22 ms·

Australian parliament passes encryption laws unamended

365 points by dhx 8y ago

jstanley 8y ago
> "Do I go home and say well I hope nothing happens and I hope that the Government's politics don't backfire on the safety of Australians? I'm not prepared to do it," Mr Shorten said. And yet, that is precisely what has happened here.
artichokeheart 8y ago
To anyone with a business from anywhere else in the world. Yes please do, publicly and loudly, cease to deal with us (Australia) due to the very real possibility that all of you private and commercially sensitive communications will be monitored and recorded (Also given the five eyes agreement shared with other countries.) Australia already have a history of using their spy services for commercial gain. https://en.m.wikipedia.org/wiki/Australia%E2%80%93East_Timor_spying_scandal https://en.m.wikipedia.org/wiki/Australia%E2%80%93East_Timor...
- ENGNR 8y ago
  I second this. Please be vocal about how Australian's are now boycotted. We need the government to freak out
  - steve_taylor 8y ago
    As an Australian dev, I concur. I would rather our tech industry die (and I end up digging holes in a coal mine for a living) than have this country become a global spy hub used by governments to subdue their citizens.
- brokenmachine 8y ago
  God this is so true. I am so ashamed of our so-called representatives. Please, Apple, do what you know is right and disable all iPhones in Australia. Google, please do the same with Android. If you have a website, geoblock Australia from it. Quarantine us from the world. We are sick and will infect you all.
  - schappim 8y ago
    I really hope Apple does this. Half the politicians seem to use iPads for all their computing needs.
  - chris_wot 8y ago
    No, don't geoblock us. Just refuse to do actual business in Australia. Only allow us to download apps from the U.S. where such broken legislation is not in effect.
    - daemin 8y ago
      Don't think it will help since the agencies can force telcos to mitm the store fronts.
      - brokenmachine 8y ago
        Even this draconian bill I don't think has the power to make telcos mitm sites hosted overseas, does it? But who knows, this bill seems to be the Christmas gift that keeps on giving! Merry Totalitarian Christmas, everyone!!
        daemin 8y ago
        Setting up a MITM would just be a small request from a low level technical employee. Just make packets from this IP go to this other IP for this one account.
        brokenmachine 8y ago
        But if that foreign site is using https then the telco couldn't know which account is logging in.
      - Gaelan 8y ago
        How do the App Store and play store react to bad HTTPS? Do they allow the user to trust?
- boyter 8y ago
  +1 block us. Apple if you are reading this stop selling us iPhones. Australians need to feel the pain of this otherwise nothing will change. 1 billion dollars wiped from Atlassian already. I’m hoping the markets react more and destroy the industry here. Might want to assume that all Australian developers are now potentially compromised.
  - robryan 8y ago
    Possible it will go nowhere. How can Apple for example provide a backdoor for imessage which isn't a systemic weakness?
    - boyter 8y ago
      Considering that isn’t even defined in the bill that just passed I have little hope it will save it.
      - brokenmachine 8y ago
        > have little hope it will save it. have little hope what will save what?
    - s369610 8y ago
      have the app store send a special version of the app or system update to robryan that as well as renders the message on the screen also sends it to the gov.
    - daemin 8y ago
      The intelligence service will request a special version of the software which will store the contents unencrypted, or decrypt the existing contents, or send information to a different server. Then they will coerce a telecommunications provider to install this application on the targets machine (says nothing about having it installed on everybody's machine accidentally or otherwise). Then they shall profit.
    - brokenmachine 8y ago
      They could be compelled to send firmware updates only to specific phones with a new version of imessage that doesn't perform end-to-end encryption.
- marcus_holmes 8y ago
  yep, I'm working on an encrypted product, and will be recommending we don't launch it in Australia. Tiny market, enormous regulatory burden. Not worth it.
- atemerev 8y ago
  While you are probably correct, the world needs to urgently stop doing any business with China first. And since it’s not going to happen, other countries beyond China unfortunately start to get some funny ideas, too...
  - artichokeheart 8y ago
    China is a 1.3 billion people Australia is 25 million. Big difference when it comes to cost and incentive.
    - girvo 8y ago
      Although, we’re a rich 23 million. Of course China’s middle class more than makes up for it, but there’s a reason tech companies like (liked?) Australia.
dhx 8y ago
Full text of bill: https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6195 https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...
lwansbrough 8y ago
Literally zero percent chance I touch any software made in Australia now.
- TheChaplain 8y ago
  Isn't Atlassian Australian? Or did they move?
  - stock_toaster 8y ago
    I believe Fastmail is too, sadly.
  - askaboutit 8y ago
    They’re Australian but have offices in other countries. I believe they would move for the right reasons. This seems like a pretty big reason, considering they’re targeted at enterprise. But move where? UK will have this next, America does this without any laws at much greater effect and scale.
    - ENGNR 8y ago
      Iceland? Switzerland? They'd need the system admins, CI infrastructure and code review team to be in a jurisdiction free of this kind of thing, and then treat all changes subject to laws like these as hostile The alternative is sell software that everyone knows has backdoors. Pretty hard business case to make
    - mikro2nd 8y ago
      California. I had to agree to some changes to their ToS the other day (for Bitbucket) in which I agreed to dispute resolution under California law. I suppose that's a pretty good indication of their thinking. It's not like this legislation is unexpected or sudden.
      - emiliobumachar 8y ago
        Are the U.S. "gag orders" equivalent to this new Australian law?
CalRobert 8y ago
How can someone know whether their software is compromised by this?
- deleted 8y ago
  [deleted]
- steve_taylor 8y ago
  Officially, they can’t, but you can be absolutely certain that iMessage, WhatsApp, Signal and Telegram are going to be immediately targeted with TCNs (technical capability notice), requiring them to bundle Australian government spyware and requiring that those apps send all conversations to the spyware.
  - cyphar 8y ago
    This isn't quite true. The bill allows companies to provide statistics on how many TARs, TANs, and TCNs they've been served within a 6-month window. The obvious problem is that nothing stops them from lying or just omitting that information -- because why would you admit that your software is insecure?
    - shakna 8y ago
      Employees of a company may also be served, and required not to tell their employer. So a company may not know if they are compromised.
      - gnud 8y ago
        I doubt you could introduce backdoors in big software (Messenger, iMessage, WhatsApp) using only one/a few employees - unless everyone who does code reviews happens to live in Australia.
      - cyphar 8y ago
        Right, but then the employee can publish statistics about how many TCNs they've received.
white-flame 8y ago
This is government-compelled labor, whose product is only of value to government, and which labors in direct opposition to the personal safety and well-being of the entire general population. Australia, you fail at the very notion of free western civilization.
- steve_taylor 8y ago
  It’s also government compelled lying.
rswail 8y ago
It's a stupid law passed by stupid politicians. The only thing to do now is to demand that ALP politicians reverse it in the next sitting of Parliament.
- cyphar 8y ago
  ALP voted for it unanimously. I don't hold out much hope that they'll reverse course -- we should push for third parties in the next election.
  - rswail 8y ago
    They voted for it to cover Bill's ass on the last day of parliament and 2 weeks of Dutton and ScoMo getting dumb people scared about Xmas. The amendments to this stupid act do gut a lot of the stupidities (not completely), so the pressure now is to make this (and the Nauru re-settlement) the only thing that the ALP allows on the first days of parliament next year. Write to your MPs, the shadow ministers and the cross bench. Writing to the LNP politicians is a pointless exercise.
    - jsmeaton 8y ago
      Cop a beating over Christmas, who cares? No one is going to remember by election time anyway. The opposition had an easy win today, and they threw it back to the gov.
hestefisk 8y ago
I live in Australia and this is the dumbest bill I have ever seen in parliament. Australian politicians have no clue what the fuck they have just done. Rushed through in less than four days so they can go on holidays. Bigots.
- gonzo41 8y ago
  I'm pretty sure it's still illegal to show a naked mannequin in Tasmania. There are plenty of stupid laws on the books. This is one. For sure! But read the guardian blog from today. The opposition is avoiding having to fight against "Mr. Stop the boats.". And as for rushed through. Lots of stupid shit took a ton of time. Like the marriage survey that could have been done in 15 minutes.
- mtgx 8y ago
  > Rushed through in less than four days so they can go on holidays. It was planned this way by the intelligence agencies and its supporters. It always is.
- rswail 8y ago
  To quote our last PM (well, this week anyway): "The laws of Australia prevail in Australia, I can assure you of that. The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia."
  - nailer 8y ago
    Oh god. I left Oz in 2008 when Turnbull was a small-l-liberal, pro-business, pro-tech guy. From what I hear from home he became another deliberately ignorant Aussie conservative.
