Australia’s Horrific New Encryption Law Likely to Obliterate Its Tech Scene

https://thenextweb.com/politics/2018/12/10/australias-horrif…

Australia‘s government signed a bill into law last week giving law enforcement agencies the right to force technology companies to reveal users’ encrypted messages. Another way of putting it: Australia‘s tech scene will soon be located on the Wayback Machine.

The new law gives Australian law enforcement agencies the power to issue cooperation notices to technology entities with the purpose of gaining access to specific users’ encrypted messages and data. These entities may include companies, websites, or anything else that transmits data to an end-user in Australia.

Thoughts?

Comments

          • -8

            @mskeggs:

            But you and I don't know…etc

            and we dont know lots of things in the future.

            We dont know if Ozbargain will use all the data they have in the future as well… I would guess not, but we DONT know

            thats why we Elect our Parliament.so if things are done wrong we can change.

    • +3

      And if you were falsely accused of something, based on a misunderstanding of the partial information that had been gathered on you?
      Detained without being allowed to tell anybody that you had been detained?

    • +1

      Understandable, but this way this has been done is absolutely atrocious. From the wording this isn't as simple as "intel agencies can access if you're under suspicion of terrorism". This is "any authorities can have unfiltered access to any Australians stuff.

      Well, besides those working for the gov and their families of course.

    • This isn't really about our personal privacy so much as it's about our brain drain economy.
      Our "tech sector" will no longer be able to export tech services overseas.
      This is equivalent to sitting out the industrial revolution.
      With these laws in place, once everyone has moved onto renewable energy, what's our economy going to be like in 25 years? What would make this a desirable country to live in?

      But regarding your little "I don't send dickpics" comment:

      https://www.reddit.com/r/changemyview/comments/6g50av/cmv_on…

    • +5

      I believe that the authorities will have no interest in my love message to my wife.

      If you've got nothing to hide then nothing to fear.

      I bet there are many users on this forum who would be interested to see naked photos of your wife. Can you post some for us?
      (Or do we need to join a government agency and ask them to provide them for us by turning on her phone while she's in the shower?)

      • +1

        I bet she's an old granny….ewww…

    • +7

      I expect you have no issue with the government installing a CCT in your bathroom? They promise to only use it for legitimate law enforcement purposes. After all, you have nothing to hide.

    • Try telling that to a police officer you're filming in public and he tells you to stop filming…

    • If you've got nothing to hide then nothing to fear.

      Then why they dont make "public servants" privacy a PUBLIC thing already? That ought to be a little bit more transparency than what we have now. Logic had failed you or you fail logic … Either way Putin wins, amirite?

  • -4

    If the government can have all the access to your paper files/documents, I don't see why it can't seize the digital copy too.

    • +12

      The cost of seizing paper files requires good justification and also informs the owner of said files of the search. This new type of eavesdropping is a lot more insidious.

    • +3

      Although having a government agency able to access your information isn’t too much of a concern in itself, there are a few elements that are significant problems.

      1. For an agency to gain access to your physical paperwork requires your knowledge as they have to enter your property to seize your data. This new law means you have no idea when they are investigating you. Fine if you are a criminal, but if you aren’t it’s a pretty shitty premise. Extending this, an agency may be ‘any’ agency looking for any information and not something necessarily criminal, after all they can now access your information. Maybe your parenting is being called into question so an agency decides to look at your Whatsapp and FB messenger to check on you….. text messages often have no accurate context so this is dangerous to start with.

      2. What an agency can do so can a criminal who wants to access your data. Which organisations in Australia are less capable of avoiding hacking and yet hold the most sensitive information about us? (Spoiler) it’s the government….. why? Because of lack of funding for the best people and process.

      The real danger with these laws are the misuse of them, unfortunately what Australia is doing now is going to spread throughout the 5 ‘eyes’ to start with and then globally. We are a test bed for bigger markets….

      Technology has a way of working around this though and maybe this is where a distributed messaging platform takes over …..

    • +9

      Two very different, and not really comparable scenarios. If you want to compare, look at “TSA Locks” that get used in luggage. You have your own key for the lock, and can use it like a normal lock to protect things. But the gov also has a key, and their key also opens all your locks. These TSA keys that open their locks were a closely guarded secret.. until they got leaked. Now you can get your own copy for a couple of dollars and open every TSA lock in existence.

      The Australian government is mandating that companies build that same kind of access into Australian tech, while promising that only they will hold the key. Suddenly high end, previously impenetrable security can be circumvented.

