Aussie Attorney General's War On Encrypted Web Services 151
Bismillah writes "If Attorney-General Brandis gets his way in the process of revising Australia's Telecommunications Interception Act, users and providers of VPNs and other encrypted services will by law be required to decrypt government intercepted data. Because, 'sophisticated criminals and terrorists.' New Zealand already has a similar law, the Telecommunications Interception and Computer Security Act. Apparently, large Internet service providers such as Microsoft and Facebook won't be exempt from the TICSA and must facilitate interception of traffic."
Srsly? (Score:1)
Re: (Score:2)
Re: (Score:2)
You mean Australians have terrorists as pets and in zoos?
Re:Srsly? (Score:4)
You know what? We just about do.
When a Lib/Nat government thinks it has a whiff of a terrorist, it goes crazy apeshit bonkers. The last "terrorist" they caught was Muhamed Haneef [wikipedia.org]. A doctor, born in India. An ordinary, or better than average, guy. His crime? He "recklessly" provided a SIM card to a dimwit second cousin of his, who failed spectacularly at blowing up Glasgow Airport. Haneef was locked up for weeks until a magistrate said "hey police guys, this case is a crock of shit" and the DPP said "Oh my tittyfucking God you're right" and dropped the charges. The government then instantly cancelled his visa and deported him.
Note that, while Haneef was detained, he was cause celebre in Australia. He was the AFP's prize possession. He may as well have been, as you say, an exhibit in a zoo.
And that is the closest thing there is to an Australian terrorist.
Re: (Score:2)
Re: (Score:2)
"Terrorists" has become almost like a bad Jedi mind trick.
Public: "Why do you need to read all of our e-mails?!!! We're going to vote you out of office!!!"
Politician *waving hand*: "Terrorists use e-mail."
Public *robotically repeating*: "Terrorists use e-mail."
Politician *waving hand*: "Terrorists do bad things."
Public *robotically repeating*: "Terrorists do bad things."
Politician *waving hand*: "We must stop the terrorists by any means necessary."
Public *robotically repeating*: "We must stop the terrorists
Re: (Score:2)
We had a few arse-backwards white supremacists in the 1980s blow up some chinese resturants and a few things. Somehow doubt those hillbillies are going to be particularly sophisticated about their communication.
Re: (Score:3)
You know, I know, possibly he knows, but it seems to still work on the dimwits keeping him in office.
Re: (Score:1)
this is just a way to find the terrorists. once encryption is outlawed, only terrorists will use it.
you just get the ip address, go to the house, and do a swat team entrance on it. lather, rinse, repeat until nobody is using encryption in Australia.
Re: (Score:2)
What house? Pay as you go mobile has internet too, you don't need any (registered) house address for it.
Re: (Score:2)
What house? Pay as you go mobile has internet too, you don't need any (registered) house address for it.
You've got something better. To actually send/receive data, the unit has to be in contact with a tower. Unlesss the perp is so far out in nowhere that you can't get enough towers to trilaterate, you can pinpoint the exact position of the unit for any unit detected sending encrypted traffic (which TFA indicates should be monitored by the phone company). Then you call Obama and he sends in the drones.
Re: (Score:2)
You do in Australia!
Re: (Score:2)
Australia already has that. To get a prepaid SIM card, you have to provide a drivers license or passport, and a registered home address.
Re: (Score:1)
Comment removed (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3)
Many in power that come from the legal profession do not realize that "the law" is just a bad crutch and cannot deliver most things it is supposed to deliver. Instead they think they are shaping reality. It is some specific form of serious mental disability. It is also a threat to society.
Re: (Score:2)
I hereby give you, scientist made with power. [youtube.com] Courtesy of Robot Chicken.
Re:Gravity (Score:4, Insightful)
Actually, he does not have the power to enforce a law defying gravity. He has a mandate to do so and he may be stupid enough to try though.
Re:Gravity (Score:5, Informative)
Thankfully the Attorney General only has the power to enforce laws, not to write laws (that's the job of the elected senators and ministers).
Yes. How fortunate that Senator George Brandis isn't you know, a member of the Senate.
But seriously, of all the inner circle of petrified, ideological nincompoops in the new government this guy is up with the best of them. He has no idea about law, how law should be made or enforced, the intent of law and the notion of correct legal practice and judicial ruling. Just the person you want, you know, for the attorney general.
He was an Q & A the other night, arguing for the removal of the racial villification clauses form the Racial Discrimination acts. Why? Because one of his cronies had been found guilty under this section. He said it out loud. Other more apparently learned members of the panel schooled him on the notion of "the rule of law".
No, George. It's not the role of the law to protect your racist buddies when they make false claims against named persons and then publish them, explcitly alleging that their alleged behaviour is typical of their race (or worse, racial mixture)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
How would one claim plausible deniability?
"Your honor, I was simply transmitting random ASCII to a friend! He replied with random PETSCII!"
