7 ms·

Some of the comments so far seem to suggest that this bill would require software to include backdoors. However, it looks like [the bill's PDF](https://parlinf

by _Nat_ 8y ago

Some of the comments so far seem to suggest that this bill would require software to include backdoors. However, it looks like [the bill's PDF](https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_first-reps/toc_pdf/18204b01.pdf;fileType=application%2Fpdf#search=%22legislation/bills/r6195_first-reps/0000%22 https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi...) includes: > Division 7—Limitations > 317ZG Designated communications provider must not be required to implement or build a systemic weakness or systemic vulnerability etc. > (1) A technical assistance notice or technical capability notice must not have the effect of: > (a) requiring a designated communications provider to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection; or (b) preventing a designated communications provider from rectifying a systemic weakness, or a systemic vulnerability, in a form of electronic protection. > (2) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to implement or build a new decryption capability in relation to a form of electronic protection. > (3) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to one or more actions that would render systemic methods of authentication or encryption less effective. These limitations would seem to imply that the bill can't require a "systemic weakness", either by introducing a new one or prohibiting the patching of an existing one, which would seem to suggest that end-to-end crypto wouldn't be affected. Is this a correct reading? Or are there concerns that the government might, say, require end-to-end crypto to be vulnerable to a government-held golden key? --- Edit: Part of the text, > to implement or build a new decryption capability in relation to a form of electronic protection , sounds like it's prohibiting golden-key-based schemes.

