9 ms·

Commandeering Australian citizens to become spies

141 points by alfiedotwtf 8y ago

nicwilson 8y ago
See also https://old.reddit.com/r/programming/comments/a3kk7u/australian_programmers_could_be_fired_by_their/ https://old.reddit.com/r/programming/comments/a3kk7u/austral... https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6195 https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat... and for a laugh at the sad state of affairs https://www.youtube.com/watch?v=eW-OMR-iWOE https://www.youtube.com/watch?v=eW-OMR-iWOE
- jjgreen 8y ago
  Interesting comment on that thread. Since all Australian SSL certs are now compromised (we must assume that), shouldn't all Australian certifying authorities be de-trusted?
  - g45y45 8y ago
    There are none. https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport https://ccadb-public.secure.force.com/mozilla/IncludedCACert...
    - yarosv 8y ago
      Now question is who with Australian passport work there and have access to keys.
    - alfiedotwtf 8y ago
      Not true. Symantec have offices in Australia
vermilingua 8y ago
This is based on a false premise, that the Govt will ask developers, and that they would care if it is difficult/infeasible/impossible to actually complete. In reality, they issue a notice to the company, give them a timeframe, and expect it to be done. They don’t care about the intricacies of git.
- mabbo 8y ago
  But the problem remains the same: how do you keep it a secret? How does the backdoor not get leaked immediately to the press, to the customers of the software, etc? Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. Edit later: by 'freedom taken seriously I mean by the people, not by the government.'
  - vermilingua 8y ago
    > where freedom is taken seriously. Ahahahahahahaha
  - brokenmachine 8y ago
    >Australia is a Western nation where freedom is taken seriously. Oh, you sweet summer child.
  - hvklos 8y ago
    Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. That’s the carefully cultivated reality distortion field at work. It may look that way from the outside, but it’s a tightly controlled, aging and fearful society. Anyone who steps out of line is dealt with harshly and swiftly. The government may loosen the leash on those who align with their political philosophy (so figures who vilify vulnerable groups are given a bit of freedom under the current government) but the jackboot of the state isn’t far away. Re your edit: there is compulsory voting, so the people obviously like it that way.
- cylinder 8y ago
  Yeah you just go to the CEO or legal counsel, threaten loss of licenses, seizure of personal assets
  - alfiedotwtf 8y ago
    CEO or legal counsel? They can directly compel current and former individual employees: https://twitter.com/alfiedotwtf/status/1070658693409079296 https://twitter.com/alfiedotwtf/status/1070658693409079296
alfiedotwtf 8y ago
And for more clarity on the commandeering bit: https://twitter.com/alfiedotwtf/status/1070658693409079296 https://twitter.com/alfiedotwtf/status/1070658693409079296
BLKNSLVR 8y ago
Something interesting about this is that proper code management practices would mean there would have to be a chain-of-command having knowledge of the need for a specific code commit that targets a single user with a surveillance backdoor. Could an approached employee say "I have to run this past software engineer X" before it will even be allowed to commit, so software engineer X is read-in, but he has to get auth from Middle Manager Y, and so on. The more people who are read-in, the more chance there is of a leak or someone overhearing a conversation or people questioning a stream of progressively higher-tiered employees being brought into a meeting with strange men wearing sunglasses, fedoras, with knife-sharp pleats in their slacks, and using company meeting rooms like they own the place. This is making assumptions about the quality of company Z's code publishing process, but I'd be guessing that there would be a lot more "targets" using popular software from big vendors that have these QA processes in place. The other interesting thing about this is that it may spur far more interest in both using and regularly auditing open source software. Proprietary software is far more at risk of losing reputation in this situation simply because of its opacity. P.S. https://blog.cryptoaustralia.org.au/2017/03/21/run-your-end-to-end-encrypted-chat-server-matrix-riot/ https://blog.cryptoaustralia.org.au/2017/03/21/run-your-end-...
- phoe-krk 8y ago
  Also, what exactly happens if the code is worked on in teams and/or available for any people in the company (and it sure is), and if another developer questions the committed code or attempts to change or remove it? Does such code gets explicitly painted "don't remove, don't edit, don't ask any questions"? Suddenly we get code in our product that nobody cannot talk about, nobody should understand, and nobody can fix if it introduces any other bugs into the product. It's a complete disaster.
  - BLKNSLVR 8y ago
