Skip to content
Trust

Warrant canary · September 2026

Warrant canary

A statement we sign offline each month: that Ciphera has received no secret warrant, gag order, or demand for user keys or plaintext. The GPG signature is the proof — not our word. If a month’s canary ever fails to appear on time, the silence is the disclosure — read the non-update protocol.

Period
September 2026
Published
02-09-2026
Next update
on or before 05-10-2026
Signing key
offline GPG
Status
Current

01 · The signed statement

The signed statement

CIPHERA WARRANT CANARY
======================

Period: September 2026
Published: 02-09-2026 (DD-MM-YYYY)
Next update: on or before 05-10-2026
Company: Ciphera (Belgian company, jurisdiction: Belgium / European Union)

As of the date above, Ciphera:

  1. Has NOT received any National Security Letter, secret warrant, or
     equivalent gag-ordered legal process from any government agency.
  2. Has NOT received any request or order compelling disclosure of
     cryptographic keys, decrypted user data, or plaintext user secrets.
  3. Has NOT been compelled to install, modify, or weaken any security
     mechanism, backdoor, or interception capability.
  4. Has NOT received any order to modify source code or binaries in a
     manner hostile to user security.
  5. Has NOT handed over bulk user data to any third party absent specific,
     legally-valid, narrowly-scoped process that Ciphera may lawfully
     disclose.

Proof of non-backdating (headlines from 02-09-2026):

  - [BBC]: Zelensky says airlines should avoid Russian airspace as Ukraine escalates drone operations
    https://www.bbc.co.uk/news/articles/c9v9yydy2wvo

  - [NPR]: Israel bars U.S. citizens over criticism and ties to Palestinian activists, lawyers say
    https://www.npr.org/2026/09/02/nx-s1-5950449/israel-bars-americans-over-palestinian-ties

  - [RTÉ]: EU summons Russian envoy over Leipzig 'hybrid attack'
    https://www.rte.ie/news/2026/0902/1590018-foreign-ministers-meeting/

  - [Tagesschau]: Reform im Kabinett: Das soll sich bei der Einkommensteuer ändern
    https://www.tagesschau.de/inland/innenpolitik/einkommensteuer-reform-folgen-100.html

This canary is signed with GPG key
94E796164FF853902D89E46173011BE3BD5174AE, whose public key is published at
https://ciphera.net/trust/canary-pubkey.asc.

Verify:
    gpg --import canary-pubkey.asc
    gpg --verify canary-2026-09.txt.asc canary-2026-09.txt

-- Usman Baig, founder, Ciphera

02 · Verify the signature

Verify the signature

Signing key fingerprint

94E7 9616 4FF8 5390 2D89 E461 7301 1BE3 BD51 74AE

gpg --import canary-pubkey.asc
gpg --verify \
  canary-2026-09.txt.asc \
  canary-2026-09.txt

Expect: Good signature from “Ciphera Warrant Canary <canary@ciphera.net>”

PlaintextSignaturePublic key

03 · Archive

Archive

04 · Non-update protocol

If the canary goes silent

If it is past the date above and a new canary has not been published, the lapse itself is the disclosure.

Don’t

  • Ask Ciphera or its representatives why.
  • Interpret any statement from Ciphera about "technical issues" as explaining the lapse.
  • Assume the previous canary remains valid past its stated expiration.

Do

  • Treat the absence as meaningful.
  • Recognise that Belgian/EU law may prohibit Ciphera from commenting on the reason for non-update.
  • Consult your own legal counsel about what the lapse implies for your use of Ciphera services.

The signing key exists on no production system. No employee, operator, or automated process can produce or sign a canary. Only the founder, holding the offline key, can publish — or deliberately withhold — a canary.