25 ms·

Australia’s vague anti-encryption law sets a dangerous new precedent

• LeoPanthera 8y ago
  I am particularly concerned how this will affect Fastmail, an Australian company. I've hosted my mail there since 2002 and they've always been quite pro-privacy. But I fear that such a stance is now literally impossible for any Australian company.
  • AsyncAwait 8y ago
    Atlassian is another company that comes to mind here.
  • cyphar 8y ago
    TCNs (which is the primary thing this article is about) won't practically affect email providers, because email providers already have your plaintext emails -- they don't need to implement new capabilities to intercept them. (As an aside, I use Mailbox.org which has a feature to auto-encrypt incoming emails to a PGP public key -- which means that only new emails would be usable with interception.) However there is now a no-warrant-required method of getting information (in the form of TANs and TARs) which has no judicial overview -- previously they would've needed a warrant. This is definitely a massive concern, but given that you wouldn't have seen a warrant previously (Fastmail would get it) this is not a practical difference to you (obviously it's a massive ethical difference and so on). But to be honest, I actually hope people stop using Australian services and big companies start backing out of the Australian market. It's the only way our dropkick government will realise how much of an own-goal this legislation was.
    • techrich 8y ago
      maybe some people cannot get iPhones. Or use netflix or other items that depend on good encryption!
      • cyphar 8y ago
        Sure, but the point is that warrants already allowed for access to services that are insecure.
    • bad_user 8y ago
      It’s not the same thing. Don’t know Australian law, but for a warrant you need to demonstrate probable cause in front of a judge. And that’s a pretty high bar.
      • cyphar 8y ago
        I didn't say it was the same thing, and I agree that the lack of judicial oversight makes it incredibly rife for abuse as well as much easier to get. I said that to you (a user who wouldn't be the target of a warrant) there isn't a practical difference if you're targeted. You wouldn't be able to mount a defence in court anyway. But of course, it being easier is a very serious problem from a societal perspective.
        • bad_user 8y ago
          It depends. Australia is part of the 5 eyes countries. So now via cooperation between security agencies and due to no judicial oversight, I think more people are affected, whereas before this you would have to convince an Australian judge to give you a warrant. IANAL.
      • briandear 8y ago
        The problem is that if a back door exists for government, it necessarily exists for anyone. Here’s Tim Cook making that point: https://m.youtube.com/watch?v=rQebmygKq7A https://m.youtube.com/watch?v=rQebmygKq7A
        • bad_user 8y ago
          We aren't talking of back doors here. With an email provider you don't need a back door to get somebody's emails.
        • cyphar 8y ago
          I'm aware of that, but in the case of email service providers there is no need for a backdoor. They have access to your emails on-disk since emails are plaintext (in general).
    • jeeeeb 8y ago
      I think that section 317ZH specifies that a TAN/TRN/TCN is invalid if a warrant would be required to access the information. Specifically: A technical assistance request that relates to an agency, or a technical assistance notice that relates to an agency, or a technical capability notice that relates to an agency, has no effect to the extent (if any) to which it would request or require a designated communications provider to do an act or thing for which the agency, or an officer of the agency, would be required to have or obtain a warrant or authorisation under any of the following laws: (a) the Telecommunications (Interception and Access) Act 1979 ; (b) the Surveillance Devices Act 2004 ; (c) the Crimes Act 1914 ; (d) the Australian Security Intelligence Organisation Act 1979 ; (f) a law of the Commonwealth (other than this Part) that is not covered by paragraph (a), (b), (c) or (d); (g) a law of a State or Territory.*
  • lawn 8y ago
    Aww man. I've been a super happy user as well for quite some time. What should a privacy concerned customer do?
    • austhrow743 8y ago
      Given that they store all of your data in plain text, probably run your own email server or use a different service. That's not really changed by this new law and was always the case. I use fastmail as well, I like their ui a lot. I certainly treat it as the stockpile of plain text messages tied to my real life identity through my credit card that it is though.