    "Does such code gets explicitly painted "don't remove, don't edit, don't ask any questions" This would flag the code as 'interesting' to any other members of the development team, and it would likely make it obvious which account is being specifically targeted, which works against the secrecy required of the whole thing.
jaketay 8y ago
This legislation has support from both major parties, it's set to pass either this week or next. I don't know why Google, Facebook, Tesla, Microsoft, Atlassian and other big tech companies with investments in Australia don't push back. Nothing pressures Australian politicians more than an advertising campaign. The mineral resources industry spent just $8m on advertising to prevent a new mining tax that would have cost them several billion dollars. Better yet, as the Government is currently being held together by a few minority seats just spend a few hundred thousand in the most at risk seats. That alone would be enough to completely abandon or water down this legislation.
- hannasanarion 8y ago
  It passed earlier today, it's law now.
  - cyphar 8y ago
    It's not law until it gets Royal Assent, but yes it's passed both houses and will be law very shortly.
- cyphar 8y ago
  The legislation has already passed both houses, and is headed for Royal Assent. They'd need to repeal it, and given that Labor unanimously voted for it, I have no doubt it's never going to be repealed.
mostlyjason 8y ago
Could this be a threat to open source software? If they require developers to insert backdoors to decrypt data, and the company uses open source software for security, how do we know they won’t attempt to weaken it? Most open source projects don’t have the resources or manpower to review every commit, especially when the person submitting is prevented from disclosing their true purpose and under threat from their government. This could be a threat to companies all around the world that use OSS.
- phoe-krk 8y ago
  This threat to free and open source software isn't new. Governments have been trying to sneak vulnerabilities for a long time now. What is new is an army of people who will now be forced to make a choice between making and submitting destructive patches and facing penalties and jail. Incidentally, all of these people are the ones who are subject to Australian law. I feel sorry for them, but I expect that, as an effect of this legislation, many people will stop accepting submissions from these people to keep their software secure - be it proprietary programs or free software.
stephen_g 8y ago
If you're wondering why this kind of thing happens all the time in Australia, the late Donald Horne summed it up beautifully in the 1960s: "Australia is a lucky country run mainly by second rate people who share its luck" [1] Australia has many intelligent, brilliant people. For some reason, the design of our political system results in almost none of them getting into Government. This awful, fundamentally flawed law (literally only passed into law because our opposition was terrified of being called "soft on crime" in the media over Christmas) is just one in a long line of disappointments. 1. https://en.wikipedia.org/wiki/The_Lucky_Country https://en.wikipedia.org/wiki/The_Lucky_Country
- tomatotomato37 8y ago
  Don't worry, that pretty much describes all of western government. If they aren't trying to spy on their own people, they're getting into slapfights over social media corporations or invading random third world countries "Democracy is the worst form of government, except for all the others"
- erentz 8y ago
  Maybe. But I really-really wish we had Australia’s STV system here in the USA.
  - JadeNB 8y ago
    What is Australia's STV system? I went Googling a bit, and the only quick hit was https://en.wikipedia.org/wiki/STV_(TV_station) https://en.wikipedia.org/wiki/STV_(TV_station) , which seems unlikely to be what you meant.
    - khr 8y ago
      erentz was probably referring to the single transferable vote system (https://en.wikipedia.org/wiki/Single_transferable_vote https://en.wikipedia.org/wiki/Single_transferable_vote), which uses a ranked ballot in elections and results in relatively proportional representation. CGP grey explains it pretty well: https://www.youtube.com/watch?v=l8XOZJkozfI https://www.youtube.com/watch?v=l8XOZJkozfI
fryry 8y ago
As an Australian Dev living in the U.K. this is absolutely terrifying. I'm compelled to somehow deploy a backdoor at whatever company I'm working for if they have a single Australian user on threat of jail time???
- g45y45 8y ago
  You are not bound to the laws of Australia in the UK. Foreign nationals in Australia are. That being said, this is coming to the UK too.
  - marak830 8y ago
    Yes he is, and at risk of a felony charge waiting for him if he returns to Aus. Not sure about extradition but I assume that could be on the table too.
decentralised 8y ago
So in short, don't hire Australian employees because they may be compelled to spy on my business by their government.
deleted 8y ago
[deleted]
TACIXAT 8y ago
Isn't this the exact thing that China has in law that is causing everyone to dump Huawei over?
- peterkelly 8y ago
  This is probably the reason they want to dump Huawei. Much easier to subvert technology produced locally or in allied countries (and the other Five Eyes members will undoubtedly adopt similar laws soon, if they haven't already).
