13 ms·

Australia's anti-encryption law will merely relocate the backdoors: Expert

278 points by axiomdata316 8y ago

Nicksil 8y ago
Non-AMP link: https://www.zdnet.com/article/australias-anti-encryption-law-will-merely-relocate-the-backdoors-expert/ https://www.zdnet.com/article/australias-anti-encryption-law...
- dang 8y ago
  Thanks. Changed to that from https://www-zdnet-com.cdn.ampproject.org/v/s/www.zdnet.com/google-amp/article/australias-anti-encryption-law-will-merely-relocate-the-backdoors-expert/?amp_js_v=0.1#amp_tf=From%20%251%24s https://www-zdnet-com.cdn.ampproject.org/v/s/www.zdnet.com/g....
deleted 8y ago
[deleted]
dajonker 8y ago
It's frightening how politicians with such little knowledge and understanding of certain subjects have so much power to create legislation about those subjects. But apparently that's how we have built our civilization, through trial and error.
- dogma1138 8y ago
  The problem is that we as a society already agreed that it’s acceptable. We allowed the government to open mail, open locks and tap phones with a warrant all of which were technically challenging. Phone networks must be set up with specific dedicated access for law enforcement heck I remember crawling through the SNMP MIBs on my Motorola cable modem 15 years ago and discovering a whole class of them dedicated to lawful interception. Most networking equipment providers even have guides on how to set these up: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cfg/configuration/xe-3s/sec-usr-cfg-xe-3s-book/sec-lawful-intercept.pdf https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cf... And this is why the encryption battle is a bit odd to me as much as I would like encryption to be never tampered with we’ve already as a society agreed that the government in some cases should have access so what makes WhatsApp so different to a phone call? If encryption isn’t a way to backdoor ourselves out of the existing legal interception laws then as much as I hate to admit it we don’t have a leg to stand on. If it is then we should just publicly say that the government shouldn’t be able to tap phones regardless of what technology they are using to communicate.
  - mtgx 8y ago
    Most of the time such laws are passed on Christmas or New Year's eve (Obama literally allowed the NSA to share Upstream surveillance data with all the other 16 agencies like 3-4 days before his presidency ended - how exactly would anyone have stopped Obama then?!), or people "allow" them to pass through inaction, which I think is not quite the same as actively supporting something. Governments of the world simply take advantage of people's inaction or their lack of attention to certain issues. This is a problem with how most democracies work (the democratic processes are not democratic enough, but we've failed to improve upon them due to complacency). And 10 years later when people wake up to it they come out and say "but we've been using this for a decade and it's been so helpful in our investigations!". And even if that was true, often they don't provide real proof, and also the government is almost never interested in doing a cost-benefit analysis for such things. Like it may have been "helpful", but how much damage did that lack of privacy and the existence of backdoors caused, too?
    - dogma1138 8y ago
      That still doesn't answer my question, the legal precedence for all of these was set up decades if not centuries ago. We agreed that a government should be able to tap a phone, in fact it's illegal to be a communication provider in the US and in the majority of the rest of the world essentially every country where there is a rule of law has the same laws without complying with the legal intercept requirements from the government. Every piece of telecommunications equipment already has these backdoors built-in, in fact part of the FCC certification is to ensure compliance with LEI when applicable. What Obama did with the NSA is also a doesn't have any bearing on this issue, if the NSA surveillance is warrantless it's another issue as far as sharing the contents of the in interception with other agencies well it's again a different issue. But again this isn't about the NSA, this isn't even about the US the question is and always was what makes WhatsApp any different than a phone call? Your mobile provider by law must provide LEI of data, voice and text, now no one uses voice anymore, most people don't even text not without using alternative apps like WhatsApp or iMessage. So what is so special about these apps that the laws don't apply to them? and if we are using encryption as a way to back out of the rights we as a society already granted our government then by all means let's do it publicly because there is no reason why the government should be able to tap the phone of a 90 year old grandmother but not yours just because you know how to use WhatsApp. >Like it may have been "helpful", but how much damage did that lack of privacy and the existence of backdoors caused, too? Practically none, every telecommunication equipment in the US and the west in large has LEI backdoors built-in these aren't used for exploitation, just like the fact that most mobile phones can be easily tapped by anyone with a $100 worth of SDR equipment. While these are technically a risk in practice they aren't really a risk because they still have a high barrier for entry, high risk, and essentially very low reward due to the lack of scalability.
- johnchristopher 8y ago
  I work for the tech division of a non-tech related branch of public service. It's scarier than you think. People passing by in the hall are sometimes literally added to the meeting taking place and get to (are obliged ?) voice any advice they might have on the subject being discussed. Boom, they are now an expert and project leader. It's not about legislation though but the consequences are very real (how to project gets implemented with all the dance with contractors and other branches and how it will impact everyone in the country).
- dgzl 8y ago
  That's what lobbyists are for, and the reason that they aren't inherently bad.
- josefresco 8y ago
  "It's frightening how politicians with such little knowledge and understanding of certain subjects have so much power to create legislation about those subjects" But we've elected these politicians to ... create legislation! Should leave it up to people like ... Zuckerberg? Jack?
  - prolikewh0a 8y ago
    >Should leave it up to people like ... Zuckerberg? Jack? Why not say, cryptographers, mathmeticians, computer scientists that arent multi-billionaires that actually do have your best interests in mind and haven't been corrupted by money?
    - josefresco 8y ago
      Cryptographers, mathematicians, and computer scientists should be consulting politicians, who should have a broader view than just their specialty. Also, money corrupts without prejudice, even cryptographers, mathematicians, and "computer scientists".
femto 8y ago
There is a government consultation process open RIGHT NOW for this bill. You have to get your submissions in by the end of today (6 hours time). Every Australian here needs to make a submission (please). The page for the inquiry is: https://www.homeaffairs.gov.au/about/consultations/assistance-and-access-bill-2018 https://www.homeaffairs.gov.au/about/consultations/assistanc... The email address for submissions is: AssistanceBill.Consultation@homeaffairs.gov.au A submission only has to be a few lines, so just bang out a few words. Whilst a well researched submission is the gold standard, even a rudimentary email will send the message that people care about this issue and counter whoever is whispering in politicians' ears. Anything is better than nothing. Less time critically, you also need to write to or call your federal MP. --- Edit: The committee might also be swayed by submissions from non-Australian experts? Australia first, your country next.
- tomglynch 8y ago
  Email sent!
- Sag0Sag0 8y ago
  Email sent!
- ehnto 8y ago
