The election thread - Two middle-late aged white men trying to be blokey and convincing..., same old shit, FFS.

[johnny]

These people are, and they are perfectly aware of their own interests in this matter. These interests are not aligned with the people they wish to regulate.

Sorry mate, but you’re off the reservation here. You speak like the security agencies aren’t part of society themselves and live in some kind of different reality. They are fully aware of the trade off being made and they’d prefer not to make it at all. However the decision has to be made and my point is that there is a real security concern behind the motivation and it’s not just about “teh terrorizmz!!1!”

If that's really what you believe, you need to cast your net much wider to understand why opposition to this abject stupidity is so broad

Ha, yeah, nice try but I never made out that there wasn’t corresponding opposition among qualified circles. It’s silly, at best and deceptive at worst to imply that because something isn’t mentioned then it’s not apparent or understood.

Your mind is clearly set and you seem to have an image of Australia’s security agencies that are a little reminiscent of “deep state”, which are so off the mark that I’m not sure where to even start.

So I’ll finish up in saying that yes, the legislation probably needs improving, yes, politicians should never be blindly trusted to wield power, yes, there will be work around found, etc. However, the idea that the people who are driving this have considered these things you mention and more, they also have access to info and other things you’re not aware of and they aren’t comfortable in having to make this call, but they have given the choices they face.

Do with that what you will.

 

[hifiandmtb]

Even with iron-clad, perfect legislation, there are still privacy & security concerns that will always exist with this type of encryption-bypass action.

I didn't read anything in Binaural's posts that suggests he thinks "...you seem to have an image of Australia’s security agencies that are a little reminiscent of “deep state”...". I just read that he feels enacting what they have opens up avenues of abuse, malpractice or ineptitude that don't exist today.

 

[pink poodle]

No way @johnny! @bigbrother can fuck off out of my really interesting on line presence...

 

[Binaural]

Sorry mate, but you’re off the reservation here. You speak like the security agencies aren’t part of society themselves and live in some kind of different reality. They are fully aware of the trade off being made and they’d prefer not to make it at all. However the decision has to be made and my point is that there is a real security concern behind the motivation and it’s not just about “teh terrorizmz!!1!”

Of course the decision didn't have to be made that way. Up until right now we had no such law because such legislation is presumptively ineffective, economically counterproductive, and any specific predicted benefits have mostly been presented as vague scare tactics. And you will appreciate that I don't agree the security community are fully aware of the tradeoffs, because they have made no attempt address comments, predict or model economic or criminal harms resulting from adding security vulnerabilities to every encrypted link. It may even be (gasp!) that since nobody is threatening workers of security agencies with jail for refusing to do work for the government, they might take a relaxed attitude to such a prospect. For that matter, Peter Dutton can now even force someone who works on an open source project to work for free for them. Forgive me if I think the security community doesn't give enough of a shit about these sort of minor questions.

Ha, yeah, nice try but I never made out that there wasn’t corresponding opposition among qualified circles. It’s silly, at best and deceptive at worst to imply that because something isn’t mentioned then it’s not apparent or understood.

You said, quote:

I haven’t met a security practitioner or an academic in the cyber and sec space (shit, I can even show you ethicists that acknowledge the requirement) that isn’t fully behind this access.

You may not have meant to imply that there was no serious opposition among qualified people, but I can only go on the plain meaning what you wrote.

Your mind is clearly set and you seem to have an image of Australia’s security agencies that are a little reminiscent of “deep state”, which are so off the mark that I’m not sure where to even start.

So I’ll finish up in saying that yes, the legislation probably needs improving, yes, politicians should never be blindly trusted to wield power, yes, there will be work around found, etc. However, the idea that the people who are driving this have considered these things you mention and more, they also have access to info and other things you’re not aware of and they aren’t comfortable in having to make this call, but they have given the choices they face.

Do with that what you will.

I know what a deep state is, and also why it's not applicable here, no need to waft those sort of conspiratorial asides around as if I'm some sort of lost Qanon. As hifimtb said, I am against abuses of legislative processes. They got 15,000 comments in a week of review of the proposed legislation and didn't change a thing before presenting the bill to parliament.

