13 ms·

Did Australia Poke a Hole in Your Phone’s Security?

212 points by boyter 8y ago

et2o 8y ago
I doubt that Apple will build a significant backdoor. Most likely they will figure out some symbolic way to accommodate this law, exploiting the vague wording. The nuclear option is probably to just stop selling their products in Australia. The population of Australia is only 25 million people. It would be a huge hit but not insurmountable, and then the Australian politicians would face significant backlash and probably walk back the law.
- cronix 8y ago
  > The nuclear option is probably to just stop selling their products in Australia. Someone needs to. With EU laws, Australian laws, US laws, and more and more every day, the internet is rapidly becoming a tool of the least common denominator. In other words, whatever country has the toughest laws will govern the planetary internet system as all others will have to follow by extension. Apple, for example, can't make an iphone for every country to comply with that countries individual laws that differ from every other country, which also change with a regular basis. Of course though, there will always be hackers skating on top relatively free. We're becoming a two-tiered internet. The relatively few who know how to get around the restrictions, and everybody else. All Apple has to do is float the possibility they may not sell their products in Australia anymore, and point out why. The rest would take care of itself.
  - hazz99 8y ago
    As an Australian with Apple products, I really hope Apple pulls out of the market. Some large entity definitely needs to take a stand.
    - quicklime 8y ago
      In this specific case, I hope that's the outcome. But in the general case, I hope we don't end up in a world where global megacorps have that much sway over governments (maybe we're in that world already...)
      - hamhock666 8y ago
        I don't think it is necessarily the sway of corporations as much as the sway of the citizens. If Apple got out of Australia it could cause a lot of media attention which could get citizens riled up, especially if they could no longer get Apple products.
        cronix 8y ago
        > If Apple got out of Australia it could cause a lot of media attention which could get citizens riled up All they'd really have to do is announce that they are considering it. Just write up an analysis and stick it on their website. The world will notice, immediately. How many hours do you think it would take before it was a major news story everywhere?
  - aaaaaaaaaab 8y ago
    >In other words, whatever country has the toughest laws will govern the planetary internet system as all others will have to follow by extension Just like how you eat 90% halal whether you’re muslim or not :) https://medium.com/incerto/the-most-intolerant-wins-the-dictatorship-of-the-small-minority-3f1f83ce4e15 https://medium.com/incerto/the-most-intolerant-wins-the-dict...
  - IdiocyInAction 8y ago
    The alternative, that may very well come to pass, is that the internet will cluster into different subnetworks for different ideologies. I could very well see that happen with the EU. The golden times for the internet are over anyway. It went from an optimistic dream of free expression of information to a platform for delivering ads.
    - hxsvui 8y ago
      The Internet was English speaking, western and had a keyboard with the Latin alphabet. These days are over, but it's injust to argue with ideology and a negative tone here. The Internet serves people all-over the world and must respect local laws, because it serves the local people. Also, free expression is stronger than ever before. You can now even claim your opinion is a fact.
  - discordance 8y ago
    Apple is required by law in Japan to make iPhones make a sound when taking a photo, and they complied. These new voyuer laws in Australia are obviously much more severe, but there is precedent for a company to customise phones by jurisdiction.
    - cronix 8y ago
      A software tweak is a lot easier to change than hardware accelerated encryption.
    - dan-robertson 8y ago
      These things are quite obviously very different and I can’t find a way to read this in good faith (except perhaps from an extreme libertarian point of view), let alone in a good light. One is a law requiring phones to try to alert people whose privacy is being invaded in some circumstances. The other is a law requiring phones to invade people’s privacy in some circumstances. I think it is quite reasonable to follow the former, just as it could be reasonable for laws to require phones to broadcast tsunami warnings or meet various antitrust requirements.
      - AnaniasAnanas 8y ago
        > One is a law requiring phones to try to alert people whose privacy is being invaded in some circumstances. A law that restricts my freedom to customize my device. Plus their privacy was being invaded from the moment that I looked at them, taking a photo would not change anything. > just as it could be reasonable for laws to require phones to broadcast tsunami warnings As long as it is configurable, sure.
        et2o 8y ago
        This is the logic of a 12 year old.
    - et2o 8y ago
      Camera shutter sounds aren’t a moral issue apple has staked a position on.
  - Jach 8y ago
    > Apple, for example, can't make an iphone for every country to comply with that countries individual laws that differ from every other country, which also change with a regular basis. Well, they can. You can do a lot when you're a trillion dollar company. It's just grossly inefficient and ugly and they'll try to avoid it if they can, sharing as much as possible when they can't, the same way everyone deals with multiple possible configurations they have to support. I too hope they put their foot down, though.
    - cronix 8y ago
      Yes I should have said impractical. I'd hate to think of what a special iPhone would cost just for the Australian market, which is relatively small, should Apple (and others) decide to not foist this on everyone else world-wide. Just come out with different hardware that's easier to hack just for Australia - only to be sold in Australia, and charge appropriately. Make them pay more to be less secure. It would be justifiable if the hardware was different for a smaller market. It's no different than if they came up with their own cellular system that was incompatible with international standards. It would cost more to build for it because it's a small market with unique requirements.
      - azinman2 8y ago
        That would be fundamentally against Apple’s values. Disclosure: I work for Apple.
        confounded 8y ago
        iMessage decryption keys on servers controlled by the Chinese government went ahead just fine. Values are useful, but not as useful as an attractive stock-price.
- onetimemanytime 8y ago
  >>I doubt that Apple will build a significant backdoor. Most likely they will figure out some symbolic way to accommodate this law, exploiting the vague wording. This is version 1.0. The law can be redrafted to remove any doubts. Once Australia gets it, so will USA and others via sharing agreements (5 eyes).
- smgoller 8y ago
  I for sure believe this is the proper course of action. I also think companies that operate websites with sensitive data should block Australians from using their services because of the large possibility of being accessed by compromised devices. And if you want to go really all the way to full paranoid mode, Australia's peering points should be blackholed/shut off due to security concerns.
- adventured 8y ago
