Slashdot Mirror
Australia Passes Anti-Encryption Laws [Update] (zdnet.com)
Earlier today, Australia's House of Representatives passed the Assistance and Access Bill. The Anti-Encryption Bill, as it is known as, would allow the nation's police and anti-corruption forces to ask, before forcing, internet companies, telcos, messaging providers, or anyone deemed necessary, to break into whatever content agencies they want access to. "While the Bill can still be blocked by the Senate -- Australian Twitter has been quite vocal over today's proceedings, especially in regards to the [Australian Labor Party's] involvement," reports Gizmodo. ZDNet highlights the key findings from a report from the Parliamentary Joint Committee on Intelligence and Security (PJCIS): The threshold for industry assistance is recommended to be lifted to offenses with maximum penalties in excess of three years; Technical Assistance Notices (TANs) and Technical Capability Notices (TCNs) will be subjected to statutory time limits, as well as any extension, renewal, or variation to the notices; the systemic weakness clause to apply to all listing acts and things; and the double-lock mechanism of approval from Attorney-General and Minister of Communications will be needed, with the report saying the Communications Minister will provide "a direct avenue for the concerns of the relevant industry to be considered as part of the approval process."
The report's recommendations also call for a review after 18 months of the Bill coming into effect by the Independent National Security Legislation Monitor; TANs issued by state and territory police forces to be approved by the Australian Federal Police commissioner; companies issued with notices are able to appeal to the Attorney-General to disclose publicly the fact they are issued a TCN; and the committee will review the passed legislation in the new year and report by April 3, 2019, right around when the next election is expected to be called. In short: "Testimony from experts has been ignored; actual scrutiny of the Bill is kicked down the road for the next Parliament; Labor has made sure it is not skewered by the Coalition and seen to be voting against national security legislation on the floor of Parliament; and any technical expert must have security clearance equal to the Australia's spies, i.e. someone who has been in the spy sector." Further reading: Australia Set To Spy on WhatsApp Messages With Encryption Law.
UPDATE: The encryption bill has passed the Senate with a final vote of 44-12, with Labor and the Coalition voting for it. "Australia's security and intelligence agencies now have legal authority to force encryption services to break the encryptions, reports The Guardian. Story is developing...
The report's recommendations also call for a review after 18 months of the Bill coming into effect by the Independent National Security Legislation Monitor; TANs issued by state and territory police forces to be approved by the Australian Federal Police commissioner; companies issued with notices are able to appeal to the Attorney-General to disclose publicly the fact they are issued a TCN; and the committee will review the passed legislation in the new year and report by April 3, 2019, right around when the next election is expected to be called. In short: "Testimony from experts has been ignored; actual scrutiny of the Bill is kicked down the road for the next Parliament; Labor has made sure it is not skewered by the Coalition and seen to be voting against national security legislation on the floor of Parliament; and any technical expert must have security clearance equal to the Australia's spies, i.e. someone who has been in the spy sector." Further reading: Australia Set To Spy on WhatsApp Messages With Encryption Law.
UPDATE: The encryption bill has passed the Senate with a final vote of 44-12, with Labor and the Coalition voting for it. "Australia's security and intelligence agencies now have legal authority to force encryption services to break the encryptions, reports The Guardian. Story is developing...
This is Australia, where the laws of the nation Trump the laws of mathematics.
Sent from my ASR33 using ASCII
I'd really like to see who they take to court to try and undo the encryption on the Monero et al. blockchains.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
I wouldn't be a bit surprised if this bill was a backroom deal between the desires of the five eyes and the Australian Government.
Breaking encryption for one government breaks it for all.
I just means there will be a plethora of hidden encryption apps used exclusively by those who plan to do evil.
Wait until someone adds machine learning to the process of communicating meaning and watch people's messages disappear entirely.
As it's not words that information gathers wish to capture, but the meanings being conveyed.
The Australian government have escalated the information war, and don't understand the consequences of doing so.
Has been stopped for now:
No it hasn't. It is being debated in the Senate right now.