Lastly, I don't know why you have to infer how they feel emotionally about this legislation as it's not relevant, but it implies you see yourself as one of this community. You should be aware that the Australian tech industry whom these people have lazily screwed is hopping mad about this. Show some respect for the fact that your community has done what the whole world recognises as a shithouse job of proposing workable, practical legislation that will make us safer while balancing our freedoms and individual rights.

 

[johnny]

You said, quote:

You may not have meant to imply that there was no serious opposition among qualified people, but I can only go on the plain meaning what you wrote.

Yeah, that's fair, I didn't word that very well, when I said "met", I meant it literally and I understand that, that is a small sample size. My point was that the national security community, that includes academics, techies and ethicists, is very much on board with this, if reluctantly so.

I know what a deep state is, and also why it's not applicable here, no need to waft those sort of conspiratorial asides around as if I'm some sort of lost Qanon.

I misinterpreted your meaning in the first paragraph, in that case.

As hifimtb said, I am against abuses of legislative processes. They got 15,000 comments in a week of review of the proposed legislation and didn't change a thing before presenting the bill to parliament.

That's the political side to it, which I'm not defending, at all. I trust politicians to politicise, securitise and abuse, and little else.

Lastly, I don't know why you have to infer how they feel emotionally about this legislation as it's not relevant, but it implies you see yourself as one of this community.

But it is relevant and yes, I do work alongside many of these people. I've spent the last 3 weeks working alongside the former head of national counter-terrorism for the US, who is some one else who doesn't like the fact that these types of things have to happen but sees the imperative and is on the public record saying so, as are others and the discussion around this issue is not a new thing.

Why is it relevant? Because it shows that the risks are understood, that there is no cavalier attitude and they are PART of the society that gives up some of their privacy/liberty due to these outcomes. My initial reason for posting was that the thread was originally "dumb politicians, etc. etc.", when that picture has no reflection of what's going on here (yes, politicians suck, see previous statement...).

You should be aware that the Australian tech industry whom these people have lazily screwed is hopping mad about this.

And that's what I'm getting at. "Lazily screwed over?" If that's what you believe, you have no idea what these people do, how they do it and why. If you think they don't take account what the tech industry things and economic impacts of legislation, you again, need to completely reassess.

Show some respect for the fact that your community has done what the whole world recognises as a shithouse job

And again, "the whole world". I refer to your previous suggestion of casting a wider net. Your world? Maybe, but not the whole world, by a long shot and it's people who have to make more difficult and impactful decisions that those in private industry who highest responsibility is most often profitability, who make these calls, not some dullard that couldn't cut it int he real world. Lot's of these folk revolve in and out of private industry because they have the capability to do so - they do not live in a bubble and detached from 'the tech industry'.

 

[johnny]

What's actually in Australia's encryption laws? Everything you need to know

The controversial Assistance and Access Bill was 176 pages long, then 67 pages of amendments were rushed through in the final hours of debate. This is what we've ended up with.


By Stilgherrian | December 10, 2018 -- 03:00 GMT (14:00 AEDT) | Topic: Security



Labor caved in last Thursday. Despite spending hours telling Parliament why the Assistance and Access Bill was dangerous garbage, and complaining about the rushed process, they dropped all of their proposed amendments and voted in the sitting government's version anyway.

So now it's law.

What is the Assistance and Access Bill?
Its full name is the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018, which is now an Act [PDF]. It makes changes to more than a dozen pieces of legislation in an effort to combat what the government refers to in its explanatory memorandum [PDF] as "the challenges posed by ubiquitous encryption".

The most controversial part is the "frameworks for voluntary and mandatory industry assistance to law enforcement and intelligence agencies" to help government access the content of encrypted communications.

It is Australia's contribution to the Five Eyes nations' tougher attitudes to the regulation of online communications. Information and communications technology vendors and service providers have a "mutual responsibility" to offer "further assistance" to law enforcement agencies, they said in August this year.


