The article buries the lede pretty badly.
>The government’s explanatory note says that the Bill could force a manufacturer to ... install government software on it
If the bill passes, using a phone purchased in Australia is no longer secure. I know my security threat model excludes manufacturer-installed root kits - is there a reasonable strategy for mitigating this risk? Buying a phone in the US and importing it yourself is one, but that seems very awkward.
edit: reading the actual text, there's some protection in section 317ZG, which prohibits the law from being used to cause "systematic weakness" or "systematic vulnerability", but explicitly carves out an exception for targeting specific devices. So for a specific example, the bill would allow the Australian government to compel Apple to secretly push an over-the-air update to backdoor a specific device of interest.
>The mere fact that a capability to selectively assist agencies with access to a target device exists will not
necessarily mean that a systemic weakness has been built.
Yeah, the bill is definitely designed to allow exactly the scenario I described. They're after using the code-signing keys and technical expertise of device manufacturers and communication program developers to target individual devices with encryption backdoors.
>Likewise, a notice may require a provider to facilitate access to information prior to or after an encryption
method is employed, as this does not weaken the encryption itself.
Definitely planning on backdooring devices and reading the messages pre-encryption and post-decryption.