5 ms·
Proposed Australian law allows secret ministerial demands to install spyware
- IiydAbITMvJkqKf 5y agoAustralia is still a prison colony, just with different wardens.
- rhamzeh 5y agoThe previous iteration of this was a disqualifier for using FastMail when I was migrating away from GSuite. I wonder why people would accept to use AU-based services with all these shenanigans in place.
- concinds 5y agoWhat did you move to? I'm moving away from Google and considering alternatives, but Fastmail seems to be the most "reputable" and it's hard to know who to trust.
- rhamzeh 5y agoI chose Migadu. You might want ProtonMail or Tutanota if you wish, but having it accessible over my Mobile app of choice was a blocker for me. Some of the extra credits that made me choose Migadu: * Their site works without JavaScript enabled * Very simple and lightweight * Strong support for standards and portability * Open Source (as in FOSS) Stack, including their UI. https://git.sr.ht/~migadu/ https://git.sr.ht/~migadu/ * They're not after investors or scaling: https://www.migadu.com/procon/ https://www.migadu.com/procon/
- Sander_Marechal 5y agoWhat does this mean for Atlassian and it's hosted suite of tools? They are stopping the on-premise versions in 2024. It seems to me that this puts Atlassian in the same GDPR pickle that Google is in with respect to FISA.
- justinjlynn 5y agoThis is exactly why 'data sovereignty' is a concern for those using hosted cloud services. Atlassian, along with other hosting providers, likely have a policy and a control in place. However, it's absolutely something one should research and understand before using any cloud service.
- Sander_Marechal 5y agoThat doesn't mean much if an Australian count can order Atlassian to add code to the hosted JIRA that leaks our data to them.
- justinjlynn 5y agoActual text of legislation as proposed (relevant areas buried in section 30DJ): https://parlinfo.aph.gov.au/parlInfo/search/display/display.w3p;db=LEGISLATION;id=legislation%2Fbills%2Fr6833_first-reps%2F0001;query=Id%3A%22legislation%2Fbills%2Fr6833_first-reps%2F0000%22;rec=0#63b0be7e9b834ed8acca126ab8c2e99c https://parlinfo.aph.gov.au/parlInfo/search/display/display.... This proposed legislation grants much wider powers directly to the Secretary of Home Affairs and allows them to demand the installation of arbitrary software on your systems which reports directly to the ASD (the Australian Signals Directorate - a branch of the Australian military). The choice of this software, and its configuration, is left to the Secretary's prerogative. There doesn't need to be reason to suspect anything - the system only need be related to operating systems of 'national significance'. This declaration of 'national significance' is, of course, the prerogative of the Secretary - for any reason the Secretary desires. I am not a legal professional, so my interpretation is based on my honest opinion and, admittedly relatively inexperienced, reading of the legislation. However, I do believe it to be quite clearly spelled out. Of particular concern to me, as a systems engineer, is the fact that the proposed law does not mandate that the software be compatible with the system in question, nor does it mandate the correctness of the software, nor does it indemnify the organisation against the results of failure, compromise or data loss as a result. Did they forget about the solarwinds incident already?! Further, the law does not appear to provide for the reimbursement of debugging issues related to the software installation or provide for a means of technical advisory or support for this software or a pathway to contest the particular software chosen. You could be stuck with a rootkit for which you have no one to ask for assistance in troubleshooting or for workarounds. This means is that your systems engineers and operations staff could be responsible for months of dealing with kernel panics caused by a mandatory rootkit exfiltrating data from your systems and running arbitrary code in your systems. So much for agility in deployments and systems updates. You can't do anything that might 'break' this software. There isn't even any definition of what it means to maintain the functionality of the software. Theoretically, if you interrupt the connection or the software's operation at all - even for maintenance or accidentally - you could be on the hook for violating the notice. Should those responsible for the system in question fail to install or maintain the software in providing reports directly to the ASD via an Internet connection they are also mandated to supply, 200 penalty units may be levied. That's the equivalent of $44,000 AUD. Multiple notices under the act may be issued and penalties applied for failure to comply with each notice! It could easily bankrupt an operator should the legislation be used as a politically motivated weapon. Remember, it does not appear to be required that the installation of the software and/or system specified in the notice even be possible. As such, if true, it is absolutely possible the secretary could issue a notice which is impossible to comply with fully. Please, if you'd be impacted by this legislation, contact your representative and get your organisation to submit a submission to the committee regarding this legislation via the article link. They've only permitted a few weeks for this feedback! It closes 3 March. They know it's a very short period and they're really trying to get this through under the radar. Don't let them.
- baybal2 5y agoWho drafted this legislation? Name?
- justinjlynn 5y agoThe Hon. Karen Andrews MP, Minister for Home Affairs ( https://en.wikipedia.org/wiki/Karen_Andrews https://en.wikipedia.org/wiki/Karen_Andrews ), referred the Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022 to the Committee for inquiry and report. They take responsibility for its contents as drafted. The current Secretary of the Department of Home Affairs (to whom the power would be given, should it not be delegated) is Michael Pezzullo AO ( https://www.homeaffairs.gov.au/about-us/who-we-are/our-senior-staff/michael-pezzullo https://www.homeaffairs.gov.au/about-us/who-we-are/our-senio... ).
- PickledHotdog 5y agoJust when I thought she couldn't be any more useless. Now she's actively dangerous
- deleted 5y ago[deleted]
- bigDinosaur 5y agoAs far as I am aware, Michael Pezzullo is the truly dangerous one.
- techdragon 5y agoShe may have submitted it to the Parliament under her name but this entire document has Michael Pezzullo’s disgusting slimy fingerprints all over it. He’s been the driver behind more than a decade of disgusting authoritarian legislation.
- hifikuno 5y agoI thought we (Australians) already had something similar to this done a few years ago? I remember being really annoyed that A) they could force us to install a backdoor and B) we can't talk to anyone about it. I guess this might be slightly different as they are making you install spyware were as last time you just had to leave a backdoor open.
- justinjlynn 5y agoExactly, it's a very large expansion of powers already permitted under the Assistance and Access Act, etc. This doesn't mean it should be permitted, just as previous legislation shouldn't've been permitted in its proposed form.