Well, that sort of argument by itself will just get you into deep trouble. (Taking the piss with a court is a good way to get into trouble, and your argument is hardly plausible in the first place.) Steganography might work, but then you've got the problem of distributing the baselines so that the other party can decrypt; sending lots of visually-identical-but-not-bit-identical copies of the same image would usually be a dead giveaway that you're using steganography.
Or that you use Google+; I keep seeing th
Re: (Score:3)
Don't. Just forget the password. They can't prove you haven't. In fact its actually really common for people under duress to forget passwords for real, since memory can get quite impaired by anxiety (Its part of why torture doesnt work. The more people are freaked out, the more the brain reverts to a fight-or-flight baseline with faster reflexes and diminished cognitive skills)
Re: (Score:2)
(Its part of why torture doesnt work. The more people are freaked out, the more the brain reverts to a fight-or-flight baseline with faster reflexes and diminished cognitive skills)
Spoken like one of the millions that has not cracked under torture throughout history. No, the reason it doesn't work so well is that they don't know if you're just making shit up to avoid being tortured more. And even if you do tell they're likely to torture you some more because they'll assume you're still holding something back, so even if you get some truth it's maybe half-truth or mixed up with lies. If they had a safe and they knew for sure you have the combination and could instantly verify if you to
Re: (Score:3)
No, the reason it doesn't work so well is that they don't know if you're just making shit up to avoid being tortured more.
This really makes passwords an 'ideal case' for torture, if there can be such a thing: it can immediately be verified whether you're telling the truth.
I've read some stories from WWII that makes waterboarding sound very tame
Spoken like someone who's never been waterboarded.
Re: (Score:2)
Why bother with that story? Just say you wrote it on a bit of paper, and you can't find it. But hey, if you release me from jail, I can spend the next 50 years searching for it.
Re: (Score:2)
The view of laws like this is to have a paragraph to get anyone without the need for complex key loggers, OS dependant malware, ongoing law enforcement infiltration to recover/enter/decrypt and then build a case.
You will hand over the needed information or face a prison term unconnected to any more information found or not found.
Better to be the first to 'he
Re: (Score:2)
ASIO in Australia did try a vision of a law to get people detained for seven days, after 7 days you could be re arrested on another new warrant. As long as the security cleared paperwork was in on time, that new 7 day effort would have never been reviewed per person. A construct of hidden 7 day arrests could be used via a flow of multiple warrants.
So the repeated re arrest option is interesting due to that lack of legal contact over
Perfect Forward Secrecy (Score:5, Informative)
So they would ban the use of Perfect Forward Secrecy. Using PFS it is impossible to decrypt the intercepted content even with the Certificate's private key.
Re: (Score:1)
not impossible, infeasible
Re: (Score:3)
By the sound of the article, they might be too stupid to ban it. Rather they'd write some law that says you have to hand over any keys you have, but inconveniently for them, there would be nothing useful to hand over.
Genius (Score:5, Insightful)
Yes Mr. Contractor, for the new ultra-hardened backdoor with super-duper locks I'd like you to leave the key over there under that rock. No, I'm sure only our RSA, NSA, TLA certified guys will be using it. How would anyone else know it's there?
Snowden (Score:4, Insightful)
The department argues the obligation on service providers would merely "formalise" existing arrangements.
This is fallout from the Snowden leaks.
What was once done in secret is now being brought into the light.
I guess I was hoping they'd just stop, instead of legalizing the invasive spying programs.
Re:Snowden (Score:5, Insightful)
This is fallout from the Snowden leaks.
No, Brandis doesn't need an excuse for this behaviour, he was like this before Snowden was born. His predecessor (and mentor) from the Howard government was Ruddock, Ruddock was the guy who threw out the Magna Carta in order to make a political prisoner out of David Hicks, it was the most shameful act of any Aussie AG I have witnessed in the last 50 odd years. I will be very surprised if Brandis does not sink even lower than Ruddock (assuming that's possible).
People who thirst for the power that comes with the role of AG should somehow be banned from applying for the job.
Re: (Score:1)
Re: (Score:2)
In the past it was known as verballing - after a long "interview" you where happy to sign "your" confession.
Your lawyer would be up against the trust and charm of the police vs the guilty person who had signed a detailed confession.
This method worked very well in Australia until video and audio recording during interviews was established after law reforms.
This is a return to the
Knee jerk (Score:2)
Re: (Score:2)
Who'd have thought you'd ever be happy about a deadlocked legislative, hmm?
Re: (Score:2)
Will it work? It has been tried in the UK and the justice system leaked before many big cases could gain traction. The top police then spend more time hunting in their own ranks, the press and within the legal system for who leaked. Then the funding runs out or investigations just stop
Just making it easier for China. (Score:1)
Re: (Score:2)
Nail, head, hit. We have enough issues with software that is just poorly programmed, much less stuff that has to back doors put in by law.