    • ObsoleteNerd 8y ago
      I'm an Australian privacy-obsessed Fastmail user, and use them for my family domains and all our primary email. I'll keep using them, because email isn't private in the first place. Any more than snail mail is. Both can be intercepted and read by authorities without you knowing. For secure communications, you shouldn't be using email in the first place, so these new laws don't change much in that regard (in my understanding, I'm still catching up on the new laws because I have limited internet access right now, I'm happy to be corrected).
      • LeoPanthera 8y ago
        This is increasingly not true. SMTP-over-TLS is now the standard, and unless you are trying to imply that TLS is broken, email is far more secure than it used to be.
        • int_19h 8y ago
          If it's not end-to-end encrypted, it's not secure in the sense OP clearly means.
          • giancarlostoro 8y ago
            Correct: if either mail server is compromised by the government then it may as well be plaintext.
• Jedi72 8y ago
  Do we trust Intel chips are free from gov backdoors? Or that Microsoft/FB arent in bed with the NSA? I would say the precedent has long since been set.
  • mimixco 8y ago
    You're right, but this is the first time (I know of) that a government has explicitly required backdoors and forcing tech companies to download malware/spyware to their customers' devices. This new law brazenly makes encryption useless and sets a dangerous precedent.
    • djsumdog 8y ago
      There was an attempt to do this in the 90s in the US, but it failed. There's a paper titled "Keys Under Doormats" that outlines the debate of that era: https://www.schneier.com/academic/paperfiles/paper-keys-under-doormats-CSAIL.pdf https://www.schneier.com/academic/paperfiles/paper-keys-unde...
  • retrogradeorbit 8y ago
    Not that this is any good, but at least in the US the state pays for the surveillance. Here the businesses have to foot the bill for who knows hoe many unending requests. If you thought it was hard to make a viable tech business in Australia before, well you can forget all about that now. It's more like if Microsoft and FB were in bed with the NSA. And then they sent you the bill for your own surveillance. And if you didn't pay, then sent you to jail.
    • cyphar 8y ago
      That's not necessarily true. For TCNs there is an explicit section that deals with compensating businesses, through an "Applicable costs negotiator". See s.317ZK(16). And there is no criminal liability for non-compliance. "Just" very hefty civil fines.
  • IshKebab 8y ago
    Actually we have yet to see any evidence that the government have forced Intel, Facebook, Amazon etc to insert backdoors. In fact the Snowden leaks kind of have evidence to the contrary - the NSA hacked Google's private network. They wouldn't need to bother if they had legally compelled them to add some kind of national security backdoor.
• exodust 8y ago
  Don't worry, nobody is going to build back doors into anything for a government which can't keep its own pants from falling down every couple of weeks. They're fishing for likes, desperately wanting to "keep Australia safe" with political spin and rushed laws, just in time for Xmas. People can already have 100% private verbal conversations in person without anyone listening or knowing what was said. In the 21st century, this full-proof mode of communication has simply extended to digital mediums via encryption. They need to face reality of the modern age, and move on.
  • retrogradeorbit 8y ago
    But don't forget these fools whose pants constantly fall down can do horrendous damage as they run smack bang into the modern age. And they are unlikely to "move on". They are more likely to wreck everything, and then when they fail, try again but worse.
• retrogradeorbit 8y ago
  The thing that makes me most despondent is, you just watch them all get voted back in next election.
  • cyphar 8y ago
    It looks like Labor will win next election, but that really doesn't matter. Labor voted for the bill unanimously.
    • thiagocsf 8y ago
      Shorten’s strategy to lose the battle/win the war has soured my view of him forever. He’s revealed himself to be a man of no principles.
      • doctorstupid 8y ago
        I now call him Backdoor Bill.