My ism, it's full of beliefs.
The senate had to pass back the bill to the house of representatives to accept its amendments, and the government has called it quits for the year in order to avoid allowing asylum seekers to be transferred from island prison camps to australia to receive medical care
I mean how can you ignore experts on a question that only experts can understand? It does not get much more stupid than this.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Watching the debate that is happening right now, the lies being used to convince the house to pass this Bill are just sickening.
For US, UK, NZ, Canadian citizens their governments can access the powers via existing intelligence agreements.
The Australian government have escalated the information war, and don't understand the consequences of doing so.
Fraud. They talk about not building backdoors, they just want the keys to the front door by coercing IT professionals with fines, liability and jail time.
My ism, it's full of beliefs.
They are attempting to pass the Bill in the senate at this very moment. I am watching them debate passing it it *right now*.
This is about all software.
My ism, it's full of beliefs.
Bullshit - I am watching the debate in the Senate as I am typing this to you.
My ism, it's full of beliefs.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
It has been a dream for any one of the five eyes countries to pass laws like this. Once the agencies are able to get a foot in the door, precedence will be used as a reason the other four courts should also have access to the data. "The tools to are already created" argument will now exist in a courtroom . This is going to open a whole plethora of doors for all countries.
This will quickly spill over into the rest of the world. Once you see the democracies of the world go this route, the flood gates will open. There will be laws made all over the world that will copy this word for word. Entire turn-key packages to look all of this up will be sold to the highest bidders.
In the end, I see a market being created for stolen country keys and hacked law enforcement portals. Those keys will be nearly priceless. One key for all of whatsapp? Done. One portal for all of proton-mail? Done. The next question will be, "How would you like your secrets served up today sir?"
--
Be mindful when it comes to your words. A string of some that don't mean much to you, may stick with someone else for a lifetime. - Rachel Wolchin
https://www.abc.net.au/news/20...
The "opposition" has just moved to drop their own amendments to the Bill. The Division bell is now ringing. The greens attempted to move the "oppositions" amendments however leave was not granted for them to do so.
So for all of the effort from industry and individuals the Bill now stands before the Senate to be passed as originally presented in its flawed form.
This is disgusting.
My ism, it's full of beliefs.
https://en.wikipedia.org/wiki/... wrote this.
its pretty much the same as Regulation of Investigatory Powers Act 2000 (c.23) (RIP or RIPA) is an Act of the Parliament of the United Kingdom
they don't try and break encryption they simply ask that you hand over the Keys so they can break into the stream
the same thing as the :
United States Foreign Intelligence Surveillance Court (FISC, also called the FISA Court) is a U.S. federal court established and authorized under the Foreign Intelligence Surveillance Act of 1978 (FISA) to oversee requests for surveillance warrants.
so americans do you want to examine your own systems because the people who Cant Infiltrate Anything simply go to court...
It seems it's been too long since we've had to work for our freedom and pay for it in blood, both our enemies' and our own.
That which comes free and is considered to be a given rarely has any worth in the eyes of people.
We are descending into totalitarianism again, one way or another, and at some point we will be sick enough of being enslaved, also one way or another, that we'll rise up, heads will roll and we'll install another ruling class, one we trust, to slowly grow complacent and enamored with their power.
The cycle is alive and well and we merely markers on it.
That's something the German attempts at data retention laws have taught me. Politicians will always try to pass some BS w/o thinking the implications through. It usually comes crashing down. In my experience Supreme Courts have a habit of wanting reasoning, procedures, redress procedures, limitations and implementations explained to them. Then the inconsistencies come to light in a forum they cant bullshit their way out of. I've seen numerous instances were courts asked the government if they had a severe case teh dumb.
Panic and autocratic name calling should be reserved for when the supreme court says a law is OK. Until then keep talking about the BS inconsistencies.
The ones in power I presume has the most to hide... I aint shit to hide sir... soon you'll find most people are like that.... except for the ones at the top. This may be your downfall....
