3 ms·

A similar law passed in Australia a few years ago; various Australian law enforcement agencies can request or even demand companies to make changes to their cod

A similar law passed in Australia a few years ago; various Australian law enforcement agencies can request or even demand companies to make changes to their code (read: introduce backdoors). Until people and companies start treating Australian-made software as dangerous to the extent that it affects the economy, other countries will probably follow with similar laws. That should include being hesitant to use American software as well. There's a good reason EU companies aren't allowed to store data on American servers.

pjc50 2y ago
Current state of this, as far as I can tell: https://www.firstattribute.com/en/news/eu-data-boundary-for-microsoft-cloud-solutions/ https://www.firstattribute.com/en/news/eu-data-boundary-for-... Note that it's seemingly unclear whether it's OK for EU companies to store data even on EU servers of US parent companies. Although very little has actually been done about this and everyone, governments included, is still using Microsoft 365.
- eapressoandcats 2y ago
  In principle as long as a state has legal hooks into a large enough part of the business it’s probably ok. Data centers are less tricky than phones because they don’t move. I’m also not sure there’s so much practical difference between a company headquartered in the EU vs USA. The relevant thing would seem to be where operations happen, and what legal and practical hooks each side has into the company, including physical location of servers and the people who operate and write code for them.
nickslaughter02 2y ago
More context: https://www.schneier.com/blog/archives/2024/09/australia-threatens-to-force-companies-to-break-encryption.html https://www.schneier.com/blog/archives/2024/09/australia-thr...
dannyw 2y ago
It’s not just at Australian made hardware or software. You think Australia won’t try to assert this against a global company with presence in Australia?
throwaway290 2y ago
With a warrant a company can be forced to implement this capability for a specific case. Is it the same?
- shakna 2y ago
  "TCNs are orders that require a company to build new capabilities that assist law enforcement agencies in accessing encrypted data. The Attorney-General must approve a TCN by confirming it is reasonable, proportionate, practical, and technically feasible." It's a step above a warrant, as an order, when building a new capability. But yes, its focused in on one case. As to "reasonable" - our current AG is a strong supporter of expanding government powers as a way to fix any new problem that appears. He's done some good. And some bad. It isn't hard to see him rubber-stamping these, if someone across the hall needs it done. Also... If a TCN order comes through, you're not permitted to tell the business that you've been ordered to create a backdoor in them. And they can order random anyone in the company to comply - it doesn't have to go to the C-level.
  - throwaway290 2y ago
    https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/assistance-and-access-industry-assistance-framework https://www.homeaffairs.gov.au/about-us/our-portfolios/natio... "What assistance can be provided" > Note: private communications and data may only be accessed with lawful authority pursuant to the existing warrant framework
fransje26 2y ago
> Until people and companies start treating Australian-made software as dangerous Atlassian?

pjc50 2y ago

Current state of this, as far as I can tell: https://www.firstattribute.com/en/news/eu-data-boundary-for-microsoft-cloud-solutions/ https://www.firstattribute.com/en/news/eu-data-boundary-for-... Note that it's seemingly unclear whether it's OK for EU companies to store data even on EU servers of US parent companies. Although very little has actually been done about this and everyone, governments included, is still using Microsoft 365.

eapressoandcats 2y ago
In principle as long as a state has legal hooks into a large enough part of the business it’s probably ok. Data centers are less tricky than phones because they don’t move. I’m also not sure there’s so much practical difference between a company headquartered in the EU vs USA. The relevant thing would seem to be where operations happen, and what legal and practical hooks each side has into the company, including physical location of servers and the people who operate and write code for them.

nickslaughter02 2y ago

More context: https://www.schneier.com/blog/archives/2024/09/australia-threatens-to-force-companies-to-break-encryption.html https://www.schneier.com/blog/archives/2024/09/australia-thr...

dannyw 2y ago

It’s not just at Australian made hardware or software. You think Australia won’t try to assert this against a global company with presence in Australia?

throwaway290 2y ago

With a warrant a company can be forced to implement this capability for a specific case. Is it the same?

shakna 2y ago
"TCNs are orders that require a company to build new capabilities that assist law enforcement agencies in accessing encrypted data. The Attorney-General must approve a TCN by confirming it is reasonable, proportionate, practical, and technically feasible." It's a step above a warrant, as an order, when building a new capability. But yes, its focused in on one case. As to "reasonable" - our current AG is a strong supporter of expanding government powers as a way to fix any new problem that appears. He's done some good. And some bad. It isn't hard to see him rubber-stamping these, if someone across the hall needs it done. Also... If a TCN order comes through, you're not permitted to tell the business that you've been ordered to create a backdoor in them. And they can order random anyone in the company to comply - it doesn't have to go to the C-level.
- throwaway290 2y ago
  https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/assistance-and-access-industry-assistance-framework https://www.homeaffairs.gov.au/about-us/our-portfolios/natio... "What assistance can be provided" > Note: private communications and data may only be accessed with lawful authority pursuant to the existing warrant framework

fransje26 2y ago

> Until people and companies start treating Australian-made software as dangerous Atlassian?