  I have already sent my reaponse in, I definitely implore everyone to read the bill and write an appropriate response. This isn't an anit-encryption bill specifically, it's a framework for strong-arming companies into undermining all consumer security measures no matter what they are. I will say, I found the bill palatable and sympathetic to the concerns of industry. I am impressed at the delicacy of the bill. I still disagree with it fundamentally and emailed to that effect. But I am impressed by our government's ability to read the situation.
- ajdlinux 8y ago
  I've sent my submission - my approach for this particular submission, and I'm not sure whether it's the best approach, was to indicate that I agree with the general arguments that this bill is bad for privacy, but also that if a scheme like this is going to be introduced anyway, that the oversight and transparency regime is not tough enough to allow the public to have confidence that the new powers are being used appropriately, or for researchers to be able to accurately measure the impact of the new regime on privacy and security. I will also be writing to (and maybe phoning!) my MPs and Senators, and I anticipate this bill will go to a Senate committee for inquiry at which point there will be a further opportunity for submissions. edit: and oh yeah, don't forget to contact your senators, not just your local MP. I only have 2, those of you who have 12 may have a few crossbench senators who will be crucial if, somehow, Labor can be persuaded to vote against, and in any case could have an outsized impact on proposing amendments to make the new powers less-bad.
justsee 8y ago
The key example justifying the need for this bill is as follows: > A high risk Registered Sex Offender (RSO) was placed on the register for raping a 16 year old female, served nine years imprisonment and is now monitored by Corrections via two ankle bracelets whilst out on parole. Victoria Police received intel that he was breaching his RSO and parole conditions by contacting a number of females typically between 13 and 17 years of age. Enquiries showed that he was contacting these females and offering them drugs in return for sexual favours. The suspect was arrested and his mobile phone was seized but despite legislative requirements he refused to provide his passcode. Due to an inability to access his phone as well as the fact that he used encrypted communication methods such as Snapchat and Facebook Messenger, Victoria Police was unable to access evidence which would have enabled them to secure a successful prosecution and identify further victims and offences. These are high victim impact crimes that are being hindered by the inability of law enforcement to access encrypted communications. The limited information reveals they identified some targets, which means they would know (some of) his Facebook and Snapchat account names. While the content of messages can be encrypted, the connection graph is not, so why couldn't Victorian Police request details of accounts the suspect's account had communicated with and request the parents of those users provide endpoint access to the encrypted chat history?
- bkor 8y ago
  From what I understood Whatsapp does regularly work with the police. The contents is encrypted. But you can easily monitor who communicates with whom. So if one person is unwilling, you can check if the other is willing. I find it more worrisome that going after one person is more important than the privacy of a huge group.
- TomK32 8y ago
  Why must we all open our communication just because of a few sick individuals who are already imprissioned or under surveillance?
  - dangerface 8y ago
    I don't think the justification for spying on you is really why they want to spy on you.
gravelc 8y ago
Can anyone comment on how this is likely to affect multinational entities like Apple? Given the Australian market is so small, would it not more sense to leave the jurisdiction entirely rather than compromise security? Same goes for App makers like Signal. Why bother with Australia? (I'm Australian, and really don't want to see this happen FWIW, but it seems the rational decision)
- lrvick 8y ago
  Closed tools like Signal, Snapchat, Slack, Whatsapp, iMessage, Messenger, Hangouts etc will all make the promises about privacy you want to hear, but at the end of the day they are closed source and updates or commands can be sent to your handset to send plaintext to their servers at any time. The question is under what criteria this will happen. Insider abuse? Government order? To make money? Trying to make it illegal for companies to do this sort of thing on a country by country basis is worth pursuing, but it is not a real solution. We need to stop trying to use the law to enforce security. The solution is to use tools that take court ordered backdoors off the table. Support open and federated communications networks where anyone can build their own clients or servers where pressuring of any entity can't put community built clients at risk. There are a range of clients/protocols that meet this criteria such IRC with OTR, XMPP, IRCv3, Silence, Matrix.org. Take your pick, and convince your contacts to use that instead of companies where you have to just take their word for it they won't backdoor you as it suits them.
  - cyphar 8y ago
    Signal is free software[1] -- GPLv3 in fact. Don't get me wrong, it has its own issues with Moxie having very strange views of the threat model (and being anti-federation and anti-distribution), but it is definitely not proprietary. I also concur with the Matrix.org recommendation. [1]: https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
    - lrvick 8y ago
      Signal likes to throw around that they are free software but really that is more marketing than fact. The signal -client- is open source, but the server is closed. Yes partial server code is open, but running your own server is not allowed. The signal signed clients will only talk to the closed server and Moxie has made it clear he does not want forked clients or clients not built by his team connecting to his network. Open source f-droid builds are not permitted, and if you want updates you must use the play store builds. Those with open source phones must turn on unverified sources and risk man in the disk attacks to install the apk from the signal website. Security you can't fully verify, is just called marketing.
close04 8y ago
I'm curious about the principle of these laws. [Later Edit: not Australian specific, something that can be applied anywhere] If the only way to convict a suspect would be for them to self incriminate during testimony should the 5th amendment be waived? How many other rights should be cancelled because they prevent law enforcement from having an easier job? Banning guns to make doctors' jobs easier is out of the question but banning privacy to make policemen's jobs easier isn't?
- pcl 8y ago
  Bear in mind that this is an Australian law, so the 5th Amendment isn't involved. I don't know much about Australian law, so I don't know if they have an equivalent right within their legal system.
  - gravelc 8y ago
    There is a right to silence under common law apparently.
  - close04 8y ago
    No, I'm fully aware it's not the US, I simply used a principle that's popular enough (from movies) that many people could relate. It's the principle that matters. I edited the original comment a little to highlight this. I'm sure that there must be something in the Australian constitution that guarantees a right for the citizens. Should it be taken away just to make someone job a little easier?
- Sacho 8y ago
  For US law on this subject, check out the Third Party Doctrine. There's a good article by Orin Kerr on it, which is a defense of the doctrine but also goes over its fundamentals(https://repository.law.umich.edu/cgi/viewcontent.cgi?article=1348&context=mlr https://repository.law.umich.edu/cgi/viewcontent.cgi?article...)
sbhn 8y ago
If it is a success in Australia, it will be rolled out across the rest of the commonwealth
- ObsoleteNerd 8y ago
  People are missing the entire point. This was never just about Australia doing it. It's a proposal by Australia AS PART OF THE 5 EYES to bring this in. They're absolutely planning for this to roll out to all the 5 Eyes countries. If we really want to quash this, we need to start making that clear to everyone in the UK, US, CA, NZ, and AU, that this effects ALL of us. They're just using Australia to launch it for this exact reason, 95% of the population of the 5 Eyes will think they're not effected, not fight it, and it'll pass. Then good luck stopping their momentum.