    - shusson 8y ago
      Ha, you forget how often we change our PMs :p
      - 8y ago
ENGNR 8y ago
Doesn't this also effect git repositories maintained by Australians? (I say this as an Australian who wants secure software) All it takes is one malicious npm package
- cyphar 8y ago
  As an Australian software developer who has written encryption software in the past, I'm also very concerned. I'm also doubly concerned that projects will now reject my patches because of my nationality. What an amazing shitshow of a government.
  - steve_taylor 8y ago
    I’m seriously considering moving from Australia to a country that isn’t part of the Five Eyes.
    - brokenmachine 8y ago
      I'm thinking about moving to NZ. How are they?
      - billwashere 8y ago
        One of 5 eyes (Australia, Canada, New Zealand, the United Kingdom and the United States)!
      - toyg 8y ago
        They are in Five Eyes, were instrumental in Echelon, illegally raided Dotcom... NZ is a beautiful country, but one of the weakest-willed in international terms. (Also, by all reports, internet connectivity sucks big time).
        eythian 8y ago
        > Also, by all reports, internet connectivity sucks big time If the poster is coming from Australia, NZ is not so bad.
ACow_Adonis 8y ago
Is there a (non-alarmist/non-defensive/non-partisan) summary available of what the bill actually contains and what its practical effects might be?
- cyphar 8y ago
  I'd recommend actually reading the bill to form your own conclusions. The main problem is that it mostly is a series of amendments, and many of them are quite unrelated. Most of the discussion is about the Technical Capability Notice section (which allows the government to compel a telecommunication provider, under threat of 5 years imprisonment, to create the ability to access communications otherwise inaccessible) but very few people are talking about the Computer Access Warrant sections... And it's possible for employees to be forced to do this, and you cannot reveal information about these technical notices to your employer -- in fact you are given immunity from civil persecution precisely for this reason. So you now have to sabotage your employer because of an order by the Australian government. Good luck keeping your job.
  - ACow_Adonis 8y ago
    I very well may end up reading the whole thing, but that's partly why i'd actually like an expert summary, because my understanding is that these are amendments to existing legislation, and as a non-expert, the ability for me to be able to understand all the other legislation and implications that it works with is probably pretty close to zero...
  - rswail 8y ago
    The best discussion I've found in terms of the legislation is at [1]. The most insidious part to me as a programmer, is the definition of a "Designated Communications Provider" which (amongst others) includes (S317C, item 6): "the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-users in Australia" and the "eligible activities" are: (a) the development by the person of any such software; or (b) the supply by the person of any such software; or (c) the updating by the person of any such software" [1] https://parlinfo.aph.gov.au/parlInfo/download/legislation/billsdgs/6370016/upload_binary/6370016.pdf;fileType=application/pdf https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi...
healsjnr1 8y ago
This is another thing that adds to my deep sense of shame to live in this country (sadly, that list is long and growing). This bill does nothing to prevent the kinds of things it is intended to prevent. The apps this law targets were engineered specifically to prevent this kind of interference. The idea that passing legislation will suddenly change that, magically allowing decryption of messages is beyond idiotic. The legal and technical barriers to getting anything useful from this legislation are huge. Not to mention the ease with which this can be bypassed (run OpenVPN and IRC on an overseas server, done). The justification for rushing this was so that Australia could be kept 'safe' over Christmas. It's beyond difficult to describe how ridiculous that is. Edit: Sorry, I also have to add that in the same sitting of Parliament the government also filibustered legislation that would have enabled medical evacuation of refugee children from child detention on Nauru. It's been a bad day for Human rights in Australia.
- cyphar 8y ago
  > It's beyond difficult to describe how ridiculous that is. Especially since ASIO (who really wanted this bill to pass) has stated that even if the bill passed today, they wouldn't have the necessary powers before Christmas.
  - daemin 8y ago
    So now any of the Five Eyes intelligence agencies can have a chat with ASIO and get them to coerce companies and individuals within companies to put these back doors in. Then they can all use the same back doors, so everyone living in the USA, UK, Canada, and New Zealand can have their encryption compromised and communications intercepted. There's no way that companies will create back doors specifically just for Australia, so everyone will have access. In terms of Australia I'm not sure what we could actually do about this. Given that it's ASIO and other government departments that want these powers and that they have tried to introduce this sort of law over the course of the last decade. Both major parties have introduced legislation such as this and both voted for it. Maybe it is time for civil disobedience, and have everyone create and distribute encryption applications for all devices, because they couldn't possibly jail everyone right? I just wonder who will be the first person jailed or the first company fined for refusing these orders. In terms of the world at large, which country should we trust now? A lot of the Western Democracies are becoming rapidly "security" focused authoritarian, and the other countries powerful enough to stand up to them are not much better. Should we trust applications with code written in Russia? What about hardware products manufactured in China? Should we trust services running in the USA? Now we also have to be wary of any company that runs a service in the Five Eyes countries. Sometimes I wonder if we really have it better than people in the middle ages or other earlier periods, in some ways it clearly is, but in others it's just the same smell coming from different shit.
deleted 8y ago
[deleted]
brokenmachine 8y ago
Could an expat Australian dev be compelled to put backdoors in software even while overseas, under threat of being prosecuted when he returns? If so, Australians can't even be employed in foreign software companies.
- boyter 8y ago
  The law as written applies to any company or person that does business or has customers in Australia. This includes websites. So they don’t need anyone Australian on your team as written. However yes.
- pvg 8y ago
  No. People work in jurisdictions other than their own with potentially conflicting laws all the time. If it worked the way you seem to be suggesting it does, nobody, never mind Australians, would be able to work outside their home municipality at all.
  - bigiain 8y ago
    Extraordinary rendition of SV software devs. I doubt even _that_ would cause an uproar so long as it's timed to coincide with yet another threat to the aspirationally wealthy Australian way of life... "Well, we need to lock up E2E encrypted messaging app developers in Nauru and Guantanamo Bay, because otherwise mortgage rates will go up and your house and investment property values will fall!"
    - pvg 8y ago
      This is why Australia was formally handed over to the Illuminati in the Treaty of Westphalia.
- isostatic 8y ago
  Could any developer put backdoors in under promise of a suitcase of cash? If your review system fails because your Aussie developer "may be compromised", it fails because your $good_country developer may also be compromised.
acutesoftware 8y ago
I am an Australian software developer and am currently getting https://www.lifepim.com https://www.lifepim.com ready for release which, funnily enough has the main selling point as "Your data is private, secure and free from adverts" - what a joke. The scary part is not knowing how the law is going to be implemented - I am hopeful that smart people work on the implementation of it in terms of practicality. If it is an on request thing "give us the details of terrorist@blah.com" then that is doable, but if they really want backdoor access to all accounts, then that is ridiculous amount of work and a lot of security risks to worry about. Wait and see I guess.
- dbetteridge 8y ago
  Looks like a cool product. Realistically could we just setup all code to be hosted overseas and then pay a set of reviewers in Europe to check PR's for possible backdoors? Don't think the law let's them compell you to build the backdoor in a super secret and hidden way...
  - boyter 8y ago
    The way it’s written that could be 5 years in gaol because you let people know about it.
    - StavrosK 8y ago
      Not relevant, but I love the old-school spelling of "gaol". Is it still used anywhere or are you being whimsical?
      - brokenmachine 8y ago
        That's the official spelling in Australia, and I think the UK.
      - shakna 8y ago
        Yes, Australia uses it still. e.g. Ballarat Gaol, Old Melbourne Gaol.
sn41 8y ago
Okay - a quick question: how does bitbucket deal with this, since Atlassian is an Australian company? Am I making an error here?
- boyter 8y ago
  1 billion lost from the company already. I am hoping for them to depart Australia for good on this.
  - netheril96 8y ago
    > 1 billion Is that metaphorical or actual number? If latter, I am interested in the source.
    - BigJono 8y ago
      Their stock is down 4.3% today and their market cap is around $20B
      - Tor3 8y ago
        Thay may be unrelated - most stock markets went down about that much today (and I'm glaring at my own stocks at the moment - none in Atlassian, they're down an average of 4.23% as of now)
shakna 8y ago