      Like the TSA locks.. You’d have to be out of your mind to purchase Australian tech with a built in backdoor when you have secure alternatives from overseas. This will destroy industries. Also like TSA locks, it won’t affect criminals, because they aren’t going to use easily circumvented security when there are alternatives.

  • +12

    How exactly do they expect this to work? It seems unbelievably stupid to me. I must be missing something. Do they think WhatsApp will build a backdoor and trash their product because Australia wants them to? How could Australia make them?

    • +3

      Once legislated, apps with encryption but without an ASIO backdoor would be no longer allowed.
      Force Apple/Google/Microsoft to region block any non-conforming apps from their stores.
      Updates for those apps are rolled out:
      - compliant version apps are automatically deprecated with the new one (very unlikely for most larger apps like Whatsapp/Facebook Messenger/Viber)
      - apps that fail to comply may be marked as 'incompatible'
      Users can search for alternative sources of these apps from 3rd party sites, but for most people that is an unlikely step, and only a minority will have those non-compliant apps in the long-term.

    • +3

      Chances are they won't ask whatsapp to break their encryption, they'll ask the phone carrier to install malware directly onto your device instead.

    • +4

      The mechanism I am seeing speculated is that the gov will force OS vendors to do a targeted update to specific individual users which will inject a key logger or similar at OS level as part of system updates. It would be manageable to deal with Apple/MS/Google and each already have automated software update.
      This approach would allow them to say with hand on heart there is no systemic bug that impacts users software, only those people who are subject to the orders.

      We'll likely never know, but such an approach is likely a good balance between achieving what the security people want and maintaining security for non-targeted people.

      • +1

        good balance

        I wouldn't say good.

        (good post tho.).

  • +23

    Criminals still can send encrypted email to others without help of so-called apps.
    Criminals can create their own messaging system and deploy (gov cannot stop downloading custom APK file)
    Criminals can run custom ROM and bypass all gov wish to implement.

    Looks more like it's targeting general population, whistle blowers and journalists (abc?), not really hardcore crims.

    • or targeting common (non-hardcore highly IT literate) crims?

      • Now announcing ABB's smartphone configuration consultancy corporation. Based in Switzerland. For a small fee, our local rep will install known-good encrypted messaging apps for anyone, no questions asked!

        Head office guarantees, backed by a $1M bounty, that our local rep has not been served a notice under this law.

        • Gold

        • Go look up Phantom Secure phones. Half of them were sold to aussie crims.

    • It would make sense for anti corruption as well, but apparently gov officials and their families aren't included? Maybe I miss-understood another commentor.

      Of course there's also the "hone grown" terrorists who may be stupid enough to use this stuff.

    • Thing is, just in being one of these odd users, that will raise alarm bells. You can have a perfectly secure system, but the fact that you use it, and mainly other crims do too, raises flags for giving that person 'special treatment'.

    • They already do, most of them use Telegram which even Mr Putin's cyberdogs failed to crack down or even block effectively. In the end, they simply gave up, a pretty pathetic failure.

    • +1

      Hardcore crim here, can confirm

  • You're a knucklehead using WhatsApp if privacy is your priority anyway, regardless of Australian laws. Ask the co-founders if you don't believe me.

    • Doesn't WhatsApp have end to end encryption now?

      • This. Can you explain further Shay?

      • "metadata" from a messaging service is almost as good as message contents, for many purposes.
        Simply knowing who is talking to who, and how often, the web of contacts can be traced, and the key nodes can be surveilled by other means.
        WhatsApp (FB) has all this information.

        BTW, Google, can you please make us an undetectable app that shares the screen of a user we nominate? No? Oh, ok.
        Hey Google employees, you have to make that thing we asked nicely about before or we lock you up.

        • +2

          Google employee: opens pull request
          Integration engineer: Uh… what's this?
          Google employee: I can't tell you
          Integration engineer: request closed

          • +2

            @idonotknowwhy: Next day
            Integration engineer: Hey what happened to Barry? I wanted to ask him more about that change he made…
            Barry's cube mates: Who's Barry? We've always worked here with Gary.

      • thats not the point of this law.
        Gov can ask to create a "safe storage" of messages in the local storage which can be extracted by them. End-user may not know if the app is tempered or not.

    • +2

      WhatsApp is a compromise between privacy and wide use. I value privacy, most of my family and friends don't - but they still use WhatsApp.

  • +18

    Unfortunately the vast majority of Australia will have no idea how bad this is. It's essentially tarnished the entire Australian tech industry. Not seen such a massive foot shooting since brexit

    Guess I better make plans to leave in a couple years. No way will a decent tech industry survive here with this in it's current form

    • +5

      No way will a decent tech industry survive here with this in it's current form

      Australia decided not to have an tech industry when they wouldn't reform CGT and stock options.