  - cyphar 8y ago
    It's my understanding that once Australia passes it there's no need for the other 5 Eyes countries to pass it, since they have agreements to be able to send data they've collected to other 5 Eyes countries. Which means that they could just send all of the data to Australia and have the encryption broken (as-a-Service you might say). Unfortunately I was out of the country when this whole shitshow went down. I sent an email, but I'm going to go see my Federal MP in person tomorrow.
    - gtvwill 8y ago
      ^^^ hit the nail on the head. Its exactly what happens.
    - fit2rule 8y ago
      It works in other ways too - for example, the ADF can do things that the American military can't. Thus, the Americans come calling to their Australia partners in crime when they want some nefarious deed done on the battlefield... and Australians just roll over and let it happen - as long as there are avocado's to smash, Australians just don't care what their government is up to.
consp 8y ago
> "Furthermore, what is described remains a backdoor, albeit a keyed backdoor. There is no requirement for backdoors to be universally exploitable to be considered a backdoor, it merely needs to provide an alternative entry point into the target system or protocol." If someone just looking for holes in the law already sees this, what would the supposed to be knowledgeable politician do/think they are doing. Note: It's wrong because you are creating a universal access point in encryption to violate the original intent of the encryption (which is end to end most likely). This would mean you sell/show end to end encryption which has a man in the middle no matter what you do. And if it is poorly implemented, which is often the case with backdoors, it is probably universally accessible. Even if they say it's not. As already stated by the author.
sir-alien 8y ago
The problem is that with physical telecoms providers, you can mandate these LEI implementations. If the provider doesn't comply you ban the sale of the device. Yes, you can get a few black market devices to get around this but you can't head into your local shop to obtain it. With the current scale of open source software, you can mandate a law for backdoors but countries that do not have such laws would be able to remove these backdoors from the open source software if they are ever put in. Simply banning OSS won't help either since many countries that have banned encryption still see widespread use of encryption software as the internet has no borders. Firewalls don't count because that is equivalent to trying to stop a million tunnel diggers from digging over the border all at the same time with a million more diggers ready to go. Ask China with their great firewall full of holes. Backdooring or banning major providers like WhatsApp, etc will only push more and more people to an open solution that is globally distributed. The only solution to gaining encryption access is the simple option. The option that if you are an interesting enough person, will get to play catch with a wrench while your hands are tied.
justatdotin 8y ago
this is just icing on the cake. we need to urgently dismantle Heimat and Interior
boobahdoobah 8y ago
Hello, I'm writing to oppose the 2018 Assistance & Access Bill. Although I recognize the difficulties encryption poses to law enforcement & counter-terrorism, it is not a strong enough reason to compromise the safety, security & privacy of 24 million Australian citizens. Every Australian has a right to reliable, mathematically guaranteed privacy & security, not compromised/undermined by oppressive legislature. Neither domestic nor international companies should be required to assist anyone in breaking privacy protections, nor should warrants allow access to protected devices, and nor should existing legislature be strengthened. Would these changes help law enforcement catch a few criminals? Probably. Will it weaken the safety, security & privacy of millions of respectable, law-abiding Australians? Definitely. Cheers, Louise
dhx 8y ago
China passed a similar law last year[1] forcing citizens and companies to provide assistance with state intelligence matters. Are these laws just a public acknowledgement and formalisation of what has been going on since early civilisation? In the cold war it was bugged typewriters[2] and sabotaged chips and industrial components. Ten years ago it was counterfeit chips from China causing early failures in US military equipment[3] and US backdooring of cryptography standards[4]. More recently, Chinese companies have been factory backdooring hundreds of millions mobile phones[5] and Western countries have been vacuuming up the Internet[6]. How many integrated circuits purchased from factories abroad today can be trusted when hardware backdoors have been shown to be almost undetectable even to the best resourced labs?[7][8] Instead of manufacturers around the world being coerced into backdooring technology[9][10] without regulation, at least there may now be some formality. These laws don't change how much trust can be placed in foreign technology (answer: not much at all). It shouldn't be a shock that Australia has banned Chinese equipment from the likes of Huawei and ZTE from broadband and 5G mobile network rollouts[11]. And it shouldn't be a surprise to Australian companies if China bans the import of Australian technology. [1] https://www.lawfareblog.com/beijings-new-national-intelligence-law-defense-offense https://www.lawfareblog.com/beijings-new-national-intelligen... [2] http://www.cryptomuseum.com/covert/bugs/selectric/ http://www.cryptomuseum.com/covert/bugs/selectric/ [3] https://web.archive.org/web/20081011075757/http://www.businessweek.com/magazine/content/08_41/b4103034193886.htm?chan=magazine+channel_top+stories https://web.archive.org/web/20081011075757/http://www.busine... [4] https://bits.blogs.nytimes.com/2013/09/10/government-announces-steps-to-restore-confidence-on-encryption-standards/ https://bits.blogs.nytimes.com/2013/09/10/government-announc... [5] http://www.kryptowire.com/adups_security_analysis.html http://www.kryptowire.com/adups_security_analysis.html [6] https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure... [7] http://www.emsec.rub.de/media/crypto/veroeffentlichungen/2014/07/03/BeckerChes13.pdf http://www.emsec.rub.de/media/crypto/veroeffentlichungen/201... [8] https://web.eecs.umich.edu/~taustin/papers/OAKLAND16-a2attack.pdf https://web.eecs.umich.edu/~taustin/papers/OAKLAND16-a2attac... [9] https://www.usatoday.com/story/opinion/2013/08/27/nsa-snowden-russia-obama-column/2702461/ https://www.usatoday.com/story/opinion/2013/08/27/nsa-snowde... [10] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d... [11] http://www.abc.net.au/news/2018-08-23/huawei-banned-from-providing-5g-mobile-technology-australia/10155438 http://www.abc.net.au/news/2018-08-23/huawei-banned-from-pro...
Jedi72 8y ago
