9 ms·

Is this true ? There is no way I am hiring an Australian citizen then.

by KorematsuFred 8y ago

shitloadofbooks 8y ago
The answer is "it's complicated." See https://github.com/alfiedotwtf/AABillFAQ https://github.com/alfiedotwtf/AABillFAQ
- mastazi 8y ago
  Thank you for providing a better source - reality is more nuanced than what most news outlets want you to believe, but unfortunately hiring practices are influenced by public discourse, and unfortunately the prevalent message out there is "don't hire Australians"
  - manigandham 8y ago
    No, business hiring is influenced by risk and value. Having any of this language is a risk that's just not worth it, especially because of how ambiguous and surreptitious this is. It's up to the citizens and their government to rectify such poor legislation.
  - opportune 8y ago
    It might be cheaper foor a business to just not hire Australians than to hire a lawyer and dedicate bizdev time to figuring out the intricacies and nuance
    - viraptor 8y ago
      It is not cheaper than getting sued for discrimination. Which would be easily proven in many cases, seeing how many people are more afraid of a potential issue with another country's intelligence agencies then of publicly posting about their plans to violate their own employment laws.
      - A2017U1 8y ago
        That's absurd, not hiring a foreign national on security concerns is a daily event, can you name one discrimination case won for that?
        viraptor 8y ago
        You're bringing up an valid exception validated by law. It's not the default and does not apply to almost all jobs out there. It's also usually applied as "only our nationals" rather than "not those specific other nationals" which would be the case for non-Australian. I'm not linking specific cases. (partially because you didn't specify which country you're taking any) A quick Google will bring you the specific laws, cases and lots of lawyers specifically advertising themselves to handle those cases.
      - village-idiot 8y ago
        You can’t be sued for discrimination based on the employees location, which is actually the issue at stake here. Citizenship doesn’t appear to be relevant.
        viraptor 8y ago
        Parent posts are about citizenship, not location. Literally "not hire Australians".
        village-idiot 8y ago
        Later posts make it clear the law is actually about country, not citizenship. Non-citizen residents of Australia have the same risk factor as citizens.
    - deleted 8y ago
      [deleted]
  - Nasrudith 8y ago
    The fact we have to ask is unacceptable in the first place! The same way you shouldn't have to ask if there is polonium in your tea. Given the easiest and most sensible solution is the same in both cases - dump it because it isn't worth the risk.
- cryptokernel 8y ago
  Very much complicated. Just leaving this here: https://coincircle.com/l/50VVxbObg3 https://coincircle.com/l/50VVxbObg3
mastazi 8y ago
"For example, Australia’s law enforcement could compel Apple to provide access to a customer’s iPhone and all communications made on it without the user’s awareness or consent. An engineer involved would, in theory, be unable to tell their boss about this, or risk a jail sentence." Source: Sydney Morning Herald https://www.smh.com.au/business/consumer-affairs/dangerous-overreach-on-encryption-leaves-backdoor-open-for-criminals-20181214-p50mak.html https://www.smh.com.au/business/consumer-affairs/dangerous-o... That would be a 5-year jail sentence apparently: "The Australian government could demand web developers to deliver spyware and software developers to push malicious updates, all under the cloak of “national security.” The penalty for speaking about these government orders—which are called technical assistance requests (TAR), technical assistance notices (TAN), and technical capability notices (TCN)—is five years in prison." Source: EFF https://www.eff.org/deeplinks/2018/09/australian-government-ignores-experts-advancing-its-anti-encryption-bill https://www.eff.org/deeplinks/2018/09/australian-government-...
- chii 8y ago
  I believe that is an incorrect interpretation of the law. The govt can compell an entity to assist in making encrypted information available. But the entity in question is not the individual employee, but the company who owns the product or service. If you're under the employment (i.e., not a contractor), you can't be an entity, and the employer will definitely know if they've been compelled. But I do agree the law is stupid and erodes all trust from software owned by an Australian company.
  - mastazi 8y ago
    I am not a lawyer so I wouldn't be able to comment on the meaning of "entity", I hope you are right though, and I also hope that the Australian Government would at least clarify the meaning of the provision and the legal definition of "entity" in this specific case.
  - AaronFriel 8y ago
    What if the entity is, say, an independent contractor, staffing agency, or consultancy that provides engineering support to Apple?
deleted 8y ago
[deleted]
jacques_chester 8y ago
I haven't seen a compelling argument that it has extra-territorial effect; on my reading of the amendments it doesn't. Extending your intelligence laws to cover individuals residing in other countries, who might also be citizens or permanent residents of those countries, can make for awkward dinner table discussion in diplomatic settings. So hiring Australians working outside of Australia should be OK. Of course, I'm not a lawyer. Or a spook. Or a diplomat.
flukus 8y ago
Do you avoid hiring people from China, Iran, Russia and anyone else from an authoritarian regime?
- throwaway8879 8y ago
  Yes, absolutely.
  - flukus 8y ago
