Australia Wants to Take Government Surveillance to the Next Level
nytimes.com
nytimes.com
> The "Five Eyes", often abbreviated as "FVEY", refer to an intelligence alliance comprising Australia, Canada, New Zealand, the United Kingdom and the United States. [1]
That would be "yakuza." (YAH-koo-zah)
Not to nitpick, but ASIO is closer to Australia's version of the CIA, as they are primarily focused on foreign "adversaries".
Australia has the Australian Federal Police, which is their version of the FBI.
ASIS is also the department that was secret between its founding in 1952 until 1972
[0] https://en.wikipedia.org/wiki/Australian_Secret_Intelligence...
When ASIS operators were refused entry into a hotel room, they broke down the door with sledgehammers. The hotel manager, Nick Rice, was notified of a disturbance on the 10th floor by a hotel guest. When he went to investigate, he was forced back into the lift by an ASIS operator who rode the lift down to the ground floor and forcibly ejected Rice into the lobby.
Believing a robbery was in progress, Rice called the police. When the lift started returning to the ground floor, ASIS operators emerged wearing masks and openly brandishing 9mm Browning pistols and Heckler & Koch MP5 submachine guns, two of them with silencers[1]
[1] https://en.wikipedia.org/wiki/Australian_Secret_Intelligence...
“Operating independently from its governments...”
Are the agencies involved not part of their governments? Am I missing something?
“Hackers Can Disable a Sniper Rifle—Or Change Its Target...”
It wants me to post this to social media. What’s the context of this quote? It gives none. It seems like it wants me to post clickbait.
If you want to learn about FVEY you’re probably better off just reading Wikipedia:
https://www.wired.com/2015/07/hackers-can-disable-sniper-rif...
Not just because of the potential to be hacked, but also because electronics have a wider variety of failure modes as compared to the mechanical bits, most of which have remained both highly reliable and functionally unchanged over fifty, if not a hundred, years.
Especially when you consider that, at least when it comes to safety, there's so much low-hanging fruit on the education and awareness front.
Regardless of where you stand on the politics, it seems pretty straightforward that, in a country that today has more guns than people, that safety education should be part of school curricula at multiple points.
On that note, we should probably also make sure everybody knows how to properly use a fire extinguisher, and I'm not sure we teach that, either... :/
In Britain we'd probably make a distinction between elected government and civil service. I suspect the point being made here is of operation without sufficient legislative/executive oversight, which there seems to be at least some evidence for.
They are not independent of it, under no definition of any of those words. Maybe oversight is lax. Maybe oversight is perfect and everything happens exactly as the overseers want it.
None of that changes anything about the truth of the initial claim. "Independent of" is patently false, and an obvious attempt to sensationalise.
Sure. But the words actually used were: "operating independently from", which is different.
And you're just proving that bad-faith accusation, and splitting hairs into finer and finer strands.
The conclusion they draw from that is right however; a lot of laws can be introduced to our parliament that might not get off the ground elsewhere. It's why we've fervently fought against many other, similar laws that would impinge on our rights and freedoms in the past. I spent a good part of my youth fighting against the Clean Feed legislation (it was a great big Internet filter for Australia, a terrible idea) which was thankfully defeated before it got off the ground.
We'll have to do the same for this.
The protections provided by the Australian constitution (as interpreted by the High Court) are quite weak in comparison to those included in the US Bill of Rights, it isn't really a fair comparison.
> whilst others are parts of common law and other legislation.
Anything in common law or legislation isn't worth much, since a single ordinary Act of Parliament is all it takes to cancel them out.
I also know of cases where law enforcement improprieties have led the police prosecutors to come down on the side of the defendant in question and the improprieties being dealt with by the judge.
So though we do not have constitutional protections a la USA constitution, we do have other protocols in place.
Mind you, irrespective of any specific political affiliation, most of our politicians are all for higher surveillance and control of the population. It has taken cooperation of both government benches and opposition benches to pass the more draconian legislation in recent years. It has been interesting to watch parliament and see that there are very few there who are willing to grow a backbone and actively protect the rights of the citizens of this nation.
