This, being an active process, if found out, is violating a gag order by direct action.
you update your canary to say that nothing has changed, at a known cadence.
if you ever dont make the update, readers know that the canary has expired, and so you have been served a gag order warrant.
changing or removing the canary in response to a warrant is illegal. not changing it is legal.
for an equivalent cloudwatch setup, its checking the flag for "alarm when there's no points"
I suspect they didn't go for this route as it is too slow.
As I understand, this theory wouldn’t even hold up in other countries where you could be compelled to make such a false update.
No, they can simply not publish a warrant canary in the future, which will tip people off if they've been publishing it regularly in the past.