    I admire the consistency, but the ammount of posts I see along the lines of "we won't hire Australians anymore" and the absence of posts like "we'll be adding Australia to the list of countries we don't hire from" doesn't fill me with confidence that this is common. Even before this change plenty of Chinese nationals would likely be employed wherever they were storing data in Australia and MS didn't care about that. I'm not aware of any MS ban on hiring Chinese either. So they were presumably fine with the threat of Chinese nationals inserting back doors, but it's a problem now because it's Australians.
    - opportune 8y ago
      I don't think MS really hires many chinese nationals. There certainly aren't nearly as many chinese nationals at MS compared to facebook and uber
    - Tsubasachan 8y ago
      The difference is that if a Chinese person does something for a Chinese intelligence agency they go to jail. If someone sabotages a company after being instructed to do so by a Australian agency they are carrying out a lawful order. Big difference IMO.
quickthrower2 8y ago
Do they have to tell you they are an Australian citizen? E.g. if they happen to also have local citizenship of your country?
viraptor 8y ago
1. You likely can't force someone to disclose all their citizenships. 2. In most countries you can't legally discriminate based on nationality. In practice publishing this comment here will likely cause you more trouble if you reject someone now, than Australian government. 3. If you apply this to all... what countries are you left with exactly where the government or LE can't force people to do something?
- consp 8y ago
  > 1. You likely can't force someone to disclose all their citizenships. Yes you can, in some cases; as for instance in some cases, especially IT security, you cannot be a foreign national or have ties to some specific nationality if you do business with local governments. This requires you to know the nationality(ies) of your employees. You can still have them in your team but they cannot work on the project. The Australian law would make this a very good argument to not hire them as they cannot work on any project as they are a possibly compromised. An example would be SpaceX which only hires US citizens due to DoD contracts. > 2. In most countries you can't legally discriminate based on nationality. In practice publishing this comment here will likely cause you more trouble if you reject someone now, than Australian government. I'm pretty sure that in the cryptography and IT security business the value of not having to comply with this law outweighs the cost of any discrimination lawsuits.
  - viraptor 8y ago
    Government/DoD security is much different than any random company's it security. Even large corps don't care about nationality for security team, just visa status / employment rules for most projects. (Again, when not related to gov projects) I honestly don't know how SpaceX does what it does. (Update: they are regulated as working on military stuff so it's the same as DoD rules)
caspar 8y ago
> The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer. > Is this true ? There is no way I am hiring an Australian citizen then. No. The request or notice is served to the company, not the individual, so the company is not left in the dark. There has been a lot of poor reporting about this law; roughly speaking, there are 3 types of requests for data allowed: 1. Technical Assistance Request - "give me this data please". Optional, no penalty to anyone for not complying. 2. Technical Assistance Notice - "give me this data if you can, or else..". Mandatory, penalty to the company if they can comply but do not comply.. but if the company would have to build a new thing to comply (e.g. they do not have the decryption key and there's no backdoor), then there's no penalty and they do not have to comply. 3. Technical Capability Notice - "give me this data or build a way to give me this data, or else..". Mandatory, and a penalty to the company if they do not comply. If they can't do the thing yet, they need to build a backdoor, unless doing so would introduce a "systemic weakness". In all cases, it's the company being targeted. Individuals in the company only become liable for penalties if they leak information to people not involved in the investigation. Yes, it's still a bad law that was rushed through with too little discussion. Yes, there is too much room for interpretation and too little oversight. (And yes, Australian tech companies like Atlassian are lobbying heavily to improve the situation[0][1][2].) But we're not at the point where it's reasonable to blacklist Australian tech workers yet, thankfully. Source: I am an engineering manager at Atlassian, a major Australian tech company; there has been a lot of internal discussion and guidance from our founders and legal team about this. Disclaimer: I am not a lawyer, this is not legal advice, etc. Also, I am an Australian citizen. [0]: https://www.theaustralian.com.au/business/technology/scott-farquhar-encryption-bill-a-gut-punch-to-tech-sector/news-story/911d5bdf788c3fa277d58622d568b4a5 https://www.theaustralian.com.au/business/technology/scott-f... [1]: https://www.afr.com/technology/web/security/atlassian-leads-encryption-law-revolt-as-peter-dutton-stands-firm-20190207-h1ayk2 https://www.afr.com/technology/web/security/atlassian-leads-... [2]: https://ia.acs.org.au/article/2019/tech-industry--fix-the-assistance-and-access-bill.html https://ia.acs.org.au/article/2019/tech-industry--fix-the-as...
- anitil 8y ago
  I'm confused by the "systemic weakness" exception for the third case. Obviously I need to research this, but it seems that in many cases, a backdoor is, almost by definition, a systemic weakness. Of course, I wouldn't want to argue that point in front of a judge, but it would be useful to have more clarity around this.