  > It would be a huge hit but not insurmountable I suspect Apple can trivially walk away from Australia as a market if they think it's for a very good cause. It won't be a huge hit, it's a small hit (~1.7% of annual global iPhone sales). Australia is worth maybe $6-$7 billion per year in total sales to Apple. They sell about four million iPhones per year there (9.2m smartphones sold last year, Apple has 44% of the market), then throw in Macs, iPads, watches and services. It's an affluent market and it would suck to give it up, as it'd be very difficult to regain the market share afterward. I'd worry that the reality would be that easy product substitution would make the move meaningless in terms of benefiting Australians (even though it would still be an important moral stand for Apple to take). There would be short-term blowback about it and that would pass in a matter of weeks.
  - brandonjm 8y ago
    > There would be short-term blowback about it and that would pass in a matter of weeks. They could potentially stop selling software products and disable service access entirely. What if all customer photos on iCloud become inaccessible, all iTunes and App purchases become inaccessible and OS updates stop. Then Apple stores shut down, customer support or repairs become unavailable, thousands of jobs are lost. I feel like the blowback would last much longer than a few weeks. That's an extreme response, but if Apple really wanted to get the point across they can easily include it alongside any other threatening proposals.
  - tracker1 8y ago
    I would think if Apple, Google and Samsung all walked away from the Australian market together, they'd get the message.
  - incompatible 8y ago
    I doubt that a typical large company would give up even ~1.7% of its revenue just out of principle. It can also say that "obeying Australian law" is a perfectly good principle. The Australian government has also kindly offered to reimburse the financial costs of complying.
- JumpCrisscross 8y ago
  > The nuclear option is probably to just stop selling their products in Australia Or sell a clearly-branded Australia version without the Secure Enclave.
  - angry_octet 8y ago
    Phase 1 - Criminals and people of all types would use imported iPhones. - To counter this the carriers would have to use IMEI filters to only allow approved phones. - Intl visitors would have to get a local handset (probably not such a drama as their corp wouldn't allow bringing the IT gear to Australia anyway, much like going to China). - So you use a local phone for Wifi hotspot and run an imported phone using iMessage/Signal etc. - Carrier locked devices disable hotspot? Special Apple app to only allow sharing to registered devices? Extra madness. OR: - Apple has Australian hosted iMessage zone, when you roam here it tells you and your contacts that your messages might be intercepted by the Au Gov, Click Okay to Continue? - Same for FB/WhatsApp etc. - Non-compliant apps are banned from launching in Australia, baseband asks carrier for updates to this list (bloom filter) daily. - Criminals continue to operate encrypted comms from black market wifi devices, like the old contraband 'unlocked' Raspberry Pi, even though possession of one results in 5y in gaol. - Mandatory GPS location reporting from phones, for public safety. - Warrant requirement is dropped for AI access. Messages flagged by AI get auto warrants. - Spook's are unable to sort wheat from chaff, terrorist attacks continue. Phase 2 - Political activists start getting convicted for conspiracy to plan illegal gatherings, spreading Fake News, etc, based on their messages. - Social credit system to crack down on car hoons, welfare cheats and drug users, has full access to your messages and location. - Undesirable elements are send to rural areas for compulsory education and 'work for the dole'. - SoCred made public to Shame those misbehaving. - SoCred expands to include 'disrespecting religion', 'mocking the PM'. Companies lose contracts if too many of their staff have low SoCred. - Banks, insurance, schools, employers use SoCred in deciding whether to deal with you. - China and other regimes thank Australia for lighting the way. - The end of the 3rd Age of Crypto.
- taneq 8y ago
  Australian here. I hope Apple etc.do just walk away. Our government has been a continual embarrassment for a decade now and they're just getting worse. Until they start getting reality checks they'll just continue pulling stupid stunts like this.
  - SimplePeople 8y ago
    Absolutely agree. This is a dumb, untenable, largely unenforceable and pointless law. Even if Apple were to start delaying product releases in Australia by six months to do "legislative compliance reviews" or some such. With telcos on-board, this might encourage our politicians to listen to actual experts when touting this kind of legislation.
  - tanbog 8y ago
    This law was passed with support from the opposition labor party. The stupidy here crosses the isle.
    - taneq 8y ago
      Oh, totally. I meant "government" in the sense of the entire institution, not just the current party in power. The whole of Canberra needs to get its shit together.
- kodablah 8y ago
  > I doubt that Apple will build a significant backdoor Why? They clearly have cooperated with countries' requests even if it seemingly went against their principles (e.g. Chinese laws around iCloud data). And they also have a history of not even making it known they disagree, fought against it, or anything via public statement. You won't know whether they comply or not, may not know whether they are OK with it, and judging from history they probably will comply.
- wpdev_63 8y ago
  What do you think apple already does in china? This isn't really a big deal compared to that and bottom line apple is there to make money, not take on political causes.
brian-armstrong 8y ago
What's the defense to this? For starters I think you'd want to close your Australian offices and lay off any Australian-born personnel, but what else?
- adamc 8y ago
  I think the defense is to absolutely not do business in Australia, and to mark your products as not for sale there.
  - owenversteeg 8y ago
    Which, I'd like to point out, isn't a big loss: it's population 24 million, about the size of Taiwan. If you're making a physical product, shipping and taxes will make it criminally expensive to sell there, and if you're making a digital product, there's this and the considerations of slow internet and a different time zone. I think it's actually quite reasonable and doable for companies to boycott Australia over this, and I hope we see some. It'd be free press for the company and cost relatively little - I'd imagine the press would pay for any missed Australian sales. And it'd put some pressure on the Australian government for this idiocy.
    - ianhowson 8y ago
      Australians are quite accustomed to bypassing geoblocks and import restrictions, in any case. But that's not really the problem here -- it's more that Australian products and employees may be tainted by unknown government interference.
    - NoPicklez 8y ago
      As an Australian, I'd almost rather this so then it actually makes it a problem for everyone. Then the politicians might take a good hard look at what they're trying to do.
  - reaperducer 8y ago
    and to mark your products as not for sale there. Other companies have done similar things in the past, though probably not for the same reasons. I had a GRiD Compass laptop that had a big sticker on the back with a surprisingly long list of countries where it was illegal to bring the computer. The only one I remember offhand was Israel.
