> It covers [...] device vendors [...] as long as they have "a nexus to Australia"
> But what if the suspect stores the keys themselves? In that case, the government would pull out the big guns with a second kind of order called a technical capability notice. It forces communications providers to build new capabilities that would help the government access a target’s information where possible.
> What if the communications provider doesn’t want to help? Then they could face penalties from the government, or "injunctions or enforceable undertakings".
Yeah, right. But the precedent is alarming, because what is happening (and you see it with other "pro law enforcement" or "pro privacy" legislation too) is governments are giving themselves broad enforcement powers to ask for things and then only using it when push really comes to shove. This they-can-but-they-probably-won't approach towards enforcement is dangerous as it removes predictability in favor of government subjectivity. What does it mean in practice? It can mean that while Samsung or Apple would give them the middle finger resting on their size/leverage, a smaller company can't do that. So the enforcement agencies proportionalize their punishments to the amount tolerable without citizen backlash.
Everyone should just remember this tactic when we go around praising laws with big punishments for big companies just because we happen to like the spirit of the law. And also remember this when people call us stupid for questioning subjectivity of statute enforcement or the lack of statute enforcement in general when new versions of these laws are crafted.