  - nineteen999 8y ago
    > other Five Eyes members will undoubtedly adopt similar laws soon, if they haven't already Exactly. For those getting wound up over this in other western countries - Australia is often used as a testing ground for this kind of legislation. It will be your country next.
    - ByThyGrace 8y ago
      > Australia is often used as a testing ground for this kind of legislation. I didn't know that. Can you mention any notable examples?
      - nineteen999 8y ago
        https://en.wikipedia.org/wiki/Internet_censorship_in_Australia#Proposed_mandatory_filtering_legislation https://en.wikipedia.org/wiki/Internet_censorship_in_Austral...
  - TACIXAT 8y ago
    It's the cypherpunk future I've always dreamed of.
- dhx 8y ago
  The Chinese legislation you refer to is much more expansive in scope as it is not limited to "communications providers". Refer to [1] and [2]. [1] https://www.lawfareblog.com/beijings-new-national-intelligence-law-defense-offense https://www.lawfareblog.com/beijings-new-national-intelligen... [2] https://www.aspistrategist.org.au/huawei-and-the-ambiguity-of-chinas-intelligence-and-counter-espionage-laws/ https://www.aspistrategist.org.au/huawei-and-the-ambiguity-o...
SideburnsOfDoom 8y ago
> Now to time management. When do these taps actually get done? In today’s micromanaged Agile-Scrum-Kanban environment, every minute is tracked, and tracked to JIRA tickets. Whatever happened to Agile as "we have come to value: Individuals and interactions over processes and tools" ?? https://agilemanifesto.org/ https://agilemanifesto.org/
zimbatm 8y ago
Has anyone worked at a company where Change Management was so good that there was no possible backdoor? Every system change would have to be approved by at least one other engineer and there is no ssh/sudo access on production systems? So far my impression is that all that is required is to gain access to Jenkins one way or another and you have the keys of the whole infrastructure.
- knorker 8y ago
  There's never no possible backdoor, but yes I think in order to effectively do this and not involve my whole company like the article described you may have to have to involve Intel (and AMD is coming back, so them too) to go all "trusting trust" on this problem. And even then people may notice that their FDO profiles seem to be broken, and other "huh, that's funny". Also other shops that actually obey SOX, and actually care about two-key systems (or multi-key) will not be able to keep this a secret. The same protections that work for SOX and "sysadmins kid was kidnapped and they demand a backdoor be inserted" will work for this. Sure, companies that protect against none of these will fail. But if you actually have systems in place to protect against "rogue employee" then this kind of order requires breaking ALL of these systems. I expect most companies to have no such systems, but the important ones do.
dreamcompiler 8y ago
Atlassian's an AUS company. Let's say I store code on Bitbucket, or I use Atlassian's hosted Confluence service. Does this mean Atlassian might have to notify the AUS government when I change my code, or add something to my Confluence pages? Or that they might have to secretly change my code (which means I'd have to carefully check it all the time for changes)? What if I self-host Confluence? Could a software upgrade contain a backdoor that sends my Confluence data to the AUS gov? Not that I give a damn if the AUS gov looks at my stuff, but that's completely beside the point. These appear to be real possibilities with this law, and I hope Atlassian and other AUS companies address them.
- anjsimmo 8y ago
  Yep, Atlassian headquarters are in Sydney, so they could be issued a Technical Assistance Request to covertly undermine any repo they host (or have indirect control over via pushing out software updates). While they could potentially be asked to change your code stored in Bitbucket, Git will refuse to pull if the commit hashes in Bitbucket don't match your local copy, so I don't think intelligence agencies are likely to request this as it is too easily detected. I predict altering the binaries would be a better way for intelligence agencies to covertly inject a "capability" into your software. E.g. they could ask Atlassian to introduce a hidden code injection step as part of Bitbucket Pipelines, which would be very difficult to detect unless you have deterministic builds and manually verify the output. Aside from your code, I expect intelligence agencies would be very interested to read your product's issue tracking database (all those "minor" security vulnerabilities that your team knows they should fix someday but don't have time for right now).
deleted 8y ago
[deleted]
aljungberg 8y ago
It seems like a work-around for an Australian company would be to always have a non-Australian employee have final say in what's deployed to production. Now you have to fire him to deploy the backdoor. I expect the law doesn't require you to fire people. Even if it does, he or she is not bound by the gag order and could be a canary to the rest of the world.