I have spent the last ~2 hours reading the 100 page explanatory document [1], these are some of my thoughts. The bill pretty explicitely talks about ASIO. I don't think these laws will be used for much less than espionage, or possibly deep corruption cases. For example, right now ASIO dont have the power to remove a computer to inspect it. That actually surprised me (what would not surprise me is that they routinely do this anyway). In many cases I dont see why physical access is required though, I am sure ASIO are capable of hacking most routers/IoT devices, possibly even laptops, just using known methods (are drug-lords really that up to date on L1TF?). The biggest issue I have is that the granting of warrants always comes down to whether some judge or minister thinks its all good. Although, in one of the sub-sections they say the Attorney-General can delegate their powers to a senior ASIO officer, so this is a C-suite level person inside ASIO likely to have these powers (note that they explicitely point out that this person can not further delegate that power, so these decision makers are direct reports to the Attorney General presumably). On the topic of getting people to give up passwords and/or keys, it says that agencies have "the ability to compel persons" to hand them over... whatever that means. Does "compel" mean, breaking fingers compel? I am pretty sure this is with a warrant. There are provisioms for situations where evidence may be lost, or other dire circunstances, where they can request things orally and immediately, but they do have reporting requirements around such circumstances. Probably the most alarming thing is the technical notices. With these, they can basically ask first, but if required - demand - tech companies to add in back-doors. They try to deny it but thats what they are. It is pretty explicit that they cant compel companies to introduce 'systemic weaknesses', so its not about making product wide easter eggs that give you root permissions. I think they mean more like "put a clause in your code that when Dr Evil logs into WhatsApp, and only Dr Evil, it forwards all comms to us." Thats pretty strong power, and not really a systemic weakness is WhatsApp, but most definitely fits the definition of a back door to me. They say companies will be compensated on a 'no loss, no profit' basis. One kind of nice limitation on this is that it will definitely be expensive for ASIO to do this. Companies are in some ways incentivized to restrict their acts to single customers, because if ASIO want to monitor 10 people, well that requires 10x the budget doesnt it. This was my first time trying to read law. If you read law as code, then law is TERRIBLY written. This amendment is the worlds most ancient pull-request system, putting this into VC would make it much clearer for all involved. There is no concept of a dependency tree, instead other acts are referenced at will and with no version lock to say whether that definition is still current. I suspect there are a lot of regression fails when they write new legislation, unless someone is pouring over all other acts looking for things which reference the act we want to change. TL:DR; I'm gonna let this go through to the keeper. Writing law is complex. Ultimately it always comes down to, can we trust our government and public institutions, as well as our companies, to do the right thing? How much must we bind ourselves as a society, to ensure that they cannot abuse us? Its tough. I tend to think that the 99% of the people writing these laws, and the officers enforcing them, aren't monsters or evil people - they are my fellow Australians. [1] https://www.homeaffairs.gov.au/consultations/Documents/explanatory-document.pdf https://www.homeaffairs.gov.au/consultations/Documents/expla...
paulie_a 8y ago
"it could affect 'every website that is accessible from Australia'" It won't matter to any of my websites, I will ignore their law. Just like I ignore GDPR. I don't do anything egregious, but those laws simply are/would not be relevant to me.
- king_phil 8y ago
  Your view includes only a fraction of the real world. From a european ISP standpoint: the introduction of a systemic weakness is a violation of Art. 32 GDPR. We just can't do it. Classic double-bind. GDPR is more important than Australia to us, so we just block all access from and to austrialia. We have 195.000 affected webhosting customers (domain, email, website, servers), btw.
  - jstanley 8y ago
    > so we just block all access from and to austrialia Please don't do this. The internet does not respect borders, and there's absolutely nothing positive that can come from changing that. By blocking Australia you're just screwing over ordinary Australian people who probably don't agree with what their politicians have decided.
    - Grangar 8y ago
      Maybe that's necessary to push some resistance among the common Australian.
      - jstanley 8y ago
        It's not OK to make ordinary people's lives difficult just to further your own political interests, regardless of how noble those interests might be.
  - paulie_a 8y ago
    I am not following, why are you concerned about Australian law as a n European isp. Why would you block Australia?
jhabdas 8y ago
He said backdoor. Tee-hee
- dang 8y ago
  Please don't do this here.
michaelmrose 8y ago
So basically since the vast majority of technology products are produced outside of Australia while one can imagine them forcing them to only sell hardware products with broken security just for australia however. - The population of australia is only 24 million less than 1/10th of the US and this would require expensive engineering just to sell to this market. - Caving to Australia makes this look like an attractive option to other more lucrative markets. - Some people would just import their own phones from overseas - Software products are unlikely to desire to compromise their networks/products for Australia and its 1000x easier to import software than hardware. The best strategy would seem to be ignore Australia.
DoctorOetker 8y ago
From a different article referenced by this article: Turnbul says: > "A back door is typically a flaw in a software program that perhaps the -- you know, the developer of the software program is not aware of and that somebody who knows about it can exploit," he said. "And, you know, if there are flaws in software programs, obviously, that's why you get updates on your phone and your computer all the time." >"So we're not talking about that. We're talking about lawful access." And again, the warfare is linguistic dictionary wars all over again (like "collection" etc...) He just redefines "back door" to denote 0-day in order to be able to define "lawful access" as the TrustZone root & automagical updates which is the backdoor they demand access to.
BLKNSLVR 8y ago
If Australia was really concerned about encrypted communication as a threat to national security then they would outlaw end-to-end encrypted messaging. Terrorists and child abusers and wife beaters walking free because law enforcement can't read the private messages of "these people" due to this thing called encryption. They should specify that any form of private communication cannot be encrypted end-to-end where the decryption keys are only accessible to the communication participants. Internet browsing, online shopping and banking transactions are allowed, as is communication which is encrypted by a service provider, and as such can be decrypted by said service provider upon request from law enforcement. Anyone caught using end-to-end encrypted communications can AND WILL be fined. The effect of this would be the same as what they're currently proposing, but they're currently hiding it behind words that most of the population don't comprehend, and therefore doesn't make the kind of mainstream headlines that it should. By taking this weasel-worded approach the Australian Government is being intentionally ambiguous about their intentions and the effect of this legislation.
dbg31415 8y ago
Privacy vs. security... it's a complicated. Nobody cares that the police can tap a phone line... so by that logic, why can't they tap any other communication medium? But... what I do know is that the Australian government is not the one to solve the problem. They're a small market, without a lot of technical expertise... having lived in Sydney for some time now... I know you don't want the Australian government involved in tech. * Australian PM Calls for End-to-End Encryption Ban, Says the Laws of Mathematics Don't Apply Down Under | Electronic Frontier Foundation || https://www.eff.org/deeplinks/2017/07/australian-pm-calls-end-end-encryption-ban-says-laws-mathematics-dont-apply-down https://www.eff.org/deeplinks/2017/07/australian-pm-calls-en... * 1,464 Western Australian government officials used ‘Password123’ as their password. Cool, cool. - The Washington Post || https://www.washingtonpost.com/technology/2018/08/22/western-australian-government-officials-used-password-their-password-cool-cool/?noredirect=on&utm_term=.35df184ee840 https://www.washingtonpost.com/technology/2018/08/22/western... * NBN regional connections to cost about $7000 per premise || https://www.news.com.au/technology/online/nbn/nbn-regional-connections-to-cost-about-7000-per-premise/news-story/a067409cc4c04fc946ceef54c8d89f54 https://www.news.com.au/technology/online/nbn/nbn-regional-c...

