3 ms·

I heard it had something to do with this.. "US officials have raised concerns that the Chinese government could pressure ByteDance to hand over information col

I heard it had something to do with this.. "US officials have raised concerns that the Chinese government could pressure ByteDance to hand over information collected from users that could be used for intelligence or disinformation purposes." Oddly Atlassian/Jira has the same issue. Australia has something called assisted access. So a developer at Jira could alter the encryption or face jail. And they wouldn't even be able to tell their boss about the "order". No idea how these two things are different in any way.

amadeuspagel 4y ago
Yes. And of course in most countries, it's not even necessary for there to be an explicit law to that effect, if the government orders a company to add a backdoor, they'll do it.
midoridensha 4y ago
>So a developer at Jira could alter the encryption or face jail. And they wouldn't even be able to tell their boss about the "order". How exactly would this work? dev: "Here's a merge request, please approve it." team lead: "Why are you changing the encryption? What is the purpose of this? And why are you working on this task when it's not part of our sprint planning? Where did you get the idea for it?" dev: "I can't tell you that. You have no right to read this code change! You need to approve this MR now, or else!" team lead: "See me in my office. We need to talk to HR."
- brokenmachine 4y ago
  That sounds ridiculous, but in reality I would think the govt would probably approach a C-level exec, and then serve all the people they need to silence from there. Working from the top down.
  - midoridensha 4y ago
    I was just going off of the previous comment, that the govt would force some random developer to make changes in a company's codebase. Such a thing would be ridiculous for the reason I pointed out: there's no way to keep it secret. Even if the govt approaches a C-level exec, I don't see how this would be kept a secret. The codebase is generally available within a company to everyone who has access, which for a large project is many people. Are they going to somehow swear all the devs in a department to secrecy? How do they enforce this? If the devs had security clearances and this job required keeping state secrets, that's one thing, but that's not what we're discussing here. If I were working in a civilian (non-clearance) job and the govt forced some nefarious changes into the codebase I was working on, I wouldn't feel any obligation to not inform the press.
    - brokenmachine 4y ago
      >Are they going to somehow swear all the devs in a department to secrecy? Yes. >How do they enforce this? How they usually enforce laws. Jail. In Australia it's up to 10 years. https://www.comparitech.com/blog/information-security/assistance-access-bill/ https://www.comparitech.com/blog/information-security/assist... >These orders can force people to hand over their passwords, their biometric data, or knowledge of any relevant systems and devices. They don’t just target the person suspected of a crime, but can also cover their associates, owners of the devices in question, systems administrators and those who have used the devices. >Not complying with these requests under the SD Act can lead to up to 10 years imprisonment and an A$126,000 (US$88,212) fine. >In a similar manner, the changes to the ASIO Act enable the Director-General to petition the Attorney-General to force individuals to provide the same kind of data. Refusing to comply can lead to up to 5 years of jail, or an A$63,000 (US$44,106) penalty. One of the biggest issues with the new powers under the ASIO Act is that there is no judicial oversight – the authorities never have to go before a judge to get permission. >It’s worth noting that these powers can be used in the investigation of any crime with a maximum penalty of three years or more. It seems heavy-handed that someone who refuses to comply could potentially end up with a sentence that exceeds the penalty for the original crime. >I wouldn't feel any obligation to not inform the press. Worth noting that anyone who reported on it would face jail time as well.
      - midoridensha 4y ago
        All this stuff goes directly against the First Amendment which guarantees free speech. Australia of course has no constitutional right to free speech, but America does.
        brokenmachine 4y ago
        I believe free speech is far from absolute and America has lots of legal avenues for gag orders from courts.

amadeuspagel 4y ago

Yes. And of course in most countries, it's not even necessary for there to be an explicit law to that effect, if the government orders a company to add a backdoor, they'll do it.

midoridensha 4y ago

>So a developer at Jira could alter the encryption or face jail. And they wouldn't even be able to tell their boss about the "order". How exactly would this work? dev: "Here's a merge request, please approve it." team lead: "Why are you changing the encryption? What is the purpose of this? And why are you working on this task when it's not part of our sprint planning? Where did you get the idea for it?" dev: "I can't tell you that. You have no right to read this code change! You need to approve this MR now, or else!" team lead: "See me in my office. We need to talk to HR."

brokenmachine 4y ago
That sounds ridiculous, but in reality I would think the govt would probably approach a C-level exec, and then serve all the people they need to silence from there. Working from the top down.
- midoridensha 4y ago
  I was just going off of the previous comment, that the govt would force some random developer to make changes in a company's codebase. Such a thing would be ridiculous for the reason I pointed out: there's no way to keep it secret. Even if the govt approaches a C-level exec, I don't see how this would be kept a secret. The codebase is generally available within a company to everyone who has access, which for a large project is many people. Are they going to somehow swear all the devs in a department to secrecy? How do they enforce this? If the devs had security clearances and this job required keeping state secrets, that's one thing, but that's not what we're discussing here. If I were working in a civilian (non-clearance) job and the govt forced some nefarious changes into the codebase I was working on, I wouldn't feel any obligation to not inform the press.
  - brokenmachine 4y ago
    >Are they going to somehow swear all the devs in a department to secrecy? Yes. >How do they enforce this? How they usually enforce laws. Jail. In Australia it's up to 10 years. https://www.comparitech.com/blog/information-security/assistance-access-bill/ https://www.comparitech.com/blog/information-security/assist... >These orders can force people to hand over their passwords, their biometric data, or knowledge of any relevant systems and devices. They don’t just target the person suspected of a crime, but can also cover their associates, owners of the devices in question, systems administrators and those who have used the devices. >Not complying with these requests under the SD Act can lead to up to 10 years imprisonment and an A$126,000 (US$88,212) fine. >In a similar manner, the changes to the ASIO Act enable the Director-General to petition the Attorney-General to force individuals to provide the same kind of data. Refusing to comply can lead to up to 5 years of jail, or an A$63,000 (US$44,106) penalty. One of the biggest issues with the new powers under the ASIO Act is that there is no judicial oversight – the authorities never have to go before a judge to get permission. >It’s worth noting that these powers can be used in the investigation of any crime with a maximum penalty of three years or more. It seems heavy-handed that someone who refuses to comply could potentially end up with a sentence that exceeds the penalty for the original crime. >I wouldn't feel any obligation to not inform the press. Worth noting that anyone who reported on it would face jail time as well.
    - midoridensha 4y ago
      All this stuff goes directly against the First Amendment which guarantees free speech. Australia of course has no constitutional right to free speech, but America does.
      - brokenmachine 4y ago
        I believe free speech is far from absolute and America has lots of legal avenues for gag orders from courts.