8 ms·

"For example, Australia’s law enforcement could compel Apple to provide access to a customer’s iPhone and all communications made on it without the user’s aware

"For example, Australia’s law enforcement could compel Apple to provide access to a customer’s iPhone and all communications made on it without the user’s awareness or consent. An engineer involved would, in theory, be unable to tell their boss about this, or risk a jail sentence." Source: Sydney Morning Herald https://www.smh.com.au/business/consumer-affairs/dangerous-overreach-on-encryption-leaves-backdoor-open-for-criminals-20181214-p50mak.html https://www.smh.com.au/business/consumer-affairs/dangerous-o... That would be a 5-year jail sentence apparently: "The Australian government could demand web developers to deliver spyware and software developers to push malicious updates, all under the cloak of “national security.” The penalty for speaking about these government orders—which are called technical assistance requests (TAR), technical assistance notices (TAN), and technical capability notices (TCN)—is five years in prison." Source: EFF https://www.eff.org/deeplinks/2018/09/australian-government-ignores-experts-advancing-its-anti-encryption-bill https://www.eff.org/deeplinks/2018/09/australian-government-...

chii 8y ago
I believe that is an incorrect interpretation of the law. The govt can compell an entity to assist in making encrypted information available. But the entity in question is not the individual employee, but the company who owns the product or service. If you're under the employment (i.e., not a contractor), you can't be an entity, and the employer will definitely know if they've been compelled. But I do agree the law is stupid and erodes all trust from software owned by an Australian company.
- mastazi 8y ago
  I am not a lawyer so I wouldn't be able to comment on the meaning of "entity", I hope you are right though, and I also hope that the Australian Government would at least clarify the meaning of the provision and the legal definition of "entity" in this specific case.
- AaronFriel 8y ago
  What if the entity is, say, an independent contractor, staffing agency, or consultancy that provides engineering support to Apple?
  - chii 8y ago
    i believe an independent contractor is considered a service provider, and so they could be compelled to provide the gov't assistance. I also believe that these service provider(s) are required to not disclose the fact they've provided assistance. Therefore, apple would do well to not hire any australian company for their contracting purposes (but instead, employ them as an employee).
- Benjamin_Dobell 8y ago
  IANAL, but sadly, the law does seem to target people rather than (or in addition to) corporations. https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_first-reps/toc_pdf/18204b01.pdf;fileType=application/pdf https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi... > 317C: > For the purposes of this Part, the following table defines: > (a) designated communications provider; > (b) the eligible activitiesof a designated communications provider > A person is a designated communications provider if... ... Actually, there's too many to list. But here are a few examples: > - the person provides an electronic service that has one or more end-users in Australia > - the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-users in Australia > - the person manufactures or supplies components for use, or likely to be used,in the manufacture of a facility for use, or likely to be used,in Australia > - the person is a constitutional corporation who: (a) manufactures; or (b) supplies; or (c) installs; or (d) maintains; data processing devices Note that in the last situation they specifically mention corporations, but that prior situations do not require this. The requirements listed are to be interpreted as an OR not and AND... so ah, that's fun. So yes, we Australians can be legally required by our Government to perform corporate espionage... and almost no-one in Australia (certainly not the public at large) seems to give a f--k.
  - Benjamin_Dobell 8y ago
    Oh, and it's probably worth noting that you need not even be an Australian citizen to be covered, you simply need to have users in Australia. Of course, whether Australia can enforce these laws against non-citizens is another matter. However, this legislation was specifically put together with co-operation of all members of the five eyes, so there's a reasonable possibility of extradition. The Department of Home Affairs even made a public statement confirming as much. It seems to have since been pulled from their website, but is available at: https://cryptome.org/2018/11/5-Eyes-Crypto.pdf https://cryptome.org/2018/11/5-Eyes-Crypto.pdf Five Eyes just wanted this legislation pushed through somewhere and targeted Australia because we: - lack a bill of rights - are constantly distracted by politicians backstabbing each other, and - there's a strong 'think of the children' sentiment in Australia that can be (and has been) used to push through all sorts of egregious bills.
- bigiain 8y ago
  You are making the incorrect assumption that the people writing these laws are not idiots. They don't understand the technology. They don't listen to any of the people who advise them about this technology. They seem only to be listening to the police and other law enforcement crying about "paedophiles and terrorists GOING DARK". The Prime Minister at the time claimed the laws of Australia overrode the laws of mathematics. Seriously.