It's over. I may as well not be a programmer anymore. The government has effectively made it possible that anyone and everyone who develops software or hardware used by anyone in the country, or where they feel national security comes into play, must compromise their software, and tell no one. They can ask any intern to break the software, and not tell their employer. It's bad enough to have a gaping hole in your security, but now they can ask people who have no idea what they're doing to create a backdoor. All Australian software has now been rendered completely untrustworthy, and when those compromises in security are found, by the nation states who now know that Australian software will have holes in it, it will result in the very thing that this bill claims to prevent. Our infrastructure has been opened up for attack, by any of our neighbours who have a reason to do so, whilst simultaneously gutting the economy of IT in Australia. Who wants to buy shitty backdoored Chinese software? It's the same now for Australia. Australia's government has now opened the door for widescale cyberterrorism to have a chance at wreaking destruction.
- daemin 8y ago
  Remember that the Australian Government (whatever party happens to be in power at the time, it doesn't matter which) doesn't want technology or innovation in this country. They only want the value of dirt to remain high. So that buildings remain valuable and that we can export more natural resources.
- stonith 8y ago
  Isn't this pretty much the same as the US and their National Security Letters? They can compel engineers/companies to do pretty much anything, and the veil of secrecy is the same.
  - shakna 8y ago
    As far as I'm aware, an NSL can't compel you to create a new architecture. This can.
  - tssva 8y ago
    National Security Letters can't compel engineers/companies to do pretty much anything. National Security Letters can only request non-content information. A NSL also can't compel the gathering of additional non-content information beyond that already being gathered. So a NSL could request the records for who you are sending encrypted messages to but not the content of the messages and if your messaging provider can't or doesn't already gather that information they can't be compelled to start gathering such information. If a NSL requests information which the recipient believes violates that guidelines of information which can be requested they can disclose the NSL to legal counsel and challenge the NSL in court.
_Nat_ 8y ago
Some of the comments so far seem to suggest that this bill would require software to include backdoors. However, it looks like [the bill's PDF](https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_first-reps/toc_pdf/18204b01.pdf;fileType=application%2Fpdf#search=%22legislation/bills/r6195_first-reps/0000%22 https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi...) includes: > Division 7—Limitations > 317ZG Designated communications provider must not be required to implement or build a systemic weakness or systemic vulnerability etc. > (1) A technical assistance notice or technical capability notice must not have the effect of: > (a) requiring a designated communications provider to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection; or (b) preventing a designated communications provider from rectifying a systemic weakness, or a systemic vulnerability, in a form of electronic protection. > (2) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to implement or build a new decryption capability in relation to a form of electronic protection. > (3) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to one or more actions that would render systemic methods of authentication or encryption less effective. These limitations would seem to imply that the bill can't require a "systemic weakness", either by introducing a new one or prohibiting the patching of an existing one, which would seem to suggest that end-to-end crypto wouldn't be affected. Is this a correct reading? Or are there concerns that the government might, say, require end-to-end crypto to be vulnerable to a government-held golden key? --- Edit: Part of the text, > to implement or build a new decryption capability in relation to a form of electronic protection , sounds like it's prohibiting golden-key-based schemes.
- schappim 8y ago
  What does this mean for Zero-knowledge systems?
  - cmroanirgo 8y ago
    You must build a custom made back door. eg. Something like ProtonMail would need to inject some extra javascript so that the government could obtain a copy before encryption, I expect. If I were to write some software of this nature these days, I'd make sure that the client would be aware of any changes in the api - sort of like a personal warrant canary. (Note that a warrant canary is legal in this legislation).
k_sze 8y ago
Can somebody write up a tutorial/guide on how to block all network communications (incoming or outgoing) with Australian IPs, on all or select ports, under common OSes (Windows, Linux, Mac, BSD).
- Tor3 8y ago
  Can't write the guide for you, but the raw material can be found here (and other places): http://www.ipdeny.com/ipblocks/data/aggregated/au-aggregated.zone http://www.ipdeny.com/ipblocks/data/aggregated/au-aggregated... That's a list of the (current) IPv4 Australian blocks. Each value (e.g. 1.0.4.0/22) can be used directly as a parameter for iptables on Linux, e.g. /sbin/iptables -A INPUT -s 1.0.4.0/22 -j DROP (to really block any communication - or use REJECT instead) A script to walk through the file works fine.
  - k_sze 8y ago
    Great starting point!
dbetteridge 8y ago
Business opportunity for EU devs provide Australian businesses with PR and code review to ensure their software isn't backdoor'd
- brokenmachine 8y ago
  And if it is, then what? Good idea though. Maybe some kind of Certification?
  - dbetteridge 8y ago
    Well ideally you get in early and catch it in a mandatory PR process, all PR's pass through EU devs who are the only ones who can merge. Otherwise yes, security certification process to review existing code and then maintain as above.
  - missjellyfish 8y ago
    As if certifications would prove anything. Just look at what the German tüv certifies secure. They are missing even the most basic XSS stuff. I have no hope here.
- davedx 8y ago
  More like, biz opportunity to make products competing with Jira, Confluence et al. Wonder how many banks and other security sensitive orgs use Jira and store all their tech specs in there. All of them?
  - based2 8y ago
    https://www.jetbrains.com/youtrack/specials/compare/jira-vs-youtrack https://www.jetbrains.com/youtrack/specials/compare/jira-vs-... https://www.xwiki.org/xwiki/bin/view/Main/WebHome https://www.xwiki.org/xwiki/bin/view/Main/WebHome
- stephen_g 8y ago
  If an Australian developer was served with a Technical Capability Notice to build a backdoor, and then submitted code to be analysed by a third party who found it, the developer would literally be liable to be jailed for 15 years and a $50K fine for individuals or $10 million for companies. The law requires us to deliver exploits secretly and lie to everybody about it.
chris_wot 8y ago
Bill Shorten is an idiot for letting this get through.
- brokenmachine 8y ago
  I agree 100%, but we can assign just as much blame to Morrison for presenting the bill as well.
- pascalo 8y ago
  He was a push over on metadata retention, why would it have been different this time? What a joke!
krautjakob 8y ago
Ouch. Since I'm using Fastmail ... can anybody recommend a good alternative? I don't mind paying for a good and secure E-Mailprovider. Protonmail looks nice, but it does not seem to offer IMAP (because mails are end2end encrypted).
- miqkt 8y ago
  Posteo (https://posteo.de https://posteo.de). Made the switch earlier this year. Webmail UI might seem clunky to some, but I use IMAP so non-issue for me. Easy to set up encryption and apparently they're powered sustainably too. One deal breaker I know of is you can't map to your own custom domains. There's something in their FAQ which explains their rationale behind this.
- martinbm 8y ago
  ProtonMail is indeed great and offers a bridge for use with IMAP-compatible programs. Check out https://protonmail.com/bridge/ https://protonmail.com/bridge/. I believe they are working on a more integrated solution, but no news of when it'll be out have been announced.
- shakna 8y ago
  Paid Protonmail has a bridge to IMAP/SMTP. [0] [0] https://protonmail.com/bridge/ https://protonmail.com/bridge/
  - ftrtiabi 8y ago
    Yeah but not for mobile, which I assume means you have to use their own client? Ridiculous how much computing has regressed.
  - endgame 8y ago
    GNU/Linux support when?
    - kazen44 8y ago
      there is a "beta" version available for linux. This version seem to work perfectly fine on my fedora machine so far.
bwilli123 8y ago
Does this mean that if I take my iphone into an Apple Store in Australia for repair that a Genius could load unknown software (under legal compulsion) without Apple itself knowing?
- brokenmachine 8y ago
  Yes. This is a civil rights nightmare.
- bausshf 8y ago
  Yes
- techtalsky 8y ago
  Technically, yes, as I understand the legislation.
- Whitestrake 8y ago
  They have to attempt to keep Apple from learning about it, as I understand it. I wonder what steps Apple will take to bar this kind of eventuality. If an employee makes a good faith attempt to comply with this request, which is then blocked by the overseas manufacturer, can they throw their hands up and say, "Well, I tried!"? Would this allow them to avoid the $50k fine and 10 years in jail the Government can hand out for not complying?
jacques_chester 8y ago
If you are an Australian software engineer, you have one advantage that other nationalities do not: the E3 visa. It is a US working visa that is specifically reserved for Australians and consequently it is much easier to get than an H1B. My advice is that the Australian tech industry just got nuked from orbit, so come work in the USA. The pay is better, the work is more interesting and the tech companies actually have sway over policy here.
- cylinder 8y ago