[($)]
The first duty of an agency that wishes some unknown data to be decrypted would be to prove that it was, in fact, an encrypted message. If they were presented with a file containing random numbers they couldn't just say "you must provide the key to decrypt that" as they have not shown that such a key actually exists.
Of course, the only way to prove that such a key exists would be to use it to decrypt the data. But until the transmission of blocks of random junk becomes widespread and well known (possibly with the occasional encrypted message inserted, as government agencies do it) the "reasonable man" criteria would apply and courts would assume that all apparently random data is actually encrypted messages.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
I cannot imagine they have thoroughly vetted this. Send them on their way
LOL what will they do next?
Actually, the right supports privacy and encryption. The left supports a lack of privacy, and no encryption, because it's important that the rights of the government exceed the rights of the individual, which is actually fascism.
A lot of people say this won't work, but it will work. Mostly companies will just block encrypted traffic, or force people to use encryption that can be easily broken. Use of strong encryption will be pretty much tantamount to an admission of guilt for whatever they accuse you of. If there's money to be made, and as small a country as Australia is, there is actually money to be made out of 20+ million people, then it's big enough that companies will work to help the Australian Government enforce it's laws, just how American, European and Chinese companies all charge people GST for Australia now, even though it was said that it wouldn't work, and would be impossible to enforce.
What you really need to worry about.... Australia has long been a testing ground to work out if new ideas will be accepted in the US.
They will simply respond with this.
In the end, technological measures cannot protect you; only the rule of law can. This bill compromises the rule of law, reduces accountability and transparency, and will cause long term civil and economic damage to Australia as a result.
Okay honey, let me go pass a law to make them exist for you.
I can see how a local telco like Telstra might have to do it, but the tech giants like Apple/Google/MS etc don't.
Bwahahahah! That's a good one. Yeah, I'm sure they're all just lining up to put principles ahead of profit.
All they have to do is a pop-up which says "In compliance with Australian regulation whatever it's called, your unique decryption key will be uploaded to and retained on our servers. Have a nice day."
---
DRM is like antifreeze, to the MPAA/RIAA it's sweet, to the consumers it's poison.
Please stop saying "Australia" did these things, it's our batshit politicians not the people.
Aussies are all for compression. They compress words lie:
Sraya for Australia
Assie for Australian
Avro for Afternoon
Brickie for Bricklayer
Brolly for umbrella
etc..
Since encryption messes with compression. They are culturally averse to it.
Well, that's not entirely true. What will happen in reality is that everything that relies on encryption, will either leave AU or be inherently insecure.
They will also find themselves an island in many more ways than they already are because they will be treated as a security hole. By both the good and the bad guys. They have no idea what they are in for.
Well, AC, is Australia party to any such ISDS agreement with the USA?
And if there's a leak, it could come from Apple or Microsoft or Facebook, just as easily as from the Australian spies.
Also, of course, there are already companies from 'friendly' nations that sell software that breaks Apple's encryption, as well as others. Hello Israel!
BS by definition lies.
Generally there are two ways this will work:
1. Companies/corporations that build or provide services using uncrackable encryption get fined and then sanctioned until they either build in backdoors or go out of business/leave the country.
2. Users of such services get fined or imprisoned until they render their passwords. Use of hard encryption first becomes evidence of wrongdoing, and then conclusive proof of it.
Well, they have all been fighting the law since time immemorial. You think they are suddenly going to do a 180?
This is Australia, where they "block" piratebay at the DNS level.
Actually, the right supports privacy and encryption.
Of course they do.
Ezekiel 23:20
Fighting that stupid ISDS law?
Yes, and Australia has, more recently, just said "Nope!" to any agreement that tries to include such idiocy, thankfully.
hold back an OS and telco who have to help a 5 eye gov/mil?
Domestic spying is now "Benign Information Gathering"
It usually comes crashing down. In my experience Supreme Courts have a habit of wanting reasoning, procedures, redress procedures, limitations and implementations explained to them. Then the inconsistencies come to light in a forum they cant bullshit their way out of. I've seen numerous instances were courts asked the government if they had a severe case teh dumb.