  - j16sdiz 8y ago
    They don't understand technology. But they know law -- and how to abuse them.
  - chii 8y ago
    THe law provides a specific provision to say that there are limitations to what the assistance can be: > 317ZG Designated communications provider must not be required > to implement or build a systemic weakness or systemic > vulnerability etc. But the issue here is whether it's possible to perform the required "assistance" but not introduce systemic weakness or systemic vulnerability. I think it's a logical contradiction, so the law is pretty damn stupid...
    - shakna 8y ago
      Systemic weakness or systemic vulnerability is redefined to not include anything that the notice can require however, rendering that particular exception pointless. > systemic vulnerability means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified. The words "systemic weakness" means something completely different to how the industry would use it.
      - bigiain 8y ago
        "We don't need you to introduce a Systemic Weakness into the whole class of 'electronics', we just need you to selectively target the specific class 'mobile phones' that are connected to John Doe 3 aka bogey-man-de-jour." This is now request that your lawyer would happily bill by the hour arguing with their lawyers in front of a judge - to determine whether it's a correct and enforceable interpretation of that shittily written legislation. Except you aren't allowed to tell your lawyer we asked you to do it.
philliphaydon 8y ago
So developer discusses with his boss. Developer A adds back door. Developer B then patches back door. Boss fires developer A. Developer A then uses this TAR crap to sue government for forcing him to do something and lose his job. I can’t see the government being able to defend itself. We elect the government to serve the people and the decisions of the government are negatively impacting the people no matter which way you spin it. My 2cents.
- deleted 8y ago
  [deleted]
- ENGNR 8y ago
  'developer discusses with his boss' => that's 5 years prison right there, not joking It's 5 for not doing it and 5 for telling anyone, 10 for both
  - maldeh 8y ago
    Assuming it could be proven, surely? And there have to be limitations as to how far an individual could go as to subterfuge, so if your company enforces a 2-person code review and there aren't other authorized Australian nationals at hand, you could point at process preventing you from doing so without others' knowledge (how naive this defense is, I have no idea)
    - int_19h 8y ago
      You opt into participating that process by accepting the job, though. So from Australia's perspective, the way to comply with their law is to not take such jobs, and to leave if the process changes prevent you from complying.
      - viraptor 8y ago
        I think you're inventing scenarios here that are too unlikely even for a pretty corrupt country. There probably exist laws in a number of countries which would technically jail you for taking some not-explicitly-illegal job. But this is absurd. Unless you're an actual lawyer giving opinion here?
deleted 8y ago
[deleted]
jeremija 8y ago
How exactly would this work? Let's say I have been coerced into making a back door, and my company has a policy of enforcing code reviews for every project. Surely, somebody would notice? Or would they count on me to do my best to obfuscate the back door? What if I "don't know" anything about obfuscation?
- mcv 8y ago
  Good question. I think nobody knows. Most likely what happens is: * You make the change * You report back that you made the change and it's now pending in code review * Your change gets rejected in code review * Australia tells you to make the change and circumvent code review * You tell them you have no way to do that; every change goes through code review * Australia wants to know who reviews your code, and if your code could be reviewed by an Australian * Your boss asks you why you haven't delivered any changes recently and why are you constantly on the phone explaining the code review process * Australia contacts a reviewer and tells them to accept your next change or else * You get fired before you can submit the change again
  - zerotolerance 8y ago
    More likely: * You make the change. * Your peer green lights the change because they have also been independently compelled by the government. * You and your peer never talk about it again.
deleted 8y ago
[deleted]
KorematsuFred 8y ago
Do you know what exactly constitutes a backdoor and how exactly Australian government "orders" their citizen to add this backdoor ? I less worried about an individual writing backdoor code and more worried about sabotage by giving private keys to government, leaking sensitive data etc. while these are not strictly backdoors in technical sense I guess government can put such things under that broad category. Another question I have in my mind is whether it would be legal to post "Australian citizens may not apply for this job" under the job posting in USA. Clearly there is a good reason to believe an Australian citizen is not good enough for tech jobs given that he comes with this baggage.