schappim 8y ago
What does this mean for Zero-knowledge systems?
- cmroanirgo 8y ago
  You must build a custom made back door. eg. Something like ProtonMail would need to inject some extra javascript so that the government could obtain a copy before encryption, I expect. If I were to write some software of this nature these days, I'd make sure that the client would be aware of any changes in the api - sort of like a personal warrant canary. (Note that a warrant canary is legal in this legislation).
  - cyphar 8y ago
    Warrant canaries are illegal in Australia, at least in the case of other kinds of secret warrants. I would be very surprised that a judge would (given the existing laws that have similar properties) consider a warrant canary legal. (For those wondering how they can be illegal, in Australia it's illegal to state the existence or non-existence of certain kinds of secret warrants. So a statement of a canary is, itself, illegal.)
    - cmroanirgo 8y ago
      There are allowances (from what I understand) in this bill. From "Section 6 - Unauthorised disclosure of information": - A person who is: ... ...may, in the person’s capacity as such a provider or employee, disclose: (e) the total number of technical assistance notices given to the provider during a period of at least 6 months; or (f) the total number of technical capability notices given to the provider during a period of at least 6 months; or (g) the total number of technical assistance requests given to the provider during a period of at least 6 months. Note: This subsection authorises the disclosure of aggregate statistical information. That information cannot be broken down: (a) by agency; or (b) in any other way. " [0] [0] pp50-51, http://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_first-reps/toc_pdf/18204b01.pdf;fileType=application%2Fpdf http://parlinfo.aph.gov.au/parlInfo/download/legislation/bil...
      - cyphar 8y ago
        Right, I forgot to mention the statistics. Yes, you can publish statistics in 6-month windows -- which is kind of what warrant canaries are supposed to provide information about -- but I'd be surprised if the "cannot be broken down" might be used to restrict the usefulness of statistics... I mean, a literal reading would allow you to provide minute-by-minute 6-month windows (or a new 6-month window each time you get a request) which could be used to get very detailed alerts each time a new request was given but obviously you'd get into hot water by doing that.
rswail 8y ago
The problem is that "systemic weakness" and "systemic vulnerability" are very badly defined. There's no definition of what "render systemic methods of authentication or encryption less effective".
- jboles 8y ago
  That is by design. The Australian Government has historically been somewhat arrogant in any area of technology. Their attitude, in this case and others, is similar to that of management at a company with a poor technology culture. "we're in charge and we're making this law, now you nerds can go sort out the details".
shakna 8y ago
However, the bill also requires access be provided, where access is: > access, when used in relation to material, includes: > (a) access that is subject to a pre-condition (for example, the use of a password); and > (b) access by way of push technology; and > (c) access by way of a standing request So whilst you may not build a systemic weakness, you may be required to provide a variant of your software to a specific user. Or provide the government with a "pre-condition" such as a golden key.
brokenmachine 8y ago
They were going to supply a definition of "systemic weakness", but I can't find one in the bill itself. I'm patiently waiting for their proposed method of reading end-to-end encrypted messages without introducing a systemic weakness. But the meaning of words don't seem to matter anymore in the reality distortion field that is the Australian government. This is all supposedly to somehow make us more secure for Christmas.
- StavrosK 8y ago
  Indeed, the laws of mathematics make this impossible. Count yourself lucky to be living in a country where the laws of mathematics don't apply.
  - brokenmachine 8y ago
    The laws of mathematics are "commendable", but they're nothing compared to Australian laws hurriedly passed 5 minutes before the Christmas holidays. History will not remember these people well.
    - bigiain 8y ago
      History will most likely remember these people as the completely incompetent board of director of the fossil fuel industry that presided over the final execution of the planet's habitable eco system. The fact that they were politicians or even the Prime Minister for 5 minutes briefly in late 2018 won't even be a footnote...
  - cvwright 8y ago
    This line of argument is not helpful. What are you going to do if/when somebody shows up with a scheme that shows you're wrong, and the laws of mathematics do in fact permit such schemes?
    - StavrosK 8y ago
      Fix cryptography.
cmroanirgo 8y ago
There are so many loopholes in this thing. One predominant thing to keep in mind is the legal onus that is put on a company that does not comply. The basic gems are that I got from reading the draft legislation was: - If you have server side encryption, & we want you to decrypt a particular person's data, then we expect you to do so - ad infinitum. - If you do client side encryption then we expect you to put into place a system that allows us to decrypt a particular person's data. (One assumes that a modification should be made for the particular client such that their data can be gathered in an unencrypted manner). So, irrespective of the caveats that you've mentioned, the bill still stands. The caveats you've mentioned are the standard bait-and-switch style legalese, to make it sound more palatable. I'd assume that in reality, it's up to the company (at their own legal cost) to prove that what needs to be created is in fact, a back door.
- episteme 8y ago
  Does the legislation say they can do this without justification though? Can they just ask for anyones information or does there need to be some sort of warrant?
  - JoshTriplett 8y ago
    Does it matter? The correct answer to "decrypt this person's data now" is "sorry, we can't". Not "won't", "can't".
  - brokenmachine 8y ago
    It has to be under suspicion of a crime that attracts over 3 years jail (which is almost anything). They mentioned oversight of a "retired judge" and a "technology expert" in the autoplay video at the bottom of https://www.news.com.au/technology/online/security/inprinciple-deal-struck-on-controversial-encryption-bill/news-story/75492c0ee5a389a0ada7955733529af4 https://www.news.com.au/technology/online/security/inprincip...
    - mcv 8y ago
      Why a retired judge and not an active judge? Presumably because an active is required to obey certain standards and is legally independent. A retired judge is effective just some guy.
episteme 8y ago
Thank you for this, there is a lot of doomsaying in this thread but this reads to me that it would be possible to refuse requests based on these limitations.
- brokenmachine 8y ago
  There's doomsaying because this is doom. That's a pretty big call to refuse a secret request that you're not allowed to disclose to anyone, risking a lengthy jail term without the possibility of even seeking legal advice. War Is Peace, Freedom Is Slavery, Ignorance Is Strength. Have a safe Christmas Australia! Papers please!!
  - magduf 8y ago
    It's interesting how the English-speaking countries seem to be doing their very best to emulate the novel "1984".
- cyphar 8y ago
  The problem is that you are reading it as though the words mean what a technical person means by "systemic weakness" (such as weakening the crypto in an app in order to target a user). This is not what the words mean (and this entire bill and discussion around it is full of Orwellian doublespeak -- they redefine the word "backdoor" to mean 0-day for instance). The words aren't defined at all in the bill (which should be a massive red flag), but even the amendments that include definitions completely miss the point and basically imply that only something like Dual_EC_DRBG is considered a "systemic weakness". There is a lot of doomsaying because it is very seriously, no-kidding bad. Not to mention that denying such a request should almost certainly be done with some very serious (and expensive) legal advice.
  - manicdee 8y ago
    Noting that you can’t seek legal advice because you’re not allowed to talk to anyone about the request.
mtgx 8y ago
There's one itsy bitsy issue with that whole "systemic weakness" thing. It's not defined in the law. You'd think something like that would not be carelessly omitted by accident, no? What this means in practice is that virtually nothing they do will ever amount to that being a "systemic weakness", just like Obama kept saying post-Snowden revelations that there have been "no abuses" of intelligence powers and that nobody in the NSA did anything wrong (even after revelations of LOVEINT, etc came out). An Australian government order for decryption could turn into another EternalBlue-type exploit affecting millions of PCs, and the government will likely still claim that wasn't a systemic issue because they "didn't intended it to be one" (as if spy agencies ever intend their backdoors to be used by rival nations - and yet that happens every time). https://www.computerworld.com.au/article/648483/encryption-bill-what-systemic-weakness-it-depends-government-says/ https://www.computerworld.com.au/article/648483/encryption-b... https://www.itnews.com.au/news/govts-decryption-bill-can-only-lead-to-systemic-weaknesses-512390 https://www.itnews.com.au/news/govts-decryption-bill-can-onl...
justinclift 8y ago
Wonder how long it'll take for the Aust branches of the US copyright cartel to start demanding access to "pirates" comms through this. From memory, the Aust internet filter was originally introduced using similar excuses. eg stop terrorist recruitment, pedos, etc. The copyright cartel was having "pirate" sites blocked not long after, and has been expanding it's approach since. Seems like a similar play book in action with this.
- manicdee 8y ago
  That’s the whole point of this legislation, and one of the reasons the legislation specifically supports the death penalty is to allow this legislation to be used by Australia to support the USA, where the death penalty still exists.
  - BLKNSLVR 8y ago
    There's a secondary point to this legislation: discouraging whistleblowers by making it more difficult to both hide yourself and be hidden by whichever journalist you're working with. Chilling effects is a desired outcome of this legislation.
    - brokenmachine 8y ago
      Whistleblowing attracts up to a 25-year sentence, so yes this is terrible for journalists. What's the maximum sentence for copyright infringement?
      - manicdee 8y ago
        25 years assuming you are sentenced in Australia rather than extradited to the USA to be killed.
  - brokenmachine 8y ago
    I don't understand your logic. Is the death penalty specifically mentioned in this bill somewhere?

