Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft says encryption laws make companies wary of storing data in Australia

abc.net.au

Post reply on HN
Print view View original

271–280 of 294 posts

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#271

Post by caspar »

KorematsuFred wrote: post #38
mastazi wrote: post #30

I have migrated to Australia many years ago and I have recently become eligible to become a citizen. However I’ve heard stories of tech companies refusing to hire Australians because of the AA Bill, so I’m holding it off for now. The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer. I…

Is this true ? There is no way I am hiring an Australian citizen then.

> The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer.

> Is this true ? There is no way I am hiring an Australian citizen then.

No. The request or notice is served to the company, not the individual, so the company is not left in the dark.

There has been a lot of poor reporting about this law; roughly speaking, there are 3 types of requests for data allowed:

1. Technical Assistance Request - "give me this data please". Optional, no penalty to anyone for not complying.

2. Technical Assistance Notice - "give me this data if you can, or else..". Mandatory, penalty to the company if they can comply but do not comply.. but if the company would have to build a new thing to comply (e.g. they do not have the decryption key and there's no backdoor), then there's no penalty and they do not have to comply.

3. Technical Capability Notice - "give me this data or build a way to give me this data, or else..". Mandatory, and a penalty to the company if they do not comply. If they can't do the thing yet, they need to build a backdoor, unless doing so would introduce a "systemic weakness".

In all cases, it's the company being targeted. Individuals in the company only become liable for penalties if they leak information to people not involved in the investigation.

Yes, it's still a bad law that was rushed through with too little discussion. Yes, there is too much room for interpretation and too little oversight. (And yes, Australian tech companies like Atlassian are lobbying heavily to improve the situation[0][1][2].)

But we're not at the point where it's reasonable to blacklist Australian tech workers yet, thankfully.

Source: I am an engineering manager at Atlassian, a major Australian tech company; there has been a lot of internal discussion and guidance from our founders and legal team about this.

Disclaimer: I am not a lawyer, this is not legal advice, etc. Also, I am an Australian citizen.

[0]: https://www.theaustralian.com.au/business/technology/scott-f...

[1]: https://www.afr.com/technology/web/security/atlassian-leads-...

[2]: https://ia.acs.org.au/article/2019/tech-industry--fix-the-as...

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#272

Post by brokenmachine »

throw0101a wrote: post #219
jacques_chester wrote: post #64

Earlier quoted context omitted.

It depends on your criteria. But it's a wealthy country with a high standard of living, relatively safe and stable, with well-established democratic and legal systems, has relatively low corruption, safety nets for health and welfare, subsidised education and if you avoid the crocodiles it can be very pleasant in parts.

Canada meets a lot of these criteria, though the climate may not agree with everyone--though at least we don't have a plant that causes you to suicide yourself (gympie-gympie) * https://curiosity.com/topics/the-suicide-plant-has-the-most-... * https://en.wikipedia.org/wiki/Dendrocnide_moroides

Wow, I'm Australian and I'd never heard of that plant.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#273

Post by brokenmachine »

toomanybeersies wrote: post #174
mastazi wrote: post #30

I have migrated to Australia many years ago and I have recently become eligible to become a citizen. However I’ve heard stories of tech companies refusing to hire Australians because of the AA Bill, so I’m holding it off for now. The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer. I…

Do you mean tech companies in Australia refusing to hire Australian citizens? Or foreign companies? Because the first is very illegal. If your home country allows dual citizenship, it doesn't seem like a problem for getting a job outside Australia. If it's not a government job where they'll do security checks, just don't disclose your dual citizenship. I hold dual citizenship, and not that my company has asked or wou…

>right to participate in the democratic process

You mean the same democratic process that passed this bill when literally 99% of the responses within the consultation period were against it?

Or maybe you're talking about the democratic process where our opposition agreed to pass this bill even though they thought it was badly thought-out and needed amendments which were promised to happen in February but still haven't, in return for our government not allowing doctors to see sick people in our secret offshore prisons that almost nobody supports.