murph-almighty 8y ago
>Prime Minister Malcolm Turnbull of Australia said in July, “The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia.” Does math not apply in Australia? Is this where "new math" comes from?
- i_am_proteus 8y ago
  Finally, somewhere I can go without being bound by the law of gravity.
  - endymi0n 8y ago
    Better respect gravity. It‘s the law.
    - quicklime 8y ago
      We will decide whether things should fall in this country, and the direction in which they fall!
  - bori5 8y ago
    “I know this defies the law of gravity, but I never studied law!” Bugs Bunny
  - nixpulvis 8y ago
    Ha, gravity exists with or without the need for math.
- lvs 8y ago
  If John Clarke were still alive, this would make for one hell of an interview.
- yesenadam 8y ago
  'Math' is indeed not allowed in Australia. Here, outside the walls of the USA, we have 'maths' instead - although it's fairly similar.
devy 8y ago
Some of previous discussions regarding this law: https://news.ycombinator.com/item?id=17756020 https://news.ycombinator.com/item?id=17756020 https://news.ycombinator.com/item?id=17949653 https://news.ycombinator.com/item?id=17949653 https://news.ycombinator.com/item?id=18631493 https://news.ycombinator.com/item?id=18631493 https://news.ycombinator.com/item?id=18661483 https://news.ycombinator.com/item?id=18661483 https://news.ycombinator.com/item?id=18636076 https://news.ycombinator.com/item?id=18636076
r32a_ 8y ago
Australia always tries these types of laws, they tried a Great Wall of China-like firewall a few years ago it didn't go anywhere. I suspect this will be the same.
- brandonjm 8y ago
  Do you mean the "ISP-only" DNS restrictions of 2016? That was just a lame attempt to appease the film and media companies. Unfortunately for Aus Gov, DNS registries are not solely operated by Australia.
  - wfriesen 8y ago
    What's particularly strange to me is that devices such as Google WiFi come preconfigured to point at Google's DNS, so a layman in Australia will be bypassing these blocks without deliberately doing so.
    - brandonjm 8y ago
      It did have some interesting effects though. I know of several of my old school acquaintances who were very technologically challenged that managed to navigate their network settings far enough to change DNS.
- ianhowson 8y ago
  The mandatory filtering proposal was rejected before hitting parliament. AABill has already been accepted.
  - Joakal 8y ago
    Rejected? Yes, but the filtering has been active for a while now. Labor gave up but got AFP to censor for child porn etc. Liberals in power extended it to copyright infringement. It's definitely a bipartisan policy for Internet censorship in Australia. Most Australians don't care. https://en.wikipedia.org/wiki/Internet_censorship_in_Australia https://en.wikipedia.org/wiki/Internet_censorship_in_Austral...
mtgx 8y ago
> “We never thought it would pass,” said Alan Jones, chief executive of M8 Ventures, a tech investment firm in Sydney. “We all just figured that Australia’s political leaders would consider the expert advice that told them this was nuts.” This is a counter-argument to all the comments I see on HN about "waiting and see if the proposal goes anywhere". It's usually too late to stop it if you do that and allow most if not all of the negotiation between parties to take place by the time you wake up and react.
- alasdair_ 8y ago
  >“We never thought it would pass,” ... “We all just figured that Australia’s political leaders would consider the expert advice that told them this was nuts.” Also known as the "Brexit strategy"
  - bigyahu 8y ago
    (Alan Jones here) I should clarify my comments in the article. By “we” I meant our venture fund, M8 Ventures. I didn’t mean to imply no one in the local tech industry lobbied against it. A large number of industry groups, tech companies and individuals argued persuasively and at length against the many flaws in the legislation. I did not make a submission to the committee or speak in Canberra. I did, however, expect that expert advice would be listened to, understood, and acted on. And I did expect the Australian Labor Party to make good on their commitment to not allow the legislation to pass without amendment. Sadly, I was wrong. We are being governed by people driven by dogma who feel no responsibility to consider facts, science or data in their policy decisions.
- stephen_g 8y ago
  This time there actually was a big ground-swell of opposition. In the consultation period there were hundreds of submissions, all of them negative (except one from some random church in Tasmania). These were a mix of letters from technical groups, business groups, law groups, human rights groups, civil society groups, and individuals (both developers/specialists and regular concerned citizens). When the bill was being considered by the Parliamentary Joint Committee for Intelligence and Security, some of these groups were called up. I read the Hansard (transcript) of the hearing - the testimony was impeccable. Clear, concise, and absolutely demolished the bill. Unfortunately, to give you the level some of the senators were working at, a lot of the questions came back to "but don't you think we need to stop terrorists?" when going through how it's technically impossible to do what the law enforcement wants without creating systemic weaknesses/vulnerabilities, and you can't just define that away like the bill tried to... Coming up to it being passed, there was a huge amount of calls, emails and letters to the members of parliament and senators. Several mentioned the unusual volume in Parliament, and also many in the opposition mentioned multiple times how many problems there was with the bill. They illogically passed it in mid-December to "keep Australia safe over Christmas" (despite the fact that nothing in the bill could be put into effect for months and Australian law enforcement and intelligence services already have far more over-reaching powers to do all sorts of stuff that would be illegal in the US and Europe). Opposition to the bill was way better organised, and way bigger than anything previous for the tech industry. We are getting better at the politics, but given the irrational actions of the opposition in voting for it (who had the numbers in the Senate to block the bill) I can only conclude that there must have been some dirty dealing going on either between the parties, or between the intelligence services and the parliamentarians.
andrewstuart 8y ago
I want Amazon, Apple, Microsoft and Facebook to make clear statements as to whether or not their systems have been compromised by Australia's security laws. Is my phone now compromised? Is the Amazon AWS Sydney data centre now backdoored? Without clarity, it appears the big tech companies plan to comply with the legislation, which means they might be backdoored.
- nbabitskiy 8y ago
  How is it possible to be backdoored in secret? You would instantly know from a prosecution evidence in court, unless every time they make a parallel construction.
- deleted 8y ago
  [deleted]
- boyter 8y ago
  They can say 6 months after the notification in public about how many requests they have received in the last 6 months.
- jacques_chester 8y ago
  > I want Amazon, Apple, Microsoft and Facebook to make clear statements as to whether or not their systems have been compromised by Australia's security laws. The A&A bill specifically prohibits this. You can't answer yes or no to the question of whether you have been served a notice. Warrant canaries are not effective -- they're not even allowed, on my reading.
