Australian Secretary Of Defense Not Concerned About Phone Hack; Doesn't Think People Want To Spy On His Phone

from the oh-really-now? dept

If you were the Secretary of Defense of a large country, you might think you'd be slightly concerned that foreign agents would want to spy on you. Not so down in Australia apparently, where the current Secretary of Defense, insists that he'd be "surprised" if anyone wanted to find out what was on his phone. Seriously.

We've written about the recent story, revealed in documents leaked by Ed Snowden, that the NSA and GCHQ were able to hack into the systems of Gemalto, the world's largest maker of SIM cards for mobile phones, and obtain the encryption keys used in those cards. While Gemalto insists that the hack didn't actually get those encryption keys, not everyone feels so comfortable with Gemalto's own analysis of what happened.

Senator Scott Ludlam (who we've written about a few times before) reasonably found the story of the Gemalto hack to be concerning, and went about asking some questions of the government to find out what they knew about it. The results are rather astounding. First he had asked ASIO, the Australian Security Intelligence Organization, and they said it wasn't their area, but it might be ASD (the Australian Signals Directorate). The video below shows Ludlam asking the ASD folks for more information about the hack and being flabbergasted that they basically say they haven't even heard about the hack at all: Right at the beginning, the first person says he's not aware of the situation, and Ludlam asks "are you aware of the broad outlines?" and gets a "no I am not" response, leading to a rather dry "Really?!? Okay, this is going to be interesting" reply from Ludlam. It goes on in this nature for a while, with the various people on the panel playing dumb, and Ludlam repeatedly (and rightly) appearing shocked that they appear to have no idea about the story.

But the really incredible part comes in the last minute of the video, in which Ludlam asks the Australian Secretary of Defense, Dennis Richardson, about his own concerns about his phone being spied on:

Ludlam: Do you use an encrypted phone, Mr. Richardson?

Richardson: No, I don't.

Ludlam: Right. Okay. Do you use a commercial -- I'm not asking you to name names -- but do you use a commercial telecommunications provider?

Richardson: Yeah, yeah, yes.

Ludlam: So there might be a SIM card in your phone or mind. Does this alarm you at all?

Richardson: No.

Ludlam: No?

Richardson: No.

Ludlam: Why is that?

Richardson: Well, because I don't particularly deal with people who... if anyone wants to listen to my telephone calls they can. I'd be surprised if they do, but I don't particularly have conversations which I'm particularly worried about.

[Laughter all around the room]

Ludlam: So it's okay if foreign spooks have hacked every mobile handset in the country because you don't have anything in particular...

Richardson: It's possible some might try to.

Ludlam: It's possible some just have.

Richardson: [shrugs] Well, it's possible.

So there you have it, folks. The Australian Secretary of Defense says that anyone is allowed to listen in to his calls, because there's nothing secret about any of them. I'm not quite familiar with public records/freedom of information laws in Australia, but is it possible for someone to put in a request for recording all of the Secretary of Defense's phone calls?

Filed Under: asd, asio, australia, dennis richardson, gchq, hacking, nsa, phones, scott ludlam, sim cards, surveillance
Companies: gemalto

Australian Spy Agency Reaches Out And Touches Self In Warrantless Wiretap Misfire

from the calls-are-coming-from-inside-the-house! dept

ASIO -- Australia's NSA -- runs the tightest spying ship in the spying-ship-spying-on-spying-ships business. It's all detailed in one tiny paragraph hidden 26 pages deep in an 100+ page Inspector General's report. [pdf link]

"ASIO intercepted, without warrant, calls made from one of its own regional offices due to a technical error. The data was deleted and processes put in place to ensure it does not happen again."

I'm not sure what tipped the spooks off. Maybe it was the range of the familiar voices (possibly their own, even!) heard during the transcription process. Or maybe it was the embarrassing moment where one ASIO agent admitted to the agent at the other end of the line that he was a "long-time listener" but a "first-time caller," shortly before the feedback loop made the call too painful to continue.

The above screw-up didn't violate the privacy of anyone but a few privacy-violators and the Inspector General readily notes that this sort of thing won't be happening again. Presumably, future warrantless interception will be checked against the very short list of DO NOT SPY numbers, most of which should be readily apparent by their in-house extension numbers.

The report quickly moves on from this little embarrassment but failing to clarify whether it was the interception or the lack of a warrant that was the problem. A "we don't spy on ourselves" policy would make sense but wouldn't necessarily be a violation of the Telecommunications (Interception and Access) Act. On the other hand, the warrant requirement for ASIO is basically an impediment no thicker than the ink applied by a rubber stamp -- all that stands between what the agency wants to do and what it's going to find a way to do anyway. As the laws governing ASIO's surveillance stand now, a warrant is nothing more than a nice afterthought.

The Bill introduces the concept of a "delayed notification search warrant" -- often referred to in the United States as a 'no-knock warrant' -- which would allow Australian Federal Police to search premises without prior warning and "without having to produce the warrant at the time of entry and search".