  the US has already been doing this stuff for a long time, without it being legal. They can always pressure you and threaten to ruin any engineer's life if they don't do what they want. and who do you think came up with this legislation? It's US Intelligence. Australia is their testing lab, just like Macca's does.
  - jacques_chester 8y ago
    Apple stared down the FBI in a mass murder case, because it was possible for them to do so. They won't be able to do that in Australia. I don't like the US shonkiness any more than anyone else. But these situations are not precisely equivalent, especially since this bill passed.
    - brokenmachine 8y ago
      The US government ignores their laws, while Australia passes terrible ones. Six of one, half dozen of the other.
      - MaxBarraclough 8y ago
        > The US government ignores their laws and yet > Apple stared down the FBI in a mass murder case, because it was [legally] possible for them to do so.
        brokenmachine 8y ago
wallace_f 8y ago
What kicked this off the front page? Note that the most-upvoted post in the past month, critical of Google, was at the time mysteriously kicked off the front page as well.
- sn41 8y ago
  Yep. very mysterious. I don't know if it is deliberate, but what's the front page policy?
- Tor3 8y ago
  Yeah, that was strange. But suddenly it went back from page 2 to the front page again, around pos. 15
- wolfgang42 8y ago
  I believe HN has a flame war detector that trips when the number of comments is greater than the number of votes, and pulls the submission off the front page. (I haven't looked, but this is probably what happened to the Google post as well.) Since it's back on the front page now, I'd guess that the HN mods decided that this was important and un-tripped the detector.
anotherhuman0 8y ago
Somebody over on Reddit [1] went through all the submissions (there was a consultation period) and summarised and tallied them [2]. Fully 99%+ of submissions were against the bill. A sad day for democracy indeed. A church in Tasmania was in favour, because child pornography. 1. https://www.reddit.com/r/australia/comments/a3j466/assistance_and_access_bill_2018_just_passed_the/eb75et6/ https://www.reddit.com/r/australia/comments/a3j466/assistanc... 2. https://docs.google.com/spreadsheets/d/1dowpZ_Xtr1N_DgkHJN8iinbqRd1peTgQp_fSL0vELDA/edit#gid=0 https://docs.google.com/spreadsheets/d/1dowpZ_Xtr1N_DgkHJN8i...
- wallace_f 8y ago
  A sad day for democracy, but this fact restores some faith in humanity.
  - akerro 8y ago
    A sad day for democracy, but this fact restores some faith in dictatorship. FTFU
  - colpabar 8y ago
    How?
    - JustSomeNobody 8y ago
      That so many people were against it?
      - wallace_f 8y ago
        Yea, that's what I meant. At least the people seemed to be overwhelmingly opposed to it, and trying to vote against it. RIP to internet points on that comment, lol.
        cmroanirgo 8y ago
        Yeah, I too, read your comment in the -ve. Thanks for the clarification. So, yeah, a great day for humanity that didn't want this.
deleted 8y ago
[deleted]
buttslasher69 8y ago
Someone make a website with a more complete list of Australian software & hardware companies so we can blacklist them all more efficiently Or even a list of Australian devs to blacklist lol
jhauris 8y ago
Can anyone comment on how this affects those of us in other five eyes countries? Are we now subject to any provisions of this law by proxy?
throwawaymanbot 8y ago
A great day for those of us who are against Western Democracy. Bravo Australia. And as a bonus... the Symbiotic relationship with Chinese policy points on course for completion too! BRAVO!
naaaaak 8y ago
> Fully 99%+ of submissions were against the bill. A sad day for democracy indeed. This is what happens when you give up your guns. Government stops caring about serving you and implements total control of you.
turblety 8y ago
Obviously this law and ones like it have no place in a modern, free society, but in regards to the risk with using business apps, it's just the same as before. You can not trust app's from companies incorporated in the five eyes [1]. If you are using a product made in any of the five eyes you are already compromised. By compromised, I mean you can be almost 100% sure that if the owner's of those countries want your data they will get it, and they will get it easily too. They do not need warrants, courts or judges to sign of on anything and haven't done for a long time. To clarify my position on this. Whether a law like this is actually passed or not, you should assume that every company incorporated in these countries have been forced to place backdoors in their systems. I'm not saying that every company has done this. I'm saying you should assume they have. 1. https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes
aiisahik 8y ago
As an Australian citizen who has spent many years in the US, I can say that this law is in line with the main ideology of the Australian government: extreme parentalism. You run a red light: fine for $450 in the mail. No court date, no arguments. You exceed the speed limit by 5km/h: $200 fine in the mail. No arguments. It is brutal but it's hard to deny that it works. Australia has some of the lowest per capital road deaths in the OECD. The problem is that the government wants to regulate the internet the say way they regulate road traffic. You can read up all the idiotic attempts here: https://en.wikipedia.org/wiki/Internet_censorship_in_Australia https://en.wikipedia.org/wiki/Internet_censorship_in_Austral... I wonder if this means Australia will have the ability to ban apps like Telegram from the app store?
- brokenmachine 8y ago
  They are trying to secretly force tech companies into unpaid labour to destroy the security of their own products in their ham-fisted stupid attempts however. This is much worse than the authoritarian way they handle traffic fines. There is no legal representation, no judicial oversight and no actual definitions of essential terms in the bill. Make no mistake, this is a dictatorship.
  - brokenmachine 8y ago
    Oops. Actually, it's a totalitarian regime.
- photojosh 8y ago
  To be fair, I got a fine in the mail years ago for stopping in a no stopping zone. (Couldn't find a carpark and had a screaming baby in the back) The notice says you can contest in court, which I did and got off. That was back as a student, it wouldn't be worth my time to take a whole day off anymore. :(
  - exodust 8y ago
    Yeh you can elect to contest any fine in court. I've done it twice here in Aust, and had the fine thrown out both times, including a big $750 driving unregistered fine. It takes about 4 hours or more out of your day to attend court which is obviously not possible for everyone.
75dvtwin 8y ago
Australia -- the 1st world leader of the modern Progressive policies. 2018 -- citizens loose communication privacy protection [0] 2017 -- whistleblowers and dissidents are committed to mental institutions [1] 2016 -- citizens loose financial transaction privacy (the cashless society with finalized transition by 2020) [2] 1996 -- government confiscated all firearms from the hands of private, law abiding citizens Sweden, and Canada are next. Basically -- step-by-step methodology to run country-sized Mafia operation is being implemented. [0] this article [1] http://www.blotreport.com/australian-politics/are-the-thought-police-coming/ http://www.blotreport.com/australian-politics/are-the-though... [2] https://bitsonline.com/australia-cashless-2020-payments-network/ https://bitsonline.com/australia-cashless-2020-payments-netw...
- hnzix 8y ago
  > government confiscated all firearms It's relatively easy to get access to firearms in Australia, including semi-automatic pistols. [0] The gun control laws mainly affected semi-automatic rifles and shotguns. [0] https://www.huffingtonpost.com.au/2017/10/04/australias-gun-laws-arent-as-tough-as-you-think-and-standards-are-slipping_a_23233112/ https://www.huffingtonpost.com.au/2017/10/04/australias-gun-...
  - 75dvtwin 8y ago
    thx for the correction. You are right. I should have said the confiscation (mandatory bayback) started with all semi-automatics and pump-action in 1996. WRT pistols, the pistols that are allowed, have less lethal power than bow and arrow (if the below excerpt is correct). ".... they can then attend at a licenced firearm dealer and select a handgun which is suitable for the competition in which they intend to take part. This firearm may be a single-shot air pistol, a single-shot .22-calibre pistol or a .22-calibre revolver or self-loading pistol. …" https://ssaa.org.au/news-resources/research-archive/handgun-ownership-facts-in-australia/ https://ssaa.org.au/news-resources/research-archive/handgun-... not sure if this was also the case before '96 and self-defense was already banned then. The bolt actions that are allowed, cannot have pistol grip and must not look 'military'.
- 8y ago
brokenmachine 8y ago
I have to say, the coverage of this bill on the news has been atrocious. I've seen zero discussion of the possible ramifications of losing all security companies in Australia. Any software company that depends on security (and which one doesn't?) would be insane in the membrane to think they could credibly work in Australia now. All they are saying is "the bill was passed to access encrypted communications of terrorists and criminals". No discussion of no judicial oversight either. News orgs are shooting themselves in the foot because there's no possibility of a journalist protecting their sources anymore with this nightmare.
- ffoxd 8y ago
  Australia doesn’t have much in the way of judicial oversight. The joys of parliamentary supremacy and a weak constitution.
mimixco 8y ago
This is a big deal for people of all countries as the major tech firms will quickly build-in the required backdoors to stay in compliance -- and they won't just be there for Australian citizens; they'll be there for all of us.
- mvid 8y ago
  Will they? Is Australia a big enough market to give up global credibility as a company?
  - mimixco 8y ago
    We can only hope not.
techsin101 8y ago
Reminds me of that book

