4 ms·

This would obviously only work if the encrypted messages can also be decrypted. And that's the worrying part. As soon as that mechanism exists, all assumption

This would obviously only work if the encrypted messages can also be decrypted. And that's the worrying part. As soon as that mechanism exists, all assumption of data safety goes out the window.

rswail 8y ago
Which is why the section on systemic vulnerabilities (317GZ) is (IMHO) the most important to get clarified and expanded. The other area that needs to get clarified is the definition of "designated communications provider" in 317C, particularly those related to software/hardware development and manufacture. The fact is, this legislation will pass, because both the Liberals and Labor march in lock step on "national security". So the fight becomes how to limit the scope to ensure that the requirement to "implement or build a systemic weakness or systemic vulnerability" is expanded out to exclude: a) common security libraries that are shared across operating systems and applications b) secure hardware (HSMs, SEPs, etc) c) protections and procedures required under PCI/DSS, banking, medical, GPDR and equivalent laws d) requests that make it likely that a provider's business will suffer due to loss of trust of the security of the information that a user/customer provides.