Is this true ? There is no way I am hiring an Australian citizen then.

shitloadofbooks 8y ago

The answer is "it's complicated." See https://github.com/alfiedotwtf/AABillFAQ https://github.com/alfiedotwtf/AABillFAQ

mastazi 8y ago
Thank you for providing a better source - reality is more nuanced than what most news outlets want you to believe, but unfortunately hiring practices are influenced by public discourse, and unfortunately the prevalent message out there is "don't hire Australians"
- manigandham 8y ago
  No, business hiring is influenced by risk and value. Having any of this language is a risk that's just not worth it, especially because of how ambiguous and surreptitious this is. It's up to the citizens and their government to rectify such poor legislation.
- opportune 8y ago
  It might be cheaper foor a business to just not hire Australians than to hire a lawyer and dedicate bizdev time to figuring out the intricacies and nuance
  - viraptor 8y ago
    It is not cheaper than getting sued for discrimination. Which would be easily proven in many cases, seeing how many people are more afraid of a potential issue with another country's intelligence agencies then of publicly posting about their plans to violate their own employment laws.
    - A2017U1 8y ago
      That's absurd, not hiring a foreign national on security concerns is a daily event, can you name one discrimination case won for that?
      - viraptor 8y ago
        You're bringing up an valid exception validated by law. It's not the default and does not apply to almost all jobs out there. It's also usually applied as "only our nationals" rather than "not those specific other nationals" which would be the case for non-Australian. I'm not linking specific cases. (partially because you didn't specify which country you're taking any) A quick Google will bring you the specific laws, cases and lots of lawyers specifically advertising themselves to handle those cases.
    - village-idiot 8y ago
      You can’t be sued for discrimination based on the employees location, which is actually the issue at stake here. Citizenship doesn’t appear to be relevant.
      - viraptor 8y ago
        Parent posts are about citizenship, not location. Literally "not hire Australians".
        village-idiot 8y ago
        Later posts make it clear the law is actually about country, not citizenship. Non-citizen residents of Australia have the same risk factor as citizens.
  - deleted 8y ago
    [deleted]
- Nasrudith 8y ago
  The fact we have to ask is unacceptable in the first place! The same way you shouldn't have to ask if there is polonium in your tea. Given the easiest and most sensible solution is the same in both cases - dump it because it isn't worth the risk.
cryptokernel 8y ago
Very much complicated. Just leaving this here: https://coincircle.com/l/50VVxbObg3 https://coincircle.com/l/50VVxbObg3

