9 ms·

It's amazing to me that the people who write these laws are the least capable of understanding their impact. If I am reading FastMails statement right, they ha

It's amazing to me that the people who write these laws are the least capable of understanding their impact. If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it. Only a lawmaker who has the technical acumen of say, my grandmother, would decree something like that and think it was a good idea. Australia deserves better than these clowns. Then again, I live in the US so...

CamperBob2 8y ago
In any protracted discussion of US politics, it's pretty common for someone to raise the point that other countries have better voting systems than the one we use, where a winner-take-all paradigm inevitably devolves to a contest between only two dominant parties, and where there is little incentive for the victorious party to form a working coalition with the other. Australia's use of ranked-choice voting is frequently cited as one area where our first-past-the-post system is behind the curve, and in fact we're starting to consider adopting ranked choice voting in some limited areas [1]. We also hear frequent arguments in favor of Australia's compulsory voting law as a way to combat the sort of voter apathy that led to the... unexpected outcome in our last Presidential contest. Stories like this serve as good counterpoints for Americans to raise in those debates, I think. Yes, Australia has implemented a number of progressive electoral reforms... but those progressive electoral policies are obviously not getting them better leadership or better laws. So why should we, in the US, follow their example? [1]: https://bangordailynews.com/2018/08/28/opinion/contributors/a-century-of-ranked-choice-voting-in-australia-offers-lessons-for-maine/ https://bangordailynews.com/2018/08/28/opinion/contributors/...
- rickycook 8y ago
  well, australian voting systems aren’t exactly progressive (it’s just a few steps above the worst case), and neither is the voting populace id say our government matches closer to our electorate than what the US government does, but we still have only 2 major parties which severely limits choice. there are ways to combat this (NZ, Germany for example) this example is also a fairly poor one, because it’s possible this law came as a “test the waters” as part of 5 eyes, so it could be followed in other counties. where spying and secrets are concerned, we shouldn’t draw too many conclusions because we don’t know all the facts
  - A2017U1 8y ago
    It doesn't necessarily have to be enacted in other 5 eyes countries. The specific wording of the law said they can enlist citizens to put in backdoors at the request of other Governments. Even more absurd is that it also mentions this regarding economic espionage purposes. They legally could ask a developer to commit large scale theft of industrial secrets from say Germany for the benefit of Canadian enterprises. Anyone refusing faces penalties in secret court rooms. The open ended nature of the wording is staggering.
- Jaepa 8y ago
  That's an interesting notion. Not to follow this tangent to far, but I think that most likely it is a more representative democracy. If you were to ask the people in the US if they want a bill that would allow law enforcement to "read the private messages of terrorist", I'd guess that most people would say yes, not knowing or understanding the ramifications of what the law would mean, or what a clear definition of what terrorist are. But to the point, I do agree that mandatory voting may be actively harmful as it values all degree of civic engagement the same. That being said here in the states we have actively installed barriers to make voting more difficult. We aren't really getting better leadership or better laws from it.
- getmoheb 8y ago
  Actually the political logic on national security legislation here is a little more complicated and not really related to the electoral system or compulsory voting. National security policy has been used as a wedge issue here in the last 20 years, like in lots of other places. So the raft of security legislation that's been passed since the conservatives took office in 2013 has actually been as a result of both major parties voting together. If the Labor Party (centre-left) opposes security legislation, they're painted as soft on terror, weak on border security, etc. Security agencies have given a shopping list to the Liberal (i.e. conservative) government - data retention, citizenship, and encryption amongst others. The Libs have put bill after bill forward in an attempt to generate opposition from Labor and thereby get an effective national-security wedge. Some of them have been 'genuine' reforms but some have been less so. Labor knows this of course. But it's ahead in the polls and wants to be a small target come the election, so it has refused to bite. The result has been a bunch of shitty new security laws. It can be wonderfully disheartening to watch, especially given that lots of people on both sides of politics know perfectly well that they're bad laws but can't say it out loud due to the the politics of it. They're not all idiots who don't understand tech. So while the electoral system here has delivered slim majorities for successive governments (or indeed minorities at times), it's not really relevant here. When the major parties vote together the laws are going to pass. Sorry if that's off topic but I find it very interesting, albeit depressing sometimes.