      Just like we decided not to have a international financial services industry.

      The only thing the Gov wants/allows is mineral and gas extraction, which must be done by big corporations (they don't care if overseas or not).
      Thats literally all they care about.

    • +4

      I'd say it all but guarantees Australia will never have online/internet voting.
      Any in-built vulnerability means it's not even worth considering.

      This probably applies to a whole range of future technology applications that Australia simply can not consider anymore. Sad!

  • +6

    Linux, and an overseas vpn. Your hornpub recommendations will remain confidential.
    Use Signal (complied from source) for your dickpics.

    Edit: P.S. I'm kidding, I know this basically destroys some Australian business like fastmail.com and makes them incompatible with European privacy laws (no more exporting such services)

  • +1

    I would be more worried about the ACCC wanting to change the opt-out feature to opt-in. This will surely make google, facebook etc pull the plug on Australia because if the ACCC gets it right, many other countries will try and follow.

    http://theconversation.com/accc-wants-to-curb-digital-platfo…

  • -6

    Horrific & obliterate

    I love our sensationalised headlines

    • +9

      This is one case where it might not be sensational.

    • This is potentially the most damaging legislation in decades. If you think those headlines are hyperbole, you just don’t understand the entire impact of these laws yet.

      • -1

        I bet you've never actually used the word "hyperbole" in real life. Just online to make u sound fancy.

        • +1

          I’m pretty sure hyperbole is taught in 5th - 6th grade English. Apparently finishing primary school is fancy now.

          • @Praeto: I've note even heard that word before since today….

          • @Praeto: Please give a real life example where you have used the word hyperbole in a conversation

        • It's the NFL game set to surpass the superbowl.

        • Hyperbole: Specific trajectory of a curved ball.

  • +7

    The new encryption bill will capture minor offences dealt with in local courts (despite the "terrorism" claims used to pass it), as well as potentially allowing law enforcement agencies to target journalists and whistleblowers:

    https://www.theguardian.com/technology/2018/dec/12/encryptio…

    Basically any AFP officer can now use this information to bribe anyone (politician, business leader, drug dealer, etc) they want. And if you think "that will never happen", they have already abused their metadata powers:
    https://www.abc.net.au/news/2017-04-28/afp-officer-accessed-…

    • +1

      And what will be done the employ might be reprimanded (but probably not, or if they are it will be a fake reprimand).

      I like these two bits the best:

      • The journalist whose metadata was accessed has not been informed, Commissioner Colvin added.

      • "What was accessed was the records of calls, not the content of those calls," he said. (this apparently makes it ok).

      Because you wouldn't want to warn sources! hehehe… god we really are sheeple.

  • Isn't encryption done within your PC?
    How would the providers be able to decrpyt this?

    • +1

      By giving you an app with an encryption workaround, or, by installing an input logger on your device.

    • +1

      Do you update Windows? Heard of telemetry data? Now imagine that they will send what you do on PC to Australia government before it's even encrypted.

      Why would Windows do this? They would lose government money if they left Australia.

  • +20

    It's quite astounding that there are people on this very site defending the passing of such dangerous and disturbing legislation.

    • +6

      Sounds like terrorist talk. Or maybe pedophile. Definitely not what a law abiding citizen of Eurasia would be saying.

    • +2

      Yep. This video is a good explanation why it's a bad idea: https://youtu.be/CINVwWHlzTY

    • I've only read one comment stating they would be ok with this as long as it's only just the intelligent service using it coz apparently they be doing it anyways behind our backs…..

      Maybe I missed some…?

  • +3

    This will impact the employability of Australians in the tech industry globally as well. You can now be seen as a security risk, given that the government can compel you to provide a backdoor into systems or applications.

    Extreme? Maybe. But definitely not outside the realm of possibility at all.

    • I don't see that specifically, worst case is the compel the Australian arm of a business, so if you're an Australian working for that arm, and the arm is requested/forced to do something, and you're the person who implements it, even then, you're just working for the arm, don't see the final connection there.

  • +4

    The law can't stand the way it is, services are the number one thing this economy does, and this makes us uncompetitive, and basically a joke. All the businesses should refuse to comply under almost all circumstances, because even if there's information available about 1 criminal, that the software is somehow protecting, adding an intentional vulnerability is unethical to all of their existing customers, as it violates their privacy and/or security as well.

    What an utter disgrace.

    • +3

      When the government send their citizen overseas to USA to be jailed for uploading, I said nothing because I was buying dvds.

