Hacker News Reader

They're a member of the FIVE EYEs. https://en.wikipedia.org/wiki/Five_Eyes

For a second there, I thought I was reading omnipedia instead. Scary stuff.

Well as long as they leave their back doors on these systems open for the rest of us, i think its ok :P

Would love to distrubute zk-chain validators via self replicating router malware lol

Scary shit. Sounds like they're pretty drunk with power. Does Australia really have a capable offensive security group like the NSA to pull these sorts of things off, though?

They do but the real question is whether its appropriate to source intelligence from a place like the NSA when the outcomes are meant to be used by the police.

> So they can get a warrant to come into your house while you're not home and put a keylogger in your keyboard USB cable, or put a bug on the UART of your router, etc. Or just hacking your cheap Netgear router with one of the hundreds of vulnerabilities that exist.

That's actually not that weird.

If you are a suspected criminal and a judge give a warrant targeting you specifically, it's quite natural the police can now gather information on you by any mean possible.

It's not warrant-less, it's not mass surveillance, it sounds like regular police work. Or am I missing something?

Not being a legal expert, I can’t tell where the boundary is between enabling legitimate police work and giving (accidentally or deliberately) the police the power to plant fake evidence, the latter being what some of this sounds like. But, I’m not a legal expert, and “sounds like” is a way to make very large mistakes when looking outside of one’s own domain of expertise like I’m doing here.

(Also doesn’t help that I hear about stories like this from people who don’t like them, so I get a potentially biased first impression).

They could always do that: once they have a warrant, they can search your house and pretend to find physical evidences in it.

Indeed they could. However the linked page says:

> A DATA DISRUPTION WARRANT enables the agencies to “add, copy, delete or alter” data on devices.

With the exception of the word “copy”, this makes it seem like the plan is to make it not merely possible but also legally acceptable for anyone given such a warrant to create/place that evidence (or delete things to make real data look incriminating by lack of context).

Again, I really know I can’t trust my interpretation of any legal text, all I can say is it does sound bad to an outsider like me.

I have no idea how Australia handles this, but in the U.S., the process of discovery is what is supposed to keep the police from just planting evidence. Prosecution needs to present all evidence that will be used against you, including exactly where it came from and chain of custody. If they can't, it gets thrown out. The only exception is they can't be compelled to give away the identity of confidential informants. But a confidential informant also can't testify anonymously, so the police would always need additional evidence beyond the word of a CI.

It's not a perfect system by any means. The police can and do plant evidence. But a lot of convictions also get thrown out and this is often why obviously guilty people get off on "technicalities" because the police don't follow procedure down to the letter.

The opposite end of the spectrum, not giving the police any power to do covert surveillance at all, is effectively just giving a license to the Mafia to do whatever it wants, as anyone who just commits all of their crimes privately will get away with it as long as they can sufficiently scare or kill anyone who would otherwise have been willing to testify.

It's a tradeoff either way, and we try to let there be a middle ground, where the police can bug your house, tap your phone, hack your router, but they need a warrant that has to be granted by a completely separate branch of government that is not in the same chain of command, and they have to prove to your lawyers that they obtained all of the evidence they have against you legally.

Indeed, I have no issue with the police having the power to read whatever data a warrant grants.

My problem is the linked page says:

> A DATA DISRUPTION WARRANT enables the agencies to “add, copy, delete or alter” data on devices.

Copy is fine, it’s the other three which are scary. Perhaps they shouldn’t be scary, perhaps they have well-defined meanings in law I’m just not familiar with (like how “Hacker News” has nothing to do with cyber crime), but I can only respond within the limits of my knowledge, and that seems scary.

I think the reason they want the ability to add, delete, and alter is so they can disrupt certain users, software, or services legally, like botnets or arms deals. It's probably too broad and could be abused though.

It's certainly better than simply compromising everyone but it's not like they're going to stop their mass surveillance activities. This is just a step towards legitimization of those activities.

It's time for computer security to include nation states in their threat model. We need tamper-evident hardware.