5 ms·

So now any of the Five Eyes intelligence agencies can have a chat with ASIO and get them to coerce companies and individuals within companies to put these back

by daemin 8y ago

So now any of the Five Eyes intelligence agencies can have a chat with ASIO and get them to coerce companies and individuals within companies to put these back doors in. Then they can all use the same back doors, so everyone living in the USA, UK, Canada, and New Zealand can have their encryption compromised and communications intercepted. There's no way that companies will create back doors specifically just for Australia, so everyone will have access. In terms of Australia I'm not sure what we could actually do about this. Given that it's ASIO and other government departments that want these powers and that they have tried to introduce this sort of law over the course of the last decade. Both major parties have introduced legislation such as this and both voted for it. Maybe it is time for civil disobedience, and have everyone create and distribute encryption applications for all devices, because they couldn't possibly jail everyone right? I just wonder who will be the first person jailed or the first company fined for refusing these orders. In terms of the world at large, which country should we trust now? A lot of the Western Democracies are becoming rapidly "security" focused authoritarian, and the other countries powerful enough to stand up to them are not much better. Should we trust applications with code written in Russia? What about hardware products manufactured in China? Should we trust services running in the USA? Now we also have to be wary of any company that runs a service in the Five Eyes countries. Sometimes I wonder if we really have it better than people in the middle ages or other earlier periods, in some ways it clearly is, but in others it's just the same smell coming from different shit.

bigiain 8y ago
And then somebody from inside will get a guilty conscience, but remember what happened to Snowden, and just sell the backdoor straight to Huawei or NSO or Mohamad bin Salem (salving themselves by pretending they're going to donate hundreds of millions to "improving the world", but instead will by private islands and matching citizenships to Peter Thiel's...) :sigh:
- daemin 8y ago
  Realistically, if you were a developer not in the chain of command and asked to do this: Would you? Could you? You would be knowingly putting your name to a vulnerability, and if someone asks then you have to keep it a secret and feign incompetence. Then if they revert your change you'll have to re-implement it. If you do tell your superiors (which would be most likely what would happen, even before writing the code) then you would be in violation and could be put in jail. If you refuse you would be put in jail, or they would go to the next person in their list.
  - brokenmachine 8y ago
    If you think about logistics they'd have to make contact with people in the company to even find out who the devs are who are capable of making a backdoor. That would probably tip off others in the company as to what was happening anyway. You'd think they'd essentially have to serve the whole dev team with the secret order. I think you could immediately resign. It's not a slavery bill... is it?
    - daemin 8y ago
      There's LinkedIn, there's social media, there's actually keeping a record of who enters and leaves a company's premises. There's heading down to the bar after work on Friday. There's community events and meetups.
      - bigiain 8y ago
        And there's the previous backdoors they got into BitBucket/Github/Gitlab/Mercurial/Perforce/etc. And,no doubt, the "LEO Portals" that FAANG and FAANG wannabes already have which they'll just hand over to Australian authorities (probably including local councils and the taxi commission, based on evidence about how the metadata retention powers have been used...) After the first few times they use these new powers, the people who're gonna come asking are 99.9% likely to know exactly who the person who will write, commit, and code review the backdoor they're demanding... And their direct manager, and the management chain all the way to the C suite... I think I need to quit this entire industry, maybe take up boatbuilding or something...
      - brokenmachine 8y ago
        But just seeing who's going into the building doesn't tell you exactly who is handling encryption and security in the codebase.
  - bigiain 8y ago
    I wonder what the legal implications of just quitting on the spot when asked might be?
- cyphar 8y ago
  While America might have the Espionage Act, we have an law (passed a year or two ago) that gives mandatory minimum sentences of >15 years for revealing information about ASIO. And sharing the information (even if it's public) carries the same penalty -- so re-tweeting such revelations is a criminal offense. As is viewing it. Chilling effect? More like dipped-in-liquid-nitrogen effect. I hope Australia will have its own Edward Snowden, but the immediate repercussions would be far more severe in Australia.

by daemin 8y ago

bigiain 8y ago

And then somebody from inside will get a guilty conscience, but remember what happened to Snowden, and just sell the backdoor straight to Huawei or NSO or Mohamad bin Salem (salving themselves by pretending they're going to donate hundreds of millions to "improving the world", but instead will by private islands and matching citizenships to Peter Thiel's...) :sigh:

daemin 8y ago
Realistically, if you were a developer not in the chain of command and asked to do this: Would you? Could you? You would be knowingly putting your name to a vulnerability, and if someone asks then you have to keep it a secret and feign incompetence. Then if they revert your change you'll have to re-implement it. If you do tell your superiors (which would be most likely what would happen, even before writing the code) then you would be in violation and could be put in jail. If you refuse you would be put in jail, or they would go to the next person in their list.
- brokenmachine 8y ago
  If you think about logistics they'd have to make contact with people in the company to even find out who the devs are who are capable of making a backdoor. That would probably tip off others in the company as to what was happening anyway. You'd think they'd essentially have to serve the whole dev team with the secret order. I think you could immediately resign. It's not a slavery bill... is it?
  - daemin 8y ago
    There's LinkedIn, there's social media, there's actually keeping a record of who enters and leaves a company's premises. There's heading down to the bar after work on Friday. There's community events and meetups.
    - bigiain 8y ago
      And there's the previous backdoors they got into BitBucket/Github/Gitlab/Mercurial/Perforce/etc. And,no doubt, the "LEO Portals" that FAANG and FAANG wannabes already have which they'll just hand over to Australian authorities (probably including local councils and the taxi commission, based on evidence about how the metadata retention powers have been used...) After the first few times they use these new powers, the people who're gonna come asking are 99.9% likely to know exactly who the person who will write, commit, and code review the backdoor they're demanding... And their direct manager, and the management chain all the way to the C suite... I think I need to quit this entire industry, maybe take up boatbuilding or something...
    - brokenmachine 8y ago
      But just seeing who's going into the building doesn't tell you exactly who is handling encryption and security in the codebase.
- bigiain 8y ago
  I wonder what the legal implications of just quitting on the spot when asked might be?
cyphar 8y ago
While America might have the Espionage Act, we have an law (passed a year or two ago) that gives mandatory minimum sentences of >15 years for revealing information about ASIO. And sharing the information (even if it's public) carries the same penalty -- so re-tweeting such revelations is a criminal offense. As is viewing it. Chilling effect? More like dipped-in-liquid-nitrogen effect. I hope Australia will have its own Edward Snowden, but the immediate repercussions would be far more severe in Australia.