Commandeering Australian citizens to become spies • Hacker News Board

Re: Commandeering Australian citizens to become spies

#11

Post by brokenmachine » Thu, Dec 06, 2018, 1:30 PM UTC

mabbo wrote: post #5

vermilingua wrote: post #3

This is based on a false premise, that the Govt will ask developers , and that they would care if it is difficult/infeasible/impossible to actually complete. In reality, they issue a notice to the company, give them a timeframe, and expect it to be done. They don’t care about the intricacies of git.

But the problem remains the same: how do you keep it a secret? How does the backdoor not get leaked immediately to the press, to the customers of the software, etc? Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. Edit later: by 'freedom taken seriously I mean by the people, not by the government.'

>Australia is a Western nation where freedom is taken seriously.

Oh, you sweet summer child.

Re: Commandeering Australian citizens to become spies

#12

Post by brokenmachine » Thu, Dec 06, 2018, 1:31 PM UTC

alfiedotwtf wrote: post #8

cylinder wrote: post #6

Earlier quoted context omitted.

Yeah you just go to the CEO or legal counsel, threaten loss of licenses, seizure of personal assets

CEO or legal counsel? They can directly compel current and former individual employees: https://twitter.com/alfiedotwtf/status/1070658693409079296

Former employees? So you can't even resign? WTF?

Re: Commandeering Australian citizens to become spies

#13

Post by mtarnovan » Thu, Dec 06, 2018, 1:36 PM UTC

cyphar wrote: post #7

vermilingua wrote: post #3

This is based on a false premise, that the Govt will ask developers , and that they would care if it is difficult/infeasible/impossible to actually complete. In reality, they issue a notice to the company, give them a timeframe, and expect it to be done. They don’t care about the intricacies of git.

The law explicitly allows them to target individuals. I don't believe that they gave themselves this power for no reason -- it's much easier to coerce an individual developer (who doesn't have fancy legal council) than force a company to do something. I'm sure they'll do it both ways of course, but I disagree that they'll only target companies.

I also think they would normally approach this top-down. The provision to target individuals might have been added just for the odd case were the normal approach is not feasible.

I still wonder how this law doesn't go against individual rights provided by the Constitution or other fundamental laws.

Either way this law is hilariously clueless and extremely worrying at the same time.

Re: Commandeering Australian citizens to become spies

#14

Post by 3pt14159 » Thu, Dec 06, 2018, 1:45 PM UTC

cyphar wrote: post #7

vermilingua wrote: post #3

This is based on a false premise, that the Govt will ask developers , and that they would care if it is difficult/infeasible/impossible to actually complete. In reality, they issue a notice to the company, give them a timeframe, and expect it to be done. They don’t care about the intricacies of git.

The law explicitly allows them to target individuals. I don't believe that they gave themselves this power for no reason -- it's much easier to coerce an individual developer (who doesn't have fancy legal council) than force a company to do something. I'm sure they'll do it both ways of course, but I disagree that they'll only target companies.

That's a mischaracterization. Any type of entity can be targeted, but not any agent. That's an important distinction to stop people acting as private individuals on their own time from being exempt from the law.

Not that I think this will work—it wont in the long run—but I'd rather argue against the strongest case of an argument.

Re: Commandeering Australian citizens to become spies

#15

Post by jaketay » Thu, Dec 06, 2018, 1:49 PM UTC

This legislation has support from both major parties, it's set to pass either this week or next. I don't know why Google, Facebook, Tesla, Microsoft, Atlassian and other big tech companies with investments in Australia don't push back. Nothing pressures Australian politicians more than an advertising campaign. The mineral resources industry spent just $8m on advertising to prevent a new mining tax that would have cost them several billion dollars. Better yet, as the Government is currently being held together by a few minority seats just spend a few hundred thousand in the most at risk seats. That alone would be enough to completely abandon or water down this legislation.

Re: Commandeering Australian citizens to become spies

#16

Post by cyphar » Thu, Dec 06, 2018, 1:49 PM UTC

3pt14159 wrote: post #14

cyphar wrote: post #7

Earlier quoted context omitted.

