Australian Gov't Floats New Batch Of Compelled Access Legislation With An Eye On Encryption
from the hello-darkness-my-old-friend dept
The Australian government is looking to revamp its compelled access laws to fight encryption and other assorted technological advances apparently only capable of being used for evil. It's getting pretty damn dark Down Under, according to the Department of Home Affairs' announcement of the pending legislation.
Encryption conceals the content of communications and data held on devices, as well as the identity of users. Secure, encrypted communications are increasingly being used by terrorist groups and organised criminals to avoid detection and disruption. The problem is widespread, for example:
Encryption impacts at least nine out of every ten of ASIO’s priority cases.
Over 90 per cent of data being lawfully intercepted by the AFP now use some form of encryption.
Effectively all communications among terrorists and organised crime groups are expected to be encrypted by 2020.
An example of harmful encryption is provided for readers at home, so they can weigh their own security and privacy against an anecdote about a registered sex offender who may or may not have escaped prosecution (the outcome of the case isn't provided) by using encrypted messaging apps. And it includes an inadvertently helpful lesson about the stupidity of targeting encryption with legislation, even if the DHA likely doesn't realize it.
The suspect was arrested and his mobile phone was seized but despite legislative requirements he refused to provide his passcode.
There's the limitation of lawmaking. Lawbreakers break laws and they're not going to stop just because you've told them not to with a government mandate. Legislation [PDF] like this does little more than make life more difficult for service providers and device makers while undermining the privacy and security of millions of law-abiding citizens.
The explanation sheet [PDF] notes the government is not seeking to mandate encryption backdoors. That being said, it would like providers of encrypted services/devices to leave the door cracked open so the government can step inside whenever it feels the need to look around.
The type of assistance that may be requested or required under the above powers include (amongst other things):
Removing a form of electronic protection applied by the provider, if the provider has an existing capability to remove this protection.
Providing technical information like the design specifications of a device or the characteristics of a service.
Installing, maintaining, testing or using software or equipment given to a provider by an agency.
Formatting information obtained under a warrant.
Facilitating access to devices or services.
Helping agencies test or develop their own systems and capabilities.
Notifying agencies of major changes to their systems, productions or services that are relevant to the effective execution of a warrant or authorisation.
Modifying or substituting a target service.
Concealing the fact that agencies have undertaken a covert operation.
The law can't retroactively force companies to produce crackable devices and messaging systems. But the first bullet point could see the Australian government demanding they do so in the future if they want to provide goods and services to the Australian public. Fortunately, the bill includes a clause making future demands along these lines impossible for the time being.
The Bill expressly prohibits technical assistance notices or technical capability notices from requiring a provider to build or implement a systemic weakness or systemic vulnerability into a form of electronic protection. This includes systemic weaknesses that would render methods of authentication or encryption less effective. The Australian Government has no interest in undermining systems that protect the fundamental security of communications. The new powers will have no effect to the extent that requirements would reasonably make electronic services, devices or software vulnerable to interference by malicious actors. Importantly, a technical capability notice cannot require a provider to build a capability to remove electronic protection and puts beyond doubt that these notices cannot require the construction of decryption capabilities.
Without further discussion by the legislature, it's tough to tell whether creating an escrow system would be considered a "system weakness" or make "encryption less effective." I mean, it obviously is and does, but does the DHA see it that way? And will this clause survive the final markup? Compelling decryption using "existing" methods seems especially useless if most services and devices cannot currently be decrypted by providers. The government is better off seeking outside help from contractors who do nothing else but find ways to crack or bypass encryption, rather than dropping language into the law that suggests backdoors the government won't call "backdoors" will be mandated in the future.
It also gives the government a considerable expansion of power, allowing it to peruse private companies' design specs and a heads up if any redesigns are in the works. It also forces companies to be compliant partners in government surveillance by mandating their assistance in man-in-the-middle attacks ("modifying or substituting a target service") and ordering them to withhold information from affected customers.
There is a public comment period, which is a nice touch. There also appears to be some respect for the good encryption does, rather than simply viewing it as an escape route for criminals and terrorists. But there's also a good deal of power expansion tied to rickety wording that suggests backdoors might be mandated if the government can talk itself into viewing proposals as something other than backdoors. And there's no guarantee this vague promise will make the final cut.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: australia, backdoors, encryption, going dark, law enforcement, surveillance
Reader Comments
Subscribe: RSS
View by: Time | Thread
...and by many, many more individuals and business to avoid being attacked by those same people. Almost as if it's a tool that can be used for any purpose, and so should be treated as such.
Funny how they always leave that part out.
"Removing a form of electronic protection applied by the provider, if the provider has an existing capability to remove this protection."
Cue services that have no such capability becoming more popular...
"Modifying or substituting a target service."