chii 8y ago

I believe that is an incorrect interpretation of the law. The govt can compell an entity to assist in making encrypted information available. But the entity in question is not the individual employee, but the company who owns the product or service. If you're under the employment (i.e., not a contractor), you can't be an entity, and the employer will definitely know if they've been compelled. But I do agree the law is stupid and erodes all trust from software owned by an Australian company.

mastazi 8y ago
I am not a lawyer so I wouldn't be able to comment on the meaning of "entity", I hope you are right though, and I also hope that the Australian Government would at least clarify the meaning of the provision and the legal definition of "entity" in this specific case.
AaronFriel 8y ago
What if the entity is, say, an independent contractor, staffing agency, or consultancy that provides engineering support to Apple?
- chii 8y ago
  i believe an independent contractor is considered a service provider, and so they could be compelled to provide the gov't assistance. I also believe that these service provider(s) are required to not disclose the fact they've provided assistance. Therefore, apple would do well to not hire any australian company for their contracting purposes (but instead, employ them as an employee).
Benjamin_Dobell 8y ago
IANAL, but sadly, the law does seem to target people rather than (or in addition to) corporations. https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_first-reps/toc_pdf/18204b01.pdf;fileType=application/pdf https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi... > 317C: > For the purposes of this Part, the following table defines: > (a) designated communications provider; > (b) the eligible activitiesof a designated communications provider > A person is a designated communications provider if... ... Actually, there's too many to list. But here are a few examples: > - the person provides an electronic service that has one or more end-users in Australia > - the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-users in Australia > - the person manufactures or supplies components for use, or likely to be used,in the manufacture of a facility for use, or likely to be used,in Australia > - the person is a constitutional corporation who: (a) manufactures; or (b) supplies; or (c) installs; or (d) maintains; data processing devices Note that in the last situation they specifically mention corporations, but that prior situations do not require this. The requirements listed are to be interpreted as an OR not and AND... so ah, that's fun. So yes, we Australians can be legally required by our Government to perform corporate espionage... and almost no-one in Australia (certainly not the public at large) seems to give a f--k.
- Benjamin_Dobell 8y ago
  Oh, and it's probably worth noting that you need not even be an Australian citizen to be covered, you simply need to have users in Australia. Of course, whether Australia can enforce these laws against non-citizens is another matter. However, this legislation was specifically put together with co-operation of all members of the five eyes, so there's a reasonable possibility of extradition. The Department of Home Affairs even made a public statement confirming as much. It seems to have since been pulled from their website, but is available at: https://cryptome.org/2018/11/5-Eyes-Crypto.pdf https://cryptome.org/2018/11/5-Eyes-Crypto.pdf Five Eyes just wanted this legislation pushed through somewhere and targeted Australia because we: - lack a bill of rights - are constantly distracted by politicians backstabbing each other, and - there's a strong 'think of the children' sentiment in Australia that can be (and has been) used to push through all sorts of egregious bills.
bigiain 8y ago
You are making the incorrect assumption that the people writing these laws are not idiots. They don't understand the technology. They don't listen to any of the people who advise them about this technology. They seem only to be listening to the police and other law enforcement crying about "paedophiles and terrorists GOING DARK". The Prime Minister at the time claimed the laws of Australia overrode the laws of mathematics. Seriously.
- j16sdiz 8y ago
  They don't understand technology. But they know law -- and how to abuse them.
- chii 8y ago
  THe law provides a specific provision to say that there are limitations to what the assistance can be: > 317ZG Designated communications provider must not be required > to implement or build a systemic weakness or systemic > vulnerability etc. But the issue here is whether it's possible to perform the required "assistance" but not introduce systemic weakness or systemic vulnerability. I think it's a logical contradiction, so the law is pretty damn stupid...
  - shakna 8y ago
    Systemic weakness or systemic vulnerability is redefined to not include anything that the notice can require however, rendering that particular exception pointless. > systemic vulnerability means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified. The words "systemic weakness" means something completely different to how the industry would use it.
    - bigiain 8y ago
      "We don't need you to introduce a Systemic Weakness into the whole class of 'electronics', we just need you to selectively target the specific class 'mobile phones' that are connected to John Doe 3 aka bogey-man-de-jour." This is now request that your lawyer would happily bill by the hour arguing with their lawyers in front of a judge - to determine whether it's a correct and enforceable interpretation of that shittily written legislation. Except you aren't allowed to tell your lawyer we asked you to do it.