The law explicitly allows them to target individuals. I don't believe that they gave themselves this power for no reason -- it's much easier to coerce an individual developer (who doesn't have fancy legal council) than force a company to do something. I'm sure they'll do it both ways of course, but I disagree that they'll only target companies.

That's a mischaracterization. Any type of entity can be targeted, but not any agent . That's an important distinction to stop people acting as private individuals on their own time from being exempt from the law. Not that I think this will work—it wont in the long run—but I'd rather argue against the strongest case of an argument.

According to Sect 317C, a "designated communications provider" includes:

    A person is a designated communications provider if ...

    6. the person develops, supplies or updates software used, for use, or likely to be used, in connection with:

      (a) a listed carriage service; or
      (b) an electronic service that has one or more end-users in Australia

    ... and the eligible activities of the person are ...

      (a) the development by the person of any such software; or
      (b) the supply by the person of any such software; or
      (c) the updating by the person of any such software

So individuals can definitely be targeted -- it's specifically in the bill. In your parlance, all individuals that "develop, supply, or update software that is likely to be used by an electronic service that has one or more end-users in Australia" are entities and not agents. They are defined to be a "designated communications provider" and the same rules apply to them as any other "designated communications provider".

Re: Commandeering Australian citizens to become spies

#17

Post by jjgreen » Thu, Dec 06, 2018, 2:18 PM UTC

nicwilson wrote: post #2

See also https://old.reddit.com/r/programming/comments/a3kk7u/austral... https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat... and for a laugh at the sad state of affairs https://www.youtube.com/watch?v=eW-OMR-iWOE

Interesting comment on that thread. Since all Australian SSL certs are now compromised (we must assume that), shouldn't all Australian certifying authorities be de-trusted?

Re: Commandeering Australian citizens to become spies

#18

Post by phoe-krk » Thu, Dec 06, 2018, 2:28 PM UTC

BLKNSLVR wrote: post #10

Something interesting about this is that proper code management practices would mean there would have to be a chain-of-command having knowledge of the need for a specific code commit that targets a single user with a surveillance backdoor. Could an approached employee say "I have to run this past software engineer X" before it will even be allowed to commit, so software engineer X is read-in, but he has to get auth f…

Also, what exactly happens if the code is worked on in teams and/or available for any people in the company (and it sure is), and if another developer questions the committed code or attempts to change or remove it? Does such code gets explicitly painted "don't remove, don't edit, don't ask any questions"? Suddenly we get code in our product that nobody cannot talk about, nobody should understand, and nobody can fix if it introduces any other bugs into the product.

It's a complete disaster.

Re: Commandeering Australian citizens to become spies

#19

Post by hannasanarion » Thu, Dec 06, 2018, 2:30 PM UTC

jaketay wrote: post #15

This legislation has support from both major parties, it's set to pass either this week or next. I don't know why Google, Facebook, Tesla, Microsoft, Atlassian and other big tech companies with investments in Australia don't push back. Nothing pressures Australian politicians more than an advertising campaign. The mineral resources industry spent just $8m on advertising to prevent a new mining tax that would have cos…

It passed earlier today, it's law now.

Re: Commandeering Australian citizens to become spies

#20

Post by marcus_holmes » Thu, Dec 06, 2018, 2:34 PM UTC

cyphar wrote: post #16

3pt14159 wrote: post #14

Earlier quoted context omitted.

That's a mischaracterization. Any type of entity can be targeted, but not any agent . That's an important distinction to stop people acting as private individuals on their own time from being exempt from the law. Not that I think this will work—it wont in the long run—but I'd rather argue against the strongest case of an argument.

According to Sect 317C, a "designated communications provider" includes: A person is a designated communications provider if ... 6. the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-users in Australia ... and the eligible activities of the person are ... (a) the development by…

The difference between can and will be is huge.

Look at it from their point of view... they approach some developer and it's amateur hour. The dev might get stroppy, there's all sorts of infrastructure problems, they might not do it right... it's a mess.

But if they approach the CEO, it gets done right. The CEO brings in Legal, who promptly shit themselves. They bring in the CTO, who is told to shut up, sign this NDA, and work out how to make this happen as fast and painlessly as possible. No problems, the bad things get done, no-one gets told anything, all good. Shit continues to roll downhill...