      • ux-app 8y ago
        > soured my view of him forever. He’s revealed himself to be a man of no principles. I don't have a strong opinion of Shorten one way or the other, but I've read a lot of people express a similar POV and it strikes me as extremely naive. If you went into politics with a view to die on your sword rather than compromise any of your values you'd have a very short career. Losing the battle to win the war is the only way to achieve anything. I mean, be realistic. If the ALP had blocked the bill it would be political suicide for them. For now some nerds (us) are debating the issue on an obscure forum. The alternative would be for every man and his dog having our corrupt media ram the "Labor has made it easier for terrorists to kill you" story down their throat for the next few months.
        • strken 8y ago
          > The alternative would be for every man and his dog having our corrupt media ram the "Labor has made it easier for terrorists to kill you" story down their throat for the next few months. In some ways that would be a good thing, because it would force a public debate about warrantless surveillance at a time when relatively few people trust the LNP government or its law-and-order rhetoric.
• cyphar 8y ago
  While I understand why they didn't mention this (because it's not clear if this interpretation of the bill is correct -- given there is currently no common law around it), I would like to point out what is the most concerning thing (to me) about this legislation. It potentially allows the government to turn employees into saboteurs. According to s.317C(6), a "designated service provider" can be someone who has developed software that is likely to be used in an electronic service that has one end-user in Australia. This is a very wide net and immediately includes effectively every free software developer, and the employees of every tech company. Now, there is an argument to be made that employees don't qualify (because they're acting on behalf of their employer), but that's not clear at the moment. It also includes sysadmins (or even ex-sysadmins) as people who can be "activated" as saboteurs. It should be noted that it's very unlikely that this legislation would result in the Armageddon most people (including myself) are quite worried about. I imagine it's much more likely this power will be used against a few big players (Apple, Facebook, Google) in order to add features like being able to add additional devices to group chats (or something like that). But obviously the law gives them much more power than that, and that's a very big concern. (And the fact that only 2 MPs voted against it tells me there's almost certainly some back-door dealings that resulted in this bill being passed.)
  • drngdds 8y ago
    >This is a very wide net and immediately includes effectively every free software developer, and the employees of every tech company. This doesn't seem very meaningful? I live in the US. If the Australian government goes to me and tells me to sabotage my employer, I can tell them to pound sand.
    • cyphar 8y ago
      It's an Australian law, so it can only affect people under Australian jurisdiction -- I didn't think that needed to be said. There are significant numbers of free software developers in Australia (I'm one of them). The point is that all software engineers (in Australia) being able to be co-opted as saboteurs is a fairly "meaningful" problem and should be a concern to everyone...
• DyslexicAtheist 8y ago
  warrant canaries, but for individuals
  • cyphar 8y ago
    The law allows you to provide statistical information about how many of the relevant notices you've received within a 6-month-window. So there's no need for warrant canaries (which is a good thing, since they're not generally legal in Australia).
    • brokenmachine 8y ago
      A single notice can request the data of every single one of your users.
      • cyphar 8y ago
        This is not necessarily true (as discussed elsewhere in this thread), but even if it was true you could still tell people that you've received 1 request. This fulfils the same properties as a warrant canary. I'm currently talking to some lawyers about how flexible the 6-month window might be. (Can you give overlapping 6-month windows? What if you give a new 6-month window every day?)
• amelius 8y ago
  No more ssh at work ...