mastazi 8y ago

"For example, Australia’s law enforcement could compel Apple to provide access to a customer’s iPhone and all communications made on it without the user’s awareness or consent. An engineer involved would, in theory, be unable to tell their boss about this, or risk a jail sentence." Source: Sydney Morning Herald https://www.smh.com.au/business/consumer-affairs/dangerous-overreach-on-encryption-leaves-backdoor-open-for-criminals-20181214-p50mak.html https://www.smh.com.au/business/consumer-affairs/dangerous-o... That would be a 5-year jail sentence apparently: "The Australian government could demand web developers to deliver spyware and software developers to push malicious updates, all under the cloak of “national security.” The penalty for speaking about these government orders—which are called technical assistance requests (TAR), technical assistance notices (TAN), and technical capability notices (TCN)—is five years in prison." Source: EFF https://www.eff.org/deeplinks/2018/09/australian-government-ignores-experts-advancing-its-anti-encryption-bill https://www.eff.org/deeplinks/2018/09/australian-government-...

chii 8y ago
I believe that is an incorrect interpretation of the law. The govt can compell an entity to assist in making encrypted information available. But the entity in question is not the individual employee, but the company who owns the product or service. If you're under the employment (i.e., not a contractor), you can't be an entity, and the employer will definitely know if they've been compelled. But I do agree the law is stupid and erodes all trust from software owned by an Australian company.
- mastazi 8y ago
  I am not a lawyer so I wouldn't be able to comment on the meaning of "entity", I hope you are right though, and I also hope that the Australian Government would at least clarify the meaning of the provision and the legal definition of "entity" in this specific case.
- AaronFriel 8y ago
  What if the entity is, say, an independent contractor, staffing agency, or consultancy that provides engineering support to Apple?

deleted 8y ago

[deleted]

jacques_chester 8y ago

I haven't seen a compelling argument that it has extra-territorial effect; on my reading of the amendments it doesn't. Extending your intelligence laws to cover individuals residing in other countries, who might also be citizens or permanent residents of those countries, can make for awkward dinner table discussion in diplomatic settings. So hiring Australians working outside of Australia should be OK. Of course, I'm not a lawyer. Or a spook. Or a diplomat.

flukus 8y ago

Do you avoid hiring people from China, Iran, Russia and anyone else from an authoritarian regime?

throwaway8879 8y ago
Yes, absolutely.
- flukus 8y ago
  I admire the consistency, but the ammount of posts I see along the lines of "we won't hire Australians anymore" and the absence of posts like "we'll be adding Australia to the list of countries we don't hire from" doesn't fill me with confidence that this is common. Even before this change plenty of Chinese nationals would likely be employed wherever they were storing data in Australia and MS didn't care about that. I'm not aware of any MS ban on hiring Chinese either. So they were presumably fine with the threat of Chinese nationals inserting back doors, but it's a problem now because it's Australians.
  - opportune 8y ago
    I don't think MS really hires many chinese nationals. There certainly aren't nearly as many chinese nationals at MS compared to facebook and uber
  - Tsubasachan 8y ago
    The difference is that if a Chinese person does something for a Chinese intelligence agency they go to jail. If someone sabotages a company after being instructed to do so by a Australian agency they are carrying out a lawful order. Big difference IMO.

