No reporting period has closed yet. This page sets out the format and the schedule in advance, so that the first report can be checked against a commitment rather than presented as one. Publishing a table of zeroes before a period has closed would be a claim about requests received, and that is the one claim a page like this cannot afford to get wrong.
What is published, and when
A report covering each calendar quarter is published within thirty days of the quarter closing, at this address, and is not removed afterwards. Every report states the figures below. A figure that is zero is printed as zero rather than omitted.
| Figure | Definition |
|---|---|
| Orders received | Every legal demand for data, by category of requesting authority and country. |
| Orders seeking an identity | Those that asked for the person behind an alias rather than for the alias itself. |
| Forwarding addresses disclosed | Occasions on which a forwarding address was decrypted, and for how many aliases. |
| Accounts affected | Distinct accounts touched by a disclosure, whether or not the requester was told. |
| Requests refused | Demands declined, with the ground of refusal. |
| Emergency disclosures | Requests handled outside the normal process on a claim of imminent harm, and their outcome. |
Requests are counted when received, not when resolved, so a request contested for two years appears in the quarter it arrived and again in the quarter it concludes, with the outcome.
The canary, and how to read it
No canary has been published yet
The first statement has not been signed. Nothing has been withdrawn, because nothing has been made yet.
Check it yourself, in three commands
curl -O https://app.skudo.org/canary.asc
gpg --recv-keys <fingerprint below>
gpg --verify canary.ascA good signature proves the statement came from the key below and has not been altered. It does not prove the statement is true, and nothing can: that part rests on a person having been willing to sign it.
Each report is accompanied by a signed statement covering the period: that no order has been received which cannot be disclosed, and that no key has been surrendered outside the process described in the architecture document.
The statement is signed by Skudo, with the key published in advance. A canary is evidence rather than a guarantee: it works because a human being has to keep signing it, and it can be defeated by a compromise of the signing key.
What silence means
If a report is late, that is a fact about the report. If a canary is not renewed, that is a fact about the canary. Neither is a coded message and neither should be read as one, but both are visible, checkable events rather than private ones, which is the entire purpose of publishing them.
Verify a canary against the published keys and the stated period. A canary that verifies for a period other than the one it claims to cover is not a canary.
How Skudo answers a request
The process and the limits of what can be produced are set out in full in the architecture document. In summary: Skudo produces what it holds. For an alias that is the address itself, which is stored in clear because the relay has to read it, and an encrypted forwarding address, which Skudo can decrypt because Skudo runs the service.
Requests from law enforcement should go to the address published on the contact page, with the legal basis stated. Requests that arrive by other channels are redirected there rather than acted on.
Audit reports
No external review of the relay or the key handling has been carried out yet. An independent review of this kind is quoted in the tens of thousands, and Skudo is self-funded and free to use, so this is a question of budget rather than of willingness.
When one is commissioned the report is published here in full, including open findings, with the auditor named and the scope stated. An audit summary without the report behind it is a marketing document, and this page will not carry one.