dbg31415 8y ago
* Honest Government Ad | Anti Encryption Law - YouTube || https://www.youtube.com/watch?v=eW-OMR-iWOE https://www.youtube.com/watch?v=eW-OMR-iWOE This law is a bad law.
renholder 8y ago
They haven't considered the negative repercussions, like any oppressive government asking for the same tool and using to quell any dissidence. Fuck those people, amiright!? /s
_bxg1 8y ago
"The law says the Australian authorities cannot ask a company to build universal decryption capabilities or introduce systemwide weaknesses." I've seen this proposed as an enormous loophole, since every backdoor is a "systemwide weakness", and the lawmakers just don't understand that fact.
- ThrustVectoring 8y ago
  The law also defines "systemwide weaknesses" in a way that, uhh, allows for having actual systemwide weaknesses without being able to claim that they're being made to introduce "systemwide weaknesses" under the text of the law.
- BLKNSLVR 8y ago
  I think that they think it's only a system-wide weakness if someone blabs. And no-one will blab because that's a significant amount of jail time. That's always worked... /s
- tzs 8y ago
  What counts as a systemwide weakness"? For example, if it allows the Australian government to decrypt things, but does not make it any easier for anyone else to decrypt things unless they do so by going through the Australian government (either with Australia's cooperation, or by hacking them, or by the Australian government leaking private keys), would that be a systemwide weakness?
  - phinnaeus 8y ago
    How do you make something easy for one party to decrypt but remain difficult for everyone else?
    - morganw 8y ago
      By giving that party another key. Key escrow is even harder to implement than regular security, but it is in use. FileVault on macOS and Mobile Device Management for iOS have Institutional Recovery Keys already implemented. https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf https://developer.apple.com/business/documentation/MDM-Proto...
tracker1 8y ago
How are the data pipes to EU? HTTPS + no device caching Complying would violate EU law where the data is stored or compromise the entire system and all devices.
a-dub 8y ago
could be interesting if the process involved publishing a txn to the bitcoin blockchain. that is, every unlock were made publicly and immutably visible thus putting the government in the hot seat to later justify all uses of the facility.
- baroffoos 8y ago
  That does literally nothing because the government can just say "Push an update to this device to not do that" which is what the whole law is about.
  - a-dub 8y ago
    the idea is that if there's a late auditable solution, then today's methods of doing it on the down low become distasteful. they're gonna do it regardless, but the politicians may agree to forcing them down a process that is publicly auditable in the long run... basically if late auditability makes it possible for them to do their jobs, then the basis for today's sketchy down low approach is ameliorated.
    - dane-pgp 8y ago
      Right, this is basically Binary Transparency, with the same sort of social mechanisms in place as Certificate Transparency has for dealing with misbehaving CAs. The idea of storing release hashes (or public keys) in a distributed, permissionless, append-only log actually makes a lot of sense, and there are several serious proposals for how to do this, such as EthIKS: http://www.jbonneau.com/doc/B16b-BITCOIN-ethiks.pdf http://www.jbonneau.com/doc/B16b-BITCOIN-ethiks.pdf and Contour: https://arxiv.org/pdf/1712.08427.pdf https://arxiv.org/pdf/1712.08427.pdf
shitloadofbooks 8y ago
Literally no one understands this bill. The best resource I've found so far is this: https://github.com/alfiedotwtf/AABillFAQ https://github.com/alfiedotwtf/AABillFAQ
- stephen_g 8y ago
  A big criticism of the bill by people like the Law Council (apart from it being irresponsibly rushed through with way too little oversight) was that it was intentionally vague and broad in a lot of it's definitions. So you have a lot of people saying it's incredibly bad, and a lot of others saying, "no, it's not quite that bad - only really, really bad" but nobody really knows until you get a notice. It's all up to how the law enforcement and intelligence services interpret it, and there's insufficient judicial oversight and almost no recourse if they are telling you to do something that you think goes beyond what the law allows, and you have to keep it secret, so it will be hard to tell how far they take it or if it's being abused.
- cotelletta 8y ago
  I understand the lawmakers decided the anti corruption bodies should not be granted any access to the powers it offers. Really, that says enough about how threatening they consider them to be, don't you think?
chillfox 8y ago
This sort of thing happens because the tech industry doesn't bother with lobbying or really any political fighting other than the occasional angry letter. Meanwhile, the mining industry successfully countered a law they didn't like a few years ago by spending a few million on tv advertising demonising the government. The gambling industry got rid of a law by suing the government. The banking industry managed to convince the regulator to not use their powers through a combination of making it extremely costly and basically infiltrating them. Only the tech industry is like children when it comes to lobbying and politics. Ideally, every industry would be like the tech industry and not manipulate the government. But if they want to get rid of this particular law then there is plenty of examples to learn from.
- dwd 8y ago
  You mean by offering some future payback whether a cushy overpaid consulting or lobbying job or an industry recognition award like Barnaby Joyce got from Gina? I think witholding future products or services and running ad campaigns to say they wont be offering them in Australia due to the law would be the way to do it. If we could collectively get our act together, boycotting Federal Government for IT services would get the message across - chance of that happening is probably <1%.
  - chillfox 8y ago
    All of it. Basically what I am saying is that if the tech industry doesn't want the risk of future laws ruining their fun then they will have to engage in lobbying just like everyone else. Sitting back and relying on the politicians to not do anything stupid is, well stupid... Stupid is the default. In this particular case an advertising campaign is probably the only thing that is going to work, but with an election in the not too distant future, it should be pretty efficient in scaring the politicians into getting rid of the law.
    - dwd 8y ago
      I'm coming around to the opinion that anything the Government does (particularly if they think it's a clever policy) triggers the Law of Unintended Consequences. Except for some situations where they correct or curtail market excesses, most programs seem to end up causing more damage than they try to solve and worse outcomes long term. One of the few exceptions was Rudd simply handing out cash to the general population in the middle of the GFC to keep the economy turning over. Generally most incentives don't have the desired effect.
voycey 8y ago
"Australia does not have a strong tech industry..." I'm sorry - what? Having moved to Australia from the UK I am continually amazed at the tech industry here, sure in comparison to the US ours is small but that is because there is a vast difference between our populations. America only sees size as a measure of strength

