Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Australia’s vague anti-encryption law sets a dangerous new precedent

protonmail.com

Post reply on HN
Print view View original

131–140 of 265 posts

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#131

Post by marcus_holmes »

fit2rule wrote: post #126
jeeeeb wrote: post #94

Earlier quoted context omitted.

I was worried about this as well which is why I read the law and commented above. The short answer is: 1. Non-compliance with a TAN/TCN is a civil not a criminal mater 2. As I stated above the law clearly says that it is a defence for non-compliance if a TAN/TCN would compel you to commit a crime in a foreign country. The issue is whether you can be compelled to commit an act in Australia, which would be a crime in a…

Well, I'm working on software systems that are precisely the sort of thing that the Australian government will target with this law (transportation systems), and it is highly likely that these systems will be targeted with a TAN/TCN. In fact, I'm pretty sure that the software segment that I currently work on is going to be hit by this law, and hard, within the next year or so. If I don't get a TAN/TCN request, I'm al…

Or you could just ensure that you don't have access to production systems in your job. Which you shouldn't have as a developer anyway. And that any code you write is reviewed before it is put into production. Which it should be anyway.

And if they do try it, any of your non-Australian colleagues who review your code can immediately raise the alarm.

The law is ridiculous not only because of all the points they're making, but also because it just doesn't work in a modern, distributed, company. They need to compel the entire dev team to do as they wish to avoid it being stopped at some point, and if just one of those devs are not Australian (or even not living in Australia) then the secrecy part is blown and the company can take preventative action to stop this happening.

Australia has just ensured that every single Australian tech company needs a non-Australian to review its code. An absolute decrease in Australian security. The Law of Unintended Consequences strikes agan.

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#132

Post by jeeeeb »

fit2rule wrote: post #126
jeeeeb wrote: post #94

Earlier quoted context omitted.

I was worried about this as well which is why I read the law and commented above. The short answer is: 1. Non-compliance with a TAN/TCN is a civil not a criminal mater 2. As I stated above the law clearly says that it is a defence for non-compliance if a TAN/TCN would compel you to commit a crime in a foreign country. The issue is whether you can be compelled to commit an act in Australia, which would be a crime in a…

Well, I'm working on software systems that are precisely the sort of thing that the Australian government will target with this law (transportation systems), and it is highly likely that these systems will be targeted with a TAN/TCN. In fact, I'm pretty sure that the software segment that I currently work on is going to be hit by this law, and hard, within the next year or so. If I don't get a TAN/TCN request, I'm al…

I'd recommend reading the actual law, as passed by parliament. Knowing your rights and legal options under the law and based on that approaching your MP (if you are still registered to vote in Australia) with your concerns to encourage them to address them.

To do that you really need to know what the law actually says and requires. Here is a start: TCN/TAN are not limited to Australian citizens. Revoking your citizenship will not shield you from being issued a TCN/TAN, but will lessen the value of your voice in engineering change.

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#133

Post by BLKNSLVR »

gtbc wrote: post #105
ggm wrote: post #99

Earlier quoted context omitted.

Do you live here? I do, and while tiny nuggets of truth are in individual sentence clauses, this is a very paranoid and over stated argument. We have a high court. They reverse bad federal and state laws. Lots of bad immigration decisions by ministers are being overturned. Mabo happened.

The jurisdiction of the court is largely granted by statute is it not? In fact, in the case of the bad immigration decisions you mention, the minister has tried to pass legislation to restrict judicial oversight. EDIT: And he is also alleged to have used his already considerable discretionary powers to allow au pairs for politically connected individuals into Australia in violation of their visa conditions, with no c…

The au pairs issue had such a short time in the media, it's frustrating. The fact that a minister can overrule existing policy for individual cases means that any ministerial position is ripe for corruption. Both au pair cases were referred to the minister because of personal relationships with the minister as opposed to the cases themselves being worthy of reporting to the most senior level.

If there's a problem with policy, change the policy. Don't do favours for your mates if it contravenes policy. It's not fucking hard.

The fact the minister hasn't been fired is quite damning about the status of Australian politics, and highlights the need for a federal anti-corruption body.

What's worse is that this particular minister is the one forever pushing for lower immigration, greater protection for Australia's borders and showing no remorse for sick children in offshore detention - but fuck, my mate needs a French woman, who's previously worked in Australia despite only having a tourist visa, to look after his kids because he and his wife are rich enough not to have to parent their own little cunts.

shakes fist at cloud

/rant

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#134

Post by cyphar »

ObsoleteNerd wrote: post #113
zmmmmm wrote: post #107

I'm grappling with what to do about this law. I develop software in Australia, for a company, separately as a private software vendor and separately again as an open source contributor. From what I can understand, this law can compel me to silently insert malware into any of these. Morally I feel like I need to modify the licenses, READMEs and terms of conditions for products I sell and the contracts under which I do…

Maybe something like a warrant canary makes more sense? An encryption canary? Would that even pass with the new laws though? Also you stating that you might have been forced to insert malware by the government surely breaks the rule that says you can't tell anyone too, if I'm understanding it correctly.