No, only if the law is unconstitutional.
The law now says that if you, as an IT professional, do not comply you are deemed not in compliance and subject to fine ($60,000) and jail terms (up to 10 years). Additionally, you are subject to the liability from users who take legal action to recover damages if they were the victim of a subsequent crime because the government's actions - how is that for a stroke of cuntishness if you want to try to protect you users privacy.
If you do comply you are obliged to keep the actions you have complied with secret or face ($30,000) and 5 years jail and the users have no recourse to recover damages as a result of the consequences.
My ism, it's full of beliefs.
US: Nobody can do anything more embarrassing than us. Just look at the 'president' we've elected.
Australia: Hold my beer...
And who gets to decide if you've "provided as much technical assistance and information as possible"?
The prosecutor charging you with a crime presumably.
And on what basis will they make the decision?
Whether they got the information they were looking for of course.
There's a rather straight forward solution to this problem, but I doubt tech companies have the backbone to do it. Every tech company should stop selling their products and services to Australia until this law is reversed. Take away the iPhones, Facebook, Android, and every all website from anyone in Australia. Let the people of Australia decide if they want these gadgets or if they want a government that can break encryption.
Companies bulding encryption into their product is absolutely worthless. I don't trust any app that provides its own security/encryption. I don't trust the company to not give it up. For example any cloud company wanting me to use their service. I'll encrypt my data locally using encryption tools that I control and upload a pre-encrypted blob to your cloud if I want to use your service.
Digital is, by definition, imperfect. Analog is the way to go.
Once again, the wrench cartoon is unironically used in a situation where it actually indicates that the citizen ends up being protected against the most common and concerning attacks.
Here is why a $5 wrench does not completely compromise the privacy given by cryptography: it is impossible to hit someone with a wrench without them knowing about it. In fact, you can't even show a wrench to someone purely for intimidation purposes, without them knowing about it.
Massive slurping on an internet backbone, using wrenches? Can't do it.
Secretly investigating someone by wrench-cracking their crypto without them at least being able to talk to a lawyer? Can't do it.
It's a technological measure, and it works. Crypto nerds have already beaten the wrench is most conceivable scenarios. The situations where the defense doesn't work? Doesn't matter, because those scenarios are someone's silly movie fantasy.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Obviously, after this, there is no encryption in publicly available apps in Australia. My questions is if the new law makes it a crime to user your own encryption. If it is, then encryption is totally broken in Australia. If not, for those who care, there will be ways around this.
Some settling may occur during posting.
For those needing it, personal watermark encryption will make this vote inoperative.
As long as it's only them using it or they have a backdoor.
This is Australia, where the laws of the nation Trump the laws of mathematics.
Indiana used to be the same way. Where's C.A. Waldo when you need him?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
If the government takes your computer, or device, there will be nothing to decrypt.
Does the also require passwords to online storage?
Math
Spooks and Cops have tried and failed a couple of times to pass "lawful access" provisions into law in Canada. Strong push-back on what has been euphemistically rebranded "awful access" has so far succeeded in shutting this down. See: http://www.michaelgeist.ca/tag...
Coded messages would float completely under the radar, they're not encrypted as far as any algorithm is concerned.
Or they could use encrypted or unencrypted messages embedded in something else. Steganography. Unencrypted would be fine and probably legal under the new law. If you set one bit in each word in a losslessly stored image such that the nth bit in the low-order nibble of the low-order byte is the nth bit in a message, but the message itself is not encrypted, then your storage is just a file system. An inefficient one, but still just a file system.
The people who suffer are small businesses, banks, eCommerce vendors, software vendors (since encryption is how you guarantee safe delivery), hospitals (since distributing medical records will now have to be done on paper) and aviation (Australian airlines cannot meet EU data protection standards for passenger records and cannot prove flight worthiness to EU standards).
The extent they suffer will be random, based purely on Dame Fortuna, Baccus and Randomus Factoria, not on common sense, rational thought or logic.