141 points by alfiedotwtf 8y ago

See also https://old.reddit.com/r/programming/comments/a3kk7u/australian_programmers_could_be_fired_by_their/ https://old.reddit.com/r/programming/comments/a3kk7u/austral... https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6195 https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat... and for a laugh at the sad state of affairs https://www.youtube.com/watch?v=eW-OMR-iWOE https://www.youtube.com/watch?v=eW-OMR-iWOE

jjgreen 8y ago
Interesting comment on that thread. Since all Australian SSL certs are now compromised (we must assume that), shouldn't all Australian certifying authorities be de-trusted?
- g45y45 8y ago
  There are none. https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport https://ccadb-public.secure.force.com/mozilla/IncludedCACert...
  - yarosv 8y ago
    Now question is who with Australian passport work there and have access to keys.
  - alfiedotwtf 8y ago
    Not true. Symantec have offices in Australia

vermilingua 8y ago

This is based on a false premise, that the Govt will ask developers, and that they would care if it is difficult/infeasible/impossible to actually complete. In reality, they issue a notice to the company, give them a timeframe, and expect it to be done. They don’t care about the intricacies of git.

mabbo 8y ago
But the problem remains the same: how do you keep it a secret? How does the backdoor not get leaked immediately to the press, to the customers of the software, etc? Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. Edit later: by 'freedom taken seriously I mean by the people, not by the government.'
- vermilingua 8y ago
  > where freedom is taken seriously. Ahahahahahahaha
- brokenmachine 8y ago
  >Australia is a Western nation where freedom is taken seriously. Oh, you sweet summer child.
- hvklos 8y ago
  Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. That’s the carefully cultivated reality distortion field at work. It may look that way from the outside, but it’s a tightly controlled, aging and fearful society. Anyone who steps out of line is dealt with harshly and swiftly. The government may loosen the leash on those who align with their political philosophy (so figures who vilify vulnerable groups are given a bit of freedom under the current government) but the jackboot of the state isn’t far away. Re your edit: there is compulsory voting, so the people obviously like it that way.
cylinder 8y ago
Yeah you just go to the CEO or legal counsel, threaten loss of licenses, seizure of personal assets
- alfiedotwtf 8y ago
  CEO or legal counsel? They can directly compel current and former individual employees: https://twitter.com/alfiedotwtf/status/1070658693409079296 https://twitter.com/alfiedotwtf/status/1070658693409079296

alfiedotwtf 8y ago

And for more clarity on the commandeering bit: https://twitter.com/alfiedotwtf/status/1070658693409079296 https://twitter.com/alfiedotwtf/status/1070658693409079296

BLKNSLVR 8y ago

Something interesting about this is that proper code management practices would mean there would have to be a chain-of-command having knowledge of the need for a specific code commit that targets a single user with a surveillance backdoor. Could an approached employee say "I have to run this past software engineer X" before it will even be allowed to commit, so software engineer X is read-in, but he has to get auth from Middle Manager Y, and so on. The more people who are read-in, the more chance there is of a leak or someone overhearing a conversation or people questioning a stream of progressively higher-tiered employees being brought into a meeting with strange men wearing sunglasses, fedoras, with knife-sharp pleats in their slacks, and using company meeting rooms like they own the place. This is making assumptions about the quality of company Z's code publishing process, but I'd be guessing that there would be a lot more "targets" using popular software from big vendors that have these QA processes in place. The other interesting thing about this is that it may spur far more interest in both using and regularly auditing open source software. Proprietary software is far more at risk of losing reputation in this situation simply because of its opacity. P.S. https://blog.cryptoaustralia.org.au/2017/03/21/run-your-end-to-end-encrypted-chat-server-matrix-riot/ https://blog.cryptoaustralia.org.au/2017/03/21/run-your-end-...

phoe-krk 8y ago
Also, what exactly happens if the code is worked on in teams and/or available for any people in the company (and it sure is), and if another developer questions the committed code or attempts to change or remove it? Does such code gets explicitly painted "don't remove, don't edit, don't ask any questions"? Suddenly we get code in our product that nobody cannot talk about, nobody should understand, and nobody can fix if it introduces any other bugs into the product. It's a complete disaster.
- BLKNSLVR 8y ago
  "Does such code gets explicitly painted "don't remove, don't edit, don't ask any questions" This would flag the code as 'interesting' to any other members of the development team, and it would likely make it obvious which account is being specifically targeted, which works against the secrecy required of the whole thing.

