Reddit's latest transparency report, published yesterday, indicates that the social networking site has received a classified request for user information from the US government in the last year. The report has specifically removed a "warrant canary" — a small passage of text that confirmed Reddit had not received a classified request — that was present in the previous year's report, as close as the company can come to admitting it received such a request since January 29th, 2015, without violating the gag orders they come with.
The company started providing transparency reports to detail how the company provided user information to US and international governments in 2014. That first report included a line that clearly stated that "as of January 29, 2015, Reddit has never received a National Security Letter, an order under the Foreign Intelligence Surveillance Act, or any other classified request for user information." In the same passage, the company said that if it were to receive a request, it "would seek to let the public know it existed."
Reddit said it would "seek to let the public know" if it got a confidential information request
Warrant canaries have been used by a number of companies to surreptitiously warn customers and users when they have been targeted by national security letters. Apple appeared to signal in 2014 that it had received such a letter, altering the language in its 2013 and 2014 transparency reports to remove confirmation that it had not been forced to hand over data under Section 215 of the USA Patriot Act. National security letters have existed longer than the Patriot Act, but their use skyrocketed after the controversial legislation was introduced in 2001.
Even using canaries, Reddit is treading a fine line
Reddit founder Steve Huffman — posting under the username "spez" — stopped short of confirming that the company had received such an order, but his language certainly suggested that was the case. "I've been advised not to say anything one way or the other," he wrote, saying as much as he could without breaking the restrictions. He also directly referred to the practice of removing certain passages in similar reports, saying that "even with the canaries, we're treading a fine line."
Companies can legally disclose the numbers of national security letters they have received, but only in vague categories of hundreds, or even thousands. Reddit joined Twitter in an amicus brief filed this March that sought to fine-tune these arbitrary limitations, and allow companies to be more clear in how many national security letters they receive. "The whole thing is icky," Huffman wrote in the Reddit post announcing the latest transparency report, "which is why we joined Twitter in pushing back."