Australia drafts laws forcing Facebook and Google to reveal encrypted data
theguardian.com
theguardian.com
...you mean a backdoor to the device, instead of a backdoor to the encryption?
Using the phrase 'frontdoor' sounds more 'legal' and appropriate. But in reality the implications of backdooring the device, ie "before encryption" happens, is actually a far, far worse invasion of privacy than purely server side decryption. Because it exposes the entire devices to surveillance, every app and piece of data flowing through the device is then exposed (and many times not just to the intended target, the police, but also evil black hoodie sunglasses wearing hackers). While a warrant for a server-side wiretap/search is just one single data source, narrowly focused on particular data and not easily exploited by hackers as it happens largely offline.
It's also wrong, since there already is a "front door" on all devices: just use the normal password/fingerprint/face picture to unlock it.
>> In the second half of 2017 alone Apple received 2,601 requests for access to devices from Australian law enforcement agencies and granted them in 87% of cases.
…align with the famed Apple refusal to comply with the request to unlock an iPhone in the US a while back. Is the jurisdictional context different (re: the 4th amendment) or is this something different to unlocking a device?
Probably more notable is the implied rights built up by the High Court. The most important of these are a right to vote and freedom of political communication.
But nothing as sweeping as the US Bill of Rights.
Consider the fact that we are in the middle of an ongoing constitutional crisis, for which the political class knows an amendment is the only effective solution, but nobody in either major party wants to even try.
This isn't a constitutional crisis in the 'dismissal' sense.
It's just the operation of s44 of the constitution causing a headache for parliament. Its been found that many of the parliamentarians are dual citizens, which is forbidden, and their seats in parliament have been nullified by the high court.
However, there are other laws with constitutional significance. The Statute of Westminster, and the Australia Act.
But, most rights are guaranteed by Common Law, that is, any precedent or judicial opinion in any Commonwealth nation can be used for grounds that a right should be preserved when a decision is being examined by the High Court.
As an Australian, I would love the Government to take this one step further and also give us the right to not vote.
They don't have your iphone passcode on file so they can't provide it to law enforcement.
Could also very well be that the author didn't distinct between the two sufficiently.
Instead, we have these lawyers who treat maths, science and technology with contempt, who legislate for us, and don't understand what the fuck they're even talking about.
I remind people here that they should join a political party and consider seeking preselection, or at least influencing policy.
It's important that you join the party you otherwise most agree with. At different times, different parties will hold Government. Concentrating expertise on any topic in one party is a solid-gold guarantee that the other party will reject that expertise.
Apparently yes, and it's not just Australia. When Amber Rudd was Home Secretary in the UK she only opened her mouth to put her foot in it technically speaking. She came out with a hugely comical technical point after pretty much every incident, like the NHS virus a couple of years back, or when the government, iirc, "needed people with the necessary hastags".
Needless to say she was of the view mere citizens should not have encryption and that encryption needs backdoors for the good guys.
You get the same dangerous lack of awareness for science, environment and energy ministries as well as tech. Which makes me think the others, that I know less about, are much the same.
* Sell themselves to a wide and fickle audience of stangers
* Manage a campaign staff
* Understand problems in the context of history
* Read and write legislation in a way that avoids unintended consequences or misaligned incentives
* Negotiate against people with whom they have fundamental philosophical differences
* Complete a PhD program in science or engineering
That last one isn't necessary for our actual goal... and it doesn't even help when you consider that this person will also need to be an expert on military grand strategy, healthcare administration, procurement, urban design, and agriculture. We don't need a congress full of subject-matter experts. What we need are people who respect and can work effectively with subject-matter experts.
So what is it that Senator Ron Wyden and Judge Aslup do that others should copy?
* Manage a campaign staff
It is not necessary that politicians can do either / both, it is just that they appear to be the least worst option for at least a brief moment in the past.
I'm often reminded of that single panel comic where small child says "Dad, I'm considering a career in organised crime" and the father, holding a news paper, says "Government or private sector?".
The key point is really only "Sell themselves to a wide and fickle audience of strangers"
That's really the only skill our unicorn needs to stand for and win election.