365 points by dhx 8y ago

> "Do I go home and say well I hope nothing happens and I hope that the Government's politics don't backfire on the safety of Australians? I'm not prepared to do it," Mr Shorten said. And yet, that is precisely what has happened here.

artichokeheart 8y ago

To anyone with a business from anywhere else in the world. Yes please do, publicly and loudly, cease to deal with us (Australia) due to the very real possibility that all of you private and commercially sensitive communications will be monitored and recorded (Also given the five eyes agreement shared with other countries.) Australia already have a history of using their spy services for commercial gain. https://en.m.wikipedia.org/wiki/Australia%E2%80%93East_Timor_spying_scandal https://en.m.wikipedia.org/wiki/Australia%E2%80%93East_Timor...

ENGNR 8y ago
I second this. Please be vocal about how Australian's are now boycotted. We need the government to freak out
- steve_taylor 8y ago
  As an Australian dev, I concur. I would rather our tech industry die (and I end up digging holes in a coal mine for a living) than have this country become a global spy hub used by governments to subdue their citizens.
brokenmachine 8y ago
God this is so true. I am so ashamed of our so-called representatives. Please, Apple, do what you know is right and disable all iPhones in Australia. Google, please do the same with Android. If you have a website, geoblock Australia from it. Quarantine us from the world. We are sick and will infect you all.
- schappim 8y ago
  I really hope Apple does this. Half the politicians seem to use iPads for all their computing needs.
- chris_wot 8y ago
  No, don't geoblock us. Just refuse to do actual business in Australia. Only allow us to download apps from the U.S. where such broken legislation is not in effect.
  - daemin 8y ago
    Don't think it will help since the agencies can force telcos to mitm the store fronts.
    - brokenmachine 8y ago
      Even this draconian bill I don't think has the power to make telcos mitm sites hosted overseas, does it? But who knows, this bill seems to be the Christmas gift that keeps on giving! Merry Totalitarian Christmas, everyone!!
      - daemin 8y ago
        Setting up a MITM would just be a small request from a low level technical employee. Just make packets from this IP go to this other IP for this one account.
        brokenmachine 8y ago
        But if that foreign site is using https then the telco couldn't know which account is logging in.
    - Gaelan 8y ago
      How do the App Store and play store react to bad HTTPS? Do they allow the user to trust?
boyter 8y ago
+1 block us. Apple if you are reading this stop selling us iPhones. Australians need to feel the pain of this otherwise nothing will change. 1 billion dollars wiped from Atlassian already. I’m hoping the markets react more and destroy the industry here. Might want to assume that all Australian developers are now potentially compromised.
- robryan 8y ago
  Possible it will go nowhere. How can Apple for example provide a backdoor for imessage which isn't a systemic weakness?
  - boyter 8y ago
    Considering that isn’t even defined in the bill that just passed I have little hope it will save it.
    - brokenmachine 8y ago
      > have little hope it will save it. have little hope what will save what?
  - s369610 8y ago
    have the app store send a special version of the app or system update to robryan that as well as renders the message on the screen also sends it to the gov.
  - daemin 8y ago
    The intelligence service will request a special version of the software which will store the contents unencrypted, or decrypt the existing contents, or send information to a different server. Then they will coerce a telecommunications provider to install this application on the targets machine (says nothing about having it installed on everybody's machine accidentally or otherwise). Then they shall profit.
  - brokenmachine 8y ago
    They could be compelled to send firmware updates only to specific phones with a new version of imessage that doesn't perform end-to-end encryption.
marcus_holmes 8y ago
yep, I'm working on an encrypted product, and will be recommending we don't launch it in Australia. Tiny market, enormous regulatory burden. Not worth it.
atemerev 8y ago
While you are probably correct, the world needs to urgently stop doing any business with China first. And since it’s not going to happen, other countries beyond China unfortunately start to get some funny ideas, too...
- artichokeheart 8y ago
  China is a 1.3 billion people Australia is 25 million. Big difference when it comes to cost and incentive.
  - girvo 8y ago
    Although, we’re a rich 23 million. Of course China’s middle class more than makes up for it, but there’s a reason tech companies like (liked?) Australia.

dhx 8y ago

Full text of bill: https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6195 https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...

lwansbrough 8y ago

Literally zero percent chance I touch any software made in Australia now.

TheChaplain 8y ago
Isn't Atlassian Australian? Or did they move?
- stock_toaster 8y ago
  I believe Fastmail is too, sadly.
- askaboutit 8y ago
  They’re Australian but have offices in other countries. I believe they would move for the right reasons. This seems like a pretty big reason, considering they’re targeted at enterprise. But move where? UK will have this next, America does this without any laws at much greater effect and scale.
  - ENGNR 8y ago
    Iceland? Switzerland? They'd need the system admins, CI infrastructure and code review team to be in a jurisdiction free of this kind of thing, and then treat all changes subject to laws like these as hostile The alternative is sell software that everyone knows has backdoors. Pretty hard business case to make
  - mikro2nd 8y ago
    California. I had to agree to some changes to their ToS the other day (for Bitbucket) in which I agreed to dispute resolution under California law. I suppose that's a pretty good indication of their thinking. It's not like this legislation is unexpected or sudden.
    - emiliobumachar 8y ago
      Are the U.S. "gag orders" equivalent to this new Australian law?

CalRobert 8y ago

How can someone know whether their software is compromised by this?

deleted 8y ago
[deleted]
steve_taylor 8y ago
Officially, they can’t, but you can be absolutely certain that iMessage, WhatsApp, Signal and Telegram are going to be immediately targeted with TCNs (technical capability notice), requiring them to bundle Australian government spyware and requiring that those apps send all conversations to the spyware.
- cyphar 8y ago
  This isn't quite true. The bill allows companies to provide statistics on how many TARs, TANs, and TCNs they've been served within a 6-month window. The obvious problem is that nothing stops them from lying or just omitting that information -- because why would you admit that your software is insecure?
  - shakna 8y ago
    Employees of a company may also be served, and required not to tell their employer. So a company may not know if they are compromised.
    - gnud 8y ago
      I doubt you could introduce backdoors in big software (Messenger, iMessage, WhatsApp) using only one/a few employees - unless everyone who does code reviews happens to live in Australia.
    - cyphar 8y ago
      Right, but then the employee can publish statistics about how many TCNs they've received.

white-flame 8y ago

This is government-compelled labor, whose product is only of value to government, and which labors in direct opposition to the personal safety and well-being of the entire general population. Australia, you fail at the very notion of free western civilization.

steve_taylor 8y ago
It’s also government compelled lying.

rswail 8y ago

It's a stupid law passed by stupid politicians. The only thing to do now is to demand that ALP politicians reverse it in the next sitting of Parliament.

cyphar 8y ago
ALP voted for it unanimously. I don't hold out much hope that they'll reverse course -- we should push for third parties in the next election.
- rswail 8y ago
  They voted for it to cover Bill's ass on the last day of parliament and 2 weeks of Dutton and ScoMo getting dumb people scared about Xmas. The amendments to this stupid act do gut a lot of the stupidities (not completely), so the pressure now is to make this (and the Nauru re-settlement) the only thing that the ALP allows on the first days of parliament next year. Write to your MPs, the shadow ministers and the cross bench. Writing to the LNP politicians is a pointless exercise.
  - jsmeaton 8y ago
    Cop a beating over Christmas, who cares? No one is going to remember by election time anyway. The opposition had an easy win today, and they threw it back to the gov.

hestefisk 8y ago

I live in Australia and this is the dumbest bill I have ever seen in parliament. Australian politicians have no clue what the fuck they have just done. Rushed through in less than four days so they can go on holidays. Bigots.

gonzo41 8y ago
I'm pretty sure it's still illegal to show a naked mannequin in Tasmania. There are plenty of stupid laws on the books. This is one. For sure! But read the guardian blog from today. The opposition is avoiding having to fight against "Mr. Stop the boats.". And as for rushed through. Lots of stupid shit took a ton of time. Like the marriage survey that could have been done in 15 minutes.
mtgx 8y ago
> Rushed through in less than four days so they can go on holidays. It was planned this way by the intelligence agencies and its supporters. It always is.
rswail 8y ago
To quote our last PM (well, this week anyway): "The laws of Australia prevail in Australia, I can assure you of that. The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia."
- nailer 8y ago
  Oh god. I left Oz in 2008 when Turnbull was a small-l-liberal, pro-business, pro-tech guy. From what I hear from home he became another deliberately ignorant Aussie conservative.
  - shusson 8y ago
    Ha, you forget how often we change our PMs :p
    - 8y ago