278 points by axiomdata316 8y ago

Non-AMP link: https://www.zdnet.com/article/australias-anti-encryption-law-will-merely-relocate-the-backdoors-expert/ https://www.zdnet.com/article/australias-anti-encryption-law...

dang 8y ago
Thanks. Changed to that from https://www-zdnet-com.cdn.ampproject.org/v/s/www.zdnet.com/google-amp/article/australias-anti-encryption-law-will-merely-relocate-the-backdoors-expert/?amp_js_v=0.1#amp_tf=From%20%251%24s https://www-zdnet-com.cdn.ampproject.org/v/s/www.zdnet.com/g....

deleted 8y ago

[deleted]

dajonker 8y ago

It's frightening how politicians with such little knowledge and understanding of certain subjects have so much power to create legislation about those subjects. But apparently that's how we have built our civilization, through trial and error.

dogma1138 8y ago
The problem is that we as a society already agreed that it’s acceptable. We allowed the government to open mail, open locks and tap phones with a warrant all of which were technically challenging. Phone networks must be set up with specific dedicated access for law enforcement heck I remember crawling through the SNMP MIBs on my Motorola cable modem 15 years ago and discovering a whole class of them dedicated to lawful interception. Most networking equipment providers even have guides on how to set these up: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cfg/configuration/xe-3s/sec-usr-cfg-xe-3s-book/sec-lawful-intercept.pdf https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cf... And this is why the encryption battle is a bit odd to me as much as I would like encryption to be never tampered with we’ve already as a society agreed that the government in some cases should have access so what makes WhatsApp so different to a phone call? If encryption isn’t a way to backdoor ourselves out of the existing legal interception laws then as much as I hate to admit it we don’t have a leg to stand on. If it is then we should just publicly say that the government shouldn’t be able to tap phones regardless of what technology they are using to communicate.
- mtgx 8y ago
  Most of the time such laws are passed on Christmas or New Year's eve (Obama literally allowed the NSA to share Upstream surveillance data with all the other 16 agencies like 3-4 days before his presidency ended - how exactly would anyone have stopped Obama then?!), or people "allow" them to pass through inaction, which I think is not quite the same as actively supporting something. Governments of the world simply take advantage of people's inaction or their lack of attention to certain issues. This is a problem with how most democracies work (the democratic processes are not democratic enough, but we've failed to improve upon them due to complacency). And 10 years later when people wake up to it they come out and say "but we've been using this for a decade and it's been so helpful in our investigations!". And even if that was true, often they don't provide real proof, and also the government is almost never interested in doing a cost-benefit analysis for such things. Like it may have been "helpful", but how much damage did that lack of privacy and the existence of backdoors caused, too?
  - dogma1138 8y ago
    That still doesn't answer my question, the legal precedence for all of these was set up decades if not centuries ago. We agreed that a government should be able to tap a phone, in fact it's illegal to be a communication provider in the US and in the majority of the rest of the world essentially every country where there is a rule of law has the same laws without complying with the legal intercept requirements from the government. Every piece of telecommunications equipment already has these backdoors built-in, in fact part of the FCC certification is to ensure compliance with LEI when applicable. What Obama did with the NSA is also a doesn't have any bearing on this issue, if the NSA surveillance is warrantless it's another issue as far as sharing the contents of the in interception with other agencies well it's again a different issue. But again this isn't about the NSA, this isn't even about the US the question is and always was what makes WhatsApp any different than a phone call? Your mobile provider by law must provide LEI of data, voice and text, now no one uses voice anymore, most people don't even text not without using alternative apps like WhatsApp or iMessage. So what is so special about these apps that the laws don't apply to them? and if we are using encryption as a way to back out of the rights we as a society already granted our government then by all means let's do it publicly because there is no reason why the government should be able to tap the phone of a 90 year old grandmother but not yours just because you know how to use WhatsApp. >Like it may have been "helpful", but how much damage did that lack of privacy and the existence of backdoors caused, too? Practically none, every telecommunication equipment in the US and the west in large has LEI backdoors built-in these aren't used for exploitation, just like the fact that most mobile phones can be easily tapped by anyone with a $100 worth of SDR equipment. While these are technically a risk in practice they aren't really a risk because they still have a high barrier for entry, high risk, and essentially very low reward due to the lack of scalability.
johnchristopher 8y ago
I work for the tech division of a non-tech related branch of public service. It's scarier than you think. People passing by in the hall are sometimes literally added to the meeting taking place and get to (are obliged ?) voice any advice they might have on the subject being discussed. Boom, they are now an expert and project leader. It's not about legislation though but the consequences are very real (how to project gets implemented with all the dance with contractors and other branches and how it will impact everyone in the country).
dgzl 8y ago
That's what lobbyists are for, and the reason that they aren't inherently bad.
josefresco 8y ago
"It's frightening how politicians with such little knowledge and understanding of certain subjects have so much power to create legislation about those subjects" But we've elected these politicians to ... create legislation! Should leave it up to people like ... Zuckerberg? Jack?
- prolikewh0a 8y ago
  >Should leave it up to people like ... Zuckerberg? Jack? Why not say, cryptographers, mathmeticians, computer scientists that arent multi-billionaires that actually do have your best interests in mind and haven't been corrupted by money?
  - josefresco 8y ago
    Cryptographers, mathematicians, and computer scientists should be consulting politicians, who should have a broader view than just their specialty. Also, money corrupts without prejudice, even cryptographers, mathematicians, and "computer scientists".

femto 8y ago

There is a government consultation process open RIGHT NOW for this bill. You have to get your submissions in by the end of today (6 hours time). Every Australian here needs to make a submission (please). The page for the inquiry is: https://www.homeaffairs.gov.au/about/consultations/assistance-and-access-bill-2018 https://www.homeaffairs.gov.au/about/consultations/assistanc... The email address for submissions is: AssistanceBill.Consultation@homeaffairs.gov.au A submission only has to be a few lines, so just bang out a few words. Whilst a well researched submission is the gold standard, even a rudimentary email will send the message that people care about this issue and counter whoever is whispering in politicians' ears. Anything is better than nothing. Less time critically, you also need to write to or call your federal MP. --- Edit: The committee might also be swayed by submissions from non-Australian experts? Australia first, your country next.