by _Nat_ 8y ago

schappim 8y ago

What does this mean for Zero-knowledge systems?

cmroanirgo 8y ago
You must build a custom made back door. eg. Something like ProtonMail would need to inject some extra javascript so that the government could obtain a copy before encryption, I expect. If I were to write some software of this nature these days, I'd make sure that the client would be aware of any changes in the api - sort of like a personal warrant canary. (Note that a warrant canary is legal in this legislation).
- cyphar 8y ago
  Warrant canaries are illegal in Australia, at least in the case of other kinds of secret warrants. I would be very surprised that a judge would (given the existing laws that have similar properties) consider a warrant canary legal. (For those wondering how they can be illegal, in Australia it's illegal to state the existence or non-existence of certain kinds of secret warrants. So a statement of a canary is, itself, illegal.)
  - cmroanirgo 8y ago
    There are allowances (from what I understand) in this bill. From "Section 6 - Unauthorised disclosure of information": - A person who is: ... ...may, in the person’s capacity as such a provider or employee, disclose: (e) the total number of technical assistance notices given to the provider during a period of at least 6 months; or (f) the total number of technical capability notices given to the provider during a period of at least 6 months; or (g) the total number of technical assistance requests given to the provider during a period of at least 6 months. Note: This subsection authorises the disclosure of aggregate statistical information. That information cannot be broken down: (a) by agency; or (b) in any other way. " [0] [0] pp50-51, http://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_first-reps/toc_pdf/18204b01.pdf;fileType=application%2Fpdf http://parlinfo.aph.gov.au/parlInfo/download/legislation/bil...
    - cyphar 8y ago
      Right, I forgot to mention the statistics. Yes, you can publish statistics in 6-month windows -- which is kind of what warrant canaries are supposed to provide information about -- but I'd be surprised if the "cannot be broken down" might be used to restrict the usefulness of statistics... I mean, a literal reading would allow you to provide minute-by-minute 6-month windows (or a new 6-month window each time you get a request) which could be used to get very detailed alerts each time a new request was given but obviously you'd get into hot water by doing that.