I'm being facetious of course, but as an Australian citizen I haven't felt represented here for a long time.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#274

Post by anitil »

caspar wrote: post #271
KorematsuFred wrote: post #38

Earlier quoted context omitted.

Is this true ? There is no way I am hiring an Australian citizen then.

> The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer. > Is this true ? There is no way I am hiring an Australian citizen then. No. The request or notice is served to the company, not the individual, so the company is not left in the dark. There has been a lot of poor reporting about…

I'm confused by the "systemic weakness" exception for the third case. Obviously I need to research this, but it seems that in many cases, a backdoor is, almost by definition, a systemic weakness. Of course, I wouldn't want to argue that point in front of a judge, but it would be useful to have more clarity around this.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#275

Post by BLKNSLVR »

bigger_cheese wrote: post #266
balabaster wrote: post #260

Earlier quoted context omitted.

The thing that's most odd about this is if you consider the history of the cause of settlement of Australia... the first settlers weren't exactly renowned for following the rules... that's why they were there in the first place. Irony at its finest.

You need to look at our country from a historical point of view. We have a lot of cultural ties with the UK. Australia did not become a country until 1901 and no it wasn't a penal colony for that whole time, There was a lot of migration primarily from the UK - to this day UK is one of our largest source of permanent migrants. Most of Australia's laws, our parliamentary system etc was based on UK Westminster system. I…

Australia's (and Australians') attachment to the monarchy is one of those things that will change dramatically over the next twenty-odd years as the 60+ year-old set, who have anachronistic romantic notions of the monarchy, die off.

The "royal weddings" (good lord, kill me now) do their little bit in fluffing up pro-monarchy anachronistic romantic notions in some of the younger set, but nowhere near the amount needed to sustain the 'no to a republic' vote even in the next ten years.

My assumption is that a lot of these same monarchists are fundamentally racist as a direct result of the various wars, which is semi-understandable. Humans don't tend to change their minds beyond a certain age, no matter the changing context.

There's a quote somewhere about "beliefs don't change, their proponents die out". I'm finding it applies in almost universal contexts.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#276

Post by brokenmachine »

jjcm wrote: post #4

That's one of the biggest things that lawmakers here couldn't seem to understand - tech companies have high mobility across borders. Even if a law has no teeth, why would Microsoft store data in Australia when the next country over can still serve data for the region? It just creates too much risk, from a privacy and PR standpoint. Startups will be more adverse to founding in Australia as well. It just creates a blac…

They clearly don't give a fuck about the tech industry. They sell coal and talk about stopping boats, throwing the word "pedophile" in there every now and then.

That's what passes for leadership these days.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#277

Post by brokenmachine »

mikro2nd wrote: post #241
oedmarap wrote: post #85

The three areas of contention in the bill: > A technical assistance request (TAR): Police ask a company to "voluntarily" help, such as give technical details about the development of a new online service. > A technical assistance notice (TAN): A company is required to give assistance. For example, if they can decrypt a specific communication, they must or face fines. > A technical capability notice (TCN): The company…

Thought experiment: Company gets served with a TCN. They task Jolene (Snr Programmer) to implement the backdoor. She does so in a way that spews information far and wide in a highly visible manner. What are the consequences for Jolene and/or the company, especially when the spooks cry foul and Jolene's lawyer/Company replies with something along the lines of "I guess she's just incompetent and did a bad job. Sorry. B…

Jolene and some people from the company go to jail for exposing the Gestapo overreach.

The govt talks about being tough on baddies, coal keeps being sold, there's no pedophiles in my house and wow, it's Sunday so lets all watch the footy!!

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#278

Post by brokenmachine »

coldcode wrote: post #246

My employer (S&P 100 sized) is rapidly deciding to move away from all Atlassian products including Jira. If enough people stop doing business with Australian tech companies, this law will likely be punted. Money talks, politicians run.

