Canberra asks to introduce detection capabilities in encrypted communication | Hacker News Reader

Canberra asks to introduce detection capabilities in encrypted communication

zdnet.com

172 pointsstanislavb63 comments

Related (maybe?)

https://www.bbc.com/news/world-australia-48511217

In 2019, Australian federal police raided the home of a journalist, in response to her reporting on secret government plans to enact warrantless digital surveillance.

edit: I *think* this is the report she was raided for,

https://www.dailytelegraph.com.au/news/nsw/spying-shock-shad...

>"IF two Federal ministers approve, the emails, bank records and text messages of Australian citizens could be seen by digital spies. No warrants would be required and it would all be legal — and done so you’d never know."

>"The power grab is detailed in top secret letters between the heads of the Department of Home Affairs and Defence, seen by The Sunday Telegraph, which outline proposed new powers for Australia’s electronic spy agency — the Australian Signals Directorate (ASD)."

(There haven't been any HN threads about this, btw -- as far as I can tell).

There were plenty of threads. This was in regards to the AABill, which was lukewarmly discussed here in the leadup to its enactment into law.

I find it amazing how someone could argue its OK to remove the judiciary and two Federal ministers is as good. If your going to the lenght of getting federal ministers to sign off, why is it so hard/worse to bring in an independent judge? I'd love for the people behind this to try and cite some cases where the current system has caused terrorists or whatever criminal to escape.

Something else I'd like to see is 2 rules:

- Passing information of a another countries own citizens to that country is banned, or where its seems likely that it will be passed on. Stop this we'll monitor your people and you monitor ours swap as its effectively the same as spying on your own without warrant.

- Any citizen that is spied on gets a copy of the what and why ~15 years later. Long enough so its not going to disturb any investigations, and it hold govt to account so if loads of people start seeing they are spied on we can question what the govt is doing.

A lot of people don't realize that Australians cannot leave Australia -- for quite some time now.

On the basis of the current "situation". I can see them restricting entry, but restricting leaving???

You have to go through pretty tough hurdles to get permission to leave the country. And the courts have ok'd the government's power to do this.

I'm saying this, because I'll probably never go to Australia, but the government there is actually one of the worst in the universe of "free" countries right now.

The right to travel -- man... that's one of the things that we hated the Soviet Union, East Berlin and North Korea for... and now... Australia.

And on top of that, adding more surveillance powers. What's going on down under???

> A lot of people don't realize that Australians cannot leave Australia -- for quite some time now.

Do you mean pre COVID? When I visited 10 years ago I had to pass through a checkpoint (maybe customs) after checking in, before security. I’ve always wondered what that’s for as we don’t have that in the UK.

Many countries now effectively have instigated a permission to leave the country system. It’s highly worrying. Many many freedoms have come under assault since early 2020

Post Covid.

It’s post covid, and it’s ostensibly to ensure that they don’t just want to come back again soon which will cause more upset with the government because they will ‘take’ away incoming seats from stranded Australians (currently around 30,000 trying to return to the country, and only I think 3-4000 allowed in a week at present).

Not sure what you mean about coming into the country, the steps seem the same to me (inbound into australia) as they do for both the UK and the US - passport control, pick up bag, customs, out. Been the same for as long as I’ve been regularly travelling in and out (~18 years)

> Not sure what you mean about coming into the country,

Sorry, I meant on departure from Australia. I distinctly remember going through something like passport control on departure.

"When departing Australia, you need to present your passport, completed Outgoing Passenger Card and boarding pass to an ACBPS officer" [0]

Though the paper based Outgoing Card seems to have been deprecated in 2017 (before my visit)

I don't really have an opinion but the concept was alien to me at the time. Maybe the process is/was less obvious in UK, split between the airlines, advanced passenger info etc.

[0] https://assets.ctfassets.net/v228i5y5k0x4/2rMXkdDstm6okc0cgo...

Too late to edit but to clarify I meant a checkpoint on departure from Australia

I think “tough hurdles” is a perception more than anything. I left recently to live and work in Europe and they approved the application in 2 days and didn’t ask any questions. All I provided was some proof of my new employment.

