4 ms·

Officially, they can’t, but you can be absolutely certain that iMessage, WhatsApp, Signal and Telegram are going to be immediately targeted with TCNs (technical

Officially, they can’t, but you can be absolutely certain that iMessage, WhatsApp, Signal and Telegram are going to be immediately targeted with TCNs (technical capability notice), requiring them to bundle Australian government spyware and requiring that those apps send all conversations to the spyware.

cyphar 8y ago
This isn't quite true. The bill allows companies to provide statistics on how many TARs, TANs, and TCNs they've been served within a 6-month window. The obvious problem is that nothing stops them from lying or just omitting that information -- because why would you admit that your software is insecure?
- shakna 8y ago
  Employees of a company may also be served, and required not to tell their employer. So a company may not know if they are compromised.
  - gnud 8y ago
    I doubt you could introduce backdoors in big software (Messenger, iMessage, WhatsApp) using only one/a few employees - unless everyone who does code reviews happens to live in Australia.
  - cyphar 8y ago
    Right, but then the employee can publish statistics about how many TCNs they've received.
    - rswail 8y ago
      They can't provide specifics only ranges. In Division 6, section 317ZF, Unauthorized Disclosure of Information, section 3) subsection 13) a person forced to do one of these TAN/TCN/TCR things can release a count of how many of these TAN/TCN/TCR things. BUT Note: This subsection authorises the disclosure of aggregate statistical information. That information cannot be broken down (a) by agency; or (b) in any other way. So Division 6, section 317ZF (3) (13) is the ONLY way someone can tell the world what is happening.
      - cyphar 8y ago
        That is what I was referring to as "statistics" (that's what the subsection is titled).
  - pascalo 8y ago
    I seriously wonder how that would work in practice? "Hey Joey, will you work on the fizzibizzi feature that does xyz?" I can't, I have other stuff to do? "What kind of stuff? This feature is the top priority for the whole team?" I JUST CAN'T TELL YOU OKAY!!!
    - brokenmachine 8y ago
      Also, you can't ask anyone else on the team for help implementing it. These backdoors are going to be the worst code possible. What kind of crap quality code do you think a single dev under threat of jail time and the pressure of not being able to communicate with his co-workers or legal representation is going to pump out?
      - cyphar 8y ago
        You can speak to a lawyer about it, though I imagine that delaying might cause issues. There is a mandatory 28-day consultation period for TCNs but I imagine that you'd get very little useful protection from that system. Also there is no criminal punishment for not obeying a notice. There is massive civil liability though, as well as a criminal punishment for disclosing information about the notice.
      - Lio 8y ago
        It'll be handy cover though if you get caught introducing your own backdoor code. "Git says you were the person who introduced this backdoor into our banking platform. We could loose millions though that. Explain yourself now before I call the cops!" [whilst tapping nose] "I'm sorry boss I've been told not to discuss that with anyone..." "Say no more. I understand perfectly. ;) Carry on and don't tell the others."
  - CalRobert 8y ago
    Can they quit? Or are they effectively being forced to perform labor for the government? This seems like an insanely impossible to enforce proposition.
    - shakna 8y ago
      That's something we'll have to wait and see on, see how the legal world interprets it. However, if it is interpreted that you quitting is not complying, it's fines and perhaps jail time.
      - cyphar 8y ago
        There is only civil liability for noncompliance, in the form of massive fines. However there is 5-year imprisonment for people who disclose information about these notices though (unless it follows the aggregated statistics requirements).
- ENGNR 8y ago
  Those weren't passed, it went in unamended
  - cyphar 8y ago
    I don't think they were amendments -- they are included in the first reading of the bill (Sect 317ZF.13).
driverdan 8y ago
I downvoted you because the bill explicitly says it excludes systemic changes that compromise security. Apps will not have systemic spyware, only specific users can be targeted. Open source apps like Signal would be extremely hard to compromise since no one is going to allow a backdoor commit.
- claudiawerner 8y ago
  Does this mean that they can only mandate the backdooring of a user's communication if they know who the user is? Doesn't that seem irrelevant to the concerns they've raised in the past of having apprehended a suspect but been unable to decrypt their previous communications?