212 points by boyter 8y ago

et2o 8y ago

I doubt that Apple will build a significant backdoor. Most likely they will figure out some symbolic way to accommodate this law, exploiting the vague wording. The nuclear option is probably to just stop selling their products in Australia. The population of Australia is only 25 million people. It would be a huge hit but not insurmountable, and then the Australian politicians would face significant backlash and probably walk back the law.

cronix 8y ago
> The nuclear option is probably to just stop selling their products in Australia. Someone needs to. With EU laws, Australian laws, US laws, and more and more every day, the internet is rapidly becoming a tool of the least common denominator. In other words, whatever country has the toughest laws will govern the planetary internet system as all others will have to follow by extension. Apple, for example, can't make an iphone for every country to comply with that countries individual laws that differ from every other country, which also change with a regular basis. Of course though, there will always be hackers skating on top relatively free. We're becoming a two-tiered internet. The relatively few who know how to get around the restrictions, and everybody else. All Apple has to do is float the possibility they may not sell their products in Australia anymore, and point out why. The rest would take care of itself.
- hazz99 8y ago
  As an Australian with Apple products, I really hope Apple pulls out of the market. Some large entity definitely needs to take a stand.
  - quicklime 8y ago
    In this specific case, I hope that's the outcome. But in the general case, I hope we don't end up in a world where global megacorps have that much sway over governments (maybe we're in that world already...)
    - hamhock666 8y ago
      I don't think it is necessarily the sway of corporations as much as the sway of the citizens. If Apple got out of Australia it could cause a lot of media attention which could get citizens riled up, especially if they could no longer get Apple products.
      - cronix 8y ago
        > If Apple got out of Australia it could cause a lot of media attention which could get citizens riled up All they'd really have to do is announce that they are considering it. Just write up an analysis and stick it on their website. The world will notice, immediately. How many hours do you think it would take before it was a major news story everywhere?
- aaaaaaaaaab 8y ago
  >In other words, whatever country has the toughest laws will govern the planetary internet system as all others will have to follow by extension Just like how you eat 90% halal whether you’re muslim or not :) https://medium.com/incerto/the-most-intolerant-wins-the-dictatorship-of-the-small-minority-3f1f83ce4e15 https://medium.com/incerto/the-most-intolerant-wins-the-dict...
- IdiocyInAction 8y ago
  The alternative, that may very well come to pass, is that the internet will cluster into different subnetworks for different ideologies. I could very well see that happen with the EU. The golden times for the internet are over anyway. It went from an optimistic dream of free expression of information to a platform for delivering ads.
  - hxsvui 8y ago
    The Internet was English speaking, western and had a keyboard with the Latin alphabet. These days are over, but it's injust to argue with ideology and a negative tone here. The Internet serves people all-over the world and must respect local laws, because it serves the local people. Also, free expression is stronger than ever before. You can now even claim your opinion is a fact.
- discordance 8y ago
  Apple is required by law in Japan to make iPhones make a sound when taking a photo, and they complied. These new voyuer laws in Australia are obviously much more severe, but there is precedent for a company to customise phones by jurisdiction.
  - cronix 8y ago
    A software tweak is a lot easier to change than hardware accelerated encryption.
  - dan-robertson 8y ago
    These things are quite obviously very different and I can’t find a way to read this in good faith (except perhaps from an extreme libertarian point of view), let alone in a good light. One is a law requiring phones to try to alert people whose privacy is being invaded in some circumstances. The other is a law requiring phones to invade people’s privacy in some circumstances. I think it is quite reasonable to follow the former, just as it could be reasonable for laws to require phones to broadcast tsunami warnings or meet various antitrust requirements.
    - AnaniasAnanas 8y ago
      > One is a law requiring phones to try to alert people whose privacy is being invaded in some circumstances. A law that restricts my freedom to customize my device. Plus their privacy was being invaded from the moment that I looked at them, taking a photo would not change anything. > just as it could be reasonable for laws to require phones to broadcast tsunami warnings As long as it is configurable, sure.
      - et2o 8y ago
        This is the logic of a 12 year old.
  - et2o 8y ago
    Camera shutter sounds aren’t a moral issue apple has staked a position on.
- Jach 8y ago
  > Apple, for example, can't make an iphone for every country to comply with that countries individual laws that differ from every other country, which also change with a regular basis. Well, they can. You can do a lot when you're a trillion dollar company. It's just grossly inefficient and ugly and they'll try to avoid it if they can, sharing as much as possible when they can't, the same way everyone deals with multiple possible configurations they have to support. I too hope they put their foot down, though.
  - cronix 8y ago
    Yes I should have said impractical. I'd hate to think of what a special iPhone would cost just for the Australian market, which is relatively small, should Apple (and others) decide to not foist this on everyone else world-wide. Just come out with different hardware that's easier to hack just for Australia - only to be sold in Australia, and charge appropriately. Make them pay more to be less secure. It would be justifiable if the hardware was different for a smaller market. It's no different than if they came up with their own cellular system that was incompatible with international standards. It would cost more to build for it because it's a small market with unique requirements.
    - azinman2 8y ago
      That would be fundamentally against Apple’s values. Disclosure: I work for Apple.
      - confounded 8y ago
        iMessage decryption keys on servers controlled by the Chinese government went ahead just fine. Values are useful, but not as useful as an attractive stock-price.
onetimemanytime 8y ago
>>I doubt that Apple will build a significant backdoor. Most likely they will figure out some symbolic way to accommodate this law, exploiting the vague wording. This is version 1.0. The law can be redrafted to remove any doubts. Once Australia gets it, so will USA and others via sharing agreements (5 eyes).
smgoller 8y ago
I for sure believe this is the proper course of action. I also think companies that operate websites with sensitive data should block Australians from using their services because of the large possibility of being accessed by compromised devices. And if you want to go really all the way to full paranoid mode, Australia's peering points should be blackholed/shut off due to security concerns.
adventured 8y ago
> It would be a huge hit but not insurmountable I suspect Apple can trivially walk away from Australia as a market if they think it's for a very good cause. It won't be a huge hit, it's a small hit (~1.7% of annual global iPhone sales). Australia is worth maybe $6-$7 billion per year in total sales to Apple. They sell about four million iPhones per year there (9.2m smartphones sold last year, Apple has 44% of the market), then throw in Macs, iPads, watches and services. It's an affluent market and it would suck to give it up, as it'd be very difficult to regain the market share afterward. I'd worry that the reality would be that easy product substitution would make the move meaningless in terms of benefiting Australians (even though it would still be an important moral stand for Apple to take). There would be short-term blowback about it and that would pass in a matter of weeks.
- brandonjm 8y ago
  > There would be short-term blowback about it and that would pass in a matter of weeks. They could potentially stop selling software products and disable service access entirely. What if all customer photos on iCloud become inaccessible, all iTunes and App purchases become inaccessible and OS updates stop. Then Apple stores shut down, customer support or repairs become unavailable, thousands of jobs are lost. I feel like the blowback would last much longer than a few weeks. That's an extreme response, but if Apple really wanted to get the point across they can easily include it alongside any other threatening proposals.
- tracker1 8y ago
  I would think if Apple, Google and Samsung all walked away from the Australian market together, they'd get the message.
- incompatible 8y ago
  I doubt that a typical large company would give up even ~1.7% of its revenue just out of principle. It can also say that "obeying Australian law" is a perfectly good principle. The Australian government has also kindly offered to reimburse the financial costs of complying.
JumpCrisscross 8y ago
> The nuclear option is probably to just stop selling their products in Australia Or sell a clearly-branded Australia version without the Secure Enclave.
- angry_octet 8y ago
  Phase 1 - Criminals and people of all types would use imported iPhones. - To counter this the carriers would have to use IMEI filters to only allow approved phones. - Intl visitors would have to get a local handset (probably not such a drama as their corp wouldn't allow bringing the IT gear to Australia anyway, much like going to China). - So you use a local phone for Wifi hotspot and run an imported phone using iMessage/Signal etc. - Carrier locked devices disable hotspot? Special Apple app to only allow sharing to registered devices? Extra madness. OR: - Apple has Australian hosted iMessage zone, when you roam here it tells you and your contacts that your messages might be intercepted by the Au Gov, Click Okay to Continue? - Same for FB/WhatsApp etc. - Non-compliant apps are banned from launching in Australia, baseband asks carrier for updates to this list (bloom filter) daily. - Criminals continue to operate encrypted comms from black market wifi devices, like the old contraband 'unlocked' Raspberry Pi, even though possession of one results in 5y in gaol. - Mandatory GPS location reporting from phones, for public safety. - Warrant requirement is dropped for AI access. Messages flagged by AI get auto warrants. - Spook's are unable to sort wheat from chaff, terrorist attacks continue. Phase 2 - Political activists start getting convicted for conspiracy to plan illegal gatherings, spreading Fake News, etc, based on their messages. - Social credit system to crack down on car hoons, welfare cheats and drug users, has full access to your messages and location. - Undesirable elements are send to rural areas for compulsory education and 'work for the dole'. - SoCred made public to Shame those misbehaving. - SoCred expands to include 'disrespecting religion', 'mocking the PM'. Companies lose contracts if too many of their staff have low SoCred. - Banks, insurance, schools, employers use SoCred in deciding whether to deal with you. - China and other regimes thank Australia for lighting the way. - The end of the 3rd Age of Crypto.
taneq 8y ago
Australian here. I hope Apple etc.do just walk away. Our government has been a continual embarrassment for a decade now and they're just getting worse. Until they start getting reality checks they'll just continue pulling stupid stunts like this.
- SimplePeople 8y ago
  Absolutely agree. This is a dumb, untenable, largely unenforceable and pointless law. Even if Apple were to start delaying product releases in Australia by six months to do "legislative compliance reviews" or some such. With telcos on-board, this might encourage our politicians to listen to actual experts when touting this kind of legislation.
- tanbog 8y ago
  This law was passed with support from the opposition labor party. The stupidy here crosses the isle.
  - taneq 8y ago
    Oh, totally. I meant "government" in the sense of the entire institution, not just the current party in power. The whole of Canberra needs to get its shit together.
kodablah 8y ago
> I doubt that Apple will build a significant backdoor Why? They clearly have cooperated with countries' requests even if it seemingly went against their principles (e.g. Chinese laws around iCloud data). And they also have a history of not even making it known they disagree, fought against it, or anything via public statement. You won't know whether they comply or not, may not know whether they are OK with it, and judging from history they probably will comply.
wpdev_63 8y ago
What do you think apple already does in china? This isn't really a big deal compared to that and bottom line apple is there to make money, not take on political causes.

