy confirmed by independent audits. See how to verify no-log claims.
- Transparency reports listing the requests a company received and how it responded.
- Real cases where a VPN was asked for data and had none to give.
- Where the company is based, and which laws apply to it.
Close the browser leaks too
A trustworthy VPN doesn't help if your browser reveals your real IP address. WebRTC Privacy Shield stops WebRTC exposing it. See how to check your VPN is working.