jaketay 8y ago

This legislation has support from both major parties, it's set to pass either this week or next. I don't know why Google, Facebook, Tesla, Microsoft, Atlassian and other big tech companies with investments in Australia don't push back. Nothing pressures Australian politicians more than an advertising campaign. The mineral resources industry spent just $8m on advertising to prevent a new mining tax that would have cost them several billion dollars. Better yet, as the Government is currently being held together by a few minority seats just spend a few hundred thousand in the most at risk seats. That alone would be enough to completely abandon or water down this legislation.

hannasanarion 8y ago
It passed earlier today, it's law now.
- cyphar 8y ago
  It's not law until it gets Royal Assent, but yes it's passed both houses and will be law very shortly.
cyphar 8y ago
The legislation has already passed both houses, and is headed for Royal Assent. They'd need to repeal it, and given that Labor unanimously voted for it, I have no doubt it's never going to be repealed.

mostlyjason 8y ago

Could this be a threat to open source software? If they require developers to insert backdoors to decrypt data, and the company uses open source software for security, how do we know they won’t attempt to weaken it? Most open source projects don’t have the resources or manpower to review every commit, especially when the person submitting is prevented from disclosing their true purpose and under threat from their government. This could be a threat to companies all around the world that use OSS.

phoe-krk 8y ago
This threat to free and open source software isn't new. Governments have been trying to sneak vulnerabilities for a long time now. What is new is an army of people who will now be forced to make a choice between making and submitting destructive patches and facing penalties and jail. Incidentally, all of these people are the ones who are subject to Australian law. I feel sorry for them, but I expect that, as an effect of this legislation, many people will stop accepting submissions from these people to keep their software secure - be it proprietary programs or free software.

stephen_g 8y ago

If you're wondering why this kind of thing happens all the time in Australia, the late Donald Horne summed it up beautifully in the 1960s: "Australia is a lucky country run mainly by second rate people who share its luck" [1] Australia has many intelligent, brilliant people. For some reason, the design of our political system results in almost none of them getting into Government. This awful, fundamentally flawed law (literally only passed into law because our opposition was terrified of being called "soft on crime" in the media over Christmas) is just one in a long line of disappointments. 1. https://en.wikipedia.org/wiki/The_Lucky_Country https://en.wikipedia.org/wiki/The_Lucky_Country

tomatotomato37 8y ago
Don't worry, that pretty much describes all of western government. If they aren't trying to spy on their own people, they're getting into slapfights over social media corporations or invading random third world countries "Democracy is the worst form of government, except for all the others"
erentz 8y ago
Maybe. But I really-really wish we had Australia’s STV system here in the USA.
- JadeNB 8y ago
  What is Australia's STV system? I went Googling a bit, and the only quick hit was https://en.wikipedia.org/wiki/STV_(TV_station) https://en.wikipedia.org/wiki/STV_(TV_station) , which seems unlikely to be what you meant.
  - khr 8y ago
    erentz was probably referring to the single transferable vote system (https://en.wikipedia.org/wiki/Single_transferable_vote https://en.wikipedia.org/wiki/Single_transferable_vote), which uses a ranked ballot in elections and results in relatively proportional representation. CGP grey explains it pretty well: https://www.youtube.com/watch?v=l8XOZJkozfI https://www.youtube.com/watch?v=l8XOZJkozfI

fryry 8y ago

As an Australian Dev living in the U.K. this is absolutely terrifying. I'm compelled to somehow deploy a backdoor at whatever company I'm working for if they have a single Australian user on threat of jail time???

g45y45 8y ago
You are not bound to the laws of Australia in the UK. Foreign nationals in Australia are. That being said, this is coming to the UK too.
- marak830 8y ago
  Yes he is, and at risk of a felony charge waiting for him if he returns to Aus. Not sure about extradition but I assume that could be on the table too.

decentralised 8y ago

So in short, don't hire Australian employees because they may be compelled to spy on my business by their government.

deleted 8y ago

[deleted]

TACIXAT 8y ago

Isn't this the exact thing that China has in law that is causing everyone to dump Huawei over?