ENGNR 8y ago

Doesn't this also effect git repositories maintained by Australians? (I say this as an Australian who wants secure software) All it takes is one malicious npm package

cyphar 8y ago
As an Australian software developer who has written encryption software in the past, I'm also very concerned. I'm also doubly concerned that projects will now reject my patches because of my nationality. What an amazing shitshow of a government.
- steve_taylor 8y ago
  I’m seriously considering moving from Australia to a country that isn’t part of the Five Eyes.
  - brokenmachine 8y ago
    I'm thinking about moving to NZ. How are they?
    - billwashere 8y ago
      One of 5 eyes (Australia, Canada, New Zealand, the United Kingdom and the United States)!
    - toyg 8y ago
      They are in Five Eyes, were instrumental in Echelon, illegally raided Dotcom... NZ is a beautiful country, but one of the weakest-willed in international terms. (Also, by all reports, internet connectivity sucks big time).
      - eythian 8y ago
        > Also, by all reports, internet connectivity sucks big time If the poster is coming from Australia, NZ is not so bad.

ACow_Adonis 8y ago

Is there a (non-alarmist/non-defensive/non-partisan) summary available of what the bill actually contains and what its practical effects might be?

cyphar 8y ago
I'd recommend actually reading the bill to form your own conclusions. The main problem is that it mostly is a series of amendments, and many of them are quite unrelated. Most of the discussion is about the Technical Capability Notice section (which allows the government to compel a telecommunication provider, under threat of 5 years imprisonment, to create the ability to access communications otherwise inaccessible) but very few people are talking about the Computer Access Warrant sections... And it's possible for employees to be forced to do this, and you cannot reveal information about these technical notices to your employer -- in fact you are given immunity from civil persecution precisely for this reason. So you now have to sabotage your employer because of an order by the Australian government. Good luck keeping your job.
- ACow_Adonis 8y ago
  I very well may end up reading the whole thing, but that's partly why i'd actually like an expert summary, because my understanding is that these are amendments to existing legislation, and as a non-expert, the ability for me to be able to understand all the other legislation and implications that it works with is probably pretty close to zero...
- rswail 8y ago
  The best discussion I've found in terms of the legislation is at [1]. The most insidious part to me as a programmer, is the definition of a "Designated Communications Provider" which (amongst others) includes (S317C, item 6): "the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-users in Australia" and the "eligible activities" are: (a) the development by the person of any such software; or (b) the supply by the person of any such software; or (c) the updating by the person of any such software" [1] https://parlinfo.aph.gov.au/parlInfo/download/legislation/billsdgs/6370016/upload_binary/6370016.pdf;fileType=application/pdf https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi...

healsjnr1 8y ago

This is another thing that adds to my deep sense of shame to live in this country (sadly, that list is long and growing). This bill does nothing to prevent the kinds of things it is intended to prevent. The apps this law targets were engineered specifically to prevent this kind of interference. The idea that passing legislation will suddenly change that, magically allowing decryption of messages is beyond idiotic. The legal and technical barriers to getting anything useful from this legislation are huge. Not to mention the ease with which this can be bypassed (run OpenVPN and IRC on an overseas server, done). The justification for rushing this was so that Australia could be kept 'safe' over Christmas. It's beyond difficult to describe how ridiculous that is. Edit: Sorry, I also have to add that in the same sitting of Parliament the government also filibustered legislation that would have enabled medical evacuation of refugee children from child detention on Nauru. It's been a bad day for Human rights in Australia.

cyphar 8y ago
> It's beyond difficult to describe how ridiculous that is. Especially since ASIO (who really wanted this bill to pass) has stated that even if the bill passed today, they wouldn't have the necessary powers before Christmas.
- daemin 8y ago
  So now any of the Five Eyes intelligence agencies can have a chat with ASIO and get them to coerce companies and individuals within companies to put these back doors in. Then they can all use the same back doors, so everyone living in the USA, UK, Canada, and New Zealand can have their encryption compromised and communications intercepted. There's no way that companies will create back doors specifically just for Australia, so everyone will have access. In terms of Australia I'm not sure what we could actually do about this. Given that it's ASIO and other government departments that want these powers and that they have tried to introduce this sort of law over the course of the last decade. Both major parties have introduced legislation such as this and both voted for it. Maybe it is time for civil disobedience, and have everyone create and distribute encryption applications for all devices, because they couldn't possibly jail everyone right? I just wonder who will be the first person jailed or the first company fined for refusing these orders. In terms of the world at large, which country should we trust now? A lot of the Western Democracies are becoming rapidly "security" focused authoritarian, and the other countries powerful enough to stand up to them are not much better. Should we trust applications with code written in Russia? What about hardware products manufactured in China? Should we trust services running in the USA? Now we also have to be wary of any company that runs a service in the Five Eyes countries. Sometimes I wonder if we really have it better than people in the middle ages or other earlier periods, in some ways it clearly is, but in others it's just the same smell coming from different shit.

deleted 8y ago

[deleted]

brokenmachine 8y ago

Could an expat Australian dev be compelled to put backdoors in software even while overseas, under threat of being prosecuted when he returns? If so, Australians can't even be employed in foreign software companies.

boyter 8y ago
The law as written applies to any company or person that does business or has customers in Australia. This includes websites. So they don’t need anyone Australian on your team as written. However yes.
pvg 8y ago
No. People work in jurisdictions other than their own with potentially conflicting laws all the time. If it worked the way you seem to be suggesting it does, nobody, never mind Australians, would be able to work outside their home municipality at all.
- bigiain 8y ago
  Extraordinary rendition of SV software devs. I doubt even _that_ would cause an uproar so long as it's timed to coincide with yet another threat to the aspirationally wealthy Australian way of life... "Well, we need to lock up E2E encrypted messaging app developers in Nauru and Guantanamo Bay, because otherwise mortgage rates will go up and your house and investment property values will fall!"
  - pvg 8y ago
    This is why Australia was formally handed over to the Illuminati in the Treaty of Westphalia.
isostatic 8y ago
Could any developer put backdoors in under promise of a suitcase of cash? If your review system fails because your Aussie developer "may be compromised", it fails because your $good_country developer may also be compromised.

acutesoftware 8y ago

I am an Australian software developer and am currently getting https://www.lifepim.com https://www.lifepim.com ready for release which, funnily enough has the main selling point as "Your data is private, secure and free from adverts" - what a joke. The scary part is not knowing how the law is going to be implemented - I am hopeful that smart people work on the implementation of it in terms of practicality. If it is an on request thing "give us the details of terrorist@blah.com" then that is doable, but if they really want backdoor access to all accounts, then that is ridiculous amount of work and a lot of security risks to worry about. Wait and see I guess.

dbetteridge 8y ago
Looks like a cool product. Realistically could we just setup all code to be hosted overseas and then pay a set of reviewers in Europe to check PR's for possible backdoors? Don't think the law let's them compell you to build the backdoor in a super secret and hidden way...
- boyter 8y ago
  The way it’s written that could be 5 years in gaol because you let people know about it.
  - StavrosK 8y ago
    Not relevant, but I love the old-school spelling of "gaol". Is it still used anywhere or are you being whimsical?
    - brokenmachine 8y ago
      That's the official spelling in Australia, and I think the UK.
    - shakna 8y ago
      Yes, Australia uses it still. e.g. Ballarat Gaol, Old Melbourne Gaol.

sn41 8y ago

Okay - a quick question: how does bitbucket deal with this, since Atlassian is an Australian company? Am I making an error here?

boyter 8y ago
1 billion lost from the company already. I am hoping for them to depart Australia for good on this.
- netheril96 8y ago
  > 1 billion Is that metaphorical or actual number? If latter, I am interested in the source.
  - BigJono 8y ago
    Their stock is down 4.3% today and their market cap is around $20B
    - Tor3 8y ago
      Thay may be unrelated - most stock markets went down about that much today (and I'm glaring at my own stocks at the moment - none in Atlassian, they're down an average of 4.23% as of now)

shakna 8y ago

It's over. I may as well not be a programmer anymore. The government has effectively made it possible that anyone and everyone who develops software or hardware used by anyone in the country, or where they feel national security comes into play, must compromise their software, and tell no one. They can ask any intern to break the software, and not tell their employer. It's bad enough to have a gaping hole in your security, but now they can ask people who have no idea what they're doing to create a backdoor. All Australian software has now been rendered completely untrustworthy, and when those compromises in security are found, by the nation states who now know that Australian software will have holes in it, it will result in the very thing that this bill claims to prevent. Our infrastructure has been opened up for attack, by any of our neighbours who have a reason to do so, whilst simultaneously gutting the economy of IT in Australia. Who wants to buy shitty backdoored Chinese software? It's the same now for Australia. Australia's government has now opened the door for widescale cyberterrorism to have a chance at wreaking destruction.