• dbg31415 8y ago
  Two relevant humor bits. * Honest Government Ad | Anti Encryption Law - YouTube || https://www.youtube.com/watch?v=eW-OMR-iWOE https://www.youtube.com/watch?v=eW-OMR-iWOE * Encryption: Last Week Tonight with John Oliver (HBO) - YouTube || https://www.youtube.com/watch?v=zsjZ2r9Ygzw https://www.youtube.com/watch?v=zsjZ2r9Ygzw
• Taniwha 8y ago
  (essentially repeating a recent twitter thread here) Imagine you work in a modern software house and you get one of these ... and here I mean you, not your boss, not your coworkers, the govt knocks on your door and demands you put a back door in the thing you are working on at work ... So you write the code ... how do you write the unit test? how do you get it past the code review? the mandatory QA tests? ... all these things are designed into our modern software design processes essentially designed to stop bad stuff like this happening ... what happens when you get caught? you lose your job, get blacklisted in the industry, after all you can't tell them the govt made you do it (on your CV/resume trying to explain why you were fired) Equally say you run a big open source software project and you have valued contributors from Australia, people you trust and depend on ... what do you do? refuse them commit right? explicitly audit their every checkin? ask them to move on? Suppose you buy closed source code from Australia .... you can't trust it in any way, even if you trust the company any one of their employees may have been asked to suborn the code you've paid good money for ... any smart purchaser is simply going to put Aussie software on the "do not purchase" list ..... So how do I find out which software on Android Play is written in Oz?
  • BLKNSLVR 8y ago
    This: https://twitter.com/alfiedotwtf/status/1070047303275175936 https://twitter.com/alfiedotwtf/status/1070047303275175936 Which is absolutely brilliant.
    • Taniwha 8y ago
      yes that's the thread, thanks
  • paulie_a 8y ago
    For large oss projects, accept PRs from those contributers, and outright tell the Australian government to go fuck themselves. They have zero recourse.
    • kbsletten 8y ago
      I think they were trying to say "how do I know the Australians submitting PRs aren't secretly working for the govt?" Of course this raises (but does not beg) the question, "how do I ever know anybody submitting PRs isn't trying to sabatoge me?" You just have to judge people by their fruits and hope they do the right thing or stop associating with Australians at all.
• Animats 8y ago
  What problem does Australia have that could possibly justify this? Gangs in Sidney? Drug traffickers from New Zealand? Terrorists from Vietnam?
  • thiagocsf 8y ago
    Being the the country with the weakest civil rights protections in the 5 eyes allows us to be used as a test bed. If this thing goes smoothly, expect the same to be attempted in UK, US, NZ and CA.
    • lamerman 8y ago
      I think, you are right. It looks like governments globally are doing it. It may be a good indicator that encryption actually is hard for them at least on big scale. Russia also introduced a law year ago that forces companies to help "police" decrypt traffic, it works very selectively now though. It has of course nothing with criminals or terrorists, there is something more. :)
    • A2017U1 8y ago
      It doesn't need to be implemented anywhere else, the wording of the legislation specifically says they can ask on behalf of other nations.
  • incompatible 8y ago
    Crime is pretty low in Australia, but that doesn't stop political parties trying to whip up paranoia about it to help their election chances.
    • joshschreuder 8y ago
      One of the major parties' state election campaigns just a couple of weeks ago was running off the promise to curb violence in Melbourne (almost entirely baseless hysteria of African gangs). We had a mostly foiled terrorist attack the week of the election, and it was quite disgusting to see the leader of that party "pay tribute" to the victims even while having some sort of glee for the timing. If you live in a number of places in the US you would likely find the levels of violent crime hilariously low here in comparison, yet there was attempt to play on the fears and "make Melbourne safe again". Luckily it was one of the least successful major party election campaigns in recent years.
• jmpman 8y ago
  Apple should suspend selling any products into Australia and announce layoffs of all Australian employees for the day before the law goes into effect. The Australian market is small enough to make a stand without impacting the bottom line.
  • stanislavb 8y ago
    If only they did that. That would definitely have an impact. More non tech people will wake up and start asking questions locally in Oz. At the same time, Apple will show that they are really after people's privacy.
  • nojvek 8y ago
    Layoff all Australian employees. That just looks weak. Apple is only pro privacy when it makes them more money. They already do business in China. They have a fiduciary duty to their investors to not jump the gun like that.
    • jmpman 8y ago
      If taking a stand results in higher confidence in their products in other parts of the world, and higher sales, then it may be fiscally prudent to abandon the Australian market.