tomglynch 8y ago
Email sent!
Sag0Sag0 8y ago
Email sent!
ehnto 8y ago
I have already sent my reaponse in, I definitely implore everyone to read the bill and write an appropriate response. This isn't an anit-encryption bill specifically, it's a framework for strong-arming companies into undermining all consumer security measures no matter what they are. I will say, I found the bill palatable and sympathetic to the concerns of industry. I am impressed at the delicacy of the bill. I still disagree with it fundamentally and emailed to that effect. But I am impressed by our government's ability to read the situation.
ajdlinux 8y ago
I've sent my submission - my approach for this particular submission, and I'm not sure whether it's the best approach, was to indicate that I agree with the general arguments that this bill is bad for privacy, but also that if a scheme like this is going to be introduced anyway, that the oversight and transparency regime is not tough enough to allow the public to have confidence that the new powers are being used appropriately, or for researchers to be able to accurately measure the impact of the new regime on privacy and security. I will also be writing to (and maybe phoning!) my MPs and Senators, and I anticipate this bill will go to a Senate committee for inquiry at which point there will be a further opportunity for submissions. edit: and oh yeah, don't forget to contact your senators, not just your local MP. I only have 2, those of you who have 12 may have a few crossbench senators who will be crucial if, somehow, Labor can be persuaded to vote against, and in any case could have an outsized impact on proposing amendments to make the new powers less-bad.

justsee 8y ago

The key example justifying the need for this bill is as follows: > A high risk Registered Sex Offender (RSO) was placed on the register for raping a 16 year old female, served nine years imprisonment and is now monitored by Corrections via two ankle bracelets whilst out on parole. Victoria Police received intel that he was breaching his RSO and parole conditions by contacting a number of females typically between 13 and 17 years of age. Enquiries showed that he was contacting these females and offering them drugs in return for sexual favours. The suspect was arrested and his mobile phone was seized but despite legislative requirements he refused to provide his passcode. Due to an inability to access his phone as well as the fact that he used encrypted communication methods such as Snapchat and Facebook Messenger, Victoria Police was unable to access evidence which would have enabled them to secure a successful prosecution and identify further victims and offences. These are high victim impact crimes that are being hindered by the inability of law enforcement to access encrypted communications. The limited information reveals they identified some targets, which means they would know (some of) his Facebook and Snapchat account names. While the content of messages can be encrypted, the connection graph is not, so why couldn't Victorian Police request details of accounts the suspect's account had communicated with and request the parents of those users provide endpoint access to the encrypted chat history?

bkor 8y ago
From what I understood Whatsapp does regularly work with the police. The contents is encrypted. But you can easily monitor who communicates with whom. So if one person is unwilling, you can check if the other is willing. I find it more worrisome that going after one person is more important than the privacy of a huge group.
TomK32 8y ago
Why must we all open our communication just because of a few sick individuals who are already imprissioned or under surveillance?
- dangerface 8y ago
  I don't think the justification for spying on you is really why they want to spy on you.

gravelc 8y ago

Can anyone comment on how this is likely to affect multinational entities like Apple? Given the Australian market is so small, would it not more sense to leave the jurisdiction entirely rather than compromise security? Same goes for App makers like Signal. Why bother with Australia? (I'm Australian, and really don't want to see this happen FWIW, but it seems the rational decision)

lrvick 8y ago
Closed tools like Signal, Snapchat, Slack, Whatsapp, iMessage, Messenger, Hangouts etc will all make the promises about privacy you want to hear, but at the end of the day they are closed source and updates or commands can be sent to your handset to send plaintext to their servers at any time. The question is under what criteria this will happen. Insider abuse? Government order? To make money? Trying to make it illegal for companies to do this sort of thing on a country by country basis is worth pursuing, but it is not a real solution. We need to stop trying to use the law to enforce security. The solution is to use tools that take court ordered backdoors off the table. Support open and federated communications networks where anyone can build their own clients or servers where pressuring of any entity can't put community built clients at risk. There are a range of clients/protocols that meet this criteria such IRC with OTR, XMPP, IRCv3, Silence, Matrix.org. Take your pick, and convince your contacts to use that instead of companies where you have to just take their word for it they won't backdoor you as it suits them.
- cyphar 8y ago
  Signal is free software[1] -- GPLv3 in fact. Don't get me wrong, it has its own issues with Moxie having very strange views of the threat model (and being anti-federation and anti-distribution), but it is definitely not proprietary. I also concur with the Matrix.org recommendation. [1]: https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
  - lrvick 8y ago
    Signal likes to throw around that they are free software but really that is more marketing than fact. The signal -client- is open source, but the server is closed. Yes partial server code is open, but running your own server is not allowed. The signal signed clients will only talk to the closed server and Moxie has made it clear he does not want forked clients or clients not built by his team connecting to his network. Open source f-droid builds are not permitted, and if you want updates you must use the play store builds. Those with open source phones must turn on unverified sources and risk man in the disk attacks to install the apk from the signal website. Security you can't fully verify, is just called marketing.

close04 8y ago

I'm curious about the principle of these laws. [Later Edit: not Australian specific, something that can be applied anywhere] If the only way to convict a suspect would be for them to self incriminate during testimony should the 5th amendment be waived? How many other rights should be cancelled because they prevent law enforcement from having an easier job? Banning guns to make doctors' jobs easier is out of the question but banning privacy to make policemen's jobs easier isn't?

pcl 8y ago
Bear in mind that this is an Australian law, so the 5th Amendment isn't involved. I don't know much about Australian law, so I don't know if they have an equivalent right within their legal system.
- gravelc 8y ago
  There is a right to silence under common law apparently.
- close04 8y ago
  No, I'm fully aware it's not the US, I simply used a principle that's popular enough (from movies) that many people could relate. It's the principle that matters. I edited the original comment a little to highlight this. I'm sure that there must be something in the Australian constitution that guarantees a right for the citizens. Should it be taken away just to make someone job a little easier?
Sacho 8y ago
For US law on this subject, check out the Third Party Doctrine. There's a good article by Orin Kerr on it, which is a defense of the doctrine but also goes over its fundamentals(https://repository.law.umich.edu/cgi/viewcontent.cgi?article=1348&context=mlr https://repository.law.umich.edu/cgi/viewcontent.cgi?article...)

sbhn 8y ago

If it is a success in Australia, it will be rolled out across the rest of the commonwealth