CharlieSpeaks 8y ago
> Australia deserves better than these clowns. Australia's abysmal record on climate change affords it no sympathy. Australia, do your part. (Australia resident and happy Fastmail customer.)
- mking1024 8y ago
  I'm not sure what you are trying to say here. The party that pushed for these news laws is the same party that has been opposing real action on climate change for years. So yes, we do deserve better than these clowns.
  - CharlieSpeaks 8y ago
    Over the past 20 years, most developed nations have been working to reduce GHG emissions, through multiple governments and across multiple industries. Australia shirked responsibility during the Kyoto protocol, letting the rest of the world tackle this problem. Australia's current government cannot be solely blamed for this.
    - mking1024 8y ago
      Of those 20 years you mentioned, the party we're discussing has been in power for around 14 of them - and the 6 years preceding that. I'd say the party that has been in power for over 75% of the last 25 years - and has actively campaigned against acting to reduce emissions - is somewhat responsible. But what I don't understand is the relevance of climate change to the topic at hand: the assistance and access legislation harming Australian tech companies. And I'm still not sure what your original point was ("Australia's abysmal record on climate change affords it no sympathy"). Were you saying saying that Australia's tech industry deserves to be destroyed because a slim majority of the country keeps voting for a party that is, among other things, hesitant to act to reduce emissions?
cbsks 8y ago
> If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it I interpreted it as they could be forced to secretly add a backdoor, but I guess if they are sworn to secrecy on it, who knows. Maybe it’s time for me to switch from FastMail...
- deleted 8y ago
  [deleted]
Jedi72 8y ago
If I remember correctly from their statement on this issue before they were baaically unaffected by the new laws as they do not off end-to-end encryption, so they were already open to lawful intercept requests.
- bad_user 8y ago
  Email services claiming e2e encryption are snake oil. It’s interesting to me how a demographics like that of HN can fall for it.
  - isostatic 8y ago
    So when I send my gpg mail, it’s not encrypted?
    - ownagefool 8y ago
      Yes, it is. But if this is a feature of a mail service rather than a mail client, then the service has the keys and, given GPG has no perfect forward secrecy, they have the ability to decrypt all emails you send and recieve. If you go down the road of the mail service owning a mail client that promises e2e, then the issue moves to worrying about the code that runs on your device. If it's webmail, the JavaScript can easily be changed, so you really want a thick client. Then you need to worry about the thick client sending data that it's really not supposed to i.e. can it read your key and send it to $vendor? Even then, GPG without Perfect Forward Secrecy means that when your key is brute forced or side channel attacked, which we assume will happen, you lose all your secrecy, so you need to think about this as a temporary state.
      - bad_user 8y ago
        Note that the key could be client side and the email service could encrypt the email in a way as to not find out your private key. However, and this is key, a majority of email is sent and received unencrypted via their servers, because that's just how email works. In other words, email at rest might be encrypted, but most of the email in transit is not. This means that a man in the middle (e.g. the NSA) can still intercept all your communications. And even with PGP encryption, which is e2e, the meta data is still unencrypted because that's what the email protocol demands. Having the ability to see whom you're communicating with, that's enough in many cases. Email is simply not a good solution for e2e encryption. If you have secrets to protect, there are now other solutions available, like Signal and even Signal has some issues (like its reliance on phone numbers for identification).
Gaelan 8y ago
"Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." I'm reading that as "we don't encrypt customer emails, so we already had to share them." That's consistent with what they've said in the past.
- brongondwana 8y ago
