This idiom is not really correct, since a failure in the constructor of any one of the three wrapper streams will cause the original stream (`baos`) to not get closed. This is another thing Java 7 gets right, as it will “unwind” the nested definitions in case an exception is thrown at any point:

    try (ByteArrayOutputStream baos = new ByteArrayOutputStream();
         CipherOutputStream cos = new CipherOutputStream(baos,sym);
         GZIPOutputStream zos = new GZIPOutputStream(cos);
         ObjectOutputStream oos = new ObjectOutputStream(zos)) {
        oos.writeLong(System.currentTimeMillis()); // send timestamp to prevent a replay attack
        oos.writeObject(caw.getConsoleAnnotator());
    }

Of course, in this particular case, there is no native resource held open, so there is no need for any change in the code at all except for stylistic reasons.