ObsoleteNerd 8y ago
People are missing the entire point. This was never just about Australia doing it. It's a proposal by Australia AS PART OF THE 5 EYES to bring this in. They're absolutely planning for this to roll out to all the 5 Eyes countries. If we really want to quash this, we need to start making that clear to everyone in the UK, US, CA, NZ, and AU, that this effects ALL of us. They're just using Australia to launch it for this exact reason, 95% of the population of the 5 Eyes will think they're not effected, not fight it, and it'll pass. Then good luck stopping their momentum.
- cyphar 8y ago
  It's my understanding that once Australia passes it there's no need for the other 5 Eyes countries to pass it, since they have agreements to be able to send data they've collected to other 5 Eyes countries. Which means that they could just send all of the data to Australia and have the encryption broken (as-a-Service you might say). Unfortunately I was out of the country when this whole shitshow went down. I sent an email, but I'm going to go see my Federal MP in person tomorrow.
  - gtvwill 8y ago
    ^^^ hit the nail on the head. Its exactly what happens.
  - fit2rule 8y ago
    It works in other ways too - for example, the ADF can do things that the American military can't. Thus, the Americans come calling to their Australia partners in crime when they want some nefarious deed done on the battlefield... and Australians just roll over and let it happen - as long as there are avocado's to smash, Australians just don't care what their government is up to.

consp 8y ago

> "Furthermore, what is described remains a backdoor, albeit a keyed backdoor. There is no requirement for backdoors to be universally exploitable to be considered a backdoor, it merely needs to provide an alternative entry point into the target system or protocol." If someone just looking for holes in the law already sees this, what would the supposed to be knowledgeable politician do/think they are doing. Note: It's wrong because you are creating a universal access point in encryption to violate the original intent of the encryption (which is end to end most likely). This would mean you sell/show end to end encryption which has a man in the middle no matter what you do. And if it is poorly implemented, which is often the case with backdoors, it is probably universally accessible. Even if they say it's not. As already stated by the author.

sir-alien 8y ago

The problem is that with physical telecoms providers, you can mandate these LEI implementations. If the provider doesn't comply you ban the sale of the device. Yes, you can get a few black market devices to get around this but you can't head into your local shop to obtain it. With the current scale of open source software, you can mandate a law for backdoors but countries that do not have such laws would be able to remove these backdoors from the open source software if they are ever put in. Simply banning OSS won't help either since many countries that have banned encryption still see widespread use of encryption software as the internet has no borders. Firewalls don't count because that is equivalent to trying to stop a million tunnel diggers from digging over the border all at the same time with a million more diggers ready to go. Ask China with their great firewall full of holes. Backdooring or banning major providers like WhatsApp, etc will only push more and more people to an open solution that is globally distributed. The only solution to gaining encryption access is the simple option. The option that if you are an interesting enough person, will get to play catch with a wrench while your hands are tied.

justatdotin 8y ago

this is just icing on the cake. we need to urgently dismantle Heimat and Interior

boobahdoobah 8y ago

Hello, I'm writing to oppose the 2018 Assistance & Access Bill. Although I recognize the difficulties encryption poses to law enforcement & counter-terrorism, it is not a strong enough reason to compromise the safety, security & privacy of 24 million Australian citizens. Every Australian has a right to reliable, mathematically guaranteed privacy & security, not compromised/undermined by oppressive legislature. Neither domestic nor international companies should be required to assist anyone in breaking privacy protections, nor should warrants allow access to protected devices, and nor should existing legislature be strengthened. Would these changes help law enforcement catch a few criminals? Probably. Will it weaken the safety, security & privacy of millions of respectable, law-abiding Australians? Definitely. Cheers, Louise

dhx 8y ago

China passed a similar law last year[1] forcing citizens and companies to provide assistance with state intelligence matters. Are these laws just a public acknowledgement and formalisation of what has been going on since early civilisation? In the cold war it was bugged typewriters[2] and sabotaged chips and industrial components. Ten years ago it was counterfeit chips from China causing early failures in US military equipment[3] and US backdooring of cryptography standards[4]. More recently, Chinese companies have been factory backdooring hundreds of millions mobile phones[5] and Western countries have been vacuuming up the Internet[6]. How many integrated circuits purchased from factories abroad today can be trusted when hardware backdoors have been shown to be almost undetectable even to the best resourced labs?[7][8] Instead of manufacturers around the world being coerced into backdooring technology[9][10] without regulation, at least there may now be some formality. These laws don't change how much trust can be placed in foreign technology (answer: not much at all). It shouldn't be a shock that Australia has banned Chinese equipment from the likes of Huawei and ZTE from broadband and 5G mobile network rollouts[11]. And it shouldn't be a surprise to Australian companies if China bans the import of Australian technology. [1] https://www.lawfareblog.com/beijings-new-national-intelligence-law-defense-offense https://www.lawfareblog.com/beijings-new-national-intelligen... [2] http://www.cryptomuseum.com/covert/bugs/selectric/ http://www.cryptomuseum.com/covert/bugs/selectric/ [3] https://web.archive.org/web/20081011075757/http://www.businessweek.com/magazine/content/08_41/b4103034193886.htm?chan=magazine+channel_top+stories https://web.archive.org/web/20081011075757/http://www.busine... [4] https://bits.blogs.nytimes.com/2013/09/10/government-announces-steps-to-restore-confidence-on-encryption-standards/ https://bits.blogs.nytimes.com/2013/09/10/government-announc... [5] http://www.kryptowire.com/adups_security_analysis.html http://www.kryptowire.com/adups_security_analysis.html [6] https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure... [7] http://www.emsec.rub.de/media/crypto/veroeffentlichungen/2014/07/03/BeckerChes13.pdf http://www.emsec.rub.de/media/crypto/veroeffentlichungen/201... [8] https://web.eecs.umich.edu/~taustin/papers/OAKLAND16-a2attack.pdf https://web.eecs.umich.edu/~taustin/papers/OAKLAND16-a2attac... [9] https://www.usatoday.com/story/opinion/2013/08/27/nsa-snowden-russia-obama-column/2702461/ https://www.usatoday.com/story/opinion/2013/08/27/nsa-snowde... [10] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d... [11] http://www.abc.net.au/news/2018-08-23/huawei-banned-from-providing-5g-mobile-technology-australia/10155438 http://www.abc.net.au/news/2018-08-23/huawei-banned-from-pro...