None of the draconian terror related legislation has actually been needed as all such activity is covered by normal criminal and civil legislation previously brought into existence. At least one of the draconian pieces of legislation does not require changes to the legislation to have the targets of that legislation changed at whim. All it requires is an administrative change of definition to change the legislative definition of terrorist. Smart work on the part of those who framed the legislation. A new government can designate any group they don't like as terrorists without going before parliament.
So any citizen of Australia that just wants to mind their own business can be easily caught up in the entire mess.
Parliament do have the right -- however -- to simply pass a law that says "oldandtired goes to jail forever" with a simple majority.
The problem with the currently enacted terror legislation (approved by both sides) is that only an administrative change in a definition is required. This does not (as far as I can ascertain) require this to even go back to parliament for approval.
The point is that we do have certain rights before the courts that they will enforce. These are not constitutional rights but they are there.
The rights are granted to us by our creator aka natural law. The same law used to declare our independence from the crown and an inherent part of the fabric of the US.
Not sure if this is clearly stated yet.
But the notion is that governments do not “grant” these rights, and likewise government can never infringe upon god given rights.
Right, which is why we have the 9th and 10th amendments. Unfortunately they are effectively ignored, along with the Enumerated Powers clause, meaning our government effectively has unlimited power. :-(
Assuming your intellect is superior to that which you cannot measure is also a common failure among smart folks. I am sure you dont fall prey to that trap.
[1] http://www.legislation.govt.nz/act/public/1990/0109/latest/D...
For example, the bill of rights talks about "right of the people to be secure ... against unreasonable searches and seizures" and yet asset forfeiture is still a legal option. Actual practices surrounding plea bargains also look to run counter to the spirit of the BoR, but I mean what do I know.
I don't see how having a bill of rights helps. The only matter of import, and the only protection, is an engaged and motivated voting public. Constitutional amendment might provide a thin layer of protection against short-term rogue actors, but the creeping surveillance state is not rogue by any means, it seems to be a point of international consensus over many decades.
So in Australia it is very hard to get a constitutional amendment to pass, and politicians have very little say in whether the amendment will pass (they can block it by voting against it but they cannot force it to pass). Only 8 (out of 44) have passed in the past 117 years that we have been a country.
As for Australia having a bill of rights, I think it would be an improvement (especially if it was anything like the Swiss constitution) but I don't know whether our bill of rights would be ridiculously watered down (not to mention that the US bill of rights is like the 10 commandments -- many people know a couple but don't know all of them and forget that the majority of them are not really relevant today).
So while purely looking at the proportion of YES votes needed and ignoring who is casting the votes, you might be able to argue it could be harder to get something passed in the US because in Australia it requires a super-majority of the public (which is generally a smaller percentage than a majority of 3/4ths of states) which means that it is not purely the role of the government to decide the rules that restrict the government's power. This means that the concern of a constitutional bill of rights in Australia being "pointless" because it would be easy for the government to overturn doesn't make much sense.
But the power of such shape public opinion, and even people's sense of their, and their country's, identity.
The US, for example, has long had a strain of something akin to "patriotism to the constitution". It's a collective narrative that makes people believe in those rights (and the rule of law). And even those that do not share that believe have historically been motivated to play along, because it was the only way to stay what's called "acceptable company" (or "electability").
Of course we're currently running an experiment if that mechanism still works when 47% of the voting population and half the elected representatives decide to try something else for a change. Currently, it's only parts of the judiciary, and of the media, holding everything up. we'll see how it ends.
No, Australia has nothing like the Bill of rights, even if some bits of the constitution cover the same ground very partially.
To give a flavour of this, our constitution prohibits an established church using language very similar to the US 1st Amendment. But the silence about freedom of speech is deafening.
In the '90s the High Court decided there had to be an implied right to freedom of speech inherent in the political system which is itself implied by the constitution. But since it is not explicit, they still restrict it to only political speech. And (since it really did require a strong judicial activism) many in our legal community are against even this much enforcement of fundamental rights.
The High Court of Australia has ruled that Australians have an implied right to political communication and an implied right to protest.
Not specifically pertinent to this legislation but worth pointing out for HN readers who may think we live without protections and freedoms US citizens seem to enjoy.