  • jmpman 8y ago
    Would it be considered a boycott? I believe US companies are no longer allowed to boycott another country without authorization from the US government.
    • cyphar 8y ago
      Apple has a subsidiary incorporated in Australia, which is necessary to do business here. They can just shut up shop, and fire all their Australian employees (though Australian labour laws might make this difficult to do without being sued for unfair dismissal).
      • 8y ago
• lamerman 8y ago
  Considering this, ban of Huawei looks ridiculous.
  • metta2uall 8y ago
    Well, I'd much rather spies from the 5 Eyes read my emails than spies from the Communist Party of China..
  • peterkelly 8y ago
    It makes sense in a way. The government wants to make sure they're the ones with the upper hand when it comes to surveillance, rather than China.
• TomMarius 8y ago
  Doesn't this directly contradict GDPR?
  • SpicyLemonZest 8y ago
    Data for the purpose of law enforcement is generally exempt from GDPR.
    • djsumdog 8y ago
      Plus Australia is not part of the EU.
      • TomMarius 8y ago
        And? Any service that serves European customers needs to adhere to the GDPR.
        • HumanDrivenDev 8y ago
          It's possibly a good commercial decision given the size of the EU market, but a lot of people seem a bit delusional as to how much of an authority the EU is. They can't compel people outside their jurisdiction with the GDPR, anymore than Australia can with this law.
          • TomMarius 8y ago
            Actually they can - the second you place your foot on EU (or collaborating - extradition treaties) soil, and of course if you want to do business in EU then you need to have legal presence in the EU.
            • HumanDrivenDev 8y ago
              But if you set foot inside the EU... you are in the EUs jurisdiction. Extradition treaties are usually subject to 'dual criminality' - so you would have to be breaking the country you are in as well to be extradited for violation of that same law to the EU. And be realistic. The US hasn't even successfully managed to extradite Kim Dotcom from mighty New Zealand.
• cesarb 8y ago
  For free software, I wonder if reproducible builds plus a "certificate transparency"-style check in the updater (only allow an update once several build servers, preferentially located in separate jurisdictions, have validated the build and published the corresponding source code) could help. That is, make it impossible to push a backdoor to a single user without making it public to everyone. Making updates anonymous (that is, never sending any ID which could be used to target an update to a specific user) might also help.
  • cyphar 8y ago
    I don't think that's sufficient. We need devices that only allow software to run that has been signed by TPM-resident keys on the device. Updates are only attempted to be installed if the binary has been signed by multiple keys (by people in different jurisdictions) and then the device prompts the user to sign the update (which requires entering the TPM passphrase). Even if you managed to compromise all of the developers you couldn't run signed code on the device -- you'd need the user to install it. And for bonus brownie points we could have reproducible build checking (a-la certificate transparency) against the source repo, to see whether the binary is different to the official one. However, I think the threat model might have to be reconsidered (if all the developers are compromised, couldn't they upload a bad hash to the certificate transparency trail with a dummy version that only one user is given?). I might write a blog post about this actually, though I'd need better experts than myself in IMA (which is what you'd use on Linux for this) and other secure-boot work.
• ohiovr 8y ago
  If the government has open source software poisoned would they eventually be victimized by their own policy?
  • brokenmachine 8y ago
    In my opinion it's inevitable they will be victimized by this policy. If you think about logistics, the govt will probably need to come up with standard ways of implementing backdoors and API for sending data back. It won't be a whole new system for every targeted company. Every unwilling company/individual served with a notice will be aware of those methods. How long until those methods and/or keys are leaked? After that, the hackers have unlimited time and motivation to break what will be the world's largest honeypot. Also, it's only a matter of time until politicians will use these new powers against each other/their political enemies. Even State Police are getting these powers with no judicial oversight. Many of the largest data breaches have been from government departments, and in my opinion this will be no different. I know they didn't leak everything, but even the NSA with their budget couldn't keep all their data secret.