cyphar 8y ago

This isn't quite true. The bill allows companies to provide statistics on how many TARs, TANs, and TCNs they've been served within a 6-month window. The obvious problem is that nothing stops them from lying or just omitting that information -- because why would you admit that your software is insecure?

shakna 8y ago
Employees of a company may also be served, and required not to tell their employer. So a company may not know if they are compromised.
- gnud 8y ago
  I doubt you could introduce backdoors in big software (Messenger, iMessage, WhatsApp) using only one/a few employees - unless everyone who does code reviews happens to live in Australia.
- cyphar 8y ago
  Right, but then the employee can publish statistics about how many TCNs they've received.
  - rswail 8y ago
    They can't provide specifics only ranges. In Division 6, section 317ZF, Unauthorized Disclosure of Information, section 3) subsection 13) a person forced to do one of these TAN/TCN/TCR things can release a count of how many of these TAN/TCN/TCR things. BUT Note: This subsection authorises the disclosure of aggregate statistical information. That information cannot be broken down (a) by agency; or (b) in any other way. So Division 6, section 317ZF (3) (13) is the ONLY way someone can tell the world what is happening.
    - cyphar 8y ago
      That is what I was referring to as "statistics" (that's what the subsection is titled).
- pascalo 8y ago
  I seriously wonder how that would work in practice? "Hey Joey, will you work on the fizzibizzi feature that does xyz?" I can't, I have other stuff to do? "What kind of stuff? This feature is the top priority for the whole team?" I JUST CAN'T TELL YOU OKAY!!!
  - brokenmachine 8y ago
    Also, you can't ask anyone else on the team for help implementing it. These backdoors are going to be the worst code possible. What kind of crap quality code do you think a single dev under threat of jail time and the pressure of not being able to communicate with his co-workers or legal representation is going to pump out?
    - cyphar 8y ago
      You can speak to a lawyer about it, though I imagine that delaying might cause issues. There is a mandatory 28-day consultation period for TCNs but I imagine that you'd get very little useful protection from that system. Also there is no criminal punishment for not obeying a notice. There is massive civil liability though, as well as a criminal punishment for disclosing information about the notice.
    - Lio 8y ago
      It'll be handy cover though if you get caught introducing your own backdoor code. "Git says you were the person who introduced this backdoor into our banking platform. We could loose millions though that. Explain yourself now before I call the cops!" [whilst tapping nose] "I'm sorry boss I've been told not to discuss that with anyone..." "Say no more. I understand perfectly. ;) Carry on and don't tell the others."
- CalRobert 8y ago
  Can they quit? Or are they effectively being forced to perform labor for the government? This seems like an insanely impossible to enforce proposition.
  - shakna 8y ago
    That's something we'll have to wait and see on, see how the legal world interprets it. However, if it is interpreted that you quitting is not complying, it's fines and perhaps jail time.
    - cyphar 8y ago
      There is only civil liability for noncompliance, in the form of massive fines. However there is 5-year imprisonment for people who disclose information about these notices though (unless it follows the aggregated statistics requirements).
ENGNR 8y ago
Those weren't passed, it went in unamended
- cyphar 8y ago
  I don't think they were amendments -- they are included in the first reading of the bill (Sect 317ZF.13).

driverdan 8y ago

I downvoted you because the bill explicitly says it excludes systemic changes that compromise security. Apps will not have systemic spyware, only specific users can be targeted. Open source apps like Signal would be extremely hard to compromise since no one is going to allow a backdoor commit.

claudiawerner 8y ago
Does this mean that they can only mandate the backdooring of a user's communication if they know who the user is? Doesn't that seem irrelevant to the concerns they've raised in the past of having apprehended a suspect but been unable to decrypt their previous communications?