daemin 8y ago
Remember that the Australian Government (whatever party happens to be in power at the time, it doesn't matter which) doesn't want technology or innovation in this country. They only want the value of dirt to remain high. So that buildings remain valuable and that we can export more natural resources.
stonith 8y ago
Isn't this pretty much the same as the US and their National Security Letters? They can compel engineers/companies to do pretty much anything, and the veil of secrecy is the same.
- shakna 8y ago
  As far as I'm aware, an NSL can't compel you to create a new architecture. This can.
- tssva 8y ago
  National Security Letters can't compel engineers/companies to do pretty much anything. National Security Letters can only request non-content information. A NSL also can't compel the gathering of additional non-content information beyond that already being gathered. So a NSL could request the records for who you are sending encrypted messages to but not the content of the messages and if your messaging provider can't or doesn't already gather that information they can't be compelled to start gathering such information. If a NSL requests information which the recipient believes violates that guidelines of information which can be requested they can disclose the NSL to legal counsel and challenge the NSL in court.

_Nat_ 8y ago

Some of the comments so far seem to suggest that this bill would require software to include backdoors. However, it looks like [the bill's PDF](https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_first-reps/toc_pdf/18204b01.pdf;fileType=application%2Fpdf#search=%22legislation/bills/r6195_first-reps/0000%22 https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi...) includes: > Division 7—Limitations > 317ZG Designated communications provider must not be required to implement or build a systemic weakness or systemic vulnerability etc. > (1) A technical assistance notice or technical capability notice must not have the effect of: > (a) requiring a designated communications provider to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection; or (b) preventing a designated communications provider from rectifying a systemic weakness, or a systemic vulnerability, in a form of electronic protection. > (2) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to implement or build a new decryption capability in relation to a form of electronic protection. > (3) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to one or more actions that would render systemic methods of authentication or encryption less effective. These limitations would seem to imply that the bill can't require a "systemic weakness", either by introducing a new one or prohibiting the patching of an existing one, which would seem to suggest that end-to-end crypto wouldn't be affected. Is this a correct reading? Or are there concerns that the government might, say, require end-to-end crypto to be vulnerable to a government-held golden key? --- Edit: Part of the text, > to implement or build a new decryption capability in relation to a form of electronic protection , sounds like it's prohibiting golden-key-based schemes.

schappim 8y ago
What does this mean for Zero-knowledge systems?
- cmroanirgo 8y ago
  You must build a custom made back door. eg. Something like ProtonMail would need to inject some extra javascript so that the government could obtain a copy before encryption, I expect. If I were to write some software of this nature these days, I'd make sure that the client would be aware of any changes in the api - sort of like a personal warrant canary. (Note that a warrant canary is legal in this legislation).

k_sze 8y ago

Can somebody write up a tutorial/guide on how to block all network communications (incoming or outgoing) with Australian IPs, on all or select ports, under common OSes (Windows, Linux, Mac, BSD).

Tor3 8y ago
Can't write the guide for you, but the raw material can be found here (and other places): http://www.ipdeny.com/ipblocks/data/aggregated/au-aggregated.zone http://www.ipdeny.com/ipblocks/data/aggregated/au-aggregated... That's a list of the (current) IPv4 Australian blocks. Each value (e.g. 1.0.4.0/22) can be used directly as a parameter for iptables on Linux, e.g. /sbin/iptables -A INPUT -s 1.0.4.0/22 -j DROP (to really block any communication - or use REJECT instead) A script to walk through the file works fine.
- k_sze 8y ago
  Great starting point!

dbetteridge 8y ago

Business opportunity for EU devs provide Australian businesses with PR and code review to ensure their software isn't backdoor'd

brokenmachine 8y ago
And if it is, then what? Good idea though. Maybe some kind of Certification?
- dbetteridge 8y ago
  Well ideally you get in early and catch it in a mandatory PR process, all PR's pass through EU devs who are the only ones who can merge. Otherwise yes, security certification process to review existing code and then maintain as above.
- missjellyfish 8y ago
  As if certifications would prove anything. Just look at what the German tüv certifies secure. They are missing even the most basic XSS stuff. I have no hope here.
davedx 8y ago
More like, biz opportunity to make products competing with Jira, Confluence et al. Wonder how many banks and other security sensitive orgs use Jira and store all their tech specs in there. All of them?
- based2 8y ago
  https://www.jetbrains.com/youtrack/specials/compare/jira-vs-youtrack https://www.jetbrains.com/youtrack/specials/compare/jira-vs-... https://www.xwiki.org/xwiki/bin/view/Main/WebHome https://www.xwiki.org/xwiki/bin/view/Main/WebHome
stephen_g 8y ago
If an Australian developer was served with a Technical Capability Notice to build a backdoor, and then submitted code to be analysed by a third party who found it, the developer would literally be liable to be jailed for 15 years and a $50K fine for individuals or $10 million for companies. The law requires us to deliver exploits secretly and lie to everybody about it.

chris_wot 8y ago

Bill Shorten is an idiot for letting this get through.

brokenmachine 8y ago
I agree 100%, but we can assign just as much blame to Morrison for presenting the bill as well.
pascalo 8y ago
He was a push over on metadata retention, why would it have been different this time? What a joke!

krautjakob 8y ago

Ouch. Since I'm using Fastmail ... can anybody recommend a good alternative? I don't mind paying for a good and secure E-Mailprovider. Protonmail looks nice, but it does not seem to offer IMAP (because mails are end2end encrypted).

miqkt 8y ago
Posteo (https://posteo.de https://posteo.de). Made the switch earlier this year. Webmail UI might seem clunky to some, but I use IMAP so non-issue for me. Easy to set up encryption and apparently they're powered sustainably too. One deal breaker I know of is you can't map to your own custom domains. There's something in their FAQ which explains their rationale behind this.
martinbm 8y ago
ProtonMail is indeed great and offers a bridge for use with IMAP-compatible programs. Check out https://protonmail.com/bridge/ https://protonmail.com/bridge/. I believe they are working on a more integrated solution, but no news of when it'll be out have been announced.
shakna 8y ago
Paid Protonmail has a bridge to IMAP/SMTP. [0] [0] https://protonmail.com/bridge/ https://protonmail.com/bridge/
- ftrtiabi 8y ago
  Yeah but not for mobile, which I assume means you have to use their own client? Ridiculous how much computing has regressed.
- endgame 8y ago
  GNU/Linux support when?
  - kazen44 8y ago
    there is a "beta" version available for linux. This version seem to work perfectly fine on my fedora machine so far.

bwilli123 8y ago

Does this mean that if I take my iphone into an Apple Store in Australia for repair that a Genius could load unknown software (under legal compulsion) without Apple itself knowing?

brokenmachine 8y ago
Yes. This is a civil rights nightmare.
bausshf 8y ago
Yes
techtalsky 8y ago
Technically, yes, as I understand the legislation.
Whitestrake 8y ago
They have to attempt to keep Apple from learning about it, as I understand it. I wonder what steps Apple will take to bar this kind of eventuality. If an employee makes a good faith attempt to comply with this request, which is then blocked by the overseas manufacturer, can they throw their hands up and say, "Well, I tried!"? Would this allow them to avoid the $50k fine and 10 years in jail the Government can hand out for not complying?

jacques_chester 8y ago

If you are an Australian software engineer, you have one advantage that other nationalities do not: the E3 visa. It is a US working visa that is specifically reserved for Australians and consequently it is much easier to get than an H1B. My advice is that the Australian tech industry just got nuked from orbit, so come work in the USA. The pay is better, the work is more interesting and the tech companies actually have sway over policy here.