• robryan 8y ago
  One of the worst things about this bill is that the opposition knows it is full of problems and could have blocked it and forced a range of amendedments. The Labor party here though is afraid of creating any point of difference on anything that could in any way be considered “national security” legislation. So instead of risk a lengthy period over the summer break where they would be attacked if any kind of terrorist attack happened they caved and passed the original version.
  • talaketu 8y ago
    There is a bipartisan consensus on security and other matters in Australia. Most policy development in Australia is driven by the unelected agencies and departments that survive their political masters. There is nothing in the values and philosophies of the ALP such that they would not have legislated this agenda were they in government rather than opposition. There are so many other examples of this over history, such as the GST, Australia Card, refugee policy, copyright laws.
    • brokenmachine 8y ago
      >There is a bipartisan consensus on security and other matters in Australia. Unfortunately, in this case, all the experts (and commenters here) seem to be in agreement that security has been significantly weakened by bringing in these laws.
  • rorykoehler 8y ago
    Ties in nicely to Adam Curtis' observations regarding politics being a risk obsessed managerial domain now (see the economist article that was HN front page yesterday).
• gtbc 8y ago
  Australia has an unstable federal political system, with elections every three years or less (this is baked into the constitution, so it will be hard to amend). Imagine the US House of Representatives with the equivalent of Speaker of the US House of Representatives as the Prime Minister of Australia as you won't be far off. Unlike the UK, there isn't a strong civil service, and unlike the US, the Senate, states and courts are weaker, and there isn't a separate executive branch. This leads to a revolving door of occasionally unsavoury characters getting into positions of great, and virtually unchecked power. Giving these figures enormous power without judicial oversight is deeply problematic. Checks and balances are not a big thing in Australia.
  • ggm 8y ago
    Do you live here? I do, and while tiny nuggets of truth are in individual sentence clauses, this is a very paranoid and over stated argument. We have a high court. They reverse bad federal and state laws. Lots of bad immigration decisions by ministers are being overturned. Mabo happened.
    • cknight 8y ago
      I do and while I am happy with 3 year terms, I don't disagree with much else. We Aussies are pretty proud of the various improvements we have over the UK and US systems. Our independent electoral commissions minimise gerrymandering. Our preferential voting system ensures more accurate representation. Mandatory voter turnout has a moderating influence on political campaigning and avoids voter disenfranchisement issues. But you can't look at the last decade of federal politics in the country and say it has been much other than a joke. We've just per chance had Brexit and Trump happening lately which has made it seem less ridiculous in comparison. Leadership issues aside, we need a federal anti-corruption body and a well-worded bill of rights. As it stands, the government has far more room to move than they should, and on many issues the opposition has been either useless or complicit.
      • gtbc 8y ago
        I do live in Australia (forgot to mention that in reply to GP). The primary problem with the terms is not their length, but the fact that they give the Prime Minister inordinate power to control the timing of elections.
• zmmmmm 8y ago
  I'm grappling with what to do about this law. I develop software in Australia, for a company, separately as a private software vendor and separately again as an open source contributor. From what I can understand, this law can compel me to silently insert malware into any of these. Morally I feel like I need to modify the licenses, READMEs and terms of conditions for products I sell and the contracts under which I do commercial work to clearly state that I may at any time include malware into the software I supply, if directed to by my government. However unlikely, the idea that I could be commandeered at any moment to betray the users of my software and ship malware to them sickens me. But I also know that the reality of this happening is almost vanishingly small. I genuinely don't know what to do.
  • nojvek 8y ago
    > But I also know that the reality of this happening is almost vanishingly small. Why do you think it’s vanishingly small? You could somewhat trust the the current govt but you can’t trust the future. I’ve lived in Australia for a long time and the trend is clear. More surveillance is to come. Australia is very much a police state as it is.
