5 ms·
I have spent the last ~2 hours reading the 100 page explanatory document [1], these are some of my thoughts. The bill pretty explicitely talks about ASIO. I do
by Jedi72 8y ago
I have spent the last ~2 hours reading the 100 page explanatory document [1], these are some of my thoughts.
The bill pretty explicitely talks about ASIO. I don't think these laws will be used for much less than espionage, or possibly deep corruption cases. For example, right now ASIO dont have the power to remove a computer to inspect it. That actually surprised me (what would not surprise me is that they routinely do this anyway). In many cases I dont see why physical access is required though, I am sure ASIO are capable of hacking most routers/IoT devices, possibly even laptops, just using known methods (are drug-lords really that up to date on L1TF?). The biggest issue I have is that the granting of warrants always comes down to whether some judge or minister thinks its all good. Although, in one of the sub-sections they say the Attorney-General can delegate their powers to a senior ASIO officer, so this is a C-suite level person inside ASIO likely to have these powers (note that they explicitely point out that this person can not further delegate that power, so these decision makers are direct reports to the Attorney General presumably).
On the topic of getting people to give up passwords and/or keys, it says that agencies have "the ability to compel persons" to hand them over... whatever that means. Does "compel" mean, breaking fingers compel? I am pretty sure this is with a warrant.
There are provisioms for situations where evidence may be lost, or other dire circunstances, where they can request things orally and immediately, but they do have reporting requirements around such circumstances.
Probably the most alarming thing is the technical notices. With these, they can basically ask first, but if required - demand - tech companies to add in back-doors. They try to deny it but thats what they are. It is pretty explicit that they cant compel companies to introduce 'systemic weaknesses', so its not about making product wide easter eggs that give you root permissions. I think they mean more like "put a clause in your code that when Dr Evil logs into WhatsApp, and only Dr Evil, it forwards all comms to us." Thats pretty strong power, and not really a systemic weakness is WhatsApp, but most definitely fits the definition of a back door to me. They say companies will be compensated on a 'no loss, no profit' basis. One kind of nice limitation on this is that it will definitely be expensive for ASIO to do this. Companies are in some ways incentivized to restrict their acts to single customers, because if ASIO want to monitor 10 people, well that requires 10x the budget doesnt it.
This was my first time trying to read law. If you read law as code, then law is TERRIBLY written. This amendment is the worlds most ancient pull-request system, putting this into VC would make it much clearer for all involved. There is no concept of a dependency tree, instead other acts are referenced at will and with no version lock to say whether that definition is still current. I suspect there are a lot of regression fails when they write new legislation, unless someone is pouring over all other acts looking for things which reference the act we want to change.
TL:DR; I'm gonna let this go through to the keeper. Writing law is complex. Ultimately it always comes down to, can we trust our government and public institutions, as well as our companies, to do the right thing? How much must we bind ourselves as a society, to ensure that they cannot abuse us? Its tough. I tend to think that the 99% of the people writing these laws, and the officers enforcing them, aren't monsters or evil people - they are my fellow Australians.
[1] https://www.homeaffairs.gov.au/consultations/Documents/explanatory-document.pdf https://www.homeaffairs.gov.au/consultations/Documents/expla...
- throwaway59229 8y agoI have been reading through the proposed law (see my posts elsewhere in this thread) and I have to say that I disagree with your assessment that the law implies or requires targetting of specific individuals or groups rather than dragnet-style operations. Unfortunately, there doesn't seem to be anything in the bill to limit the scope of a TCN/TAN so that the government agencies can't use a single request to cover a wide range of unrelated cases/investigations. As it is written, it seems that a TCN/TAN could require that a company builds and signs arbitrary code that is handed to them by a government agency. [1] This code would be the backdoor (or Remote Access Tool or whatever they choose to they call it) and likely would be distributed as a software update (possibly also by the company although there might be some legal wrangling about whether the government might be required to host the backdoored software themselves). What this all means is that a single TCN could theoretically be issued to cover a specific case (say a reasonable investigation into some potential terrorist activity) but the signed backdoor/remote access tool that comes out of it could be used arbitrarily by the agencies involved with little to no oversight. I know that this is a difficult area for law-enforcement to operate in and I understand that part of the problem that they have at the moment is that they sometimes have no certainty about whether they can get access to specific pieces of electronic evidence (even with a warrant) but the intelligence community (including here in Australia) has a lot of bridges to build if they want to actually have this discussion in a rational manner. There are probably some reading this who think that I am being hysterical or paranoid about ASIO/ASIS/ASD and that they are rational and ethical actors, but I suspect that anyone who thinks that is likely under informed about their historical activities. There is currently some international investigation into evidence of recent (in the last 15 years) potential wrongdoing [2] that the current Attorney General (who would be the individual responsible for approving these TCN/TANs) is attempting to frustrate. [3] These moves by the current federal AG are so extraordinary that a former NSW DPP (Director of Public Prosecution) and a former Victorian Appeals Court judge have stated that "[...] unlawful activity was undertaken on our behalf to improve the government’s negotiating position" and that "there is a genuine question about whether the general interests of Australians would be served by the prosecution of either person." (the whistle-blower or their lawyer). [4] Given the evidence of poor behavior by these agencies and their apparent disregard for due process, it seems extraordinary to think that these extensive new powers could not be abused as they are currently proposed. [1] See section 317E of the law which states that providers are required to "facilitate or assist access to software that is capable of being installed on a computer, or other equipment, that is, or is likely to be, connected to a telecommunications network" and, crucially, paragraph (f) which states that providers must "assist with the testing, modification, development or maintenance of a technology or capability" [2] In Australia bugging East Timor during negotiations over a $40-56 billion oil deal. See http://www.abc.net.au/news/2014-03-04/icj-orders-australia-to-keep-east-timor-files-sealed/5296444 http://www.abc.net.au/news/2014-03-04/icj-orders-australia-t... [3] https://theconversation.com/the-shaky-case-for-prosecuting-witness-k-and-his-lawyer-in-the-timor-leste-spying-scandal-100446 https://theconversation.com/the-shaky-case-for-prosecuting-w... [4] https://www.smh.com.au/politics/federal/top-lawyers-jump-to-the-defence-of-former-australian-spy-witness-k-20180629-p4zojl.html https://www.smh.com.au/politics/federal/top-lawyers-jump-to-...