"Similar, but different."
Claiming that you're not backdooring something doesn't stop it from being a backdoor.
The parent's link, allows you to post a boilerplate submission with a single click. Far better to write and email your own submission, as form letters tend to get aggregated into one during evaluation. Your own submission only has to be a few lines, even if it just paraphrases a form submission. Uniqueness counts over bulk submissions.
The page for the inquiry is:
https://www.homeaffairs.gov.au/about/consultations/assistanc...
The email address for submissions is:
AssistanceBill.Consultation@homeaffairs.gov.au
Less time critically, you also need to write to or call your federal MP, but I'd suggest that a personal submission to the inquiry is the most "bang for buck".
The real question’s not which one of these paths to chase;
but whether you can pursue them all, in a balanced way,
so that they keep each other in check with restraint
without letting any one of them dominate.
The Government says that "systemic" weaknesses cannot be demanded. That said, the third part of the demands that can be made, the "technical capability notice", seems ripe for abuse.
At the very least, the acceptance of a bill like this will erode trust in app stores. I would expect to see some sort of checksum verification by users becoming commonplace as people become wary of potential targeted attacks.
[1] http://www.abc.net.au/news/science/2018-08-20/tech-surveilla...
That's because they already have a pre-existing "systemic" weakness that's better than any encryption back door: automatic software updates. If you can replace the software so it gives you the unencrypted data why on earth bother with a breaking the encryption? All they need is a hammer that forces the software companies to write undetectable bugs and silently install them for them, and that's what this legislation provides.
We handed this systemic weakness to them on a platter, and it's been there for years now. Even through it was many years ago, I still recall the horror I felt when my daughter has her phone stolen, and I discovered I could press a button on Google play that would install some spy software to report on the whereabouts of the thief. I'm sort of surprised it took them this long to wake up to it.
It isn't impossible to fix, so I suspect in the long term this loophole will be closed. The key to the fix is in the word "systemic", which translated means someone other than them can't exploit the weakness.
As an aside, they are apparently operating under the assumption they will be able to control who has access to it. Which is to say they believe they can control access to something that will be highly automated thus ultimately controlled by only a few people. They are after all subject to the same attack they are using on us - they will be asking programmers to update their software, software that they undoubtedly will never see because it's "company proprietary". As the saying goes every human has their price. The price the attackers can afford in this case is extraordinary: this system is the key that unlocks every banking password, every bank SWIFT password, every GPG key, every X509 secret key, every email, every boardroom discussion on billion dollar takeovers. They are kidding themselves if they think that can protect this - which is why it is a terrible proposal.
Worse, they don't have the defence we do, which is that the "normal" unmonitored population must be running strong, secure software. We get this unbugged software now from public servers we call app stores. So all you need is something that will compute the hash of the software you downloaded so you can compare it to publicly available one, and won't lie about the result. "Won't lie about the result" translates to "a device that can't be corrupted" which in turn translates to "can't have it's software upgraded". We already have such devices: they are called TPM's. We already know how to use them. Sort of. They work real well in 2FA dongles for example.
Nevertheless it has to be said the primary application of TPM's, secure boot, hasn't been a raging success. But then we haven't had a good reason to make it a success: how many people do you know have been victims of evil maid's? Well, that was nice while it lasted, but now we all about to come face to face with an evil maid from our worst nightmares: someone who can install software updates while your phone is sitting in the safety of your coat pocket without leaving a trace.
So the incentive is now here, the engineering task is well defined. Unfortunately the problem remains hard. We have to surround drivers, IPC, network stack with same high Chinese walls we currently put around apps, and somehow tie this all back to an all seeing TPM. So it's going to take a while. Maybe se4L will get it's day in the sun.
Now just a decade later this 'backward' behavior is now 'normalized'.
This is evidence things are moving too fast for us to fully comprehend or contemplate how far down the slippery slope we may be at the current time and how 'values' and definitions change in just a decade.
I appreciate that the author mentioned the gross incompetence of our intelligence operation which I presume doesn't get much mention outside the country.
PS: nice original Mac illustration for that article!