  Exactly correct. We already share customer emails under limited circumstances and for explicitly requested accounts only (we've never participated in dragnets and we don't believe this legislation will require us to either). We have a standard process for verifying each request with the AFP and ensuring that they have followed due process to get a warrant for the data. We strongly support (also spelled out in that submission) keeping judicial oversight of requests - which this legislation does still require for the access requests themselves - hence saying that nothing has changed for us, since we have existing capabilities and we already respond to legal requests.
  - fauigerzigerk 8y ago
    Due process is not the only question though. FastMail users will also be wondering whether the content of their email has to comply with other laws made by the very same lawmakers that have just shown their complete disregard for privacy and a shocking level of technical incompetence.
- dbrgn 8y ago
  To be fair, they also explicitly point out in their docs that encryption on their end is pointless (since they have the keys) and that you should encrypt your e-mails on the client side with something like PGP (where you control the keys). E-Mail sucks, that's all. Fastmail is transparent about it and does a good job. (PS: I still think that they encrypt their storage servers, but again, this will only protect against someone physically taking away their servers, not against a warrant or an intruder.)
dbg31415 8y ago
Australia is significantly behind the US in terms of tech, and Australian lawmakers are also significantly behind. Ignorant, and draconian. Not a good mix. With no Bill of Rights to protect people. It's borderline funny how inept the Australian government is with tech. NBN cost a fortune, and still sucks. My Health Record debacle. New anti-encryption laws, and leaders who think they can change the laws of math. ScoMo forgetting to set his domain on auto-renew... It's been a mess. * Victorian couple quoted up to $1.2m to connect to NBN Co's fibre service - ABC News (Australian Broadcasting Corporation) || https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-up-to-1.2million-for-fibre-connection/9842444 https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-... * My Health Record: privacy, cybersecurity and the hacking risk | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/jul/16/my-health-record-privacy-cybersecurity-and-the-hacking-risk https://www.theguardian.com/australia-news/2018/jul/16/my-he... * Scotty Doesn't Know: prankster takes over Scott Morrison's website | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/oct/19/scotty-doesnt-know-prankster-takes-over-scott-morrisons-website https://www.theguardian.com/australia-news/2018/oct/19/scott... * Prime Minister Says The Laws Of Mathematics Are Trumped By Australian Law || https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths Add to this how messed up the visa situation is in Australia, and the crazy high taxes they put on immigrants, and they wonder why their economy can't keep up and homes have dropped 20% in the last 2 years... They coasted on energy / natural resources for so long, but didn't invest any of the money correctly into tech training / startup scenes. Now that China took their foot off the gas, Australia will be in for a world of hurt.
- anotherevan 8y ago
  You forgot the last national census, where they decided our privacy was not that important[1], and they were liberally threatening everyone with severe fines if they didn't fill it out anyway. So when the most predicable result on the planet happened and twenty million people all tried to fill out the online form on the "census" evening they claimed it was a denial of service attack. The shame of it was, the ABS had a pretty good reputation up until that point (I believe). Now they're just another joke and have no good will left. [1] And which today we discover they've cocked it up even more so. https://www.itnews.com.au/news/algorithm-flaw-meant-census-responses-could-be-identified-519775 https://www.itnews.com.au/news/algorithm-flaw-meant-census-r...
stone-monkey 8y ago
To be fair, this is basically the software developer's dilemma in reverse. You're building out systems for areas of business with no domain expertise. End users constantly wonder why the developers built the software in such profoundly stupid ways. Lawmakers face the same problem in that they're barraged with constant problems from completely different fields that they're unlikely to be subject matter experts in. How do they learn about it? By consulting subject matter experts. Who are these subject matter experts? Well established businesses in their field. This can lead to laws that are incentivized towards large businesses. That's just considering a situation where everyone is working in good faith. Now consider lawmakers having to cater towards what is currently trending with the populace, kickbacks from companies, pull from different governments/organizations/political parties etc. And it's easy to see why politics is the way it is.
- giancarlostoro 8y ago
  I would expect anybody worth their salt to consult experts from said field they with to bridge into. Otherwise, why the hell are you blindly passing out laws? Sheer incompetence.
- shakna 8y ago
