Australia To Compel Technology Firms To Provide Access To Encrypted Missives (reuters.com)

Australia on Friday proposed new laws to compel companies such as U.S. social media giant Facebook and device manufacturer Apple to provide security agencies access to encrypted messages. From a report: The measures will be the first in an expected wave of global legislation as pressure mounts on technology companies to provide such access after several terror suspects used encrypted applications ahead of attacks. Australia, a staunch U.S. ally, is on heightened alert for attacks by home-grown radicals since 2014 and authorities have said they have thwarted several plots, although Prime Minister Malcolm Turnbull said law enforcement needed more help. "We need to ensure the internet is not used as a dark place for bad people to hide their criminal activities from the law," Turnbull told reporters in Sydney. "The reality is, however, that these encrypted messaging applications and voice applications are being used obviously by all of us, but they're also being used by people who seek to do us harm."

Comments

The roads

[fredrated]

are also being used by people who mean us harm. Shall we shut them all down?

Re:The roads

[Rick Schumann]

Give them time. We've been warned for decades now that the full-on Police State is coming, and now I'm starting to think that's what's going to happen. Then all the terrorists in the world will throw a big party, because they will have won.

Apropos of nothing, I see why Humans can never be immortal: After you put up with a hundred years of the continual BULLSHIT that your own species perpetrates on itself, you just don't want to see any more and WISH to die.

If there's no place for terrorists to hide

[HalAtWork]

If there's no place for terrorists to hide then there's no place for *anyone* to hide, and that is unacceptable considering how valuable it is to hide from oppression or the abusers of the system used to ensure there are no hiding spots, those who operate the system are disproportionately advantaged and with access comes the capability of concealing themselves, censoring, framing content and concealing context, etc.

This idea is ridiculous and imbalanced off the bat.

Re:Not going to happen

[j-b0y]

Will happen, eventually. But it will not solve the underlying problem of encryption technology being widely available. That stable door has been open for so long that the horse has bolted, galloped, cantered and eventually settled down to raise a family somewhere in Wyoming.

Funny this is from Australia...

[rkhalloran]

IIRC, the Bouncy Castle crypto package , developed to get around the 90's US export controls on strong ciphers, originates from Down Under. Funny their govt is now expecting developers to install Magic Good-Guys-Only Backdoors into their software so the Five-Eyes Panopticon can snoop as wanted.

Jean has a big moustache.

[houghi]

I repeat:
Jean has a big moustache.

Aunt Marie is doing well.
I repeat:
Aunt Marie is doing well.

These where the message from Radio Free Internet.

Re:Jean has a big moustache.

[NoNonAlphaCharsHere]

Exactly. Or a simple book cipher, or steganography. It's just too laughably easy for REAL terrorist types to communicate in perfect secrecy. What measures like this are about is for Law Enforcement(TM) types to trivially easily spy on the general populace.

Re:better idea

[cayenne8]

Oooh, how original. Which piece of shit Abrahamic faith is your favorite? Let me guess. Christianity.

You know, when we have radical Presbyterians running around, driving trucks through crowds on holidays, gunning down co-workers on Xmas party days, and bombing outside of concerts and just generally shooting and blowing up groups of innocent people....we can start worrying about those damned jihadist Christians then....but, until then, why don't we try to address the problems folks at hand now, eh?

Re:Here's a thought....

[haruchai]

Quit letting people from terrorist prone countries or parts of the world into YOUR country...where they refuse to assimilate and become pots of festering terrorist ideology waiting to unleash itself into the host country.

Someone should have told the Aboriginals & Native Americans that a long time ago

Re:better idea

[cayenne8]

Hmm..I guess the crusades were some type of party.

Bad example...the Crusades were a reaction to the Muslims overtaking the "Holy Land"...and not letting Christians in....it was a defensive move back in the day.

Once again, the Muslims were the initial aggressors.

Obvious response of technology firms

[swillden]

The obvious response of technology firms is to structure their encryption so that it becomes impossible for them to decrypt the content because they don't have the keys themselves. The security guys at pretty much every such company would prefer to build such systems anyway. They generally don't because doing so adds some additional layers of complexity. It's simpler and more cost-effective to instead build a key management system that is secure against compromise even by internal attackers, relying on the typical tools (secure hardware, affirmative control, responsibility splitting, etc.).