It's about banning strong encryption, right?
No. Read on.

"Voluntary and mandatory industry assistance" means what?

Under the new laws, Australian government agencies can issue three kinds of notices:

• Technical Assistance Notices (TAN), which are compulsory notices for a "designated communication provider" to use an interception capability they already have;
• Technical Capability Notices (TCN), which are compulsory notices for a designated communication provider to build a new interception capability, so that it can meet subsequent Technical Assistance Notices; and
• Technical Assistance Requests (TAR), which are "voluntary" requests, but which have been described by experts as the most dangerous of the three because there was less oversight, at least in the original version of the law.

From here on, we'll refer to these collectively as "notices".

Who can issue these notices?
A TAN or TAR can be issued by the director-general of the Australian Security and Intelligence Organisation (ASIO), the Australian Secret Intelligence Service (ASIS), or the Australian Signals Directorate (ASD), or by the chief officer of an "interception agency".

That last category includes the Australian Federal Police (AFP), the Australian Crime Commission (ACC), and the state and territory police forces provided they get the approval of the AFP Commissioner.

However the government amendments removed the various anti-corruption bodies from this category. It's not clear why.

There's no requirement for independent approval of a notice by, say, a judge issuing a warrant. However there must be an underlying warrant to access communications under the Telecommunications (Interception and Access) Act or the Surveillance Devices Act or state-level equivalents.

A notice must be in writing, unless there is "an imminent risk of serious harm to a person or substantial damage to property exists", the notice is "necessary for the purpose of dealing with that risk", and "it is not practicable in the circumstances to make the variation in writing". A notice given orally much be confirmed in writing within 48 hours.

The same goes for variations to a notice, extensions, and revocations.

All notices, extensions, and revocations must be notified to the Inspector-General of Intelligence and Security (IGIS) within seven days.

A TCN can only be issued by the Attorney-General following a request from ASIO or an interception agency, and only with the approval of the Minister for Communications.

The Attorney-General must also give written notice of the intention to issue a TCN to the communications provider, inviting them to make a submission, and respond. Except in a "matter of urgency", that process has to run for at least 28 days.

Is this about fighting terrorism and child abuse?
Kinda. "Safeguarding national security" is in there, but so is "enforcing the criminal law, so far as it relates to serious Australian offences". That's defined as any crime "punishable by a maximum term of imprisonment of 3 years or more or for life".

There's also "assisting the enforcement of the criminal laws in force in a foreign country, so far as those laws relate to serious foreign offences".

The ASD can also ask for "material, advice and other assistance on matters relating to the security and integrity of information that is processed, stored or communicated by electronic or similar means".

ASIS can also ask for assistance in relation to "the interests of Australia's foreign relations or the interests of Australia's national economic well-being".

Who counts as a "designated communication provider"?
Pretty much anyone and everyone who provides any kind of online service or communications equipment to anyone in Australia, and anyone who even installs or maintains the kit. Yes, that includes anyone who has a website.

The table listing all the categories runs for three pages.

It includes obvious players like "carrier or carriage service provider" -
that's the telcos.

But it also includes anyone who "provides an electronic service that has one or more end-users in Australia", anyone who "develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-users in Australia", device manufacturers, and even anyone who "manufactures or supplies components for use, or likely to be used, in the manufacture of customer equipment for use, or likely to be used, in Australia".

Isn't this about forcing companies to put backdoors in their products?
It depends what you mean by "backdoor".

If you mean having any method by which a third party can access the content of a specific communication, that's obviously a "Yes". That's the whole point of a communications intercept.

If you mean a method that allows any communication to be accessed at will, well, the government has been trying very hard to make that a "No".

A notice must not have the effect of "(a) requesting or requiring a designated communications provider to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection; or (b) preventing a designated communications provider from rectifying a systemic weakness, or a systemic vulnerability, in a form of electronic protection".

They cannot ask a provider to "implement or build a new decryption capability", or "render systemic methods of authentication or encryption less effective", or introduce a "selective" vulnerability or weakness that would "jeopardise the security of any information held by any other person", or create "a material risk that otherwise secure information can be accessed by an unauthorised third party".