  > By consulting subject matter experts. Experts were consulted, and ignored. A lot of experts came right out and said these laws were insane. The Australian tech industry were not in favour, and the consulted experts were not favourable. However, the experts that were listened to were the ones who worked for ASIO, who said that these laws were absolutely necessary just for the agency to continue operating, and it was urgent that they were deployed in the last few days of Parliament. So the laws got rushed.
  - stone-monkey 8y ago
    > Experts were consulted, and ignored. This led to my point, though I made it in a roundabout way. None of these laws are made in a vacuum. When you get a law that seems to cause undue harm to industries or to general consumers, it's unlikely the case that lawmakers wrote up something due to negligence of the issues, but because another entity specifically pushed to have these laws written in this way.
femto 8y ago
They understood the impact. https://www.smh.com.au/politics/federal/bill-shorten-says-labor-achieved-half-a-win-on-encryption-legislation-20181207-p50ksx.html https://www.smh.com.au/politics/federal/bill-shorten-says-la... They just put their own political skins ahead of good government and passed a law that they knew was flawed. There's been no mention of the touted amendments to fix it, as there is a federal election looming and if either side of politics proposes an amendment, the other will take the opportunity to manufacture a scare campaign and score political points.
deleted 8y ago
[deleted]
bad_user 8y ago
> If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it. No, that’s not what they said. Such statements can hurt a business and in this case it would be a pity since the business in question is doing everything they can to serve their customers.
- brongondwana 8y ago
  Thank you :) That is indeed not what we said - though we were pretty sure we would be taken out of context and the "there's a risk of somebody being asked to do this and that creates staff uncertainty" would be seen as "we've definitely already done this" :( Unsurprisingly, that's happened.
brongondwana 8y ago
We haven't been forced to add anything. The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth. We pride ourselves on telling the truth to our customers, and we're quite clear that if we receive an Australian warrant for access to information about one of our customers, then we respond. That's different from adding backdoors. Our submission asks that the law be updated so we're allowed to talk about any surveillance capabilities that we may be asked to add, but not about which users are being surveilled. That way our customers know exactly what we are capable of. Right now we haven't received any capability requests (TCN) which is the bit we're concerned about, because if they required us to add features to the product without telling all staff about them, that would make it hard to maintain and ensure security as things were refactored. And any staff who DID know about it would have to be extra careful about what they say anywhere, because they could inadvertently leak something about the capability. We expect the law to be updated soon, and hopefully this will be addressed. Until then - honestly, nothing has changed. We still operate under exactly the same process - if we receive a warrant from Australian Federal Police we respond. If we receive any other type of request, we point them to the AFP and the mutual assistance treaties that are appropriate. But it's impossible for you to verify that, because if something HAD changed, we'd have lie - and that's frustrating to us.
- larkeith 8y ago
  Given that you're able to inform us currently that you've not received any capability requests, would it be legal and feasible for you to set up a warrant canary? I don't know if Australia has the same protections against compelled speech as the US [1, 2] which theoretically allow one to function, but if so, it might help encourage people to stay. [1] https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of_Education_v._Barnette https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of... [2] https://en.m.wikipedia.org/wiki/Wooley_v._Maynard https://en.m.wikipedia.org/wiki/Wooley_v._Maynard
  - cyphar 8y ago
    Warrant canaries are explicitly disallowed under this legislation (you cannot comment on the existence or non-existence of a notice and there are strong restrictions on what sort of statistics you can provide). In fact, I'm a little worried that they just said they have received no TCNs -- while you can provide aggregate statistical information over a 6-month window, if you get it wrong you're looking at a 5-year gaol sentence. We have no real free speech laws (there is common law about it but that can be overridden by legislation). There is freedom of political speech, but that's a much weaker bar. Funnily enough, parliament has actual freedom of speech.
craftyguy 8y ago
> It's amazing to me that the people who write these laws are the least capable of understanding their impact. Kind of makes you wonder about the other laws they write that touch things you aren't as familiar with...