Warrant canaries aren't necessary (nor are they legal in Australia). The law allows you to provide aggregated statistics on how many requests you've received in a 6-month period.

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#135

Post by BLKNSLVR »

Taniwha wrote: post #129

(essentially repeating a recent twitter thread here) Imagine you work in a modern software house and you get one of these ... and here I mean you, not your boss, not your coworkers, the govt knocks on your door and demands you put a back door in the thing you are working on at work ... So you write the code ... how do you write the unit test? how do you get it past the code review? the mandatory QA tests? ... all the…

This: https://twitter.com/alfiedotwtf/status/1070047303275175936

Which is absolutely brilliant.

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#136

Post by cyphar »

jmpman wrote: post #111
jmpman wrote: post #72

Apple should suspend selling any products into Australia and announce layoffs of all Australian employees for the day before the law goes into effect. The Australian market is small enough to make a stand without impacting the bottom line.

Would it be considered a boycott? I believe US companies are no longer allowed to boycott another country without authorization from the US government.

Apple has a subsidiary incorporated in Australia, which is necessary to do business here. They can just shut up shop, and fire all their Australian employees (though Australian labour laws might make this difficult to do without being sued for unfair dismissal).

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#137

Post by fit2rule »

marcus_holmes wrote: post #131
fit2rule wrote: post #126

Earlier quoted context omitted.

Well, I'm working on software systems that are precisely the sort of thing that the Australian government will target with this law (transportation systems), and it is highly likely that these systems will be targeted with a TAN/TCN. In fact, I'm pretty sure that the software segment that I currently work on is going to be hit by this law, and hard, within the next year or so. If I don't get a TAN/TCN request, I'm al…

Or you could just ensure that you don't have access to production systems in your job. Which you shouldn't have as a developer anyway. And that any code you write is reviewed before it is put into production. Which it should be anyway. And if they do try it, any of your non-Australian colleagues who review your code can immediately raise the alarm. The law is ridiculous not only because of all the points they're maki…

>Or you could just ensure that you don't have access to production systems in your job.

Okay, so this just pushes the problem onto someone elses plate - the operator/sysadmin. I've known a few Australian operators. The law doesn't specifically target 'only people who can write code' - it applies to anyone who has access to the systems the Australian kooks and spooks want to infiltrate.

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#138

Post by edoo »

Imagine you run a secure webmail provider where all data is truly encrypted and served up to the user that decrypts it using a 3rd party javascript library that isn't even hosted on your site.

Based on the wording of this they could compel you to target that user and serve up a javascript decryption library of the governments choice.

In a similar vein they could compel Android/MS/IOS system updates to include trojans in search of decryption keys.

Edit: This is a good argument to only use Linux or BSD. Unless you had some sort of management contract it would be near impossible to be directly targeted with system updates. They'd have to get the signing key for your distro and intercept/rewrite package downloads. I bet you this is standard affair for high value targets. If you were paranoid you could update or mirror through a proxy.

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#139

Post by fit2rule »

jeeeeb wrote: post #132
fit2rule wrote: post #126

Earlier quoted context omitted.

Well, I'm working on software systems that are precisely the sort of thing that the Australian government will target with this law (transportation systems), and it is highly likely that these systems will be targeted with a TAN/TCN. In fact, I'm pretty sure that the software segment that I currently work on is going to be hit by this law, and hard, within the next year or so. If I don't get a TAN/TCN request, I'm al…

I'd recommend reading the actual law, as passed by parliament . Knowing your rights and legal options under the law and based on that approaching your MP (if you are still registered to vote in Australia) with your concerns to encourage them to address them. To do that you really need to know what the law actually says and requires. Here is a start: TCN/TAN are not limited to Australian citizens. Revoking your citize…

Pretty simple: there are countries where these activities are highly illegal. I'll become a citizen of one of them instead.

Re: Australia’s vague anti-encryption law sets a dangerous new precedent

#140

Post by ColanR »

edoo wrote: post #138

Imagine you run a secure webmail provider where all data is truly encrypted and served up to the user that decrypts it using a 3rd party javascript library that isn't even hosted on your site. Based on the wording of this they could compel you to target that user and serve up a javascript decryption library of the governments choice. In a similar vein they could compel Android/MS/IOS system updates to include trojans…

That's why in-browser email should never be considered secure against an actor of this scale.
Post reply on HN