philliphaydon 8y ago

So developer discusses with his boss. Developer A adds back door. Developer B then patches back door. Boss fires developer A. Developer A then uses this TAR crap to sue government for forcing him to do something and lose his job. I can’t see the government being able to defend itself. We elect the government to serve the people and the decisions of the government are negatively impacting the people no matter which way you spin it. My 2cents.

deleted 8y ago
[deleted]
ENGNR 8y ago
'developer discusses with his boss' => that's 5 years prison right there, not joking It's 5 for not doing it and 5 for telling anyone, 10 for both
- maldeh 8y ago
  Assuming it could be proven, surely? And there have to be limitations as to how far an individual could go as to subterfuge, so if your company enforces a 2-person code review and there aren't other authorized Australian nationals at hand, you could point at process preventing you from doing so without others' knowledge (how naive this defense is, I have no idea)
  - int_19h 8y ago
    You opt into participating that process by accepting the job, though. So from Australia's perspective, the way to comply with their law is to not take such jobs, and to leave if the process changes prevent you from complying.
    - viraptor 8y ago
      I think you're inventing scenarios here that are too unlikely even for a pretty corrupt country. There probably exist laws in a number of countries which would technically jail you for taking some not-explicitly-illegal job. But this is absurd. Unless you're an actual lawyer giving opinion here?

deleted 8y ago

[deleted]

jeremija 8y ago

How exactly would this work? Let's say I have been coerced into making a back door, and my company has a policy of enforcing code reviews for every project. Surely, somebody would notice? Or would they count on me to do my best to obfuscate the back door? What if I "don't know" anything about obfuscation?

mcv 8y ago
Good question. I think nobody knows. Most likely what happens is: * You make the change * You report back that you made the change and it's now pending in code review * Your change gets rejected in code review * Australia tells you to make the change and circumvent code review * You tell them you have no way to do that; every change goes through code review * Australia wants to know who reviews your code, and if your code could be reviewed by an Australian * Your boss asks you why you haven't delivered any changes recently and why are you constantly on the phone explaining the code review process * Australia contacts a reviewer and tells them to accept your next change or else * You get fired before you can submit the change again
- zerotolerance 8y ago
  More likely: * You make the change. * Your peer green lights the change because they have also been independently compelled by the government. * You and your peer never talk about it again.

deleted 8y ago

[deleted]

KorematsuFred 8y ago

Do you know what exactly constitutes a backdoor and how exactly Australian government "orders" their citizen to add this backdoor ? I less worried about an individual writing backdoor code and more worried about sabotage by giving private keys to government, leaking sensitive data etc. while these are not strictly backdoors in technical sense I guess government can put such things under that broad category. Another question I have in my mind is whether it would be legal to post "Australian citizens may not apply for this job" under the job posting in USA. Clearly there is a good reason to believe an Australian citizen is not good enough for tech jobs given that he comes with this baggage.