Maybe the warrant was still in transit, or maybe ASIO though the interception of its own calls fell under one of its other broad warrants, some of which could easily be interpreted as pertaining to every device connected to the Internet.

But these are this year's laws and that is last year's violation, so it still doesn't add up. What it does do is throw some hazy light on an agency that thrives in the dark and just successfully ushered in a brave new world of domestic surveillance. This incident proves a valuable point about trust (namely: don't) and answers an important rhetorical question: Who watches the watchers?

Clearly, the watchers do.

Sometimes.

But only inadvertently.

And it won't happen again.

Filed Under: asio, australia, privacy, spying, surveillance

How Australia's New 'Anti-Terror' Censorship Law Could Cover Up Botched Intelligence Operations

from the what-could-possibly-go-wrong? dept

As we reported a few weeks ago, Australia has passed a dreadful "anti-terror" law that not only allows the authorities to monitor the entire Internet in that country with a single warrant, but also threatens 10 years of jail time for anyone who "recklessly" discloses information that relates to a "special intelligence operation." But what exactly will that mean in practice? Elizabeth Oshea, writing in the Overland journal, has put together a great article fleshing things out. Here's her introduction:

The parliament has passed legislation that permits the Attorney General to authorise certain activities of ASIO and affiliates as 'special intelligence operations'. We can only assume that ASIO will seek such authorisation when its operatives plan to break the criminal or civil law -- the whole point of authorising an operation as a special intelligence operation is that participants will be immune from the consequences of their unlawfulness. It will also be a criminal act to disclose information about these operations.

So the Australian government can designate activities of its spy services as "special intelligence operations," which may well be illegal, and then it becomes a criminal act to disclose anything about those operations, however bad they are. Indeed, that even seems to include operations that result in death, as Oshea explains in one of her examples of what could happen under the new law:

A botched operation is conducted that results in the death of an innocent bystander (credit this suggestion to the former Independent National Security Legislation Monitor). Note that if a person with three children dies as a result of a failure to take reasonable care, her family will be unable to make a claim for the cost of raising her dependents. If she is maimed but not killed, she will be unable to make a claim for the cost of her medical care, lost earnings, pain and suffering, and the cost of raising her dependents.

That's a hypothetical case, but Oshea also lists a number of incidents that have already occurred, but which are likely to be covered by the new law -- and would thus become impossible to write about. Here are a couple of them, with links to the real-life cases:

Agents and officers raid a couple in their home and hold them captive at gunpoint for an hour, only leaving when they discovered they were at the wrong address. The couple will have no entitlement to compensation for any property or personal damage arising from imprisonment, trespass and assault.

Agents kidnap and falsely imprison a young medical student. They attempt to coerce answers from him, making making threats that go beyond what is permitted by the relevant search warrant.

There's more of the same, listing previously-reported incidents that would probably be censored in future. The post also explores legislative proposals that are equally disturbing:

The parliament is considering laws that will punish people with life imprisonment for a range of new offences associated with 'subverting society' (which is a component of the new definition of 'engaging in hostile activities'). The law contains a defence of advocacy, protest, dissent or industrial action, but it is very unclear how these would be applied.

Here's the kind of thing that might get you life imprisonment in Australia in the future:

Leaking materials taken from government information systems that demonstrate serious wrongdoing (as per Manning or Snowden).

Organising and engaging in denial of service attacks – the online equivalent of a sit in – against government websites, such as that of the President, Prime Minister, the Ministry of Industry, the Ministry of Foreign Affairs, and the Stock Exchange.

There's also an explanation of what data retention might mean for the public. All in all, it's a valuable guide to some of the seriously bad stuff that Australia is doing. Let's just hope that other countries don't take it as a blueprint.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: anti-terror, asio, australia, censorship, leaks, special intelligence operations, whistleblowing

Proposed Terror Law Would Allow Australia's Entire Internet To Be Monitored With Just One Warrant

from the terrorists-have-already-won dept

Recently, Techdirt has been following the Australian government's moves to bring in intrusive new surveillance powers. The "justification" for all this is, of course, "terrorism", which has become the lazy politician's excuse for everything, and has already led to episodes of ridiculous over-reaction in Australia. So it hardly comes as a surprise that the worsening situation in the Middle East has brought forth even more of the same, in the form of the "Counter-Terrorism Legislation Amendment (Foreign Fighters) Bill 2014" (pdf). An accompanying Explanatory Memorandum (pdf) gives a good summary of its rationale:

1. Australia faces a serious and ongoing terrorist threat. The escalating terrorist situation in Iraq and Syria poses an increasing threat to the security of all Australians both here and overseas. Existing legislation does not adequately address the domestic security threats posed by the return of Australians who have participated in foreign conflicts or undertaken training with extremist groups overseas ('foreign fighters').

2. This Bill provides a suite of measures which are specifically designed to strengthen and improve Australia’s counter-terrorism legislative framework to respond to the foreign fighter threat. It will provide additional powers for security agencies to deal with the threat of terrorism within Australia and that posed by Australians who participate in terrorist activities overseas. It will further counter terrorism through improving border security measures and by cancelling welfare payments for persons involved in terrorism.