cylinder 8y ago
the US has already been doing this stuff for a long time, without it being legal. They can always pressure you and threaten to ruin any engineer's life if they don't do what they want. and who do you think came up with this legislation? It's US Intelligence. Australia is their testing lab, just like Macca's does.
- jacques_chester 8y ago
  Apple stared down the FBI in a mass murder case, because it was possible for them to do so. They won't be able to do that in Australia. I don't like the US shonkiness any more than anyone else. But these situations are not precisely equivalent, especially since this bill passed.
  - brokenmachine 8y ago
    The US government ignores their laws, while Australia passes terrible ones. Six of one, half dozen of the other.
    - MaxBarraclough 8y ago
      > The US government ignores their laws and yet > Apple stared down the FBI in a mass murder case, because it was [legally] possible for them to do so.
      - brokenmachine 8y ago

wallace_f 8y ago

What kicked this off the front page? Note that the most-upvoted post in the past month, critical of Google, was at the time mysteriously kicked off the front page as well.

sn41 8y ago
Yep. very mysterious. I don't know if it is deliberate, but what's the front page policy?
Tor3 8y ago
Yeah, that was strange. But suddenly it went back from page 2 to the front page again, around pos. 15
wolfgang42 8y ago
I believe HN has a flame war detector that trips when the number of comments is greater than the number of votes, and pulls the submission off the front page. (I haven't looked, but this is probably what happened to the Google post as well.) Since it's back on the front page now, I'd guess that the HN mods decided that this was important and un-tripped the detector.

anotherhuman0 8y ago

Somebody over on Reddit [1] went through all the submissions (there was a consultation period) and summarised and tallied them [2]. Fully 99%+ of submissions were against the bill. A sad day for democracy indeed. A church in Tasmania was in favour, because child pornography. 1. https://www.reddit.com/r/australia/comments/a3j466/assistance_and_access_bill_2018_just_passed_the/eb75et6/ https://www.reddit.com/r/australia/comments/a3j466/assistanc... 2. https://docs.google.com/spreadsheets/d/1dowpZ_Xtr1N_DgkHJN8iinbqRd1peTgQp_fSL0vELDA/edit#gid=0 https://docs.google.com/spreadsheets/d/1dowpZ_Xtr1N_DgkHJN8i...

wallace_f 8y ago
A sad day for democracy, but this fact restores some faith in humanity.
- akerro 8y ago
  A sad day for democracy, but this fact restores some faith in dictatorship. FTFU
- colpabar 8y ago
  How?
  - JustSomeNobody 8y ago
    That so many people were against it?
    - wallace_f 8y ago
      Yea, that's what I meant. At least the people seemed to be overwhelmingly opposed to it, and trying to vote against it. RIP to internet points on that comment, lol.
      - cmroanirgo 8y ago
        Yeah, I too, read your comment in the -ve. Thanks for the clarification. So, yeah, a great day for humanity that didn't want this.

deleted 8y ago

[deleted]

buttslasher69 8y ago

Someone make a website with a more complete list of Australian software & hardware companies so we can blacklist them all more efficiently Or even a list of Australian devs to blacklist lol

jhauris 8y ago

Can anyone comment on how this affects those of us in other five eyes countries? Are we now subject to any provisions of this law by proxy?

throwawaymanbot 8y ago

A great day for those of us who are against Western Democracy. Bravo Australia. And as a bonus... the Symbiotic relationship with Chinese policy points on course for completion too! BRAVO!

naaaaak 8y ago

> Fully 99%+ of submissions were against the bill. A sad day for democracy indeed. This is what happens when you give up your guns. Government stops caring about serving you and implements total control of you.

turblety 8y ago

Obviously this law and ones like it have no place in a modern, free society, but in regards to the risk with using business apps, it's just the same as before. You can not trust app's from companies incorporated in the five eyes [1]. If you are using a product made in any of the five eyes you are already compromised. By compromised, I mean you can be almost 100% sure that if the owner's of those countries want your data they will get it, and they will get it easily too. They do not need warrants, courts or judges to sign of on anything and haven't done for a long time. To clarify my position on this. Whether a law like this is actually passed or not, you should assume that every company incorporated in these countries have been forced to place backdoors in their systems. I'm not saying that every company has done this. I'm saying you should assume they have. 1. https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes

aiisahik 8y ago

As an Australian citizen who has spent many years in the US, I can say that this law is in line with the main ideology of the Australian government: extreme parentalism. You run a red light: fine for $450 in the mail. No court date, no arguments. You exceed the speed limit by 5km/h: $200 fine in the mail. No arguments. It is brutal but it's hard to deny that it works. Australia has some of the lowest per capital road deaths in the OECD. The problem is that the government wants to regulate the internet the say way they regulate road traffic. You can read up all the idiotic attempts here: https://en.wikipedia.org/wiki/Internet_censorship_in_Australia https://en.wikipedia.org/wiki/Internet_censorship_in_Austral... I wonder if this means Australia will have the ability to ban apps like Telegram from the app store?

brokenmachine 8y ago
They are trying to secretly force tech companies into unpaid labour to destroy the security of their own products in their ham-fisted stupid attempts however. This is much worse than the authoritarian way they handle traffic fines. There is no legal representation, no judicial oversight and no actual definitions of essential terms in the bill. Make no mistake, this is a dictatorship.
- brokenmachine 8y ago
  Oops. Actually, it's a totalitarian regime.
photojosh 8y ago
To be fair, I got a fine in the mail years ago for stopping in a no stopping zone. (Couldn't find a carpark and had a screaming baby in the back) The notice says you can contest in court, which I did and got off. That was back as a student, it wouldn't be worth my time to take a whole day off anymore. :(
- exodust 8y ago
  Yeh you can elect to contest any fine in court. I've done it twice here in Aust, and had the fine thrown out both times, including a big $750 driving unregistered fine. It takes about 4 hours or more out of your day to attend court which is obviously not possible for everyone.

75dvtwin 8y ago

Australia -- the 1st world leader of the modern Progressive policies. 2018 -- citizens loose communication privacy protection [0] 2017 -- whistleblowers and dissidents are committed to mental institutions [1] 2016 -- citizens loose financial transaction privacy (the cashless society with finalized transition by 2020) [2] 1996 -- government confiscated all firearms from the hands of private, law abiding citizens Sweden, and Canada are next. Basically -- step-by-step methodology to run country-sized Mafia operation is being implemented. [0] this article [1] http://www.blotreport.com/australian-politics/are-the-thought-police-coming/ http://www.blotreport.com/australian-politics/are-the-though... [2] https://bitsonline.com/australia-cashless-2020-payments-network/ https://bitsonline.com/australia-cashless-2020-payments-netw...

hnzix 8y ago
> government confiscated all firearms It's relatively easy to get access to firearms in Australia, including semi-automatic pistols. [0] The gun control laws mainly affected semi-automatic rifles and shotguns. [0] https://www.huffingtonpost.com.au/2017/10/04/australias-gun-laws-arent-as-tough-as-you-think-and-standards-are-slipping_a_23233112/ https://www.huffingtonpost.com.au/2017/10/04/australias-gun-...
- 75dvtwin 8y ago
  thx for the correction. You are right. I should have said the confiscation (mandatory bayback) started with all semi-automatics and pump-action in 1996. WRT pistols, the pistols that are allowed, have less lethal power than bow and arrow (if the below excerpt is correct). ".... they can then attend at a licenced firearm dealer and select a handgun which is suitable for the competition in which they intend to take part. This firearm may be a single-shot air pistol, a single-shot .22-calibre pistol or a .22-calibre revolver or self-loading pistol. …" https://ssaa.org.au/news-resources/research-archive/handgun-ownership-facts-in-australia/ https://ssaa.org.au/news-resources/research-archive/handgun-... not sure if this was also the case before '96 and self-defense was already banned then. The bolt actions that are allowed, cannot have pistol grip and must not look 'military'.
8y ago

brokenmachine 8y ago

I have to say, the coverage of this bill on the news has been atrocious. I've seen zero discussion of the possible ramifications of losing all security companies in Australia. Any software company that depends on security (and which one doesn't?) would be insane in the membrane to think they could credibly work in Australia now. All they are saying is "the bill was passed to access encrypted communications of terrorists and criminals". No discussion of no judicial oversight either. News orgs are shooting themselves in the foot because there's no possibility of a journalist protecting their sources anymore with this nightmare.

ffoxd 8y ago
Australia doesn’t have much in the way of judicial oversight. The joys of parliamentary supremacy and a weak constitution.

mimixco 8y ago

This is a big deal for people of all countries as the major tech firms will quickly build-in the required backdoors to stay in compliance -- and they won't just be there for Australian citizens; they'll be there for all of us.

mvid 8y ago
Will they? Is Australia a big enough market to give up global credibility as a company?
- mimixco 8y ago
  We can only hope not.

techsin101 8y ago

Reminds me of that book