These two definitions were added to the legislation:

systemic vulnerability means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.

systemic weakness means a weakness that affects a whole class of technology, but does not include a weakness that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.

There's now also a lengthy definition of "target technology" that refers to a service, device, piece of software, or "particular update of software" or whatever that "is used, or is likely to be used, (whether directly or indirectly) by a particular person" whether or not the person can be identified.

That's the law's intent anyway. What this might mean in practice is still unknown. Whether any of this is even technically feasible is a question for another time.

What can agencies ask for?
The list of "acts or things" that can be requested runs for two pages. The first is "removing one or more forms of electronic protection that are or were applied by, or on behalf of, the provider". Electronic protection is defined as an authentication system or encryption.

It also includes providing technical information, "installing, maintaining, testing or using software or equipment", "assisting with the testing, modification, development or maintenance of a technology or capability", "modifying, or facilitating the modification of, any of the characteristics of a service", and "substituting, or facilitating the substitution of, a service provided by the designated communications provider" with another service.

And quite a bit more.

Are there any limits on this?
Notices can't be given unless they're "reasonable and proportionate", and the compliance with the request is "practicable" and "technically feasible".

The decision-maker has to take into account things such as the interests of national security; the interests of law enforcement; the legitimate interests of the designated communications provider; the objectives of the request; the availability of other means to achieve the objectives; whether the request is the least intrusive form of assistance with respect to "persons whose activities are not of interest"; and "the legitimate expectations of the Australian community relating to privacy and cybersecurity".

Who decides what's reasonable, etc?
The person issuing the notice.

How much of this will be public?
Almost none of it. There are hefty penalties for revealing any aspect of a notice, except in situations such as referring a complaint to IGIS or the Commonwealth Ombudsman, or in other legal proceedings.

Agencies will report the number of notices issued annually. Communications providers can report the number of notices they've received in periods no shorter than six months.

What else is in the new law?
There's changes to the computer access warrant system, including giving covert computer access powers to "law enforcement agencies investigating certain federal offences".

An electronic device found while executing a warrant can now be moved to another place for analysis for 30 days, up from 14 days. Australian Border Force can now seize and examine an electronic device for 30 days, up from 72 hours.

ASIO can now "require a person with knowledge of a computer or a computer system to provide assistance that is reasonable and necessary to gain access to data on a device that is subject to an ASIO warrant".

It's the law now, so what happens next?
Agencies can start issuing notices as soon as they like.

Labor reckons its amendments to the legislation will be considered when Parliament resumes sitting in February 2019. The Parliamentary Joint Committee on Intelligence and Security will continue its examination of the legislation through to April.

The Independent National Security Legislation Monitor must "review the operation, effectiveness and implications" of the new laws after 18 months, so around June 2020.

 

[Scotty T]

How many serious crimes have happened in Australia because these laws don't exist?

 

[Binaural]

That's quite a good explanatory article. The key items here as I see it:

• They aren't allowed to backdoor the actual protocols (for example AES-256 encryption), but they are allowed to request wholesale removal of encrypted connections and virtually any other change they would like. An example might be requiring WhatsApp to provide a data link to encrypted messages in your phone but not being able to intercept the messages in transit. These sorts of backdoors are easy to detect and block by security researchers because they rely on outbound communications, after which the name of the poor company will be mud. Who is responsible for the reputational costs of a failed attempt at backdooring? The government are not required to consider the essential interests of the target of the notice.
• "Technically feasible and proportionate" are weasel words, as the article points out. Given you can't disclose the existence of these notices, goodness knows how you can get due process if you want to challenge an assessment. Presumably if Peter Dutton feels it's reasonable, then you're shit out of luck since you can't disclose to independent expertst. Any software engineer will tell you that anything is feasible with enough time and money.
• It's striking that the government hasn't committed to reimbursing services or product suppliers at market rate. Such assistance is now apparently on the same tier as jury duty, in the sense that you are required to work for the government for any period it deems fit for no compensation.
• It's concerning that the AFP can now confiscate your phone for any reason for months at the border for any reason. A lot of people are probably going to have to forfeit their phone if they're here for less than 72 days.
• It's kind of comical that they claim to have to take into account the interests of the Australian public in cybersecurity for a program that is completely secret. The whole program is built around avoiding public scrutiny and oversight.