rswail 8y ago

The problem is that "systemic weakness" and "systemic vulnerability" are very badly defined. There's no definition of what "render systemic methods of authentication or encryption less effective".

jboles 8y ago
That is by design. The Australian Government has historically been somewhat arrogant in any area of technology. Their attitude, in this case and others, is similar to that of management at a company with a poor technology culture. "we're in charge and we're making this law, now you nerds can go sort out the details".

shakna 8y ago

However, the bill also requires access be provided, where access is: > access, when used in relation to material, includes: > (a) access that is subject to a pre-condition (for example, the use of a password); and > (b) access by way of push technology; and > (c) access by way of a standing request So whilst you may not build a systemic weakness, you may be required to provide a variant of your software to a specific user. Or provide the government with a "pre-condition" such as a golden key.

brokenmachine 8y ago

They were going to supply a definition of "systemic weakness", but I can't find one in the bill itself. I'm patiently waiting for their proposed method of reading end-to-end encrypted messages without introducing a systemic weakness. But the meaning of words don't seem to matter anymore in the reality distortion field that is the Australian government. This is all supposedly to somehow make us more secure for Christmas.

StavrosK 8y ago
Indeed, the laws of mathematics make this impossible. Count yourself lucky to be living in a country where the laws of mathematics don't apply.
- brokenmachine 8y ago
  The laws of mathematics are "commendable", but they're nothing compared to Australian laws hurriedly passed 5 minutes before the Christmas holidays. History will not remember these people well.
  - bigiain 8y ago
    History will most likely remember these people as the completely incompetent board of director of the fossil fuel industry that presided over the final execution of the planet's habitable eco system. The fact that they were politicians or even the Prime Minister for 5 minutes briefly in late 2018 won't even be a footnote...
- cvwright 8y ago
  This line of argument is not helpful. What are you going to do if/when somebody shows up with a scheme that shows you're wrong, and the laws of mathematics do in fact permit such schemes?
  - StavrosK 8y ago
    Fix cryptography.

cmroanirgo 8y ago

There are so many loopholes in this thing. One predominant thing to keep in mind is the legal onus that is put on a company that does not comply. The basic gems are that I got from reading the draft legislation was: - If you have server side encryption, & we want you to decrypt a particular person's data, then we expect you to do so - ad infinitum. - If you do client side encryption then we expect you to put into place a system that allows us to decrypt a particular person's data. (One assumes that a modification should be made for the particular client such that their data can be gathered in an unencrypted manner). So, irrespective of the caveats that you've mentioned, the bill still stands. The caveats you've mentioned are the standard bait-and-switch style legalese, to make it sound more palatable. I'd assume that in reality, it's up to the company (at their own legal cost) to prove that what needs to be created is in fact, a back door.

episteme 8y ago
Does the legislation say they can do this without justification though? Can they just ask for anyones information or does there need to be some sort of warrant?
- JoshTriplett 8y ago
  Does it matter? The correct answer to "decrypt this person's data now" is "sorry, we can't". Not "won't", "can't".
- brokenmachine 8y ago
  It has to be under suspicion of a crime that attracts over 3 years jail (which is almost anything). They mentioned oversight of a "retired judge" and a "technology expert" in the autoplay video at the bottom of https://www.news.com.au/technology/online/security/inprinciple-deal-struck-on-controversial-encryption-bill/news-story/75492c0ee5a389a0ada7955733529af4 https://www.news.com.au/technology/online/security/inprincip...
  - mcv 8y ago
    Why a retired judge and not an active judge? Presumably because an active is required to obey certain standards and is legally independent. A retired judge is effective just some guy.