brian-armstrong 8y ago

What's the defense to this? For starters I think you'd want to close your Australian offices and lay off any Australian-born personnel, but what else?

adamc 8y ago
I think the defense is to absolutely not do business in Australia, and to mark your products as not for sale there.
- owenversteeg 8y ago
  Which, I'd like to point out, isn't a big loss: it's population 24 million, about the size of Taiwan. If you're making a physical product, shipping and taxes will make it criminally expensive to sell there, and if you're making a digital product, there's this and the considerations of slow internet and a different time zone. I think it's actually quite reasonable and doable for companies to boycott Australia over this, and I hope we see some. It'd be free press for the company and cost relatively little - I'd imagine the press would pay for any missed Australian sales. And it'd put some pressure on the Australian government for this idiocy.
  - ianhowson 8y ago
    Australians are quite accustomed to bypassing geoblocks and import restrictions, in any case. But that's not really the problem here -- it's more that Australian products and employees may be tainted by unknown government interference.
  - NoPicklez 8y ago
    As an Australian, I'd almost rather this so then it actually makes it a problem for everyone. Then the politicians might take a good hard look at what they're trying to do.
- reaperducer 8y ago
  and to mark your products as not for sale there. Other companies have done similar things in the past, though probably not for the same reasons. I had a GRiD Compass laptop that had a big sticker on the back with a surprisingly long list of countries where it was illegal to bring the computer. The only one I remember offhand was Israel.

murph-almighty 8y ago

>Prime Minister Malcolm Turnbull of Australia said in July, “The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia.” Does math not apply in Australia? Is this where "new math" comes from?

