Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft says encryption laws make companies wary of storing data in Australia

abc.net.au

Post reply on HN
Print view View original

201–210 of 294 posts

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#201

Post by mcv »

jeremija wrote: post #144
mastazi wrote: post #51

Earlier quoted context omitted.

"For example, Australia’s law enforcement could compel Apple to provide access to a customer’s iPhone and all communications made on it without the user’s awareness or consent. An engineer involved would, in theory, be unable to tell their boss about this, or risk a jail sentence." Source: Sydney Morning Herald https://www.smh.com.au/business/consumer-affairs/dangerous-o... That would be a 5-year jail sentence appare…

How exactly would this work? Let's say I have been coerced into making a back door, and my company has a policy of enforcing code reviews for every project. Surely, somebody would notice? Or would they count on me to do my best to obfuscate the back door? What if I "don't know" anything about obfuscation?

Good question. I think nobody knows. Most likely what happens is:

  * You make the change
  * You report back that you made the change and it's now pending in code review
  * Your change gets rejected in code review
  * Australia tells you to make the change and circumvent code review
  * You tell them you have no way to do that; every change goes through code review
  * Australia wants to know who reviews your code, and if your code could be reviewed by an Australian
  * Your boss asks you why you haven't delivered any changes recently and why are you constantly on the phone explaining the code review process
  * Australia contacts a reviewer and tells them to accept your next change or else
  * You get fired before you can submit the change again

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#202

Post by mastazi »

incompatible wrote: post #170
mastazi wrote: post #30

I have migrated to Australia many years ago and I have recently become eligible to become a citizen. However I’ve heard stories of tech companies refusing to hire Australians because of the AA Bill, so I’m holding it off for now. The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer. I…

Australian law generally affects residents of Australia, not citizens. Are you sure they couldn't coerce you already?

The main point for me is not whether or not they can actually coerce me, but whether or not this is going to affect my employability. I have seen in various news articles reporting that, apparently, companies based in the USA and EU are currently wary of hiring Australian developers because of this law.

Regarding your point, my understanding (I'm not a lawyer so I may be wrong) is that, in general, the law of a country applies to residents only while they are residing in the country, and it ends being applicable after they leave the country. For citizens this is certainly not the case, e.g. even though I haven't been to Italy since 2013, as a citizen I still have some rights and obligations.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#203

Post by Tsubasachan »

mastazi wrote: post #30

I have migrated to Australia many years ago and I have recently become eligible to become a citizen. However I’ve heard stories of tech companies refusing to hire Australians because of the AA Bill, so I’m holding it off for now. The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer. I…

JC and the mainstream media is crying about Huawei and Kasperky but this gets through uncontested?

Do as I say not as I do.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#204

Post by kdtsh »

danieltillett wrote: post #157
kdtsh wrote: post #126

Earlier quoted context omitted.

I suppose what I meant to say was ‘in a criminal case’. You can be compelled to give evidence against yourself in non-criminal cases in the US too, the fifth amendment provides for protection only in criminal cases. I’m not sure if you can be compelled to give evidence against yourself in criminal cases in Australia, but in any case, royal commissions are not criminal cases, they’re commissions with quasi-judicial Po…

No you can’t be compelled to give evidence against yourself in a normal criminal case. You can be compelled to give evidence in a royal commission hearing and that evidence can be used to prosecute you in a subsequent criminal case.

Source? I'd guess that that evidence would be inadmissible in a criminal case.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#205

Post by chris_wot »

Jedi72 wrote: post #166
mastazi wrote: post #76

Earlier quoted context omitted.

> Australian citizenship is profoundly valuable. Getting where I am now (Australian permanent resident) has been the hardest thing I have ever done in my life. It included working casual night-shift jobs while studying to get a uni degree during the day (having an Australian degree improves your score towards a skilled visa). For a long period I have been separated from my wife and daughter due to visa complications,…

One more piece of Anecdata, Im an Australian who has decided to go for US citizenship, for several reasons but all basically due to a continuous disregard for personal liberties by our government. Australians love being told what to do, seems like 90% of the population are very satisfied to be servants of the ruling class and aspire to nothing else. Edit: I replied to the wrong comment, meant to reply to the one abov…

Good luck getting health care.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#206

Post by marcus_holmes »

fgnjksadklafs wrote: post #180
marcus_holmes wrote: post #133

Earlier quoted context omitted.

I've had long discussions with techie friends about this, and none of us can see a way that the government could actually force a dev to do anything in a way that doesn't immediately tip off the rest of the team. I mean, your code is stored in a shared repo, right? So pushing a commit with the government-mandated changes to the shared repo is "informing others". But not pushing it means it'll never get to Prod. Most…

Really? It took me about 10 seconds to come up with this: "Hey tech dude, we need a version of iOS that unlocks the encryption on this device. Be a good boy and send us an IPSW that we can install on this nasty person's phone will you?" You don't need to release it to the public. Build it on your local device and hand it to them. Nobody needs to know.

If a developer in Apple has access to the signing keys for iOS and can decrypt anything at all on a production device, then Apple is totally screwed.

It simply cannot work like this, because a single rogue employee can (and would have by now) posted it on a forum/wikileaks/something, simply because they could.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#208

Post by otabdeveloper1 »

chupasaurus wrote: post #42
mc32 wrote: post #14

Earlier quoted context omitted.

They can do what Russia does and some of Europe do and require AU citizen data remain in AU.

Heard of FAANG minus Amazon (they don't work here) datacenters in Russia? There is none, as well as data storages here. Everyone gives 0f about this law, only huge targets have fines of ~$1M yearly.

The law is about personal data, not about any old 'data storage'.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#209

Post by shakna »

chii wrote: post #173
bigiain wrote: post #122

Earlier quoted context omitted.

You are making the incorrect assumption that the people writing these laws are not idiots. They don't understand the technology. They don't listen to any of the people who advise them about this technology. They seem only to be listening to the police and other law enforcement crying about "paedophiles and terrorists GOING DARK". The Prime Minister at the time claimed the laws of Australia overrode the laws of mathem…

THe law provides a specific provision to say that there are limitations to what the assistance can be: > 317ZG Designated communications provider must not be required > to implement or build a systemic weakness or systemic > vulnerability etc. But the issue here is whether it's possible to perform the required "assistance" but not introduce systemic weakness or systemic vulnerability. I think it's a logical contradic…

Systemic weakness or systemic vulnerability is redefined to not include anything that the notice can require however, rendering that particular exception pointless.

> systemic vulnerability means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.

The words "systemic weakness" means something completely different to how the industry would use it.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#210

Post by bigiain »

shakna wrote: post #209
chii wrote: post #173

Earlier quoted context omitted.

THe law provides a specific provision to say that there are limitations to what the assistance can be: > 317ZG Designated communications provider must not be required > to implement or build a systemic weakness or systemic > vulnerability etc. But the issue here is whether it's possible to perform the required "assistance" but not introduce systemic weakness or systemic vulnerability. I think it's a logical contradic…

Systemic weakness or systemic vulnerability is redefined to not include anything that the notice can require however, rendering that particular exception pointless. > systemic vulnerability means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose,…

"We don't need you to introduce a Systemic Weakness into the whole class of 'electronics', we just need you to selectively target the specific class 'mobile phones' that are connected to John Doe 3 aka bogey-man-de-jour."

This is now request that your lawyer would happily bill by the hour arguing with their lawyers in front of a judge - to determine whether it's a correct and enforceable interpretation of that shittily written legislation.

Except you aren't allowed to tell your lawyer we asked you to do it.

Post reply on HN