But... it's not *that* much harder to build a system in which no one but the parties communicating have the keys. Compared to the legal and administrative costs involved in having to deal with an unending stream of government requests for data (which governments almost always expect companies to comply with at their own expense, as a cost of doing business), it's a no-brainer. Much cheaper to build the more complicated decentralized security model, enabling the company to respond to government requests with "Can't. Here's our security design. You can see that we have no access to the decryption keys."

Of course, the obvious response of legislators is then to mandate government-accessible backdoors. That, however, creates an entirely new public perception of the request, making it a very different game, politically.

Re: Obvious response of technology firms

[swillden]

Apple does that already. It was an engineering solution to a legal problem.

It's the obvious and predictable response of a security engineer.

However, I don't think Apple has actually fixed that "hole" yet. What the FBI was asking them to do was to provide an updated version of the firmware which bypassed the brute force mitigations on password checks. There was much discussion back then about which iPhone versions have the "secure enclave" and which don't, but the secure enclave also has updatable firmware.

However, there are ways to fix this, and I suspect that Apple is working on one for the iPhone8. I think the best solution (and I should note that my day job is Android crypto security, so I've given it more than a passing thought) is to make the firmware update process require that the user first unlock the device. There are a variety of ways to do that, and make the requirement cryptographically strong.

It should be noted that this is a general-purpose security feature, not one specifically targeted at securing against law enforcement. Without it, the security of user data can never be stronger than the internal access controls around the firmware signing key. Any employee or group of employees who have access to that key (or anyone who can bribe, extort or otherwise coerce said employees) can sign new firmware that can erode the security. The fact that it was a government attempt to coerce them to do it doesn't mean the government is the only entity who could. It's much better for user security if no one can.

Really, if Apple had a backdoor, or was forced to make one for the Gov, I guarantee that Apple would be forced to build an entire building that holds nothing but staff to respond to these requests 24/7.

Not true. If Apple (or any other company) were forced to build a government backdoor, most likely it would be the government that holds the keys, so Apple would never be involved in any of the government accesses.

Honestly, if you had a government agency that you could trust enough, such as the courts themselves, maybe, this might not be such a bad approach. That's a really, really big "if", though. The technical challenges in securing such high-value keys are not insurmountable, but they're very high, and if the keys leak, the damage to the companies who make the affected devices would be huge. Further, at least in the US the organization we would most trust to get the technical design and implementation right, the NSA, is the organization we'd want to keep furthest from the whole thing. And even if all of the technical infrastructure was perfect, then the agency would also have to make sure that its processes for approving access are airtight and have adequate oversight to prevent abuse.

Yeah... let's just not go there. Police work is only easy in a police state, and we don't want a police state.

WHY CAN'T THEY LEARN!!?!

[Rick Schumann]

What the actual fuck is wrong with these gods-be-damned politicians that they don't understand the simple FACT that if you put a gods-be-damned 'backdoor' into ANY encryption algorithm, that your DESTROY it's ability to keep sensitive data out of the hands of the very people you're trying to 'protect' against!? Does the entire gods-be-damned WORLD have lead in it's drinking water? THIS is the sort of thing I'm talking about when I say "People are getting DUMBER". Don't these politicians have techical advisors who are (hopefully!) competent and intelligent, telling them precisely what I said above (and a million times already)?

Re:Here's a thought....

[gnick]

Quit letting people from terrorist prone countries or parts of the world into YOUR country...where they refuse to assimilate and become pots of festering terrorist ideology waiting to unleash itself into the host country.

Someone should have told the Aboriginals & Native Americans that a long time ago

It wasn't until I read this that it occurred to me that handing out smallpox infected blankets was an act of terrorism.

rolleyes

[XSportSeeker]

Encryption, the best tool to detect ignorance on politicians.
We should all be using it to give politicians with stupid proposals the boot.

Re:Not going to happen

[Marisaze]

Yes and no, while an ISP can trivially block certain traffic they wouldn't be able to block encryption as a whole so easily. It would be a never ending game of cat and mouse as ISPs struggle to figure out every possible way to obfusicate encryption.,Not only does it not solve the problem, it's a huge expense to the ISPs to maintain if it becomes their legal obligation to do so, and if they're not required to maintain the law then it's simply ineffective to begin with. Even using a whitelist of "approved traffic" wouldn't fix this as there's simply too many ways to wrap unapproved traffic, and a blacklist is equally easy to circumvent.

There's no true solution outside of manually monitoring every single piece of traffic for new ways of getting around the law, and as we all know: criminals don't care that your law exists and will get around it.