CamperBob2 8y ago

In any protracted discussion of US politics, it's pretty common for someone to raise the point that other countries have better voting systems than the one we use, where a winner-take-all paradigm inevitably devolves to a contest between only two dominant parties, and where there is little incentive for the victorious party to form a working coalition with the other. Australia's use of ranked-choice voting is frequently cited as one area where our first-past-the-post system is behind the curve, and in fact we're starting to consider adopting ranked choice voting in some limited areas [1]. We also hear frequent arguments in favor of Australia's compulsory voting law as a way to combat the sort of voter apathy that led to the... unexpected outcome in our last Presidential contest. Stories like this serve as good counterpoints for Americans to raise in those debates, I think. Yes, Australia has implemented a number of progressive electoral reforms... but those progressive electoral policies are obviously not getting them better leadership or better laws. So why should we, in the US, follow their example? [1]: https://bangordailynews.com/2018/08/28/opinion/contributors/a-century-of-ranked-choice-voting-in-australia-offers-lessons-for-maine/ https://bangordailynews.com/2018/08/28/opinion/contributors/...

rickycook 8y ago
well, australian voting systems aren’t exactly progressive (it’s just a few steps above the worst case), and neither is the voting populace id say our government matches closer to our electorate than what the US government does, but we still have only 2 major parties which severely limits choice. there are ways to combat this (NZ, Germany for example) this example is also a fairly poor one, because it’s possible this law came as a “test the waters” as part of 5 eyes, so it could be followed in other counties. where spying and secrets are concerned, we shouldn’t draw too many conclusions because we don’t know all the facts
- A2017U1 8y ago
  It doesn't necessarily have to be enacted in other 5 eyes countries. The specific wording of the law said they can enlist citizens to put in backdoors at the request of other Governments. Even more absurd is that it also mentions this regarding economic espionage purposes. They legally could ask a developer to commit large scale theft of industrial secrets from say Germany for the benefit of Canadian enterprises. Anyone refusing faces penalties in secret court rooms. The open ended nature of the wording is staggering.
Jaepa 8y ago
That's an interesting notion. Not to follow this tangent to far, but I think that most likely it is a more representative democracy. If you were to ask the people in the US if they want a bill that would allow law enforcement to "read the private messages of terrorist", I'd guess that most people would say yes, not knowing or understanding the ramifications of what the law would mean, or what a clear definition of what terrorist are. But to the point, I do agree that mandatory voting may be actively harmful as it values all degree of civic engagement the same. That being said here in the states we have actively installed barriers to make voting more difficult. We aren't really getting better leadership or better laws from it.
getmoheb 8y ago
Actually the political logic on national security legislation here is a little more complicated and not really related to the electoral system or compulsory voting. National security policy has been used as a wedge issue here in the last 20 years, like in lots of other places. So the raft of security legislation that's been passed since the conservatives took office in 2013 has actually been as a result of both major parties voting together. If the Labor Party (centre-left) opposes security legislation, they're painted as soft on terror, weak on border security, etc. Security agencies have given a shopping list to the Liberal (i.e. conservative) government - data retention, citizenship, and encryption amongst others. The Libs have put bill after bill forward in an attempt to generate opposition from Labor and thereby get an effective national-security wedge. Some of them have been 'genuine' reforms but some have been less so. Labor knows this of course. But it's ahead in the polls and wants to be a small target come the election, so it has refused to bite. The result has been a bunch of shitty new security laws. It can be wonderfully disheartening to watch, especially given that lots of people on both sides of politics know perfectly well that they're bad laws but can't say it out loud due to the the politics of it. They're not all idiots who don't understand tech. So while the electoral system here has delivered slim majorities for successive governments (or indeed minorities at times), it's not really relevant here. When the major parties vote together the laws are going to pass. Sorry if that's off topic but I find it very interesting, albeit depressing sometimes.