ASIO and other intelligence agencies already request and get voluntary assistance from private companies (don't ask me how I know this) on national security grounds, but now they are allowed to demand more or less any assistance they like with no responsibility for outcomes. This is bad legislation and the public will never be allowed to scrutinise just how bad.

How many serious crimes have happened in Australia because these laws don't exist?

They'll never tell us, because that's an objective measure of the efficacy of legislation.

 

[johnny]

How many serious crimes have happened in Australia because these laws don't exist?

Not sure and not sure that could be measured but I also don't think that's the criteria it should be based on. The simple way I've had it explained to me is that they can already listen in to your phone calls, they can bug your house and they can read your mail. NEw technology allows that level of surveillance to be avoided so they're looking to again gain that access. There are a significant amount of people in Australia that have returned from countries where they've been associated with extremist groups, these and some other folks communicating internationally are a focus of these concerns.

So I won't defend the legislation, that's up to legal experts and politicians. I'm defending the reason why this access has been sought after - the same access that allows cops to tap phones and bug cars, which already exists. Of course, strong, independent oversight and all other measures to ensure probity need to be in place.

 

[Binaural]

And that's what I'm getting at. "Lazily screwed over?" If that's what you believe, you have no idea what these people do, how they do it and why. If you think they don't take account what the tech industry things and economic impacts of legislation, you again, need to completely reassess.

Refer my comment. 15,000 comments, none of them addressed. Not a single tech company that I am aware of has come out in support of the bill, even in a qualified sense. No tech player is even acknowledging that the legislation might achieve its goals! If a core value of legislators should be the assent of the governed, then they have utterly failed. So yes, legislating in an echo chamber can be fairly described as lazily screwing the tech industry.

And again, "the whole world". I refer to your previous suggestion of casting a wider net. Your world? Maybe, but not the whole world, by a long shot and it's people who have to make more difficult and impactful decisions that those in private industry who highest responsibility is most often profitability, who make these calls, not some dullard that couldn't cut it int he real world. Lot's of these folk revolve in and out of private industry because they have the capability to do so - they do not live in a bubble and detached from 'the tech industry'.

Sure, that's why they have done such a good job of consulting and winning support for the bill. I am sure the technical consultants for this bill be will out there advertising their involvement in no time!

The really sad thing here is the government could have, within the existing legal frameworks, simply have paid companies to develop spyware and other surveillance tools to their requirements. This is how the US and numerous other companies monitor suspects for whom they have a warrant - you can go nuts according to the risks of the suspect. But the Australian government doesn't have good tech skills or program management in high tech fields in Australia, and has resorted to trying to force the industry into working for them to make up for their inadequacies. Maybe some of the "experts" who prepared this bill could go into business here?

 

[Binaural]

Not sure and not sure that could be measured but I also don't think that's the criteria it should be based on.

A failure of government in general is that we don't generally require new laws to include means of measuring the impact. There should be a responsibility of legislators to "instrument" major bills such that at least some monitoring of outcomes is done by the agencies responsible for their implementation. In this case, the desired outcome is number of terrorist attacks or serious crimes averted, not some arbitrary level of access previously enjoyed by intelligence agencies and police. This bill will at least be reviewed in 18 months, but it sounds like most of the outcomes will be secret, which is pretty close to no review at all.

 

[johnny]

I think we continue to talk cross purposes here. You're main (not your only) gripe seems to be with the legislators, rather than the national security community.

 

[Haakon]

 

[Binaural]

I think we continue to talk cross purposes here. You're main (not your only) gripe seems to be with the legislators, rather than the national security community.

The thing is, you've pushed the angle that the real thrust behind this legislation is from the national security establishment, not legislators. If the legislative process has consequently barfed up an awful law, who then should I hold responsible?

