5 ms·

There are so many loopholes in this thing. One predominant thing to keep in mind is the legal onus that is put on a company that does not comply. The basic gem

There are so many loopholes in this thing. One predominant thing to keep in mind is the legal onus that is put on a company that does not comply. The basic gems are that I got from reading the draft legislation was: - If you have server side encryption, & we want you to decrypt a particular person's data, then we expect you to do so - ad infinitum. - If you do client side encryption then we expect you to put into place a system that allows us to decrypt a particular person's data. (One assumes that a modification should be made for the particular client such that their data can be gathered in an unencrypted manner). So, irrespective of the caveats that you've mentioned, the bill still stands. The caveats you've mentioned are the standard bait-and-switch style legalese, to make it sound more palatable. I'd assume that in reality, it's up to the company (at their own legal cost) to prove that what needs to be created is in fact, a back door.

episteme 8y ago
Does the legislation say they can do this without justification though? Can they just ask for anyones information or does there need to be some sort of warrant?
- JoshTriplett 8y ago
  Does it matter? The correct answer to "decrypt this person's data now" is "sorry, we can't". Not "won't", "can't".
- brokenmachine 8y ago
  It has to be under suspicion of a crime that attracts over 3 years jail (which is almost anything). They mentioned oversight of a "retired judge" and a "technology expert" in the autoplay video at the bottom of https://www.news.com.au/technology/online/security/inprinciple-deal-struck-on-controversial-encryption-bill/news-story/75492c0ee5a389a0ada7955733529af4 https://www.news.com.au/technology/online/security/inprincip...
  - mcv 8y ago
    Why a retired judge and not an active judge? Presumably because an active is required to obey certain standards and is legally independent. A retired judge is effective just some guy.
    - cyphar 8y ago
      Because they didn't want judicial oversight. It's just going to be rubber-stamp faux-arbitration.
- cyphar 8y ago
  It doesn't need a warrant, and the requirements are varied. None of them require judicial review. * TARs and TANs both generally require that an agency be investigating a serious crime (one that takes). There are some toy protections against abuse but they're basically meaningless (the AG or chief officer needs to be "satisfied" that it's reasonable and a few other token requirements -- need I remind you that we imprison refugees in sub-human conditions without the right to a trial, so "reasonable" is a stretch). * TCNs are even more general. They can be done purely "in the interests of national security".
- cmroanirgo 8y ago
  "The Director-General of Security, the Director-General of the Australian Secret Intelligence Service, the Director-General of the Australian Signals Directorate or the chief officer of an interception agency may give a technical assistance request to a designated communications provider. • A technical assistance request may ask the provider to do acts or things on a voluntary basis..." Note that an interception agency also includes "the Police Force" p9 It later states that if a provider willingly complies: "an officer, employee or agent of the provider is not subject to any civil liability for, or in relation to, an act or thing done by the officer, employee or agent in connection with the act or thing mentioned in paragraph (b)" p17 Meaning, you're up for civil charges if you fail to respond to a non-warrant request.
  - mcv 8y ago
    I don't see how you're up for civil charges if you fail to respond. It's voluntary. The line about not being subject to civil liability sounds to me like your employer can't fire or sue you for undermining the security of their product if you're doing so in response to a request.
    - ApolloFortyNine 8y ago
      That's how I interpret it too. Though does that mean they can contact an employee directly, rather than going through the company to have the backdoor installed? That's how it sounds to me, since otherwise why would you bother with this provision. And if that's the case, software really is dead in Australia. You can't trust an Australian company, even if their leadership says they've never received a request, because one of their employees may have.
    - cyphar 8y ago
      There are three kinds of notices. Only one is voluntary (Technical Assistance Request). The other two (Technical Assistance Notice, Technical Capability Notice) are both mandatory and carry several hundred penalty unit punishments for non-compliance.
deleted 8y ago
[deleted]

episteme 8y ago

Does the legislation say they can do this without justification though? Can they just ask for anyones information or does there need to be some sort of warrant?

JoshTriplett 8y ago
Does it matter? The correct answer to "decrypt this person's data now" is "sorry, we can't". Not "won't", "can't".
brokenmachine 8y ago
It has to be under suspicion of a crime that attracts over 3 years jail (which is almost anything). They mentioned oversight of a "retired judge" and a "technology expert" in the autoplay video at the bottom of https://www.news.com.au/technology/online/security/inprinciple-deal-struck-on-controversial-encryption-bill/news-story/75492c0ee5a389a0ada7955733529af4 https://www.news.com.au/technology/online/security/inprincip...
- mcv 8y ago
  Why a retired judge and not an active judge? Presumably because an active is required to obey certain standards and is legally independent. A retired judge is effective just some guy.
  - cyphar 8y ago
    Because they didn't want judicial oversight. It's just going to be rubber-stamp faux-arbitration.
cyphar 8y ago
It doesn't need a warrant, and the requirements are varied. None of them require judicial review. * TARs and TANs both generally require that an agency be investigating a serious crime (one that takes). There are some toy protections against abuse but they're basically meaningless (the AG or chief officer needs to be "satisfied" that it's reasonable and a few other token requirements -- need I remind you that we imprison refugees in sub-human conditions without the right to a trial, so "reasonable" is a stretch). * TCNs are even more general. They can be done purely "in the interests of national security".
cmroanirgo 8y ago
"The Director-General of Security, the Director-General of the Australian Secret Intelligence Service, the Director-General of the Australian Signals Directorate or the chief officer of an interception agency may give a technical assistance request to a designated communications provider. • A technical assistance request may ask the provider to do acts or things on a voluntary basis..." Note that an interception agency also includes "the Police Force" p9 It later states that if a provider willingly complies: "an officer, employee or agent of the provider is not subject to any civil liability for, or in relation to, an act or thing done by the officer, employee or agent in connection with the act or thing mentioned in paragraph (b)" p17 Meaning, you're up for civil charges if you fail to respond to a non-warrant request.
- mcv 8y ago
  I don't see how you're up for civil charges if you fail to respond. It's voluntary. The line about not being subject to civil liability sounds to me like your employer can't fire or sue you for undermining the security of their product if you're doing so in response to a request.
  - ApolloFortyNine 8y ago
    That's how I interpret it too. Though does that mean they can contact an employee directly, rather than going through the company to have the backdoor installed? That's how it sounds to me, since otherwise why would you bother with this provision. And if that's the case, software really is dead in Australia. You can't trust an Australian company, even if their leadership says they've never received a request, because one of their employees may have.
  - cyphar 8y ago
    There are three kinds of notices. Only one is voluntary (Technical Assistance Request). The other two (Technical Assistance Notice, Technical Capability Notice) are both mandatory and carry several hundred penalty unit punishments for non-compliance.

deleted 8y ago

[deleted]