The policy or manifesto is set in party HQ outside of scientific or any other expert advice or specialist knowledge. In the hope it'll win votes. Then a series of staged interviews, sound bites and dog whistles seek to move the Overton window to their policy and preferred direction of travel. Nothing to do with competence, truth, Civil Service advice or the presence or otherwise of a PhD in the Ministry. Politicians get promoted and senior roles because of ability to control a debate, and their media friendly features and abilities.
The better laws on the books often come from hard won experience, case law and Select Committee recommendations. Those tend not to be the laws of policy headlines, manifestos and high profile Ministry interviews.
Hence we get ridiculous policies and political grandstanding on a whole range of topics. Climate change and Brexit being just two examples where fact and consensus are irrelevant.
They have career public servants who are specialists in drafting legislation to work with them on writing legislation that faithfully implements their policies (eg. in Australia, the subject of the article, there is the Office of Parliamentary Counsel).
Though maybe a more fundamental point is that our legal system is quite broken. The legalese is intended to ensure clarity, yet when it results in a system where fewer people than ever have any clue about what the law actually says, in anything beyond the most broad meaningless strokes, one must wonder whether it has actually achieved its purpose or not.
I agree with the spirit of this argument, but there is a clear downside to not giving subject matter experts a vote at all. Ultimately there is then nothing to stop political expediency overriding facts and understanding, and the elected representatives are free to discard the opinions of the SMEs no matter how valid or correct they might be.
Obviously most representatives still couldn't be true experts all the different subjects that lawmakers vote on. You'd only ever have a limited number of representatives who were voting fully informed on any given issue. Still, at least that number would be greater than zero, and if you're a politician voting for a "health" law that 100% of the qualified medical practitioners among your colleagues are voting against on the same record, that tells everyone something.
Sadly, I've "seen" this (first- and second-hand) happen even with private-sector managers. When it happens to me, I always wonder, why did they bother to hire us (relatively expensive) experts in the first place?
I've heard tell on HN of "engineering first" company cultures where decisions are supposedly made based (exclusively, when possible) on objective criteria, but I have yet to see it at companies above a certain size.
> We don't need a congress full of subject-matter experts. What we need are people who respect and can work effectively with subject-matter experts.
In practice, you need experts inside the tent. There is a trust gradient in politics, with a sharp drop-off for anyone "outside" of the party room.
Especially if one side picks up an issue and uses that expertise to bash the other side. In that situation their opponent can either beat a retreat (followed by triumphalism) or they can deny the expertise. Especially if you don't trust the motives of the experts.
This is less likely to happen if all sides are seeded with expertise.
Banning CFCs is the best example of this dynamic. Reagan didn't understand the problem and it went against his policy instincts. But without the USA's involvement, any ban was pointless.
It was Thatcher -- someone nearby on the trust gradient, with a background in chemistry -- who convinced Reagan that it was a real problem. He still didn't understand it, but he had a trusted source to rely on.
great, now you might catch the dumb ones, but is there a shortage of secure communication channels? :)
I'm not certain that they understand what they're asking for, can't be done. That is, there are politicians who believe math can be bent to fit the law.
Worth noting that Malcolm Turnbull made part of his money from investing in the internet sector in the early 90s. He invested $500,000 in OzEMail (one of Australia's first internet service providers) back in 1994, and sold his stake for $57 Million to Worldcom in 1999. He's not an engineer, but he's not entirely ignorant on these matters.
I mean asking Facebook to reveal encrypted data? What even is that? The data is stored readable on both the device and presumably facebook's servers, and is only encrypted in-transit if a user enables that.
Are they asking that the data not be secure in-transit?
It's a nonsense request, until they clarify what exactly it is they want.
If this ruins them economically, maybe the world needs a proper example of what happens when politicians don't understand science.
(On the other hand, didn’t the first crypto wars end around the time someone put the RSA equations onto a T-shirt to circumvent export rules?)
The equations themselves were never export restricted, nor was computer code printed in text in a book (since OCR wasn't considered good enough at the time yet).
It doesn't stand out as a great example of "on the other hand".
Yeah and all is well and good until some faceless stalker tracks down, stalks, molests, brutalizes and finally murders some 'important/high muckety mucks' 11yr old daughter and posts it all over the net. Then the the gov have no choice but to enforce 'real' protection of your security.