Is your employer a mining company?

If not, the Australian government doesn't care.

Sell all the things!

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#279

Post by geggam »

krapp wrote: post #251
geggam wrote: post #249

Earlier quoted context omitted.

govt in the US does not have a monopoly on violence... they want you to think they do ;)

I don't think you understand what the monopoly on violence actually is. It doesn't mean the government is the only agent capable of committing violence, rather, that the government determines what forms of violence, and under what circumstances, are legal, and that the enforcement of laws and contracts are always backed up by an implicit threat of violence through incarceration or worse. The Second Amendment being le…

You do realize the constitution and the bill of rights do not grant rights but limit the governments ability to infringe on your natural law granted rights ?

To summarize the govt is limited and the people are not.

The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people.

Re: Microsoft says encryption laws make companies wary of storing data in Australia

#280

Post by ggm »

crawrey wrote: post #267
ggm wrote: post #231

Earlier quoted context omitted.

Australian citizens, regardless of their location are obliged to comply with these requests. Extra-territorial law application is very complex. KP is one of the few places where you can routinely expect to be prosecuted in Australia for breaches overseas. or FGM. Or, more recently the war in Syria but bear with me: do you not also recognize that there is a huge reluctance to try and enforce the law in that last regar…

> Extra-territorial law application is very complex. KP is one of the few places where you can routinely expect to be prosecuted in Australia for breaches overseas. or FGM. Or, more recently the war in Syria but bear with me: do you not also recognize that there is a huge reluctance to try and enforce the law in that last regard? because it turns out simply being somewhere is not neccessarily a good basis to declare…

Thanks for the cluestick. This is unworkably bad, and I look forward to Ed Husic making good on his promise to amend the law. I had not read the bill, I have only read commentaries.

I can't believe the law officer of the land permitted a bill to be drafted which requires this kind of behaviour because it feels like even resigning from your employer would be a breach of the act, since you cannot disclose you have been served with a notice in resigning. But, if you deliberately insert or attempt to insert subverting code, you are implicitly undermining the integrity of your employers code.

I repeat what I said before: This feels like a legal minefield which a competent defense could drive a tank through. Just because it passed the chambers doesn't make it right, we have the kind of system which permits the high court to overturn manifestly unjust law.

Not to implicitly believe everything said in defence of this bill could you comment on:

https://www.homeaffairs.gov.au/about-us/our-portfolios/natio...

in particular this bit:

This law can compel employees to work in secret without the knowledge of their organisation

Media reporting that has proposed this scenario is incorrect and misleading. The industry assistance framework is concerned with getting help from companies not people acting in their capacity as an employee of a company. Requests for assistance will be served on the corporate entity itself in line with the deeming service provisions in section 317ZL. A notice may be served on an individual if that individual is a sole-trader and their own corporate entity.

A company issued a notice can disclose information about it under paragraph 317ZF(3)(a) in connection with the administration or execution of that notice. This allows an employer to disclose information to their employee and vice versa in the normal course of their duty.

Additionally, a company may disclose statistical information about the fact that they have received a notice consistent with subsection 317ZF(13). Further, companies and their specified personnel may disclose notice information for the purposes of legal proceedings, in accordance with any requirements of law or for the purpose of obtaining legal advice. The notices themselves are therefore not ‘secret’ but information about their substance is controlled to protect sensitive operational and commercial information.

The same page says this:

Penalties for individuals in the legislation are for the purpose of potential enforcement proceedings against sole-traders and individuals acting as businesses.

Which means by intent (but possibly not in words in the act) the idea was not to exclude telling your employer: the point is that sole traders and individuals can be compelled the same way companies can.

Which I read, probably hopelessly optimistically, as that a requirement would almost never be placed on you, and not simultaneously on your employer: They know you are being asked to modify the code. The chance of being unable to "disclose" to your employer here feels quite limited.

Post reply on HN