The Bill is a huge collection of amendments to dozens of existing laws, including those that regulate police search powers. Here's CNET's description of a major change in this field:

The Bill introduces the concept of a "delayed notification search warrant" -- often referred to in the United States as a 'no-knock warrant' -- which would allow Australian Federal Police to search premises without prior warning and "without having to produce the warrant at the time of entry and search".

The Explanatory Memorandum details an important new capability relating to computers:

As computers and electronic devices are becoming increasingly interconnected, files physically held on one computer are often accessible from another computer. Accordingly, it is critical that law enforcement officers executing a search warrant are able to search not only material on computers located on the search premises but also material accessible from those computers but located elsewhere. This provision would enable the tracing of a suspect's internet activity and viewing of material accessed by the suspect through the use of that equipment.

That seems rather broad; an article in the Sydney Morning Herald reveals just how broad:

On Wednesday afternoon, [Australian Attorney-General] Senator Brandis confirmed that under the legislation, ASIO [Australia's spy agency] would be able to use just one warrant to access numerous devices on a network.

The warrant would be issued by the director-general of ASIO or his deputy.

"There is no arbitrary or artificial limit on the number of devices," Senator Brandis told the senate.

This means that the entire Australian internet could be monitored by just one warrant if ASIO wanted to do so, according to experts and digital rights advocates including the Australian Lawyers Alliance, journalist union the Media Entertainment and Arts Alliance and Electronic Frontiers Australia.

Whether or not new powers are needed to address the problem of "foreign fighters" returning home, clearly that ability to monitor the entire Australian Internet with just one warrant is completely disproportionate, an assault on citizens' privacy, and ripe for abuse by the authorities. It underlines once again that abrogating basic freedoms in order to "fight terrorism" simply means the terrorists have already won.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: asio, australia, george brandis, laws, surveillance, terror, warrants

Australian Attorney General Wants To Make It A Criminal Offense To Not Turn Over Private Encryption Keys

from the a-disaster-waiting-to-happen dept

The Attorney-General's department in Australia is apparently pushing for new laws down under that would force anyone who's asked to hand over their private encryption keys -- and that covers both end users and service providers. Buried in the middle of a submission concerning revising Australia's wiretapping laws, the AG's office notes:

The Department is also advised that sophisticated criminals and terrorists are exploiting encryption and related counter-interception techniques to frustrate law enforcement and security investigations, either by taking advantage of default-encrypted communications services or by adopting advanced encryption solutions.

The Department’s current view is that law enforcement, anti-corruption and national security agencies should be permitted to apply to an independent issuing authority for a warrant authorising the agency to issue ‘intelligibility assistance notices’ to service providers or other persons. The issuing authority should be permitted to impose conditions or restrictions on the scope of this authority.

[....]

Under this approach, the person receiving a notice would be required to provide ‘information or assistance’ to place information obtained under the warrant into an intelligible form. The person would not be required to hand over copies of the communication in an intelligible form, and, a notice would not compel a person to do something which they are not reasonably capable of doing. Failure to comply with a notice would constitute a criminal offence, consistent with the Crimes Act.

The above approach is consistent with the approach taken by the United Kingdom, which permits officials of law enforcement and national security agencies to, where authorised under a warrant, issue a notice requiring a person to provide assistance in connection with accessing encrypted communications. Similarly, South African law permits agencies to apply to a judicial officer for a direction requiring a person to provide information to the agency to enable the agency to decrypt lawfully intercepted communications.

The Orwellian nature of "intelligibility assistance notices" is fairly striking. Basically, this says if you don't make encrypted communication "intelligible" upon request, you would have violated criminal law. It's kind of funny how it claims this doesn't require anyone to hand over communication in an intelligible form... because it just asks for the encrypted content and the key to decrypt them. Which, you know, is basically the same damn thing.

Meanwhile, at the same time as part of the same discussion over wiretapping laws, there's an effort under way in Australia to force service providers into a big data retention scheme, forcing them to hold onto all sorts of data for law enforcement purposes. Incredibly, Australian officials seem to be using the NSA/Snowden leaks as the impetus for this.

Intelligence agency ASIO is using the Snowden leaks to bolster its case for laws forcing Australian telecommunications companies to store certain types of customers' internet and telephone data for a period of what some law enforcement agencies would like to be two years.

ASIO also, like the AG's office, seems quite concerned about you damn kids and all your encrypting:

"Since the Snowden leaks, public reporting suggests the level of encryption on the internet has increased substantially," ASIO said.

"In direct response to these leaks, the technology industry is driving the development of new internet standards with the goal of having all web activity encrypted, which will make the challenges of traditional telecommunications interception for necessary national security purposes far more complex."

So, even if everything's getting encrypted, certain law enforcement interests seem hell-bent on having everything collected and easy (forced) availability of private keys. If you happen to live in Australia, you might want to speak up about what's about to happen to what you thought were your private communications and browsing activity.

Filed Under: asio, attorney general, australia, data retention, encryption, privacy, wiretapping