The stupidest part was I had to sign something to say I wouldn’t return within 3 months or I would get fined and go to jail. I’ve lived in Aus most of my life and it still boggles my mind how much they treat their own citizens like criminals.

What's the rationale for jailing an own citizen for returning to their country in less than 3 months?

There was no reason given but I can only assume it’s punishment for not following through with your plans? In all seriousness I would suspect it’s purely a deterrence measure to further underline the arbitrary nature of this stupid restriction.

Reminder that Australian citizens wanting to leave the country need to ask for permission from the border force, and the exemption process has been quite opaque, and denounced as arbitrary in some cases.

Oh and also, this decryption bill from 2018, forcing employees to install backdoors at the request of intelligence agencies without being able to warn senior management.

The law also just quietly changed so that Australians in Australia who normally reside in another country now even need to apply for and be granted an exemption before they're permitted to leave.

I'm here now, and it feels all kinds of strange to be "stuck", when I don't even live here - no house, no job, etc.

Are they paying for your expenses?

no, nothing.

as always, it's a jail

I expect the discussion here to focus on the encryption part, but very little of this is actually about encryption. The full draft is worth reading, it’s not long: https://www.communications.gov.au/file/52396/download?token=.... In fact, I suspect the discussion here might be more beneficial if the link for this were changed from the ZDNet article to the actual draft PDF.

Here’s the full text of the part about encryption:

> 8 Additional expectation—provider will take reasonable steps regarding encrypted services

> If the service uses encryption, the provider of the service will take reasonable steps to develop and implement processes to detect and address material or activity on the service that is or may be unlawful or harmful.

In other words: you can’t just hide behind end-to-end encryption and say it’s out of your hands, you’re still at least somewhat responsible for what happens through your channel if you’re deliberately operating it as a communications channel.

(And section 9 is much the same thing but about anonymity.)

Certainly all of divisions 1 and 2 is described in impressively vague terms; in practical terms, sections 5 and 6 say roughly nothing, and section 7 says “actually we’re not defining things, it’s up to the commissioner to decide what it means”. Divisions 3 and on are a good deal more specific, giving some insights into what sorts of things would need to be implemented on the client side in an end-to-end encryption scenario. (Would the recent Apple stuff match? I’m not certain, as I haven’t paid close enough attention to that to know, but this Determination is about communication, not storage—notwithstanding possible interpretations of Division 3—so I suspect not.)

I’m sighing at clauses 17(1)(d) + 17(2)(a) which say that documents like terms of service “must be written in plain language”, and having a happy dream of a world where large companies actually got taken to task by government for writing their terms of service in legalese.

Yeah, we have a big problem with this kind of thing in Australia - a lot of legislation is being written in more and more vague terms, with more and more things delegated either to the cabinet ministers or (as in this case) unelected bureaucrats to make decisions. More and more laws have the fuzzy kind of "oh, also anything else that we feel like it applies, we'll know it when we see it" kind of clause in their definitions.

The problem is that apart from making for literally just bad laws, it's actually moving away from the principle of "the rule of law" into more and more arbitrary territory - and this isn't just in areas like this, but things like but energy policy, awarding of grants, etc. More and more, Government tenders go as "preferred tenders" rather than open/competitive tenders, and there's just been a big scandal about over a billion dollars of grant programs (in sports, commuter car parks, regional development, etc.) being used around the last election specifically targeted to seats held by the party or marginal seats they wanted to win - with no merit based procedures being followed. But many people might have missed the whole thing, if they mostly only read News Ltd. papers (70% of readership) or watch Sky News here, which curiously didn't report on it...

It's really a big mess, everything seems to be getting more and more corrupted...

On the other hand, if you try to be too specific about things like this, people will work around the legislation. In the EU, GDPR is deliberately rather vague in some areas because otherwise the whole thing would have been rendered useless.

(Mind you, I think this one is probably too vague, because it leaves a vast range of possible interpretations open and really does say just about nothing about what will actually be required.)

>a lot of legislation is being written in more and more vague terms, with more and more things delegated either to the cabinet ministers or (as in this case) unelected bureaucrats to make decisions.

not necessarily a bad thing. Has somewhat of a democratic deficit, but these days in most countries the quality of legislators is horrid while most independent bureaucratic institutions are still relatively competent.

who'd you want to write anti-trust legislation in the US, Lina Khan or Diane Feinstein? The political institutions in many countries are basically decomposing compared to the technical and administrative ones.