peterkelly 8y ago
This is probably the reason they want to dump Huawei. Much easier to subvert technology produced locally or in allied countries (and the other Five Eyes members will undoubtedly adopt similar laws soon, if they haven't already).
- nineteen999 8y ago
  > other Five Eyes members will undoubtedly adopt similar laws soon, if they haven't already Exactly. For those getting wound up over this in other western countries - Australia is often used as a testing ground for this kind of legislation. It will be your country next.
  - ByThyGrace 8y ago
    > Australia is often used as a testing ground for this kind of legislation. I didn't know that. Can you mention any notable examples?
    - nineteen999 8y ago
      https://en.wikipedia.org/wiki/Internet_censorship_in_Australia#Proposed_mandatory_filtering_legislation https://en.wikipedia.org/wiki/Internet_censorship_in_Austral...
- TACIXAT 8y ago
  It's the cypherpunk future I've always dreamed of.
dhx 8y ago
The Chinese legislation you refer to is much more expansive in scope as it is not limited to "communications providers". Refer to [1] and [2]. [1] https://www.lawfareblog.com/beijings-new-national-intelligence-law-defense-offense https://www.lawfareblog.com/beijings-new-national-intelligen... [2] https://www.aspistrategist.org.au/huawei-and-the-ambiguity-of-chinas-intelligence-and-counter-espionage-laws/ https://www.aspistrategist.org.au/huawei-and-the-ambiguity-o...

SideburnsOfDoom 8y ago

> Now to time management. When do these taps actually get done? In today’s micromanaged Agile-Scrum-Kanban environment, every minute is tracked, and tracked to JIRA tickets. Whatever happened to Agile as "we have come to value: Individuals and interactions over processes and tools" ?? https://agilemanifesto.org/ https://agilemanifesto.org/

zimbatm 8y ago

Has anyone worked at a company where Change Management was so good that there was no possible backdoor? Every system change would have to be approved by at least one other engineer and there is no ssh/sudo access on production systems? So far my impression is that all that is required is to gain access to Jenkins one way or another and you have the keys of the whole infrastructure.

knorker 8y ago
There's never no possible backdoor, but yes I think in order to effectively do this and not involve my whole company like the article described you may have to have to involve Intel (and AMD is coming back, so them too) to go all "trusting trust" on this problem. And even then people may notice that their FDO profiles seem to be broken, and other "huh, that's funny". Also other shops that actually obey SOX, and actually care about two-key systems (or multi-key) will not be able to keep this a secret. The same protections that work for SOX and "sysadmins kid was kidnapped and they demand a backdoor be inserted" will work for this. Sure, companies that protect against none of these will fail. But if you actually have systems in place to protect against "rogue employee" then this kind of order requires breaking ALL of these systems. I expect most companies to have no such systems, but the important ones do.

dreamcompiler 8y ago

Atlassian's an AUS company. Let's say I store code on Bitbucket, or I use Atlassian's hosted Confluence service. Does this mean Atlassian might have to notify the AUS government when I change my code, or add something to my Confluence pages? Or that they might have to secretly change my code (which means I'd have to carefully check it all the time for changes)? What if I self-host Confluence? Could a software upgrade contain a backdoor that sends my Confluence data to the AUS gov? Not that I give a damn if the AUS gov looks at my stuff, but that's completely beside the point. These appear to be real possibilities with this law, and I hope Atlassian and other AUS companies address them.

anjsimmo 8y ago
Yep, Atlassian headquarters are in Sydney, so they could be issued a Technical Assistance Request to covertly undermine any repo they host (or have indirect control over via pushing out software updates). While they could potentially be asked to change your code stored in Bitbucket, Git will refuse to pull if the commit hashes in Bitbucket don't match your local copy, so I don't think intelligence agencies are likely to request this as it is too easily detected. I predict altering the binaries would be a better way for intelligence agencies to covertly inject a "capability" into your software. E.g. they could ask Atlassian to introduce a hidden code injection step as part of Bitbucket Pipelines, which would be very difficult to detect unless you have deterministic builds and manually verify the output. Aside from your code, I expect intelligence agencies would be very interested to read your product's issue tracking database (all those "minor" security vulnerabilities that your team knows they should fix someday but don't have time for right now).

deleted 8y ago

[deleted]

aljungberg 8y ago

It seems like a work-around for an Australian company would be to always have a non-Australian employee have final say in what's deployed to production. Now you have to fire him to deploy the backdoor. I expect the law doesn't require you to fire people. Even if it does, he or she is not bound by the gag order and could be a canary to the rest of the world.