episteme 8y ago

Thank you for this, there is a lot of doomsaying in this thread but this reads to me that it would be possible to refuse requests based on these limitations.

brokenmachine 8y ago
There's doomsaying because this is doom. That's a pretty big call to refuse a secret request that you're not allowed to disclose to anyone, risking a lengthy jail term without the possibility of even seeking legal advice. War Is Peace, Freedom Is Slavery, Ignorance Is Strength. Have a safe Christmas Australia! Papers please!!
- magduf 8y ago
  It's interesting how the English-speaking countries seem to be doing their very best to emulate the novel "1984".
cyphar 8y ago
The problem is that you are reading it as though the words mean what a technical person means by "systemic weakness" (such as weakening the crypto in an app in order to target a user). This is not what the words mean (and this entire bill and discussion around it is full of Orwellian doublespeak -- they redefine the word "backdoor" to mean 0-day for instance). The words aren't defined at all in the bill (which should be a massive red flag), but even the amendments that include definitions completely miss the point and basically imply that only something like Dual_EC_DRBG is considered a "systemic weakness". There is a lot of doomsaying because it is very seriously, no-kidding bad. Not to mention that denying such a request should almost certainly be done with some very serious (and expensive) legal advice.
- manicdee 8y ago
  Noting that you can’t seek legal advice because you’re not allowed to talk to anyone about the request.

mtgx 8y ago

There's one itsy bitsy issue with that whole "systemic weakness" thing. It's not defined in the law. You'd think something like that would not be carelessly omitted by accident, no? What this means in practice is that virtually nothing they do will ever amount to that being a "systemic weakness", just like Obama kept saying post-Snowden revelations that there have been "no abuses" of intelligence powers and that nobody in the NSA did anything wrong (even after revelations of LOVEINT, etc came out). An Australian government order for decryption could turn into another EternalBlue-type exploit affecting millions of PCs, and the government will likely still claim that wasn't a systemic issue because they "didn't intended it to be one" (as if spy agencies ever intend their backdoors to be used by rival nations - and yet that happens every time). https://www.computerworld.com.au/article/648483/encryption-bill-what-systemic-weakness-it-depends-government-says/ https://www.computerworld.com.au/article/648483/encryption-b... https://www.itnews.com.au/news/govts-decryption-bill-can-only-lead-to-systemic-weaknesses-512390 https://www.itnews.com.au/news/govts-decryption-bill-can-onl...

justinclift 8y ago

Wonder how long it'll take for the Aust branches of the US copyright cartel to start demanding access to "pirates" comms through this. From memory, the Aust internet filter was originally introduced using similar excuses. eg stop terrorist recruitment, pedos, etc. The copyright cartel was having "pirate" sites blocked not long after, and has been expanding it's approach since. Seems like a similar play book in action with this.

manicdee 8y ago
That’s the whole point of this legislation, and one of the reasons the legislation specifically supports the death penalty is to allow this legislation to be used by Australia to support the USA, where the death penalty still exists.
- BLKNSLVR 8y ago
  There's a secondary point to this legislation: discouraging whistleblowers by making it more difficult to both hide yourself and be hidden by whichever journalist you're working with. Chilling effects is a desired outcome of this legislation.
  - brokenmachine 8y ago
    Whistleblowing attracts up to a 25-year sentence, so yes this is terrible for journalists. What's the maximum sentence for copyright infringement?
    - manicdee 8y ago
      25 years assuming you are sentenced in Australia rather than extradited to the USA to be killed.
- brokenmachine 8y ago
  I don't understand your logic. Is the death penalty specifically mentioned in this bill somewhere?