      When the government banned some games for blood, I said nothing because I could still play other games.

      When the government censored the Internet, I said nothing because I could bypass it.

      When the government banned Huawei from NBN tender for security issues, I said nothing because I don't use Huawei.

      I joined the pirate party to object to this bs.

      • …what sites do they censor? I haven't been on any sites that are censored/blocked over here…….unless region locked youtube videos count…? I've been met with a few of those…. "Sorry this video is unavailable in your country"

        • +1

          Labor started with a questionable list in 2012 but officially it was to block illegal content such as child porn.

          Under Liberals, the block got expanded for copyright infringement. A year later, the pirate bay and some others got blocked. Can you access the pirate bay?

          Currently the block is at ISP DNS level. Ie. Can bypass witb 8.8.8.8. The filter is currently a joke. But I'm sure the major parties hope to expand the scope, maybe adopt China's firewall. Ie slowly boiling a frog.

          https://en.wikipedia.org/wiki/Internet_censorship_in_Austral…

          https://www.brisbanetimes.com.au/technology/qld-dentist-furi…

          • @orangetrain: Is this the blacklist: https://wikileaks.org/wiki/Australian_government_secret_ACMA… ?

            A couple of notable domains, youtube.com, rapidshare.com that I use….otherwise the rest are foreign territory as far as I'm concerned….oh forgot wikipedia domain was on there as well. Oh I heard of Redtube, from around these forums, but haven't actually went on it before….

            Otherwise where's the updated blacklist, because piratebay isn't on there….?

            Yeah I use the Google's DNS, must be why I can still access those sites…..

            Found one from that 2009 blacklist that thought was funnily blocked: http://www.zombiesurvivalwiki.com/page/DIY+plans+and+tips - no idea why that's blacklisted but it does sound like plasuibly plan package to know in case something like that happens……and the page is gone…..poof…

            Also lol rip this guy: https://www.heraldsun.com.au/archive/news/cartoon-porn-kids-… According to NSW state, drawings of cartoon characters is also considered child porn…..

            EDIT: And which piratebay link is it? Is it this one: https://thepiratebay.org/ ? 2nd result from google…..because there's more than one….and I haven't been on that so I don't know which is the the real one…..

            • +1

              @Zachary: The official blacklist is not for public viewing. This makes it easier for the government to censor content without public oversight.

              • @orangetrain: Oh……so the only way to find out is the try every website in existence and if they're blocked, that means they're on the blacklist? …and so someone could create such a list using this method and thus you would get an equivalent blacklist that's kinda official but unofficial since it is not released by the ACMA?

  • +11

    I find it extremely ironic that the potential for the Chinese government to force tech companies to 'cooperate' was the main reason why Australia banned Huawei from our 5G network.

    • +9

      It's only bad if someone else does it.

    • +1

      hahahahahahahahahaha….should we also ban Kaspersky products too since they're from Russia and they could be spying on us too?

  • is this like when the govt blocked pirate bay ;^)

    • +1

      No. That was a failed attempt to reduce privacy.
      This is going to destroy and prospect of a "tech sector" in Australian and potentially make this country undesirable irrelevant in a few decades.

  • Sooo to the tech savvy, what safe alternatives do we have in terms of encrypted instant messaging? Are there any paid services available?

    It would be good to know an alternative to signal and whatsapp

    • No alternatives.

      If you picked up a book on programming, released an app and regularly released updates. The government would knock on your door asking for the backdoor. Non-compliance = fines + jail time. Talk to anyone about backdoors in your app = fines + jail time.

      • I feel your answer is very black and white and the response of a law abiding citizen that happily grabs their ankles when a law like this comes out.

        There has to be a server in a country that does not need to react to the said law, in a way that would be legally threatening. Ie, The Pirate Bay, mega upload etc. Their websites, servers are strategically setup to avoid piracy laws…

        Tax havens are countries that are prayed upon by companies to setup and minimise/avoid tax for companies operating in Australia like Microsoft, Apple

        Your answer is very basic, I asked for a more technical response. There 100% has to be a work around, I just don't know it (without face to face meetings etc)

        ProtonMail has already said they will not comply with this law, any which way. Therefore they know the technicality of the law and they know it cannot apply to them, their servers, their service as they don't operate from Australia.

        Fortunately, there is virtually no way to enforce this law outside of Australia because it has no foreign equivalent. ProtonMail, a Swiss company with datacenters only in Switzerland, is not under Australian jurisdiction. Any request for assistance from Australian agencies under the A&A law would need to pass the scrutiny of Switzerland’s criminal procedure and data protection laws. Tech companies with a corporate presence in Australia however, are more likely to be impacted.