i_am_proteus 8y ago
Finally, somewhere I can go without being bound by the law of gravity.
- endymi0n 8y ago
  Better respect gravity. It‘s the law.
  - quicklime 8y ago
    We will decide whether things should fall in this country, and the direction in which they fall!
- bori5 8y ago
  “I know this defies the law of gravity, but I never studied law!” Bugs Bunny
- nixpulvis 8y ago
  Ha, gravity exists with or without the need for math.
lvs 8y ago
If John Clarke were still alive, this would make for one hell of an interview.
yesenadam 8y ago
'Math' is indeed not allowed in Australia. Here, outside the walls of the USA, we have 'maths' instead - although it's fairly similar.

devy 8y ago

Some of previous discussions regarding this law: https://news.ycombinator.com/item?id=17756020 https://news.ycombinator.com/item?id=17756020 https://news.ycombinator.com/item?id=17949653 https://news.ycombinator.com/item?id=17949653 https://news.ycombinator.com/item?id=18631493 https://news.ycombinator.com/item?id=18631493 https://news.ycombinator.com/item?id=18661483 https://news.ycombinator.com/item?id=18661483 https://news.ycombinator.com/item?id=18636076 https://news.ycombinator.com/item?id=18636076

r32a_ 8y ago

Australia always tries these types of laws, they tried a Great Wall of China-like firewall a few years ago it didn't go anywhere. I suspect this will be the same.

brandonjm 8y ago
Do you mean the "ISP-only" DNS restrictions of 2016? That was just a lame attempt to appease the film and media companies. Unfortunately for Aus Gov, DNS registries are not solely operated by Australia.
- wfriesen 8y ago
  What's particularly strange to me is that devices such as Google WiFi come preconfigured to point at Google's DNS, so a layman in Australia will be bypassing these blocks without deliberately doing so.
  - brandonjm 8y ago
    It did have some interesting effects though. I know of several of my old school acquaintances who were very technologically challenged that managed to navigate their network settings far enough to change DNS.
ianhowson 8y ago
The mandatory filtering proposal was rejected before hitting parliament. AABill has already been accepted.
- Joakal 8y ago
  Rejected? Yes, but the filtering has been active for a while now. Labor gave up but got AFP to censor for child porn etc. Liberals in power extended it to copyright infringement. It's definitely a bipartisan policy for Internet censorship in Australia. Most Australians don't care. https://en.wikipedia.org/wiki/Internet_censorship_in_Australia https://en.wikipedia.org/wiki/Internet_censorship_in_Austral...

mtgx 8y ago

> “We never thought it would pass,” said Alan Jones, chief executive of M8 Ventures, a tech investment firm in Sydney. “We all just figured that Australia’s political leaders would consider the expert advice that told them this was nuts.” This is a counter-argument to all the comments I see on HN about "waiting and see if the proposal goes anywhere". It's usually too late to stop it if you do that and allow most if not all of the negotiation between parties to take place by the time you wake up and react.

alasdair_ 8y ago
>“We never thought it would pass,” ... “We all just figured that Australia’s political leaders would consider the expert advice that told them this was nuts.” Also known as the "Brexit strategy"
- bigyahu 8y ago
  (Alan Jones here) I should clarify my comments in the article. By “we” I meant our venture fund, M8 Ventures. I didn’t mean to imply no one in the local tech industry lobbied against it. A large number of industry groups, tech companies and individuals argued persuasively and at length against the many flaws in the legislation. I did not make a submission to the committee or speak in Canberra. I did, however, expect that expert advice would be listened to, understood, and acted on. And I did expect the Australian Labor Party to make good on their commitment to not allow the legislation to pass without amendment. Sadly, I was wrong. We are being governed by people driven by dogma who feel no responsibility to consider facts, science or data in their policy decisions.
stephen_g 8y ago
This time there actually was a big ground-swell of opposition. In the consultation period there were hundreds of submissions, all of them negative (except one from some random church in Tasmania). These were a mix of letters from technical groups, business groups, law groups, human rights groups, civil society groups, and individuals (both developers/specialists and regular concerned citizens). When the bill was being considered by the Parliamentary Joint Committee for Intelligence and Security, some of these groups were called up. I read the Hansard (transcript) of the hearing - the testimony was impeccable. Clear, concise, and absolutely demolished the bill. Unfortunately, to give you the level some of the senators were working at, a lot of the questions came back to "but don't you think we need to stop terrorists?" when going through how it's technically impossible to do what the law enforcement wants without creating systemic weaknesses/vulnerabilities, and you can't just define that away like the bill tried to... Coming up to it being passed, there was a huge amount of calls, emails and letters to the members of parliament and senators. Several mentioned the unusual volume in Parliament, and also many in the opposition mentioned multiple times how many problems there was with the bill. They illogically passed it in mid-December to "keep Australia safe over Christmas" (despite the fact that nothing in the bill could be put into effect for months and Australian law enforcement and intelligence services already have far more over-reaching powers to do all sorts of stuff that would be illegal in the US and Europe). Opposition to the bill was way better organised, and way bigger than anything previous for the tech industry. We are getting better at the politics, but given the irrational actions of the opposition in voting for it (who had the numbers in the Senate to block the bill) I can only conclude that there must have been some dirty dealing going on either between the parties, or between the intelligence services and the parliamentarians.

andrewstuart 8y ago

I want Amazon, Apple, Microsoft and Facebook to make clear statements as to whether or not their systems have been compromised by Australia's security laws. Is my phone now compromised? Is the Amazon AWS Sydney data centre now backdoored? Without clarity, it appears the big tech companies plan to comply with the legislation, which means they might be backdoored.

nbabitskiy 8y ago
How is it possible to be backdoored in secret? You would instantly know from a prosecution evidence in court, unless every time they make a parallel construction.
deleted 8y ago
[deleted]
boyter 8y ago
They can say 6 months after the notification in public about how many requests they have received in the last 6 months.
jacques_chester 8y ago
> I want Amazon, Apple, Microsoft and Facebook to make clear statements as to whether or not their systems have been compromised by Australia's security laws. The A&A bill specifically prohibits this. You can't answer yes or no to the question of whether you have been served a notice. Warrant canaries are not effective -- they're not even allowed, on my reading.

dbg31415 8y ago

* Honest Government Ad | Anti Encryption Law - YouTube || https://www.youtube.com/watch?v=eW-OMR-iWOE https://www.youtube.com/watch?v=eW-OMR-iWOE This law is a bad law.

renholder 8y ago

They haven't considered the negative repercussions, like any oppressive government asking for the same tool and using to quell any dissidence. Fuck those people, amiright!? /s

_bxg1 8y ago

"The law says the Australian authorities cannot ask a company to build universal decryption capabilities or introduce systemwide weaknesses." I've seen this proposed as an enormous loophole, since every backdoor is a "systemwide weakness", and the lawmakers just don't understand that fact.

