3 ms·

Does the legislation say they can do this without justification though? Can they just ask for anyones information or does there need to be some sort of warrant?

JoshTriplett 8y ago
Does it matter? The correct answer to "decrypt this person's data now" is "sorry, we can't". Not "won't", "can't".
brokenmachine 8y ago
It has to be under suspicion of a crime that attracts over 3 years jail (which is almost anything). They mentioned oversight of a "retired judge" and a "technology expert" in the autoplay video at the bottom of https://www.news.com.au/technology/online/security/inprinciple-deal-struck-on-controversial-encryption-bill/news-story/75492c0ee5a389a0ada7955733529af4 https://www.news.com.au/technology/online/security/inprincip...
- mcv 8y ago
  Why a retired judge and not an active judge? Presumably because an active is required to obey certain standards and is legally independent. A retired judge is effective just some guy.
  - cyphar 8y ago
    Because they didn't want judicial oversight. It's just going to be rubber-stamp faux-arbitration.
cyphar 8y ago
It doesn't need a warrant, and the requirements are varied. None of them require judicial review. * TARs and TANs both generally require that an agency be investigating a serious crime (one that takes). There are some toy protections against abuse but they're basically meaningless (the AG or chief officer needs to be "satisfied" that it's reasonable and a few other token requirements -- need I remind you that we imprison refugees in sub-human conditions without the right to a trial, so "reasonable" is a stretch). * TCNs are even more general. They can be done purely "in the interests of national security".
cmroanirgo 8y ago
"The Director-General of Security, the Director-General of the Australian Secret Intelligence Service, the Director-General of the Australian Signals Directorate or the chief officer of an interception agency may give a technical assistance request to a designated communications provider. • A technical assistance request may ask the provider to do acts or things on a voluntary basis..." Note that an interception agency also includes "the Police Force" p9 It later states that if a provider willingly complies: "an officer, employee or agent of the provider is not subject to any civil liability for, or in relation to, an act or thing done by the officer, employee or agent in connection with the act or thing mentioned in paragraph (b)" p17 Meaning, you're up for civil charges if you fail to respond to a non-warrant request.
- mcv 8y ago
  I don't see how you're up for civil charges if you fail to respond. It's voluntary. The line about not being subject to civil liability sounds to me like your employer can't fire or sue you for undermining the security of their product if you're doing so in response to a request.
  - ApolloFortyNine 8y ago
    That's how I interpret it too. Though does that mean they can contact an employee directly, rather than going through the company to have the backdoor installed? That's how it sounds to me, since otherwise why would you bother with this provision. And if that's the case, software really is dead in Australia. You can't trust an Australian company, even if their leadership says they've never received a request, because one of their employees may have.
  - cyphar 8y ago
    There are three kinds of notices. Only one is voluntary (Technical Assistance Request). The other two (Technical Assistance Notice, Technical Capability Notice) are both mandatory and carry several hundred penalty unit punishments for non-compliance.

JoshTriplett 8y ago

Does it matter? The correct answer to "decrypt this person's data now" is "sorry, we can't". Not "won't", "can't".

brokenmachine 8y ago

It has to be under suspicion of a crime that attracts over 3 years jail (which is almost anything). They mentioned oversight of a "retired judge" and a "technology expert" in the autoplay video at the bottom of https://www.news.com.au/technology/online/security/inprinciple-deal-struck-on-controversial-encryption-bill/news-story/75492c0ee5a389a0ada7955733529af4 https://www.news.com.au/technology/online/security/inprincip...

mcv 8y ago
Why a retired judge and not an active judge? Presumably because an active is required to obey certain standards and is legally independent. A retired judge is effective just some guy.
- cyphar 8y ago
  Because they didn't want judicial oversight. It's just going to be rubber-stamp faux-arbitration.

cyphar 8y ago

It doesn't need a warrant, and the requirements are varied. None of them require judicial review. * TARs and TANs both generally require that an agency be investigating a serious crime (one that takes). There are some toy protections against abuse but they're basically meaningless (the AG or chief officer needs to be "satisfied" that it's reasonable and a few other token requirements -- need I remind you that we imprison refugees in sub-human conditions without the right to a trial, so "reasonable" is a stretch). * TCNs are even more general. They can be done purely "in the interests of national security".

cmroanirgo 8y ago

"The Director-General of Security, the Director-General of the Australian Secret Intelligence Service, the Director-General of the Australian Signals Directorate or the chief officer of an interception agency may give a technical assistance request to a designated communications provider. • A technical assistance request may ask the provider to do acts or things on a voluntary basis..." Note that an interception agency also includes "the Police Force" p9 It later states that if a provider willingly complies: "an officer, employee or agent of the provider is not subject to any civil liability for, or in relation to, an act or thing done by the officer, employee or agent in connection with the act or thing mentioned in paragraph (b)" p17 Meaning, you're up for civil charges if you fail to respond to a non-warrant request.

mcv 8y ago
I don't see how you're up for civil charges if you fail to respond. It's voluntary. The line about not being subject to civil liability sounds to me like your employer can't fire or sue you for undermining the security of their product if you're doing so in response to a request.
- ApolloFortyNine 8y ago
  That's how I interpret it too. Though does that mean they can contact an employee directly, rather than going through the company to have the backdoor installed? That's how it sounds to me, since otherwise why would you bother with this provision. And if that's the case, software really is dead in Australia. You can't trust an Australian company, even if their leadership says they've never received a request, because one of their employees may have.
- cyphar 8y ago
  There are three kinds of notices. Only one is voluntary (Technical Assistance Request). The other two (Technical Assistance Notice, Technical Capability Notice) are both mandatory and carry several hundred penalty unit punishments for non-compliance.