Re:better idea

[Jason Levine]

I looked up the numbers and terrorists kill about 28,000 people a year worldwide. And most of them are likely Muslims that the terrorists don't think are in the "right" sect.

From the linked article: "More than 55% of all attacks took place in five countries (Iraq, Afghanistan, Pakistan, India, and Nigeria), and 74% of all deaths due to terrorist attacks took place in five countries (Iraq, Afghanistan, Nigeria, Syria, and Pakistan)."

Terrorism in countries like the US or Australia is actually vanishingly low. It's touted as a horrible threat by politicians to take away rights and to get themselves more power, but you're more likely to die in a car accident than from a terrorist. (There are 37,000 road accident deaths in the US per year and 1.3 million worldwide - Source.)

If people want to ban all Muslims because of the tiny risk of terrorism, why aren't we banning all motor vehicles to combat the higher risk of automobile-related deaths?

Good luck.

[ewhenn]

Good luck legislating math.

Mathematicians, scientists, and politicians

[alispguru]

When mathematicians say something is impossible, they usually mean "logically inconsistent with published proofs, and those proofs are the basis of EVERYTHING".

When scientists say something is impossible, they usually mean "inconsistent with published models, and those models are good enough to take us to the moon and back".

When politicians say something is impossible, they usually mean "the current legislature will say no, but that can be changed".

When politicians hear "secure encryption with back doors is impossible", they hear "impossible" in legislative terms when it's really at least in scientific terms, and very close to mathematical terms.

Re:Here's a thought....

[Areyoukiddingme]

It wasn't until I read this that it occurred to me that handing out smallpox infected blankets was an act of terrorism.

It wasn't an act of terrorism, but it may have been an attempt at genocide with bioweapons...but it's not clear whether it was an intentional use of bioweaponry or not.

It was neither an act of terrorism nor an attempted genocide because it didn't happen. The entire story is a fraud, perpetrated by a former "ethnic studies" professor named Ward Churchill.

The High Plains Smallpox Epidemic of 1837 was caused by personal contact with infected passengers from the riverboat St. Peter's, owned by a fur trading company. The epidemic on the High Plains centered around Fort Clark which, despite the name, was not a military installation. It was a privately owned fur trading post. The boss of Fort Clark was Francis Chardon, a fur trader. His personal diary survived to this day, one of numerous eyewitness accounts preserved from the time.

Not only were infected blankets not distributed, but correspondence from Joshua Pilcher, the Indian Bureau's sub-agent to the Sioux, Cheyenne, and Ponca at Fort Kiowa, just south of Fort Clark, to Mr. Chardon describes one particular problem interfering with attempts to contain the epidemic that is curiously relevant to today. A smallpox vaccine existed in 1837, but Mr. Pilcher noted "it is a verry delicate experiment among those wild Indians, because death from any other cause, while under the influence of Vaccination would be attributed to that + no other cause[.]"

Sound familiar?

In 2006, Ward Churchill was found guilty of seven counts of research misconduct by the University of Colorado Ethics Committee. He was fired in 2007. He promptly filed suit, and won a jury trial for wrongful dismissal. The jury followed the instructions to the letter in coming to their conclusion, but recognized Churchill for the lying shitheel he was and awarded him precisely $1.00. (One juror denied any such motivation in a public interview.) A judge vacated the jury verdict on the grounds that the (state) university enjoys quasi-judicial immunity. The Colorado Court of Appeals upheld that decision. The Colorado Supreme Court agreed to hear an appeal and in 2013 agreed with both the first judge and the Court of Appeals that the university was immune to suit in these circumstances. The US Supreme Court declined to get involved.

It took 19 years from when Churchill first published his fraudulent bullshit in 1994 to the time when the judicial system finished with the case. It could easily take four or five generations for his lie to finally exit the public consciousness. This despite the fact that humanity currently has the fastest, most ubiquitous communications systems in the history of the species.

"A lie can travel halfway around the world while the truth is still getting its boots on." —Mark Twain[1]

----
[1] Except Samuel Clemens never wrote that. He was first credited with saying it in 1919, though he had died in 1910. The earliest known version of the sentiment in English was written by Jonathan Swift in 1710. His version was, "Falsehood flies, and the Truth comes limping after it;".

Re:Here's a thought....

[GameboyRMH]

I'm aware that Ward Churchill has fraudulently claimed that the 1837 outbreak was caused by an attempt at genocide by the US military using plague blankets. However, that was not the only incident. In fact there is hard evidence of intentional genocide using plague blankets as bioweapons against the native Americans by the British military.