    • zmmmmm 8y ago
      I think it's vanishingly small because my software is pretty niche and the chance that anyone who is a target actually uses it is tiny just by pure laws of numbers. And then even if that happens they are much more likely to identify a bigger company that they can leverage before hitting me as the best vector into that person's devices. There simply isn't much value in getting my software backdoored compared to Google, Apple, Facebook, Microsoft, etc. But that doesn't help my on the other side of the equation where I need to sign contracts that directly prohibit things that I would be mandated to do under these laws (and do secretly). I will need to come up with some interesting boiler plate escape clauses that allow for it without sounding completely dodgy.
      • brokenmachine 8y ago
        I think the govt will attack smaller companies first, the ones who don't have the means to refuse. They'd be stupid to start with giants like Apple or Google.
• edoo 8y ago
  Imagine you run a secure webmail provider where all data is truly encrypted and served up to the user that decrypts it using a 3rd party javascript library that isn't even hosted on your site. Based on the wording of this they could compel you to target that user and serve up a javascript decryption library of the governments choice. In a similar vein they could compel Android/MS/IOS system updates to include trojans in search of decryption keys. Edit: This is a good argument to only use Linux or BSD. Unless you had some sort of management contract it would be near impossible to be directly targeted with system updates. They'd have to get the signing key for your distro and intercept/rewrite package downloads. I bet you this is standard affair for high value targets. If you were paranoid you could update or mirror through a proxy.
  • ColanR 8y ago
    That's why in-browser email should never be considered secure against an actor of this scale.
  • metta2uall 8y ago
    Hasn't the FBI already done this years ago?
• quantum_state 8y ago
  This is as outrage as forced implementation of external device into a person's body. All civic person should rise up and protest against it.
• banku_brougham 8y ago
  Regardless of what becomes of this horrific law in practice, a whole class of workers now need to spend time on legal research, money on legal advice, and prepare for contingencies that could truly upend their lives.
• rcaught 8y ago
  How does this affect the AWS Sydney region? Will KMS and CloudHSM be under threat of a backdoor and this propagate to all systems that base themselves off these products?
• brokenmachine 8y ago
  Have any tech giants like Apple or Google commented yet? They should be the ones leading the charge against this draconian insanity.
• dbuder 8y ago
  So the opposition party decided to pass this with no amendments on the understanding that it will be amended early next year. I doubt this will happen, they never go back and fix things. If they find out a piece of legislation has a loophole that is or will be abused, they never go back and fix it, it's hands up in the air - too hard.
• danieltillett 8y ago
  I am an Australian software developer. There is no way I am putting any backdoor into any software I write and I am willing to go to jail if needed. If all us Aussie developers tell the government to go jump this stupid law will fail.
  • devjungle 8y ago
    Yep. This is what I'm leaning towards as well. They can't lock us all up!!
  • cyphar 8y ago
    The punishment for non-compliance is civil fines, not gaol time. However I believe it's technically possible for them to push you into bankruptcy by making many requests and revoking them after you refuse them (fining for each copy of the request they resend to you).
    • danieltillett 8y ago
      Well then bankruptcy it will have to be if it comes to this. A mass outbreak of civil disobedience is the only way to fight this.
• XorNot 8y ago
  It's not much but I'm writing my local member, paper-copy, about this right now and encourage any Australian to do the same. It's the least you can do, costs a dollar, and politicians react to getting stacks of paper more then they do emails.
• shmerl 8y ago
  It's called a law that has unrealistic expectations on reality. Society simply would refuse to obey such "laws".
• aichi 8y ago
  It is not about PR with malicious code, I expect. I think the PR which will have backdoor code wold bump version of some dependency package only. Like the targeted attack on Bitcoin vallet few weeks ago. If you or your company isn't scanning dependencies you would never discover it.