Today, I see this announcement in the news and I am wondering which country I can emigrate to with my own kids because I am disgusted with the increasing authoritarian bent of our government, as well as our plummeting human rights record...
This opens up questions as to how someone becomes 'suspicious' if their communication is already encrypted. And if they're already a person of interest, how many myriad other ways do they have of surveilling them or checking out their activities? Terrorist attacks require non-electronic items that have to be purchased, stored, and constructed in non-electronic places. There are existing ways to surveil people, under warrant. GPS trackers, phone records, bank statements, listening devices, watching devices, IMSI catchers, metadata (which Australia has legislated must be kept by ISP's for a couple of years).
This new legislation feels like a LOT of effort for a very small percentage return over and above those things I've already listed, especially considering:
- How long would it take to develop and deploy a targetted version of a program?
- What's the likelihood of the target updating their program during the useful window of time?
- Is this timeframe going to be of use to law enforcement?
- If the timeframe is justified, what's the time limit? Is 'suspect' going to have their comms intercepted for the foreseeable future? At what point is the well deemed to be dry?
- At what point does warranted surveillance become government harassment?
What this looks like from the outside is more psychology than technology:
- Hey Terrorists, we can do these things so, you know, re-think your life's direction
- Chilling effects: encourage paranoia, discourage dissent, even discourage disagreement
Not particularly relevant - they can require a targeted version of the program be developed before someone comes under suspicion.
>What's the likelihood of the target updating their program during the useful window of time?
Doesn't matter - they can require a force-push update system be built to silently update a specific customer's app version. The law is broadly enough worded that they can order whatever software is in their way to become broken upon receipt of a court order.
>Is this timeframe going to be of use to law enforcement?
Yes, because the law will allow them to force commercial companies to build automated, scaled systems.
>If the timeframe is justified, what's the time limit? Is 'suspect' going to have their comms intercepted for the foreseeable future? At what point is the well deemed to be dry?
We'll never know, because it's designed to be used in secret.
At least they are not suggesting to compromise or limit encryption in any way.
What I fail to understand is how all this would help fighting crime. Criminals and terrorists can easily use end-to-end encryption for the communication. There is plenty of software for that and it's really easy to do nowadays.
For example-
get chats in real time
log IP addresses and pass them to gov
open containers stored on your infrastructure
get into the phone or device you have sold to a client previously
These are not interpretations of the legislation- these are the use cases they wrote it to solve.
As ex LEO I get it but the burden on organisations is going to bad for business, not to mention the insecure solutions that are going to get drummed up/coded on the fly to comply with these requests- security nightmare.
There is some reasonable paranoia that this might be a Trojan to enable access in the US. Can't pass legislation in the US? Easy, get your vassal state (AU) to pass it, then ask them to investigate your target and then force people to comply with your vassals state's request.
"yeh I know you can't do that in Texas but you can in Western Australia and we, the US, has a treaty with Australia so you're just going to hand over that data. We'll deliver it to the Aussies for you"
I may be paranoid, but I'm not the only one seeing this angle on it.
Big conspiracies- count me out. Gov is lazy and disorganised. Little conspiracies between gov-buddies ? Absolutely.
That is exactly what they are asking for. In fact, the legalisation enabling them to gather the data and under what conditions (the authorisation required, like a court order) isn't being changed. This new piece of legislation just extends who they can force to collect it form them. It use to be the telco's, which was originally just phone taps but then extended to internet data. They are now extending that to software companies. (Also cloud providers like SpiderOak and "secure email" companies.)
In a few words this extension allows them to order a software company to (with suitable compensation of course):
1. Develop / assist in developing an undetectable tap / bug for them, and
2. Surreptitiously install it for them via an over the air update.
This extends their reach from phone calls to any device that auto-installed software updates / patches. Whether you consider the ability to install a "phone tap" into your phone, tv, car, router, wifi camera, pc, robot vacuum, modem, that can read all the data on there, enable the microphone and camera, monitor the GPS and other sensors, read keystrokes, fingerprints and other authentication data to be roughly as intrusive as someone monitoring your phone calls is I guess a mater of taste.