CharlieSpeaks 8y ago

> Australia deserves better than these clowns. Australia's abysmal record on climate change affords it no sympathy. Australia, do your part. (Australia resident and happy Fastmail customer.)

mking1024 8y ago
I'm not sure what you are trying to say here. The party that pushed for these news laws is the same party that has been opposing real action on climate change for years. So yes, we do deserve better than these clowns.
- CharlieSpeaks 8y ago
  Over the past 20 years, most developed nations have been working to reduce GHG emissions, through multiple governments and across multiple industries. Australia shirked responsibility during the Kyoto protocol, letting the rest of the world tackle this problem. Australia's current government cannot be solely blamed for this.
  - mking1024 8y ago
    Of those 20 years you mentioned, the party we're discussing has been in power for around 14 of them - and the 6 years preceding that. I'd say the party that has been in power for over 75% of the last 25 years - and has actively campaigned against acting to reduce emissions - is somewhat responsible. But what I don't understand is the relevance of climate change to the topic at hand: the assistance and access legislation harming Australian tech companies. And I'm still not sure what your original point was ("Australia's abysmal record on climate change affords it no sympathy"). Were you saying saying that Australia's tech industry deserves to be destroyed because a slim majority of the country keeps voting for a party that is, among other things, hesitant to act to reduce emissions?

cbsks 8y ago

> If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it I interpreted it as they could be forced to secretly add a backdoor, but I guess if they are sworn to secrecy on it, who knows. Maybe it’s time for me to switch from FastMail...

deleted 8y ago
[deleted]

Jedi72 8y ago

If I remember correctly from their statement on this issue before they were baaically unaffected by the new laws as they do not off end-to-end encryption, so they were already open to lawful intercept requests.

bad_user 8y ago
Email services claiming e2e encryption are snake oil. It’s interesting to me how a demographics like that of HN can fall for it.
- isostatic 8y ago
  So when I send my gpg mail, it’s not encrypted?
  - ownagefool 8y ago
    Yes, it is. But if this is a feature of a mail service rather than a mail client, then the service has the keys and, given GPG has no perfect forward secrecy, they have the ability to decrypt all emails you send and recieve. If you go down the road of the mail service owning a mail client that promises e2e, then the issue moves to worrying about the code that runs on your device. If it's webmail, the JavaScript can easily be changed, so you really want a thick client. Then you need to worry about the thick client sending data that it's really not supposed to i.e. can it read your key and send it to $vendor? Even then, GPG without Perfect Forward Secrecy means that when your key is brute forced or side channel attacked, which we assume will happen, you lose all your secrecy, so you need to think about this as a temporary state.
    - bad_user 8y ago
      Note that the key could be client side and the email service could encrypt the email in a way as to not find out your private key. However, and this is key, a majority of email is sent and received unencrypted via their servers, because that's just how email works. In other words, email at rest might be encrypted, but most of the email in transit is not. This means that a man in the middle (e.g. the NSA) can still intercept all your communications. And even with PGP encryption, which is e2e, the meta data is still unencrypted because that's what the email protocol demands. Having the ability to see whom you're communicating with, that's enough in many cases. Email is simply not a good solution for e2e encryption. If you have secrets to protect, there are now other solutions available, like Signal and even Signal has some issues (like its reliance on phone numbers for identification).