Jedi72 8y ago

I have spent the last ~2 hours reading the 100 page explanatory document [1], these are some of my thoughts. The bill pretty explicitely talks about ASIO. I don't think these laws will be used for much less than espionage, or possibly deep corruption cases. For example, right now ASIO dont have the power to remove a computer to inspect it. That actually surprised me (what would not surprise me is that they routinely do this anyway). In many cases I dont see why physical access is required though, I am sure ASIO are capable of hacking most routers/IoT devices, possibly even laptops, just using known methods (are drug-lords really that up to date on L1TF?). The biggest issue I have is that the granting of warrants always comes down to whether some judge or minister thinks its all good. Although, in one of the sub-sections they say the Attorney-General can delegate their powers to a senior ASIO officer, so this is a C-suite level person inside ASIO likely to have these powers (note that they explicitely point out that this person can not further delegate that power, so these decision makers are direct reports to the Attorney General presumably). On the topic of getting people to give up passwords and/or keys, it says that agencies have "the ability to compel persons" to hand them over... whatever that means. Does "compel" mean, breaking fingers compel? I am pretty sure this is with a warrant. There are provisioms for situations where evidence may be lost, or other dire circunstances, where they can request things orally and immediately, but they do have reporting requirements around such circumstances. Probably the most alarming thing is the technical notices. With these, they can basically ask first, but if required - demand - tech companies to add in back-doors. They try to deny it but thats what they are. It is pretty explicit that they cant compel companies to introduce 'systemic weaknesses', so its not about making product wide easter eggs that give you root permissions. I think they mean more like "put a clause in your code that when Dr Evil logs into WhatsApp, and only Dr Evil, it forwards all comms to us." Thats pretty strong power, and not really a systemic weakness is WhatsApp, but most definitely fits the definition of a back door to me. They say companies will be compensated on a 'no loss, no profit' basis. One kind of nice limitation on this is that it will definitely be expensive for ASIO to do this. Companies are in some ways incentivized to restrict their acts to single customers, because if ASIO want to monitor 10 people, well that requires 10x the budget doesnt it. This was my first time trying to read law. If you read law as code, then law is TERRIBLY written. This amendment is the worlds most ancient pull-request system, putting this into VC would make it much clearer for all involved. There is no concept of a dependency tree, instead other acts are referenced at will and with no version lock to say whether that definition is still current. I suspect there are a lot of regression fails when they write new legislation, unless someone is pouring over all other acts looking for things which reference the act we want to change. TL:DR; I'm gonna let this go through to the keeper. Writing law is complex. Ultimately it always comes down to, can we trust our government and public institutions, as well as our companies, to do the right thing? How much must we bind ourselves as a society, to ensure that they cannot abuse us? Its tough. I tend to think that the 99% of the people writing these laws, and the officers enforcing them, aren't monsters or evil people - they are my fellow Australians. [1] https://www.homeaffairs.gov.au/consultations/Documents/explanatory-document.pdf https://www.homeaffairs.gov.au/consultations/Documents/expla...

paulie_a 8y ago

"it could affect 'every website that is accessible from Australia'" It won't matter to any of my websites, I will ignore their law. Just like I ignore GDPR. I don't do anything egregious, but those laws simply are/would not be relevant to me.

king_phil 8y ago
Your view includes only a fraction of the real world. From a european ISP standpoint: the introduction of a systemic weakness is a violation of Art. 32 GDPR. We just can't do it. Classic double-bind. GDPR is more important than Australia to us, so we just block all access from and to austrialia. We have 195.000 affected webhosting customers (domain, email, website, servers), btw.
- jstanley 8y ago
  > so we just block all access from and to austrialia Please don't do this. The internet does not respect borders, and there's absolutely nothing positive that can come from changing that. By blocking Australia you're just screwing over ordinary Australian people who probably don't agree with what their politicians have decided.
  - Grangar 8y ago
    Maybe that's necessary to push some resistance among the common Australian.
    - jstanley 8y ago
      It's not OK to make ordinary people's lives difficult just to further your own political interests, regardless of how noble those interests might be.
- paulie_a 8y ago
  I am not following, why are you concerned about Australian law as a n European isp. Why would you block Australia?

jhabdas 8y ago

He said backdoor. Tee-hee

dang 8y ago
Please don't do this here.

michaelmrose 8y ago

So basically since the vast majority of technology products are produced outside of Australia while one can imagine them forcing them to only sell hardware products with broken security just for australia however. - The population of australia is only 24 million less than 1/10th of the US and this would require expensive engineering just to sell to this market. - Caving to Australia makes this look like an attractive option to other more lucrative markets. - Some people would just import their own phones from overseas - Software products are unlikely to desire to compromise their networks/products for Australia and its 1000x easier to import software than hardware. The best strategy would seem to be ignore Australia.

DoctorOetker 8y ago

From a different article referenced by this article: Turnbul says: > "A back door is typically a flaw in a software program that perhaps the -- you know, the developer of the software program is not aware of and that somebody who knows about it can exploit," he said. "And, you know, if there are flaws in software programs, obviously, that's why you get updates on your phone and your computer all the time." >"So we're not talking about that. We're talking about lawful access." And again, the warfare is linguistic dictionary wars all over again (like "collection" etc...) He just redefines "back door" to denote 0-day in order to be able to define "lawful access" as the TrustZone root & automagical updates which is the backdoor they demand access to.

BLKNSLVR 8y ago

If Australia was really concerned about encrypted communication as a threat to national security then they would outlaw end-to-end encrypted messaging. Terrorists and child abusers and wife beaters walking free because law enforcement can't read the private messages of "these people" due to this thing called encryption. They should specify that any form of private communication cannot be encrypted end-to-end where the decryption keys are only accessible to the communication participants. Internet browsing, online shopping and banking transactions are allowed, as is communication which is encrypted by a service provider, and as such can be decrypted by said service provider upon request from law enforcement. Anyone caught using end-to-end encrypted communications can AND WILL be fined. The effect of this would be the same as what they're currently proposing, but they're currently hiding it behind words that most of the population don't comprehend, and therefore doesn't make the kind of mainstream headlines that it should. By taking this weasel-worded approach the Australian Government is being intentionally ambiguous about their intentions and the effect of this legislation.

dbg31415 8y ago

Privacy vs. security... it's a complicated. Nobody cares that the police can tap a phone line... so by that logic, why can't they tap any other communication medium? But... what I do know is that the Australian government is not the one to solve the problem. They're a small market, without a lot of technical expertise... having lived in Sydney for some time now... I know you don't want the Australian government involved in tech. * Australian PM Calls for End-to-End Encryption Ban, Says the Laws of Mathematics Don't Apply Down Under | Electronic Frontier Foundation || https://www.eff.org/deeplinks/2017/07/australian-pm-calls-end-end-encryption-ban-says-laws-mathematics-dont-apply-down https://www.eff.org/deeplinks/2017/07/australian-pm-calls-en... * 1,464 Western Australian government officials used ‘Password123’ as their password. Cool, cool. - The Washington Post || https://www.washingtonpost.com/technology/2018/08/22/western-australian-government-officials-used-password-their-password-cool-cool/?noredirect=on&utm_term=.35df184ee840 https://www.washingtonpost.com/technology/2018/08/22/western... * NBN regional connections to cost about $7000 per premise || https://www.news.com.au/technology/online/nbn/nbn-regional-connections-to-cost-about-7000-per-premise/news-story/a067409cc4c04fc946ceef54c8d89f54 https://www.news.com.au/technology/online/nbn/nbn-regional-c...