quickthrower2 8y ago

Do they have to tell you they are an Australian citizen? E.g. if they happen to also have local citizenship of your country?

viraptor 8y ago

1. You likely can't force someone to disclose all their citizenships. 2. In most countries you can't legally discriminate based on nationality. In practice publishing this comment here will likely cause you more trouble if you reject someone now, than Australian government. 3. If you apply this to all... what countries are you left with exactly where the government or LE can't force people to do something?

consp 8y ago
> 1. You likely can't force someone to disclose all their citizenships. Yes you can, in some cases; as for instance in some cases, especially IT security, you cannot be a foreign national or have ties to some specific nationality if you do business with local governments. This requires you to know the nationality(ies) of your employees. You can still have them in your team but they cannot work on the project. The Australian law would make this a very good argument to not hire them as they cannot work on any project as they are a possibly compromised. An example would be SpaceX which only hires US citizens due to DoD contracts. > 2. In most countries you can't legally discriminate based on nationality. In practice publishing this comment here will likely cause you more trouble if you reject someone now, than Australian government. I'm pretty sure that in the cryptography and IT security business the value of not having to comply with this law outweighs the cost of any discrimination lawsuits.
- viraptor 8y ago
  Government/DoD security is much different than any random company's it security. Even large corps don't care about nationality for security team, just visa status / employment rules for most projects. (Again, when not related to gov projects) I honestly don't know how SpaceX does what it does. (Update: they are regulated as working on military stuff so it's the same as DoD rules)

caspar 8y ago

> The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer. > Is this true ? There is no way I am hiring an Australian citizen then. No. The request or notice is served to the company, not the individual, so the company is not left in the dark. There has been a lot of poor reporting about this law; roughly speaking, there are 3 types of requests for data allowed: 1. Technical Assistance Request - "give me this data please". Optional, no penalty to anyone for not complying. 2. Technical Assistance Notice - "give me this data if you can, or else..". Mandatory, penalty to the company if they can comply but do not comply.. but if the company would have to build a new thing to comply (e.g. they do not have the decryption key and there's no backdoor), then there's no penalty and they do not have to comply. 3. Technical Capability Notice - "give me this data or build a way to give me this data, or else..". Mandatory, and a penalty to the company if they do not comply. If they can't do the thing yet, they need to build a backdoor, unless doing so would introduce a "systemic weakness". In all cases, it's the company being targeted. Individuals in the company only become liable for penalties if they leak information to people not involved in the investigation. Yes, it's still a bad law that was rushed through with too little discussion. Yes, there is too much room for interpretation and too little oversight. (And yes, Australian tech companies like Atlassian are lobbying heavily to improve the situation[0][1][2].) But we're not at the point where it's reasonable to blacklist Australian tech workers yet, thankfully. Source: I am an engineering manager at Atlassian, a major Australian tech company; there has been a lot of internal discussion and guidance from our founders and legal team about this. Disclaimer: I am not a lawyer, this is not legal advice, etc. Also, I am an Australian citizen. [0]: https://www.theaustralian.com.au/business/technology/scott-farquhar-encryption-bill-a-gut-punch-to-tech-sector/news-story/911d5bdf788c3fa277d58622d568b4a5 https://www.theaustralian.com.au/business/technology/scott-f... [1]: https://www.afr.com/technology/web/security/atlassian-leads-encryption-law-revolt-as-peter-dutton-stands-firm-20190207-h1ayk2 https://www.afr.com/technology/web/security/atlassian-leads-... [2]: https://ia.acs.org.au/article/2019/tech-industry--fix-the-assistance-and-access-bill.html https://ia.acs.org.au/article/2019/tech-industry--fix-the-as...

anitil 8y ago
I'm confused by the "systemic weakness" exception for the third case. Obviously I need to research this, but it seems that in many cases, a backdoor is, almost by definition, a systemic weakness. Of course, I wouldn't want to argue that point in front of a judge, but it would be useful to have more clarity around this.