Did Australia Poke a Hole in Your Phone’s Security?

Someone needs to. With EU laws, Australian laws, US laws, and more and more every day, the internet is rapidly becoming a tool of the least common denominator. In other words, whatever country has the toughest laws will govern the planetary internet system as all others will have to follow by extension. Apple, for example, can't make an iphone for every country to comply with that countries individual laws that differ from every other country, which also change with a regular basis.

Of course though, there will always be hackers skating on top relatively free. We're becoming a two-tiered internet. The relatively few who know how to get around the restrictions, and everybody else.

All Apple has to do is float the possibility they may not sell their products in Australia anymore, and point out why. The rest would take care of itself.

This is version 1.0. The law can be redrafted to remove any doubts. Once Australia gets it, so will USA and others via sharing agreements (5 eyes).

I suspect Apple can trivially walk away from Australia as a market if they think it's for a very good cause. It won't be a huge hit, it's a small hit (~1.7% of annual global iPhone sales).

Australia is worth maybe $6-$7 billion per year in total sales to Apple. They sell about four million iPhones per year there (9.2m smartphones sold last year, Apple has 44% of the market), then throw in Macs, iPads, watches and services.

It's an affluent market and it would suck to give it up, as it'd be very difficult to regain the market share afterward. I'd worry that the reality would be that easy product substitution would make the move meaningless in terms of benefiting Australians (even though it would still be an important moral stand for Apple to take). There would be short-term blowback about it and that would pass in a matter of weeks.

Or sell a clearly-branded Australia version without the Secure Enclave.

Why? They clearly have cooperated with countries' requests even if it seemingly went against their principles (e.g. Chinese laws around iCloud data). And they also have a history of not even making it known they disagree, fought against it, or anything via public statement. You won't know whether they comply or not, may not know whether they are OK with it, and judging from history they probably will comply.

I think witholding future products or services and running ad campaigns to say they wont be offering them in Australia due to the law would be the way to do it. If we could collectively get our act together, boycotting Federal Government for IT services would get the message across - chance of that happening is probably <1%.

That's always worked... /s

>Labor’s amendments would also clarify that a “systemic weakness” is one that “would or may create a material risk that otherwise secure information would or may in the future be accessed, used, manipulated, disclosed or otherwise compromised by an unauthorised third party”. [0]

I'm not sure how this doesn't cover all exploits - there have been a few cases of vulnerabilities discovered by state agencies being leaked/disclosed [1].

[0] https://www.theguardian.com/australia-news/2019/jan/21/home-...

[1] https://www.telegraph.co.uk/technology/2017/05/15/microsoft-...

Also known as the "Brexit strategy"

When the bill was being considered by the Parliamentary Joint Committee for Intelligence and Security, some of these groups were called up. I read the Hansard (transcript) of the hearing - the testimony was impeccable. Clear, concise, and absolutely demolished the bill. Unfortunately, to give you the level some of the senators were working at, a lot of the questions came back to "but don't you think we need to stop terrorists?" when going through how it's technically impossible to do what the law enforcement wants without creating systemic weaknesses/vulnerabilities, and you can't just define that away like the bill tried to...

Coming up to it being passed, there was a huge amount of calls, emails and letters to the members of parliament and senators. Several mentioned the unusual volume in Parliament, and also many in the opposition mentioned multiple times how many problems there was with the bill. They illogically passed it in mid-December to "keep Australia safe over Christmas" (despite the fact that nothing in the bill could be put into effect for months and Australian law enforcement and intelligence services already have far more over-reaching powers to do all sorts of stuff that would be illegal in the US and Europe).

Opposition to the bill was way better organised, and way bigger than anything previous for the tech industry. We are getting better at the politics, but given the irrational actions of the opposition in voting for it (who had the numbers in the Senate to block the bill) I can only conclude that there must have been some dirty dealing going on either between the parties, or between the intelligence services and the parliamentarians.

Of course, the principled thing would be to pull out of the AUS market, but even Apple has not proved themselves to be that principled.

There are plenty of businesses and invividuals in Australia that this law adversely affects. What are they suppose to do?

The A&A bill specifically prohibits this. You can't answer yes or no to the question of whether you have been served a notice. Warrant canaries are not effective -- they're not even allowed, on my reading.

AABill has already been accepted.

[1] https://www.abc.net.au/news/2017-07-17/innovation-nation-tak...

You see, both terrorists and sex offenders are known to use maths. We must control maths for your own good. If you oppose us, you are supporting terrorism.

(This is just the latest episode of anti-science politicians nerfing the Australian knowledge economy. See also their mishandling of the national broadband network, the latest cybersec laws destroying remote work, and the gutting of the CSIRO.)

Hahaha brilliant! Thanks for making me laugh, that's the sharpest quip I've heard all day! :D

Karma police, arrest this man

He talks in maths

He buzzes like a fridge

He's like a detuned radio

Physics laws exist and are fairly insurmountable. You throw an animal in a sack into a river and the law will get you arrested for it. This for not make the physics "fail to apply." And so it is with math, which software does.

What are good laws to have with respect software?

I'm wildly pro strong encryption myself. Software is not a law free zone, never has been, never will be. Saying otherwise is a little silly, just like the proposed (enacted) encryption laws are (imho) silly... In the US, Britain, Australia.

Three lines of argument are especially noteworthy:

“It is impossible to regulate cryptography.” or “Banning cryptography is like banning math.”

This argument misses the point in confusing the knowledge about cryptography with the wide-spread use of cryptography - or more specifically the use of cryptography to protect confidentiality. While it would be beyond the reach of governments to remove the knowledge about cryptography from the public sphere, it is certainly not impossible to threaten those that employ “illegal” cryptography with sanction.

This is exactly what happens with most regulation: Speed limits do not prevent the thought about driving fast, instead they address actually driving fast. It is behavior that is regulated, not thought.

So, similar arguments about the futility of regulation or the impossibility of enforcement aim a bit too high. Regulation does not require perfect adherence. Often it is enough if some people adhere to the specific law, and others can be punished in case of being caught. Again, speed limits are not perfectly enforceable, but they limit the number of drivers that drive recklessly, and it allows taking action against some drivers and thus nudging other drivers into compliance.

https://opaque.link/post/fog_of_cryptowar/

Shallow arguments don’t help anyone, they just marginalize the speaker beyond a narrow audience that already agrees with them.