Slashdot Mirror
Australia Set To Spy on WhatsApp Messages With Encryption Law (bloomberg.com)
Australia is set to give its police and intelligence agencies the power to access encrypted messages on platforms such as WhatsApp, becoming the latest country to face down privacy concerns in the name of public safety. From a report: Amid protests from companies such as Facebook and Google, the government and main opposition struck a deal on Tuesday that should see the legislation passed by parliament this week. Under the proposed powers, technology companies could be forced to help decrypt communications on popular messaging apps, or even build new functionality to help police access data.
Prime Minister Scott Morrison has said the legislation is needed to help foil terrorist attacks and organized crime. Critics say it is flawed and could undermine security across the Internet, jeopardizing activities from online voting to market trading and data storage.
Prime Minister Scott Morrison has said the legislation is needed to help foil terrorist attacks and organized crime. Critics say it is flawed and could undermine security across the Internet, jeopardizing activities from online voting to market trading and data storage.
I have always been suspicious of those Aussie's with their long knives and funny accents. What exactly are they up to down under there? They must be plotting something.
Do these legislative entities not realize that the bad guys can write their own encrypted apps?
Or send coded messages through existing apps that still won't help law enforcement?
What's to stop nefarious people from using that same functionality? If police can use it, even if you give them the benefit of all doubt that they would never do anything harmful with it, then the bad guys can use it too.... either because of leaks or hacking or what have you... and because the technology has to accommodate being decrypted in this way by legitimate law enforcement, how does the technology tell the difference, and recognize when it is being accessed by legitimate law enforcement and when it is not? And if (when) it cannot, then what extra measures are law enforcement going to take to protect the general public from such eventuality?
It seems to me that this is going to make law enforcement's job harder, not easier.
Australian lawmakers are idiots.... and that's being complimentary to actual idiots.
File under 'M' for 'Manic ranting'
This is stupid. Encryption is mathematics, and mathematics has no built in back-doors for illiterate politicians who don't understand how encryption works.
If you poke holes in it, then another motivated actor can find those holes and exploit them. Period.
Tell you what, politicians who demand broken encryption should be forced to use any such system for their own security. They'll cry loudly how their stuff is too important to use broken encryption.
Any encryption method which has back doors is, by definition, no longer secure. This will impact literally everything which uses encryption -- which these days is pretty much everything, including financial transactions.
You can't legislate that Pi is 3, and you can't legislate that encryption can be bypassed without understanding that if you can bypass it, someone else can and will also bypass it.
This is like mandating that all locks have a law enforcement button which opens the lock, and then saying nobody else will ever use that button because they're not supposed to -- it simply doesn't work that way in real life. Once you break it, it's broken for good.
These companies can't deploy once means of encryption in one place, and another means for Australia. So, yeah, TFS is right, this could undermine all network security.
Fucking idiot politicians.
Sometimes, they are. We know this because sometimes someone takes the software apart with reverse-engineering tools, then tells everyone.
That kind of universal verifiability is the basis of integrity. I've been pushing it for voting. Current electronic voting machines use secret software reviewed by some people under NDA and loaded on the machines before the election, so you can't verify any of it. For an electronic voting machine to be usable during an election, you need to publish the software image, and then prove that image is the image loaded at the beginning of polling--achievable, but brutally-stringent on exact procedures for opening and closing the polling day.
I've suggested the same about things like Single Transferable Vote and other voting rules: the state must publish the full ballot sets (which must be traceable to polling centers or marked as non-traceable mail-in absentee ballots) and the algorithm used to compute the results.
It's not that everyone has the tools and knowledge to verify the election; it's that we've made it impossible to get rid of the kid pointing out that the Emperor has no clothes. He won't stop telling everyone.
How long do you think we could hide code in WhatsApp to parallel-encrypt with another public key and send to another server?
How long could we hide code that downloads additional code and adds it to the application?
How would we keep people from dumping the memory space to find out what exactly that additional code does?
How quickly will Google start screaming that Facebook is doing something shady? What about RMS? Peter Gutmann?
Support my political activism on Patreon.
Whatâ(TM)s the chance that as soon as this is inacted some corporations will simply geo block Australia?
Unlocking the vault could be a slippery slope to anyone wanting to get in.
Jumpstart the tartan drive.
Just put that your application is not supported to run in Australia. As long as there is no business presence in the country the law should have no impact.
I'm looking forward to Apple turning off iMessage in Australia to make a point.
Of course, all access to this system will be recorded and stored on multiple sites with no way to delete or alter the records, for later review by elected officials to ensure no funny business like spying on political opponents.
What? No?
Huh.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
The 5 eyes networks will share every win in real time. Got some new keys to crypto? 4 other governments just got the same :)
Domestic spying is now "Benign Information Gathering"
It is worth knowing that this proposal emerged fully formed from the security agencies. This probably means that it was cooked up by the five eyes collective led by the USA and Australia was chosen as the country most likely to support it's introduction.
As many people have pointed out there is no way of implementing this without fundamentally violating the security of encrypted message applications and the impacts would flow on across the world. The assumption is that doing this would be undesirable.
Once in place, and proven to work other countries will rush to "catch up" with similar laws. Until this occurs the five eyes nations can all utilize the Australian back doors via existing intelligence sharing agreements.
If you can read this message, you'll know what to do.