3 ms·
A bunch of us at Atlassian are sending a group letter (not an official one from the company, just a bunch of us who think the bill is dangerous). Thanks for the
by jjcm 8y ago
A bunch of us at Atlassian are sending a group letter (not an official one from the company, just a bunch of us who think the bill is dangerous). Thanks for the info femto.
Edit - Here's the letter we wrote:
Hello, we are a collection of employees who work for Atlassian (a major Sydney based tech company) and we’d like to give our view of why we think this bill is dangerous.
First and foremost, it will damage the view of Australian tech companies. If a foreign company is deciding between our products or a non-Australian company, but knows that Australia may have required Atlassian to build a backdoor into their encryption, the objectively better choice would be to choose the non-Australian company. This isn't just Atlassian losing because of this; the entire Australian tech scene will be damaged.
Secondly, a master key to unlock encryption is a master key that’s available to steal. Time and time again in the tech world we’ve seen “security that can’t be beat” get beat. Equifax lost nearly every American Social Security number. Bitcoin gets stolen every day because someone’s private key gets compromised. Even as far back as World War II, we saw encryption get beat because a master key (the enigma machine) got stolen. History has shown us countless times that a master key leads to a non-secure product. Even if the this bill is only requiring companies to provide the capability to decrypt information, that only changes who controls the master key. It doesn’t remove the damage to security.
Thirdly, requiring companies to be able to break their own encryption will never be a game you can win. Even if every company in the world were compliant with this bill, the tools to make your unbreakable encryption are trivial to find and use. Any agent that was an actual threat to national security would have the resources available to them to create a non-breakable encrypted communication method. The only people who would be affected by this law would be petty criminals, but the dragnet of its implications would affect every Australian citizen in its wake.
Fourthly, this will damage the Australian startup scene. When choosing where to fund a company, the laws and world view of a country come heavily into play. If someone is creating the next messaging app but the public opinion of Australia is that their products are legally required to be insecure, that person will choose a more tech-friendly company to start their company in. Not only that, but if a company knows there are more requirements for compliance in Australia, then it makes a startup’s job harder to release a product. Startups are difficult enough as it is, and lowering the barrier to entry (not raising it) is how you make a tech industry blossom.
Lastly, even if one agrees that the damage to security is worth the tradeoff, the lack of judicial oversight in this bill is extremely worrying. Giving multiple people the ability to issue notices without judicial oversight is a power no person should be able to exercise alone. Overall we feel this bill will harm not only the tech industry, but Australia as a whole.
- lugg 8y ago> (not an official one from the company) So... Atlassian is for this bill? Edit downvotes... This is a serious question, it's a pretty notable Australian tech company and is surprising to hear the company is unwilling to make a stand. How are you going to reassure companies elsewhere that their company communications are secure when clearly they wount be.
- jjcm 8y agohttps://twitter.com/mcannonbrookes/status/1039095041371697157 https://twitter.com/mcannonbrookes/status/103909504137169715... For what it's worth, our CEO has been outspoken against this. This isn't a, "we're doing this because our company is for the bill" type of thing. It's a "we're doing this because me and my buddies who are working late tonight found out about this so we drafted up a letter to the government". I just don't want to say that I'm representing Atlassian's stance without running things through legal.
- lugg 8y agoI suspected as much, I just felt that if it was a stance worth making it was probably a stance worth running past legal (even if it meant a quick phone call out of hours.) Whether that call is met with abstantiation or otherwise is what I was wanting to infer. Because at this point, abstantiation or sitting on the fence is as good as supporting the bill.
- cyphar 8y agoI imagine it's because they aren't authorised to speak for the company on topics like what government policies the company is against (and I imagine this is why you got down-voted). But yes, I also would have expected Atlassian and other Australian-based technology companies to vocally oppose this bill because it will actually result in their customers moving away in the long run (this bill will only affect companies incorporated in Australia or other 5-Eyes countries) -- because this bill explicitly requires companies to architect security systems to be insecure. Unfortunately this doesn't appear to be the case, which is incredibly disappointing.