          1. Protonmail can refuse publicly but may be get a backdoor eventually. It's proprietary service.

          2. Why a backdoor? A. Australian government may get other email services to block delivery to Protonmail. How will you receive emails? Will you be aware? B. Block payments to a criminal organisation (maybe a no show by Protonmail).

          3. You want to establish an open source service or use it alone. Do you understand how to audit software code? The government may not care about you. But if they know about you, they will get you for 'non compliance' if you host this.

          4. Tech solutions are great but despite government being slow, they can pay some young tech savvy people for ideas.

          Best technology suggestion: host audited open source solution by you overseas and use linux. Means no Apple or Windows. Probably have to get a dumbphone too?

          Best political solution: Pirate party. Best sensible policies with technology and Internet.

          • +1

            @orangetrain: You have absolutely no idea what you're talking about. Why the f#$k would ProtonMail give a back door when the law doesn't affect them? The fines will not be legal, and blocking their services will merely be a temporary fix, they'll just rotate servers, IPs.

            Please stop embarrassing yourself.

    • If WhatsApp does not retain msgs on its servers, surely noone can read past messages?

      • That is true, but it needs to be stored on a server for you to view the message, otherwise what would you be viewing? a blank message? secondly, WhatsApp is owned by Facebook and they already work with government agencies, they are openly giving out information upon request, I do not see why WhatsApp would do anything to protect the privacy of our data if requested by government officials.

        • End to end encryption. Only the unreadable ciphertext is stored on the server. Look up "zkp" to learn more.

        • -2

          Soooo… Xiaomi, what instant messages are you sending that you are so worried about exposing to authorities? You seem to be pretty worried!

          • @Dr C: Your reply is the typical pathetic nonsense that sees these laws passed. People happily giving over their data bevause hey 'I got nuttin to hide m8'

            Some people appreciate privacy, Dr Cant

    • +1

      Stick with open-source, back doors would be obvious as the source code is visible.
      Ideally, build them yourself as you could get backdoors in the binary in the app store but have clean source code. Whisper signal is an example.

      This doesn't prevent backdoors in your operating system. Import your phone so that Telstra, etc can't backdoor your android/whatever rom.

      Use a VPN.

      I assume there are no Australian certificate authorities but if they are, you'll want to untrust them.

    • Signal is Open-Source: https://github.com/signalapp

  • +2

    How does this affect my Plex setup with SAB and Usenet?

    • Time to invest in a property in NZ and host it there brah

    • It kind of doesn't really.

  • +5

    At least in America they can carry guns against their tyrannical government

  • -5

    Horrific? Gee, that's a bit OTT mate.

    • +6

      It’s not OTT, just a failure of imagination on your part. This is potentially the most damaging legislation passed in decades.

    • +1

      +1 from me. Horrific is OTT. the legislation's just abysmally stupid, not really horrific :)

  • +2

    “Horrific” could only be used in reference to the stupidity of the legislators. I would love for law enforcement authorities to be able to get access to the communications of serious criminals, but unfortunately it’s totally infeasible. This government is the same bunch of morons who wanted to have Australia use only "breakable" encryption. FFS. Might as well say “no internet for australia”. Who are the technical advisers for these guys? I expect Morrison and Co. to be ignorant enough to come up with such unenforceable BS, but the fact that they can’t even seek out competent advice… well, I guess that shouldn’t surprise me either. After all 8-bit obfuscation would be a fitting match for their copper wire NBN. Criminals aren’t going to stop using encryption because they’re asked to. The only people who would comply with this are the people like me who are happy to send emails in plain text over SMTP because they have nothing to hide from authorities. What a useless and redundant waste of taxpayers money.

    • +7

      wtf are you on about dude?

      • -4

        "According to the government, its passage was necessary to prosecute terrorists."

        If we had enforced our border, we wouldn't need to forfeit rights for our own safety. That's what I'm on about.

        • I don't think this has anything to do with border control or immigration. It might have some overlap like all topics, but i fail to see the relevance here…

          • -7

            @Ghosteye: I literally quoted the relevant part for you… How does the importation of African and Middle Eastern terrorists, which the government is now using to justify laws nullifying encryption, have nothing to do with border enforcement and immigration?

            • +4

              @NotSureAboutThatMate: Your implication that non-white people cause

              'for concrete bollards in pedestrian areas, cops with rifles on our street corners, and now violations of our privacy under the guise of combating terrorism and pedophilia'

              is racist.

              Also stupid. Take your racist propaganda elsewhere plz

Login or Join to leave a comment