 

[link1896]

On the contrary Johnny, I think the security industrial complex is like the kid at primary school who was on the spectrum, and was always on a hair trigger. Dangerous to be around. We, the Australian people are jumping at ghosts.

The security industry has put forwards its beliefs, based on their assumptions and experience via the PJCIS. They are servants to our politicians, who are of course our elected representatives, who are supposed to have the greater good in mind. Former politicians got us into this mess blindly going to war, stirring a hornets nest. It now feeds many mouths. Win-win from their POV.

One woman a week is murdered due to domestic violence in Australia. They lack a formal multi billion dollar industry behind them with no lobbyists, hence the silence and anti terrorism is “our” focus. If one person was murdered due to terrorism each week, we would be in 24/7 lockdown.

Our political system has massively failed us yet again. It is not for any public servants to make any decisions this wide ranging and significant. They can only make recommendations. Johnny, you seem to be suggesting our politicians cannot be trusted, that our security agencies public servants know best and should have the final say. That’s not democracy. We all agree our politicians are letting us down, but going around them is so undemocratic it’s incomprehensible.

Our banking system have just become very vulnerable. It won’t be by direct attack or a vulnerability exploit, but by some unintended, unimagined pathway. Potentially Russians compromise a bank while the banks focus is directed elsewhere trying to give ASIO an unencrypted feed to someone sending 16 grand to a goat herder in Syria, and they miss someone slips in via untested code. Once the genie is out of the bottle, it’s too late. If someone compromises a big 4 bank and moves billions of savings, who’s paying? The list of hacking groups would just LOVE to do this is a mile long. A few billion syphoned off to North Korea buys a lot of military hardware.

In summary I say this is a staggeringly stupid move. If there is some wave of doom about to beset us, the war mongers should be declaring war and coming out with justification(s). But there is silence. So one can only use past experience and events, and there is no justification there.

George Orwell wrote 1984 as a warning, not a fucking manual.

 

[pink poodle]

For me the issue is the lack of scrutiny of the actions of these government agencies (we have seen how well no transparency is working out for our border security) combined with the unchecked authority now given to them. It seems to be human nature to seek out the easy way to achieve our work and why would these guys he any different? So of course these agencies are enthusiastic about having this legislation. I can't wait for the "if you have nothing to fear..." mentality to kick in.

 

[Flow-Rider]

For me the issue is the lack of scrutiny of the actions of these government agencies (we have seen how well no transparency is working out for our border security) combined with the unchecked authority now given to them. It seems to be human nature to seek out the easy way to achieve our work and why would these guys he any different? So of course these agencies are enthusiastic about having this legislation. I can't wait for the "if you have nothing to fear..." mentality to kick in.

What, you mean like the ATO ?

 

[Binaural]

@pink poodle - we've seen the same generic issues play out independently in the USA for the last 20 years, and yet we've learned nothing from their mistakes. Government introduces secret program requiring compliance to arbitrary demands, government abuses program because the oversight is also secret and subject to regulatory capture, and the only effective oversight is provided by whistleblowers, who will then be jailed for leaking secrets even if they are squarely in the public interest. At this point, somehow, it will all be blamed on refugees.

 

[SummitFever]

This sort of stuff generally follows a pattern:

- it starts with a genuine need within law enforcement for the tools to fight some sort of criminal activity (eg. terrorism or whatever other thing is high on the agenda at the time);
- it ends with the overuse of the tools for purposes completely unrelated to the original issue (e.g issuing parking fines).

These sorts of laws should have:
- automatic expiry periods to prevent them from being on the books (and out of the public eye) forever;
- mandatory (frequent) periodic reviews to ensure they are achieving their original purpose; and
- properly stated aims which if not empirically can result in their expiry.

 

[Binaural]

Automatic expiry periods are kind of a fake concession to critics of controversial legislation, as the re-authorisation of a law is often a routine matter. In this case, the risk is that the reviews proposed here are also secret (apart from gross number of assistance requests), and are essentially just a forum for the NatSec community to argue they get at least some utility from the new rules.