...but that seems like they can just force them to change anyway. That's the worrying part, as it means that they'd possibly be able to force companies to break their encryption for everyone silently whenever they have a user that's being investigated. They'll claim it will be more targeted than that, but we all know how that normally goes...
[ link to this | view in thread ]
Re:
That could also mean a capability forcing a silent software update onto a device to bypass encryption. Just think how valuable that would be to criminals.
[ link to this | view in thread ]
[ link to this | view in thread ]
Re: Re:
Indeed, that's always the major issue here. Anything that gets built in for law enforcement can be exploited by criminals. That's just the reality of tools - they are tools, they can be used for any purpose the user wishes, good or evil.
These people seem to buy into the fantasy that people can make tools that magically operate differently depending on the intent of the person using them. That's no more true for encryption devices than it is for a screwdriver. The problem here is that in trying to stop the "bad guys" using the tools effectively, they break them for everyone else to be exploited.
[ link to this | view in thread ]
Never mind that any serious bad actors (think terrorists, people in the child porn market, foreign governments pulling the same crap they do; the examples they are always touting) are early adopters of things like encryption, and will add further layers of encryption and other obfuscation methods which are not created by large corporations which might be compelled to do your work for them. What you always have left is a giant, rights-trodding, expensive machine going after low-hanging fruit which is... well, low-hanging fruit. (Or shit they totally make up or otherwise induce themselves.)
Lots of sound and fury signifying tantrums, security theatre, and probably some issue with intestinal gasses.
[ link to this | view in thread ]
And that's not all. Window blinds!
[ link to this | view in thread ]
[ link to this | view in thread ]
Yes, this is true - many governments worldwide routinely use encryption to avoid detection and disruption. They also use it to cover up their illegal activities.
[ link to this | view in thread ]
Re: Re: Re:
It is becoming more difficult to tell the difference between them, perhaps it has always been this way.
[ link to this | view in thread ]
That's nothing! Look what confiscation UK serfs are "subject" to
https://www.smh.com.au/politics/federal/criminals-required-to-explain-their-wealth-in-natio nal-crackdown-20180806-p4zvt9.html
[ link to this | view in thread ]
Re:
It's sad that I generally struggle to think of a country that isn't sliding backwards and closer towards a dictatorship these days.
[ link to this | view in thread ]
Re: That's nothing! Look what confiscation UK serfs are "subject" to
Are you with the Trump administration, by any chance?
[ link to this | view in thread ]
Re: Re: That's nothing! Look what confiscation UK serfs are "subject" to
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re:
When I see this type of thing happening..
Its finger pointing.
Its time to start hiding everything you own, before they take it all.
1 finger points THAT way..
4 fingers point BACK at you..
[ link to this | view in thread ]
A few strange things..
YOUR CORPS WILL LOVE YOU..(not really)
In all the occurrences of anything happening, HOW many persons have used SMART phones, and installed information of what they did, who helped, or anything else on the SMART phone??
90% of them used CHEAP throw away old phones FOR REASONS.
its not easy to track, no GPS, No browser that tells EVERY site who and where you are, NO chance of a INSERTED BOT/VIRUS that would copy everything you Wrote and send it to the POLICE..
I love persons that HATE, the built-in encoding, because its THERE so others cant decode and USE YOUR PHONE, REMOTELY CONTROL your phone,
THEN they HATE persons that CRACK those encodings and MESS up any USe of it...forcing the Tech corps to Create ANOTHER encoding to PROTECT YOUR PHONE..
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Industry Assistance Process Flowchart
Australia is a free country, which means the people have the ultimate say on how they choose to be controlled. If a government shifts too far toward tyranny, a free society has the right to change the org chart. The USA uses the 2nd amendment as the ultimate guarantee if things become extreme. Isn't there something simil... oh, wait... They took all the guns away and threw them in the garbage. Bummer.
[ link to this | view in thread ]
[ link to this | view in thread ]
Australia isn't going through those stages. The first minister in charge of Home Affairs (it has only been established this term) is already the worst person you can imagine in the role
[ link to this | view in thread ]
Re: The USA uses the 2nd amendment ...
... as a wonderful red herring the Government can deploy to distract the populace from encroachment on its important rights -- just make a feint towards the “right to bear arms”, and in the ensuing brouhaha, you can quietly bring some other restriction to bear, and nobody will notice.
Also, encryption is a tool with constructive, nonviolent uses. Unlike weapons like guns, which are purely destructive.
[ link to this | view in thread ]
Re: That's nothing! Look what confiscation UK serfs are "subject" to
As opposed to the US, where a warrant is not even required.
[ link to this | view in thread ]
Re: And that's not all. Window blinds!
In Eoin Colfer's Supernaturalist, blinds and curtains have mostly been replaced by windows having toggleable electronicpolarization filters to black them out.
They make a crackling sound when the police remotely depolarize them.
[ link to this | view in thread ]
[ link to this | view in thread ]