Our executive and legislature is combined in Australia (the cabinet is made up of members of the House of Representatives or senators from the party with the majority) and our public service (which cabinet ministers oversee in their portfolios) used to be really good and fiercely independent but has been increasingly politicised (especially over the last six or seven years, given the party in power) so not so much here.

"unlawful or harmful."

This is getting out of hand.

First, child pornography. (US) Then, Holocaust denial. (Germany) Then, criticism of Islam. (Most of the Islamic world) Then, criticism of the monarch. (Thailand) Then, criticism of the ruling party. (China) Then, promotion of LGBT lifestyles. (Russia).

And that's just the "unlawful" part. "Harmful" can cover bullying, fat-shaming, gun rights, negative product reviews, unauthorized benchmarking of software... All of which have been punished by one or more dominant companies.

All this gets applied arbitrarily, with no hearing or recourse, of course.

And it's not just "unlawful or harmful.", it's "is or may be unlawful or harmful."

So the burden of proving whether or not it is unlawful or unharmful seems insane. What do you do when a cop says "Maybe it is harmful, it might look innocuous, but it's also street code for murder!"

The digital equivalent of US civil forfeiture ...

As an Australian, I'm wondering how much longer Signal will be available for download here...

That was not even a week between Apple announcing local content scanning, to the Australian government taking a bill from under the table announcing "here's one we prepared earlier".

> As such, the government has prepared a consultation paper [PDF] and is accepting submissions until 15 October 2021.

Lol. There were thousands of submissions for the AABill and only a handful were read let alone published. This "community consultation" is nothing but a farcical checkbox. The Australian Government have ruined any prospect of a brightful Australian digital future.

Yes, the "public consultation" was much the same on this bill as the AAbill. Almost universally negative from the public, the "opposition" party came out again and said "This is hugely flawed. We're going to vote it though but we don't like it". It's farcical and absurd.

Yes, the illusion of choice by the opposition party. Even during an election they barely differentiate. It descends from policy into brand marketing that makes me wonder if I only now get the joke behind the Duff Bowl in that old Simpsons episode.

Have people here read "Game of Mates" by Cameron Murray and Paul Frijters? I found it hugely illuminating and I really felt like it described mechanisms, and identified dynamics, which I had been aware of but only vaguely able to articulate.

Of course the obvious question, is what can concerned citizens do?

To be honest, there's nothing we can do. Clearly, the opposition isn't, and the smaller parties like the Greens and Reason don't hold any leverage.

I've given up trying to convince people of the government encroachments. In the end, nobody will care anyway as long as they can drink their Victory Gin.

> what can concerned citizens do?

What can they do that's effective?

Nothing.

Build guillotines, maybe?

Another day, another authoritarian overreach by our nanny-state government. Presumably with these changes, apps like Signal will cease to service Australia.

Has signal withdrawn service in any economy?

Not "has any economy blocked signal" but has signal done geo-IP to say "nope: we don't let you do this"

I don't think so. I've read it is removed from app stores in Iran and China. A few other countries like Egypt try to block it.

I guess it would be a win for Android - if Signal is removed from AU app store and/or blocked by local ISPs (like in Russia), the way would be to sideload and use VPN.

Why would they need to withdraw service anyway? How can the fines be enforced? I assume the best the government could do is block access to the service but I see no reason why a foreign company needs to care about this law unless they have offices/employees/paying customers in the area.

If the treatment of Assange has taught us anything, it's that crossing borders to catch your prey just requires a little extra leverage

> cyberbullying material targeted at an Australian child

Oh that didn't take long

We, as a society, won't be remembered as the people of freedom anymore but those who lost it for nothing substantial (devices and social networks...). It's a tragedy.

> lost it for nothing substantial (devices and social networks

I do not understand these arguments: they seem to imply an exchange, and there is none. Basic dignity is threatened without a positive counterpart, with the possible exception of more security.

And I am very diffident of the "security" effect. There are countries which implement constant and pervasive tracking: their history of 5..10 burglaries per thousand houses per year are not shrunk to a small fraction, for example.