It's a pity the UN can't ban stupidity. Sadly, they haven't the wits.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Looking in outstanding mode but have folk who
* Actually read the act
* Read amendments
* Informed debate on how this cascades
* Impact on companies and customers
There's another factor. If someone has something really significant, even if it's just money, the thief would have to kill you afterwards to keep you quiet. Same reason people will say anything -other- than the truth when tortured. There's no value in the truth, there's only value in keeping the other person busy.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
If I was any company potentially affected by this, and the data security of my customers was important to me, I'd probably pull my services out of Australia over this, and that's precisely what I'd recommend to any and all companies operating in Australia at this point in time. This is utter and complete bullshit from the Australian government and it should not be allowed to stand.
..and as others have pointed out in this instantiation of this subject, as in past conversations about it, as in many comments of my own in the past: now that encryption-for-all is essentially worthless in Australia, only Australian criminals, and terrorists, and other 'ne'er-do-wells' will have encryption -- and the idiotic Australian govenment will have no way to 'force' anyone to unlock any of that. Only legitimate communications, transactions, and data will be compromised.
The depths of utter stupidity our species is capable of astounds me. It's no wonder, if there are actually starfaring alien civilizations in our galaxy, that they would refuse to reveal themselves to us. Things like this are an embarassment.
Where power is asserted through violence and intimidation, law is a pretext.
In such a society, violence is circular as is the reasoning.
Where good law is asserted through mutual consent, government is a service.
In such a society, power is largely, though not entirely, superfluous and violence approaches but doesn't quite reach zero. You have whatever sized government you like but very little control in it. It's functional, not managerial.
It's ultimately about what society values.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Ever since the Salties escaped the swamps and lagoons, learned to dress and became politicians, you've had no chance.
It's a matter of finding the kryptonite they've been using. It's out there, somewhere...
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Freedom of speech is not a meaningful cause?
FTFY.
Check out my sci-fi/humor trilogy at PatriotsBooks.
You need to think this through and not fall into a partisan trap. The left wants more power for a leftist government, and the right wants more power for a rightist government. Any candidate with enough integrity to be for the people won't get elected for the reason of avoiding gutter politics.
it is impossible to hit someone with a wrench without them knowing about it
The new law mandates that companies which have provided "technical assistance" are not allowed to talk about it. You will be undermined by your IT platform (either the software you use or the services you use or both) and you won't know about it.
Massive slurping on an internet backbone, using wrenches? Can't do it.
It absolutely can be done, and this is what the new law enables. They will go to the backbone provider and hit them with wrenches until they provide the "technical assistance" required. That can be compromising encryption going forward or it can be building backdoors into their systems.
Secretly investigating someone by wrench-cracking their crypto without them at least being able to talk to a lawyer? Can't do it.
You can do it. You hit the crypto software developer with wrenches until they provide the "technical assistance" required. The target won't know about it because the software developer can't talk about it by law.
Most humans don't want to read and enter encryption from another computer/from paper.
:)
Walking around with a one time pad for each message?
Stopping to work out each line of a message by hand?
They trust their brand, OS to create/remove the encryption as part of a modern lifestyle.
One computer can do it all for the user. Encrypt/decrypt/network all on the same trusted computer and networked OS.
The user "trusted" OS where 5 eyes gov/mil malware will wait for the human to create and later decrypt code.
Malware gets rushed out and deep into the users computer and allows a gov/mil to be that user on their own computer
Domestic spying is now "Benign Information Gathering"
I tweeted last night an idea on how we could possibly get this repealed. I decided to put my money where my mouth is open source; open community; http://internetprotests.com/wh... If we the internet join together; I believe we could get it repealed. Guess that depends on how much the people are willing to do to work against it... Just complain or actually do something about it.
Australia is currently working on a legislative solution to the discrete logarithm problem.
sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
Even in Oz there are people who think that simple legislation can change the value of pi to 3.000.
{+_+}
*sigh* You're a blast from the past...
“He’s not deformed, he’s just drunk!”
That is one form of Socialism, not all forms. Doesn't anyone have the capacity to comprehend basic English?
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)