ThrustVectoring 8y ago
The law also defines "systemwide weaknesses" in a way that, uhh, allows for having actual systemwide weaknesses without being able to claim that they're being made to introduce "systemwide weaknesses" under the text of the law.
BLKNSLVR 8y ago
I think that they think it's only a system-wide weakness if someone blabs. And no-one will blab because that's a significant amount of jail time. That's always worked... /s
tzs 8y ago
What counts as a systemwide weakness"? For example, if it allows the Australian government to decrypt things, but does not make it any easier for anyone else to decrypt things unless they do so by going through the Australian government (either with Australia's cooperation, or by hacking them, or by the Australian government leaking private keys), would that be a systemwide weakness?
- phinnaeus 8y ago
  How do you make something easy for one party to decrypt but remain difficult for everyone else?
  - morganw 8y ago
    By giving that party another key. Key escrow is even harder to implement than regular security, but it is in use. FileVault on macOS and Mobile Device Management for iOS have Institutional Recovery Keys already implemented. https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf https://developer.apple.com/business/documentation/MDM-Proto...

tracker1 8y ago

How are the data pipes to EU? HTTPS + no device caching Complying would violate EU law where the data is stored or compromise the entire system and all devices.

a-dub 8y ago

could be interesting if the process involved publishing a txn to the bitcoin blockchain. that is, every unlock were made publicly and immutably visible thus putting the government in the hot seat to later justify all uses of the facility.

baroffoos 8y ago
That does literally nothing because the government can just say "Push an update to this device to not do that" which is what the whole law is about.
- a-dub 8y ago
  the idea is that if there's a late auditable solution, then today's methods of doing it on the down low become distasteful. they're gonna do it regardless, but the politicians may agree to forcing them down a process that is publicly auditable in the long run... basically if late auditability makes it possible for them to do their jobs, then the basis for today's sketchy down low approach is ameliorated.
  - dane-pgp 8y ago
    Right, this is basically Binary Transparency, with the same sort of social mechanisms in place as Certificate Transparency has for dealing with misbehaving CAs. The idea of storing release hashes (or public keys) in a distributed, permissionless, append-only log actually makes a lot of sense, and there are several serious proposals for how to do this, such as EthIKS: http://www.jbonneau.com/doc/B16b-BITCOIN-ethiks.pdf http://www.jbonneau.com/doc/B16b-BITCOIN-ethiks.pdf and Contour: https://arxiv.org/pdf/1712.08427.pdf https://arxiv.org/pdf/1712.08427.pdf

shitloadofbooks 8y ago

Literally no one understands this bill. The best resource I've found so far is this: https://github.com/alfiedotwtf/AABillFAQ https://github.com/alfiedotwtf/AABillFAQ

stephen_g 8y ago
A big criticism of the bill by people like the Law Council (apart from it being irresponsibly rushed through with way too little oversight) was that it was intentionally vague and broad in a lot of it's definitions. So you have a lot of people saying it's incredibly bad, and a lot of others saying, "no, it's not quite that bad - only really, really bad" but nobody really knows until you get a notice. It's all up to how the law enforcement and intelligence services interpret it, and there's insufficient judicial oversight and almost no recourse if they are telling you to do something that you think goes beyond what the law allows, and you have to keep it secret, so it will be hard to tell how far they take it or if it's being abused.
cotelletta 8y ago
I understand the lawmakers decided the anti corruption bodies should not be granted any access to the powers it offers. Really, that says enough about how threatening they consider them to be, don't you think?

chillfox 8y ago

This sort of thing happens because the tech industry doesn't bother with lobbying or really any political fighting other than the occasional angry letter. Meanwhile, the mining industry successfully countered a law they didn't like a few years ago by spending a few million on tv advertising demonising the government. The gambling industry got rid of a law by suing the government. The banking industry managed to convince the regulator to not use their powers through a combination of making it extremely costly and basically infiltrating them. Only the tech industry is like children when it comes to lobbying and politics. Ideally, every industry would be like the tech industry and not manipulate the government. But if they want to get rid of this particular law then there is plenty of examples to learn from.

dwd 8y ago
You mean by offering some future payback whether a cushy overpaid consulting or lobbying job or an industry recognition award like Barnaby Joyce got from Gina? I think witholding future products or services and running ad campaigns to say they wont be offering them in Australia due to the law would be the way to do it. If we could collectively get our act together, boycotting Federal Government for IT services would get the message across - chance of that happening is probably <1%.
- chillfox 8y ago
  All of it. Basically what I am saying is that if the tech industry doesn't want the risk of future laws ruining their fun then they will have to engage in lobbying just like everyone else. Sitting back and relying on the politicians to not do anything stupid is, well stupid... Stupid is the default. In this particular case an advertising campaign is probably the only thing that is going to work, but with an election in the not too distant future, it should be pretty efficient in scaring the politicians into getting rid of the law.
  - dwd 8y ago
    I'm coming around to the opinion that anything the Government does (particularly if they think it's a clever policy) triggers the Law of Unintended Consequences. Except for some situations where they correct or curtail market excesses, most programs seem to end up causing more damage than they try to solve and worse outcomes long term. One of the few exceptions was Rudd simply handing out cash to the general population in the middle of the GFC to keep the economy turning over. Generally most incentives don't have the desired effect.

voycey 8y ago

"Australia does not have a strong tech industry..." I'm sorry - what? Having moved to Australia from the UK I am continually amazed at the tech industry here, sure in comparison to the US ours is small but that is because there is a vast difference between our populations. America only sees size as a measure of strength