Now we’re sliding on the slippery slope.

We have been for years, this is just the aftershock of 2018's shitshow.

A pet peeve of mine (as a former Canberran) is substituting Canberra to mean the Australian Government.

australia has become a police state, i knew this was gonna happen after they introduced gun laws, this is scary no matter what you believe, i am sorry, i try to be a positive person but where is the line? who is serving who? what is a democracy and when is a country not a democracy anymore? and lastly, are australians okay with this type of overreach? i don’t know maybe the media outlets are covering this wrong.

I think its' about time to go back to blackberry messaging days with person level invitations & complete P2P networking. Heck security by having every device be encrypted with a different scheme/similar

The past was not that pretty - RIM handed out the keys like candy to intelligence agencies around the world. We just can’t ever have nice things that lots of people use. States require visibility first, then censorship/control.

Very small webs-of-trust?

Keysharing parties? PGP-style, but with modern forward ratchet crypto?

Personal builds of the Signal apps that you share by installing them on your trusted friend's phones, and a backend you or a trusted friend host yourself on virtual servers outside Australian/FiveEyes jurisdiction?

(Give up and destroy all your electronic devices and only ever communicate with people you're in the same room as?)

I am going to destroy all my consumer devices, build firm/softwarez from source reproducibly, and never trust Apple again.

What are you gonna run your firmware/software on? It's not easy to find SOCs without proprietary firmware blobs _somewhere_.

I really like the idea of Bunnie Huang's Precursor, but its a fair way from retail availability still, and I doubt it'll be inexpensive enough to be able to convince enough friends to acquire one to make it any use socially.

I'm vaguely thinking of building a few devices with a TTGO TBeam and a Pi Zero, that can do medium range (1-10km-ish) LORA point to point and mesh networked shared-key encrypted comms to avoid touching the internet as much as possible, and that can provide (low data rate) mesh wifi bridges so other wifi devices can use the LORA mesh. Theres a project called Meshtastic that provides the bulk of that already on those TTGO boards, with a USB/serial/bluetooth API with some nice python example code. That'd still be "trusting" a bunch on non audible code on the TTGO and RasPi boards though.

Pretty sure ANOM was person level invitations and they didn't work out too well for those who assumed everything was encrypted and safe!

Yeah well. Everybody getting invited to that knew up front the sort of person who was inviting them. It's not like they sold them to book clubs or choirs...

Only reasonable steps? So nothing then.

AU people gone wild!

So what are we all moving to? PureOS? Need a good phone (Librem?).

Oh hey cool, apple, you know that new system you built? Well we now have 4 new classes of content we want to purge from people’s devices. The system is proposed and governments are already passing laws to exploit it. Fuck all consumer tech.

When you surrender your rights you should expect to never get them back.

rights are paid for in blood. And sold for pennies.

They were paid (even pennies) for the guns that were steamrolled/smelted over there?!

> Rights are paid for in blood. And sold for pennies.

Oh, if I could give you ten upvotes.

Very, very, very well put. Today you have made culture.

(Are you paraphrasing anyone? The formulation seems original.)

it's original - i just made it up on the spot, but it may have been influenced by popular culture which mentions such ideas.

Australia doesn't even have a bill of rights. Privacy is almost non-existent.

https://www.theaustralian.com.au/commentary/why-does-austral...

Australia has agreed to abide by these conventions by protecting the human rights of its citizens and other peoples. However, we are unique among democratic nations in not having brought about a national bill of rights to make these obligations part of our domestic law. The best we have are the human rights acts in the ACT, Victoria and now Queensland. As a result, Australians are often left to complain to the UN when their human rights have been breached as they have no remedy at home.

Isn't it strange? Naively one might expect that as surveillance capabilities grow, laws that mandate cooperation with state surveillance would be relaxed or removed. "We have cameras on every street corner, location data on every phone, metadata on every phone call, fingerprints and cheap DNA analysis, so we can drop the requirement that ID must be shown when renting a hotel room."

But the opposite happens - the more surveillance we are subjected to, the more laws are introduced to reduce our privacy even further.

Reply on news.ycombinator.com