4 ms·

I assume you mean Technical Capability Notice where you've written Technical Assistance Notice? (the latter only requires you to use an existing capability that

by caf 8y ago

I assume you mean Technical Capability Notice where you've written Technical Assistance Notice? (the latter only requires you to use an existing capability that you have - if you don't have the capability, they can't force you to use it). My reading of that is that the authorities would have to ask you for some specific technical solution. You lay out how your e2e system with reproducible builds works, and they ask you for something specific - like a backdoored build. It's up to them to figure out how to deal with issues like the reproducible build one.

cyphar 8y ago
I guess you could argue I'm referring to both (though Technical Capability Notice is more obvious). The only requirement applied to a Technical Assistance Notice is that "the Director General of Security or the chief officer of an interception agency [...] is satisfied that [...] compliance with the notice is practicable and technically feasible" (317P). So if the case officer is "satisfied" it doesn't really matter whether you can practically follow it -- and it's not clear to me what recourse someone has if they are given such a notice. Now, Technical Capability Notice restrictions are quite odd. I'm not a lawyer, so 317T.8 is pretty obfuscated to me but it appears to support the argument that they cannot require you to modify a telecommunications system so that it "has the capability to enable a communication passing over the system to be intercepted in accordance with an interception warrant". But I simply must not be reading that part of the bill correctly, because that would imply that e2e couldn't be subverted at all -- which obviously is false because that's precisely what the government wants to do. Technical Capability Notices do have review periods (which can be waived if the Attorney-General says it's urgent) and so on, but I'd be quite worried about how much of a say you really have in those situations... The 317ZG limitations sound good in theory, but as above it feels like it's just word-games to try to avoid criticism. Given the criminal penalties for disclosure of "technical capability notice information", I wonder how this situation would work if you were the maintainer of a GPLv3 project where not providing the source code would be a violation of copyright law.

by caf 8y ago

cyphar 8y ago

I guess you could argue I'm referring to both (though Technical Capability Notice is more obvious). The only requirement applied to a Technical Assistance Notice is that "the Director General of Security or the chief officer of an interception agency [...] is satisfied that [...] compliance with the notice is practicable and technically feasible" (317P). So if the case officer is "satisfied" it doesn't really matter whether you can practically follow it -- and it's not clear to me what recourse someone has if they are given such a notice. Now, Technical Capability Notice restrictions are quite odd. I'm not a lawyer, so 317T.8 is pretty obfuscated to me but it appears to support the argument that they cannot require you to modify a telecommunications system so that it "has the capability to enable a communication passing over the system to be intercepted in accordance with an interception warrant". But I simply must not be reading that part of the bill correctly, because that would imply that e2e couldn't be subverted at all -- which obviously is false because that's precisely what the government wants to do. Technical Capability Notices do have review periods (which can be waived if the Attorney-General says it's urgent) and so on, but I'd be quite worried about how much of a say you really have in those situations... The 317ZG limitations sound good in theory, but as above it feels like it's just word-games to try to avoid criticism. Given the criminal penalties for disclosure of "technical capability notice information", I wonder how this situation would work if you were the maintainer of a GPLv3 project where not providing the source code would be a violation of copyright law.