5 ms·

I'm grappling with what to do about this law. I develop software in Australia, for a company, separately as a private software vendor and separately again as an

by zmmmmm 8y ago

I'm grappling with what to do about this law. I develop software in Australia, for a company, separately as a private software vendor and separately again as an open source contributor. From what I can understand, this law can compel me to silently insert malware into any of these. Morally I feel like I need to modify the licenses, READMEs and terms of conditions for products I sell and the contracts under which I do commercial work to clearly state that I may at any time include malware into the software I supply, if directed to by my government. However unlikely, the idea that I could be commandeered at any moment to betray the users of my software and ship malware to them sickens me. But I also know that the reality of this happening is almost vanishingly small. I genuinely don't know what to do.

nojvek 8y ago
> But I also know that the reality of this happening is almost vanishingly small. Why do you think it’s vanishingly small? You could somewhat trust the the current govt but you can’t trust the future. I’ve lived in Australia for a long time and the trend is clear. More surveillance is to come. Australia is very much a police state as it is.
- zmmmmm 8y ago
  I think it's vanishingly small because my software is pretty niche and the chance that anyone who is a target actually uses it is tiny just by pure laws of numbers. And then even if that happens they are much more likely to identify a bigger company that they can leverage before hitting me as the best vector into that person's devices. There simply isn't much value in getting my software backdoored compared to Google, Apple, Facebook, Microsoft, etc. But that doesn't help my on the other side of the equation where I need to sign contracts that directly prohibit things that I would be mandated to do under these laws (and do secretly). I will need to come up with some interesting boiler plate escape clauses that allow for it without sounding completely dodgy.
  - brokenmachine 8y ago
    I think the govt will attack smaller companies first, the ones who don't have the means to refuse. They'd be stupid to start with giants like Apple or Google.
ObsoleteNerd 8y ago
Maybe something like a warrant canary makes more sense? An encryption canary? Would that even pass with the new laws though? Also you stating that you might have been forced to insert malware by the government surely breaks the rule that says you can't tell anyone too, if I'm understanding it correctly.
- zmmmmm 8y ago
  I think me merely stating that I am subject to the laws of my country under which an individual can be compelled to ... etc. probably isn't illegal. It may be illegal if I modify that statement after being issued with an order and directed not to reveal the existence order.
- int_19h 8y ago
  Australia has a law that specifically bans warrant canaries. https://arstechnica.com/tech-policy/2015/03/australian-government-minister-dodge-new-data-retention-law-like-this/ https://arstechnica.com/tech-policy/2015/03/australian-gover...
- cyphar 8y ago
  Warrant canaries aren't necessary (nor are they legal in Australia). The law allows you to provide aggregated statistics on how many requests you've received in a 6-month period.
  - brokenmachine 8y ago
    Yes but a single request can include an unlimited number of targets. They can literally ask for all communications of every one of your users.
    - zmmmmm 8y ago
      It would be very hard for that to pass the proportionality test in the law. I know it's tempting to go for the worst case dystopian scenarios but it's actually important not to go overboard. Politicians and other people with a say immediately stop listening once they hear that. This law is extremely problematic even with a conservative interpretation, so I think we should stick with that.
Nasrudith 8y ago
The simplest solution is probably a harder one practically - leave Australia. Sadly one doesn't simply leave their country and immigrate to someplace else in addition to any personal concerns - it might not be an option, let alone a desirable one but it has its merits.
- cal5k 8y ago
  Come to Canada :) We'll hire you.
  - deleted 8y ago
    [deleted]

by zmmmmm 8y ago

nojvek 8y ago

> But I also know that the reality of this happening is almost vanishingly small. Why do you think it’s vanishingly small? You could somewhat trust the the current govt but you can’t trust the future. I’ve lived in Australia for a long time and the trend is clear. More surveillance is to come. Australia is very much a police state as it is.

zmmmmm 8y ago
I think it's vanishingly small because my software is pretty niche and the chance that anyone who is a target actually uses it is tiny just by pure laws of numbers. And then even if that happens they are much more likely to identify a bigger company that they can leverage before hitting me as the best vector into that person's devices. There simply isn't much value in getting my software backdoored compared to Google, Apple, Facebook, Microsoft, etc. But that doesn't help my on the other side of the equation where I need to sign contracts that directly prohibit things that I would be mandated to do under these laws (and do secretly). I will need to come up with some interesting boiler plate escape clauses that allow for it without sounding completely dodgy.
- brokenmachine 8y ago
  I think the govt will attack smaller companies first, the ones who don't have the means to refuse. They'd be stupid to start with giants like Apple or Google.

ObsoleteNerd 8y ago

Maybe something like a warrant canary makes more sense? An encryption canary? Would that even pass with the new laws though? Also you stating that you might have been forced to insert malware by the government surely breaks the rule that says you can't tell anyone too, if I'm understanding it correctly.

zmmmmm 8y ago
I think me merely stating that I am subject to the laws of my country under which an individual can be compelled to ... etc. probably isn't illegal. It may be illegal if I modify that statement after being issued with an order and directed not to reveal the existence order.
int_19h 8y ago
Australia has a law that specifically bans warrant canaries. https://arstechnica.com/tech-policy/2015/03/australian-government-minister-dodge-new-data-retention-law-like-this/ https://arstechnica.com/tech-policy/2015/03/australian-gover...
cyphar 8y ago
Warrant canaries aren't necessary (nor are they legal in Australia). The law allows you to provide aggregated statistics on how many requests you've received in a 6-month period.
- brokenmachine 8y ago
  Yes but a single request can include an unlimited number of targets. They can literally ask for all communications of every one of your users.
  - zmmmmm 8y ago
    It would be very hard for that to pass the proportionality test in the law. I know it's tempting to go for the worst case dystopian scenarios but it's actually important not to go overboard. Politicians and other people with a say immediately stop listening once they hear that. This law is extremely problematic even with a conservative interpretation, so I think we should stick with that.

Nasrudith 8y ago

The simplest solution is probably a harder one practically - leave Australia. Sadly one doesn't simply leave their country and immigrate to someplace else in addition to any personal concerns - it might not be an option, let alone a desirable one but it has its merits.

cal5k 8y ago
Come to Canada :) We'll hire you.
- deleted 8y ago
  [deleted]