A house has two doors, frontdoor and backdoor. Either one gives you access to the contents you're trying to protect.
It's time public/gov wises up and demands REAl security.
An example of this is the monopoly internet infrastructure project that was gutted: This project is an existential threat to the television and news media organisations that enabled the current government to be elected.
Another example of this was the introduction of DNS filters to block sites that are commonly used for piracy: These sites are an existential threat to the television and news media organisations that enabled the current government to be elected.
Given the history, it is fairly likely that this legislation is also being made to satify some third party interest.
Policy in the Western world has become about what focus groups like rather than evidence.
There is expertise. Our Prime Minister knows tech, Turnbull is a millionaire from seeing the potential of the internet in the 90s and heavily invested in an ISP and took on role of chairman. Half a decade later he'd turned 500k into $50 million when Ozemail was acquired.
The policies aren't because of incompetence, they're actively malicious against the publics best interest in favour of the elite set to make bank.
Clearly when he became the communications minister I think he demonstrated that while he was willing to ignore experts and destroy things maliciously for political gain, I believe he also demonstrated he didn't actually understand recent tech or broadband networks much at all through a lot of it either. There were things that I think he actually believed that were rubbish.
Our Government cant get a simple census, fibre broadband or even site blocking right.
Despite the headline, it’s not clear that any bill has actually been drafted and certainly nothing has been introduced to Parliament. According to the minister, what will be proposed is a law that is ‘completely consistent in principle with the existing laws for telephone intercepts.’ While he ‘dodged multiple questions’ about whether the laws would authorise the use of ‘surveillance codes’ (whatever that means), he denied that there was any proposal to introduce laws requiring the use of backdoored encryption algorithms.
It would be consistent with the existing telephone intercept laws in Australia [2] (and most other developed countries) to require service providers to surveil users upon production of a warrant. In Australia, judges must consider the seriousness of the offence being investigated, and the impact on privacy, before issuing a warrant [3]. Warrants can also be obtained to install covert surveillance devices (ie. bugs) [4] if a telephone intercept or search warrant is unlikely to produce evidence.
Contrary to the comments suggesting that the legislators are completely uninformed, an Australian parliamentary committee has been conducting a public inquiry into the ‘impact of new and emerging information and communications technology’ since October 2017 [5]. Any member of the public may make a submission [6] to the inquiry and advocacy groups such as Electronic Frontiers Australia and the Law Council of Australia have done so. Relevant experts have also appeared before the committee in public hearings. It is likely that any draft legislation would be informed by the committee’s findings.
Given that the government recognises the efficacy and importance of strong encryption, the proposed new laws may look more like the US All Writs Act at the centre of the FBI–Apple encryption dispute [7]. It might not be practical to backdoor the ciphers used to encrypt data at rest on an iOS device, or in flight in a WhatsApp message. But it would be consistent with the principles of the existing telephone intercept powers (which are targeted and subject to judicial, parliamentary and ombudsman scrutiny) to require publishers like Apple to push out backdoored OS updates or apps to targeted users (or physically seized devices, as in the San Bernardino case). Perhaps the ability to obtain such targeted warrants would be less socially harmful than increased use of the existing, but more intrusive, surveillance powers.
[1]: http://www.abc.net.au/radionational/programs/breakfast/new-e...
[2]: http://www.austlii.edu.au/au/legis/cth/consol_act/taaa197941...
[3]: http://www.austlii.edu.au/au/legis/cth/consol_act/taaa197941...
[4]: https://www.homeaffairs.gov.au/about/national-security/telec...
[5]: https://www.aph.gov.au/Parliamentary_Business/Committees/Joi...
[6]: https://www.aph.gov.au/Parliamentary_Business/Committees/Joi...
[7]: https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute
We've seen in the push to Windows 10 that, when automated updates are used in a harmful manner, people disable automated updates. The same would happen here: once it's been shown that the automated updated mechanism has been used to purposefully push a harmful update, people will start disabling automated updates.
Which means that Apple and Google have a good reason for opposing such requests.
(And that's before getting to the "elephant in the room": the same mechanism created for these requests can, and probably will, also be used by malicious actors.)
Those keys are probably some of the most valuable 1s and 0s in the world.