Gaelan 8y ago

"Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." I'm reading that as "we don't encrypt customer emails, so we already had to share them." That's consistent with what they've said in the past.

brongondwana 8y ago
Exactly correct. We already share customer emails under limited circumstances and for explicitly requested accounts only (we've never participated in dragnets and we don't believe this legislation will require us to either). We have a standard process for verifying each request with the AFP and ensuring that they have followed due process to get a warrant for the data. We strongly support (also spelled out in that submission) keeping judicial oversight of requests - which this legislation does still require for the access requests themselves - hence saying that nothing has changed for us, since we have existing capabilities and we already respond to legal requests.
- fauigerzigerk 8y ago
  Due process is not the only question though. FastMail users will also be wondering whether the content of their email has to comply with other laws made by the very same lawmakers that have just shown their complete disregard for privacy and a shocking level of technical incompetence.
dbrgn 8y ago
To be fair, they also explicitly point out in their docs that encryption on their end is pointless (since they have the keys) and that you should encrypt your e-mails on the client side with something like PGP (where you control the keys). E-Mail sucks, that's all. Fastmail is transparent about it and does a good job. (PS: I still think that they encrypt their storage servers, but again, this will only protect against someone physically taking away their servers, not against a warrant or an intruder.)

dbg31415 8y ago

Australia is significantly behind the US in terms of tech, and Australian lawmakers are also significantly behind. Ignorant, and draconian. Not a good mix. With no Bill of Rights to protect people. It's borderline funny how inept the Australian government is with tech. NBN cost a fortune, and still sucks. My Health Record debacle. New anti-encryption laws, and leaders who think they can change the laws of math. ScoMo forgetting to set his domain on auto-renew... It's been a mess. * Victorian couple quoted up to $1.2m to connect to NBN Co's fibre service - ABC News (Australian Broadcasting Corporation) || https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-up-to-1.2million-for-fibre-connection/9842444 https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-... * My Health Record: privacy, cybersecurity and the hacking risk | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/jul/16/my-health-record-privacy-cybersecurity-and-the-hacking-risk https://www.theguardian.com/australia-news/2018/jul/16/my-he... * Scotty Doesn't Know: prankster takes over Scott Morrison's website | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/oct/19/scotty-doesnt-know-prankster-takes-over-scott-morrisons-website https://www.theguardian.com/australia-news/2018/oct/19/scott... * Prime Minister Says The Laws Of Mathematics Are Trumped By Australian Law || https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths Add to this how messed up the visa situation is in Australia, and the crazy high taxes they put on immigrants, and they wonder why their economy can't keep up and homes have dropped 20% in the last 2 years... They coasted on energy / natural resources for so long, but didn't invest any of the money correctly into tech training / startup scenes. Now that China took their foot off the gas, Australia will be in for a world of hurt.

anotherevan 8y ago
You forgot the last national census, where they decided our privacy was not that important[1], and they were liberally threatening everyone with severe fines if they didn't fill it out anyway. So when the most predicable result on the planet happened and twenty million people all tried to fill out the online form on the "census" evening they claimed it was a denial of service attack. The shame of it was, the ABS had a pretty good reputation up until that point (I believe). Now they're just another joke and have no good will left. [1] And which today we discover they've cocked it up even more so. https://www.itnews.com.au/news/algorithm-flaw-meant-census-responses-could-be-identified-519775 https://www.itnews.com.au/news/algorithm-flaw-meant-census-r...

stone-monkey 8y ago

To be fair, this is basically the software developer's dilemma in reverse. You're building out systems for areas of business with no domain expertise. End users constantly wonder why the developers built the software in such profoundly stupid ways. Lawmakers face the same problem in that they're barraged with constant problems from completely different fields that they're unlikely to be subject matter experts in. How do they learn about it? By consulting subject matter experts. Who are these subject matter experts? Well established businesses in their field. This can lead to laws that are incentivized towards large businesses. That's just considering a situation where everyone is working in good faith. Now consider lawmakers having to cater towards what is currently trending with the populace, kickbacks from companies, pull from different governments/organizations/political parties etc. And it's easy to see why politics is the way it is.