• askvictor 8y ago
  Consider Signal, which is open source and not based in Australia. If AU wants to intercept a signal message, then presumably they would need to either force Google and/or Apple to push a custom app to a specific user, or take over the entire phone (again, via Google or Apple). In the first case, is the app that comes from the app store somehow verifiable, or do you need to build from source to be sure? Is there anything that can be done about the second case (which I suspect is the general intent of this law)
  • cyphar 8y ago
    I think that, for long-term security, we need to have devices that are resilient to orchestrated sabotage by the vendor. The current approach by Apple is great, until Apple is compromised in one way or another. I have some idea for how this could be done (TPM-resident signing keys on each device, which have to sign all binaries before they can execute). I might end up writing a blog post about the idea.
    • gruez 8y ago
      Sounds like applocker in windows
      • cyphar 8y ago
        My experience with AppLocker is that it doesn't really work. As high-school students we would trade ways to break it to play games on our laptops (we were given school laptops which had AppLocker). If high-school students were able to figure out how to break it, I have no doubt there are more serious issues. In addition, I believe you can only whitelist based on: 1. Paths (like AppArmor). 2. Publisher (which I think is a signature, but is a signature of the publisher not the machine itself -- so a compromised publisher could give you a bad update silently). 3. Hash (which is _okay_ but arguably requires more maintenance of the "good hash" list than requiring a specific signature -- though the nice thing with hashes is that you can disallow old ones). On Linux we have IMA, and there is quite a lot of work on being able to use it as a way of requiring signed-binary execution (it's still not there, from what I've heard in recent talks). But even with that we'd need quite a bit of work to create an installer that bootstraps TPM-resident keys and signs all of the system binaries -- as well as requiring all new updates to sign said binaries.
• tempodox 8y ago
  That means, nobody outside Australia can afford to let an Aussie anywhere near a computer, since Canberra will send them to prison if they don't spy or say anything about it.
  • brokenmachine 8y ago
    Don't let us near your phones either. Every Aussie is a government-mandated blackhat hacker and spy now.
• metta2uall 8y ago
  How about we take a bigger-picture view than the implementation flaws of this super-rushed law and ask what is to be done about encrypted messages that allow many serious criminals to circumvent traditional police powers of search & surveillance? I think society as a whole will not accept criminals having such an advantage. So I think alternative laws have to be suggested & promoted, otherwise potentially really bad ones are likely to get passed everywhere..
  • whiskers08xmt 8y ago
    Coded communication is nothing new between criminals, and weakening the security/privacy of Australian software is not going to solve this problem. Weakening encryption of Australian software is not going to work against organized crime; These organizations are quick to adapt to changing law enforcement techniques. It is, however, going to make it much easier to surveil the general populace.
    • metta2uall 8y ago
      There will always be some criminals who are sophisticated enough to evade surveillance (until they make a mistake) - but that doesn't mean it's useless as many violent and/or organised criminals do get caught. Many get caught even with old-fashioned phone taps. Also, aren't there ways of implementing targeted surveillance without weakening privacy/security very much, if at all? For example, targeting a specific user/device and making sure all exfiltrated data is encrypted with a public key belonging to the police.
• bsg75 8y ago
  This is what happens when policy and law makers are essentially uneducated in the modern world. A law degree does not prepare on to understand technology, medicine, or even social issues. Government needs lawyers in the body, but if as a whole it lacks a broad education, it essentially lacks an education. If only we elected like we hired.
• brokenmachine 8y ago
  It will be interesting when we have our first outbreak of phishing, claiming to be ASIO and demanding backdoors to all IT infrastructure. Literally any employee would be subject to these laws. They could just quote the laws and demand that any employee installs malware or creates a backdoor admin account.
• willfiveash 8y ago
  Creating and maintaining a large software project that "features" differing crypto strength depending on the country it's being shipped to is a HUGE PAIN IN THE ASS! I know because this was something I did for the Solaris implementation of Kerberos. What an excellent way to introduce bugs that never get tested. Crypto/security is hard enough to get right without added complications like this.
• tempodox 8y ago
  The last government I remember that wanted every citizen as a potential spy was the German “Democratic” “Republic”. They should have patented their business model and sold it to Australia.