No, instead they're compromising trust in signed updates from vendors. That's far worse.
They use applications that take unencrypted plaintext, encrypt it, send it to the recipient's device, decrypt it, and show it as plaintext.
The law is designed to give a staggering amount of authority to use commercial resources to compromise a specific device or installed application in order to read off the plain text before encryption or after decryption and send it to the Australian government. So the "bad guys" would be using what appears to be, say, Signal, except the developers got a notice to send you an app update that swaps out actually encrypting things with "send a copy to the feds and then encrypt things".
Any company developing software or systems that ensures that you have installed what you think you have can be ordered to compromise their systems so that an Australian court order breaks the system. So if your copy of Windows is set up to reject push updates unless they've been signed by Microsoft, well, the Australians can order Microsoft to sign some binaries and push them to you.
What is concerning is I am building a information management system that focuses on privacy and this sort of bill makes a mockery of the entire concept.
There also seems to be a growing "anti-complaining" feeling around people's interactions, where it at least appears that a large number of people find it amusing to actively attack those who are highlighting a problem.
Of course it’s often enhanced by orgsnizations which benefit from the status quo. For a long time being in favor of EV’s fell into the “tree hugger” category of ridicule and censure, and only when it became possible to adopt the tech without significant personal sacrifice did that change. The idea of organizing people and exercising mass political power is obviously hard, potentially risky, and involves more than making a 5 minute video or paragraph of posting. If people have already chosen not to do that, they tend to resent the people loudly reminding them that there is another way they simply chose to ignore.
And for Australia, about immigration from flooding areas in Southeast Asia, right? Which arguably has follow-on roles in "terrorism". [I use scare quotes because the definition of "terrorism" is so politicized.]
But the ongoing ritual humiliation of Australian technologists over the past several decades is really tiresome.
... and the NBN debacle is another nail in Australia's "ability to compete on the world stage" coffin.
... and any lead Australia had in regards to renewable energy projects, investment, and research has been very effectively and efficiently squandered.
I was just surprised that it had so much awareness of the concerns around what it was doing.
The most worrying part for me was the enabling of remotely serving a warrant. In other words, if they had a warrant for your device they could hack your device instead of physically recovering it. This would mean their cybersecurity team will be broadening it's capabilities and weaponry in that area.
That is worrying. Much in the same way I don't want police cruising town in armoured vehicles with a small arsenal, I am not too hot on investigators being able to sick the hounds on an unsuspecting network. Collateral is a real issue in the digital world too. What if my org network goes down because a warrant was being served remotely on an employee and their exploits were not precision enough?
Three important things to note technical assistance requests, technical assistance notice and technical capability notice.
The type of assistance that may be requested or required under the above powers include (amongst other things):
* Removing a form of electronic protection applied by the provider, if the provider has an existing capability to remove this protection.
* Providing technical information like the design specifications of a device or the characteristics of a service.
* Installing, maintaining, testing or using software or equipment given to a provider by an agency.
* Formatting information obtained under a warrant.
* Facilitating access to devices or services.
* Helping agencies test or develop their own systems and capabilities.
* Notifying agencies of major changes to their systems, productions or services that are relevant to the effective execution of a warrant or authorisation.
* Modifying or substituting a target service.
* Concealing the fact that agencies have undertaken a covert operation
Many of these clauses are so vague ("Providing technical information like the design specifications...") that they show either a fundamental lack of practical technology knowledge, or, are deliberately vague so that the arms of the Orwellian Australian federal government octopus can create the intended backdoor without explicitly calling it a backdoor. Maybe both are true?
Was it William Shakespeare who once proffered: is a backdoor by another, obfuscated name, still a backdoor?
Protip for those playing along at home: add a + to a bitly URL to view info, such as the target URL without having to go there.
""Should governments continue to encounter impediments to lawful access to information ... we may pursue technological, enforcement, legislative or other(!) measures"
Translation: Fuck your sovereignty, we'll use violence to get what we want.
Australia doesn't interfere with sovereignty to a fault. Julian Assange, The Bali 9, Peter Greste. So it'll be interesting if there's any Australian response to the James Ricketson situation in Cambodia.