giancarlostoro 8y ago
I would expect anybody worth their salt to consult experts from said field they with to bridge into. Otherwise, why the hell are you blindly passing out laws? Sheer incompetence.
shakna 8y ago
> By consulting subject matter experts. Experts were consulted, and ignored. A lot of experts came right out and said these laws were insane. The Australian tech industry were not in favour, and the consulted experts were not favourable. However, the experts that were listened to were the ones who worked for ASIO, who said that these laws were absolutely necessary just for the agency to continue operating, and it was urgent that they were deployed in the last few days of Parliament. So the laws got rushed.
- stone-monkey 8y ago
  > Experts were consulted, and ignored. This led to my point, though I made it in a roundabout way. None of these laws are made in a vacuum. When you get a law that seems to cause undue harm to industries or to general consumers, it's unlikely the case that lawmakers wrote up something due to negligence of the issues, but because another entity specifically pushed to have these laws written in this way.

femto 8y ago

They understood the impact. https://www.smh.com.au/politics/federal/bill-shorten-says-labor-achieved-half-a-win-on-encryption-legislation-20181207-p50ksx.html https://www.smh.com.au/politics/federal/bill-shorten-says-la... They just put their own political skins ahead of good government and passed a law that they knew was flawed. There's been no mention of the touted amendments to fix it, as there is a federal election looming and if either side of politics proposes an amendment, the other will take the opportunity to manufacture a scare campaign and score political points.

deleted 8y ago

[deleted]

bad_user 8y ago

> If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it. No, that’s not what they said. Such statements can hurt a business and in this case it would be a pity since the business in question is doing everything they can to serve their customers.

brongondwana 8y ago
Thank you :) That is indeed not what we said - though we were pretty sure we would be taken out of context and the "there's a risk of somebody being asked to do this and that creates staff uncertainty" would be seen as "we've definitely already done this" :( Unsurprisingly, that's happened.

brongondwana 8y ago

We haven't been forced to add anything. The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth. We pride ourselves on telling the truth to our customers, and we're quite clear that if we receive an Australian warrant for access to information about one of our customers, then we respond. That's different from adding backdoors. Our submission asks that the law be updated so we're allowed to talk about any surveillance capabilities that we may be asked to add, but not about which users are being surveilled. That way our customers know exactly what we are capable of. Right now we haven't received any capability requests (TCN) which is the bit we're concerned about, because if they required us to add features to the product without telling all staff about them, that would make it hard to maintain and ensure security as things were refactored. And any staff who DID know about it would have to be extra careful about what they say anywhere, because they could inadvertently leak something about the capability. We expect the law to be updated soon, and hopefully this will be addressed. Until then - honestly, nothing has changed. We still operate under exactly the same process - if we receive a warrant from Australian Federal Police we respond. If we receive any other type of request, we point them to the AFP and the mutual assistance treaties that are appropriate. But it's impossible for you to verify that, because if something HAD changed, we'd have lie - and that's frustrating to us.

larkeith 8y ago
Given that you're able to inform us currently that you've not received any capability requests, would it be legal and feasible for you to set up a warrant canary? I don't know if Australia has the same protections against compelled speech as the US [1, 2] which theoretically allow one to function, but if so, it might help encourage people to stay. [1] https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of_Education_v._Barnette https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of... [2] https://en.m.wikipedia.org/wiki/Wooley_v._Maynard https://en.m.wikipedia.org/wiki/Wooley_v._Maynard
- cyphar 8y ago
  Warrant canaries are explicitly disallowed under this legislation (you cannot comment on the existence or non-existence of a notice and there are strong restrictions on what sort of statistics you can provide). In fact, I'm a little worried that they just said they have received no TCNs -- while you can provide aggregate statistical information over a 6-month window, if you get it wrong you're looking at a 5-year gaol sentence. We have no real free speech laws (there is common law about it but that can be overridden by legislation). There is freedom of political speech, but that's a much weaker bar. Funnily enough, parliament has actual freedom of speech.

craftyguy 8y ago

> It's amazing to me that the people who write these laws are the least capable of understanding their impact. Kind of makes you wonder about the other laws they write that touch things you aren't as familiar with...