I'm reminded of the Clipper chip. Yes, the LEAF key escrow system would make it easy for LEOs to get access. However, what would happen if the bad guys got ahold of the backdoor [1]? It would be a catastrophe of compromised that would make last year's leaks of information look tiny in comparison.
[1]: Trust me, if all the eggs are in one basket, the keys are obtainabl
Re: (Score:1)
In political terms too.
While I'd still say China is worse, human rights wise, than western countries, asshats like the Australian government are working hard at erasing the difference.
The Meat of It (Score:2)
The Department is also advised that sophisticated criminals and terrorists are exploiting encryption and related counter-interception techniques to frustrate law enforcement and security investigations, either by taking advantage of default-encrypted communications services or by adopting advanced encryption solutions. The Department’s current view is that law enforcement, anti-corruption and national security agencies should be permitted to apply to an independent issuing authority for a warrant authorising the agency to issue ‘intelligibility assistance notices’ to service providers or other persons. The issuing authority should be permitted to impose conditions or restrictions on the scope of this authority.
...issuing authorities should be able to authorise an agency to issue ‘intelligibility assistance notices’, requiring a person to provide information or assistance to place previously lawfully accessed communications into an intelligible form, as discussed by the PJCIS at Recommendation 16...
...
Where issued to a service provider, such notices would formalise existing arrangements....
When issued to a person other than a service provider, such as the subject of a warrant, the Department’s preliminary view is that a notice would operate in a similar fashion to orders made under section 3LA of the Crimes Act 1914. Section 3LA permits agencies that have seized physical hardware, such as a computer or an external hard drive, under a search warrant to apply for a further warrant requiring a person to ‘provide any information or assistance that is reasonable and necessary’ to allow information held on the device to be converted into an intelligible form.
Recommendation 16
The Committee recommends that, should the Government decide to develop an offence for failure to assist in decrypting communications, the offence be developed in consultation with the telecommunications industry, the Department of Broadband Communications and the Digital Economy, and the Australian Communications and Media Authority. It is important that any such offence be expressed with sufficient specificity so that telecommunications providers are left with a clear understanding of their obligations.
The Department’s preliminary view is to support recommendation 16 in principle.
- Comprehensive revision of the Telecommunications (Interception and Access) Act 1979, Submission 26 [aph.gov.au]
Re: (Score:2)
Re: (Score:3)
Steganography is neither limited to data at rest nor to pictures. As long as you can transmit data that need not have a certain format to be considered "normal", you can transmit data hidden inside other data. If everything fails, transmit a lolcat pic that contains the data you want to transmit as a mail attachment.
What's harder to hide is source and destination of your traffic, though with a bit of creativity and the use of international providers even that's not completely out of the question.
Use interna
Re: (Score:3)
Hiding the destination need not be difficult. You just do the electronic equivalent of putting a coded small ad in a newspaper. Everyone can read it, but only the intemded recipient can decode it and there is no indication as to whom the message is intended for.
Re: (Score:3)
Well, in theory, yes, but it's not very practical. Not only do you and your recepient have to agree on a code, it can also be pretty suspicious if the person trying to eavesdrop on you knows a fair lot about you (e.g. that you'd probably not usually do a birth announcement in a newspaper because you're living alone).
If that's what you plan to do, in this day and age it's probably less suspicious if you start a Facebook page, recruit a few thousand "friends" via some FB game that rewards you for having a lot
Re: (Score:2)
Yah, that IS the electronic equivalent of putting a coded small ad in a newspaper.
Brandis is a moron (Score:1)
No more need be siad.
How is that supposed to work (Score:2)
Re: (Score:3)
I've been pondering if a VPN could be encrypted using a one-time pad. Obviously the amount of data transfered would be limited by the size of the pad, but with modern storage that might not be such an issue. A remote worker or someone going on a business trip could easily fill up on two hundred gig or so of random data at company headquarters - enough to last them through a couple of weeks of typical usage while they are traveling. So long as no-one can get access to their laptop long enough to copy it off
Re: (Score:3)
256-bit block ciphers are merely difficult to attack.
That is incorrect. It is impossible to brute-force a cipher like that, and it is extremely unlikely that someone has found a cryptanalytic break for modern ciphers like AES.
Unlike a block cipher, you can prove that a one-time pad is unbreakable, but that proof depends on the assumption that the random bits of the pad are completely unpredictable. Turns out that's a non-trivial problem to solve, and an especially difficult one to test.
Re: (Score:2)
10 people using IRC, 5 on VPN, 5 on TOR.
Police can get someone suggesting the others use VPN based in EU?US?UK to stay a member... i.e. that one firm of a list of VPN providers is the only way to be secure.
Overtime Australian police can get to any Western VPN firm and get evidence on more people as they use their real details/ip or become comfortable and let more trackable aspects slip.
A firm which communicates with VPN (any Australian connectio
Pretty stupid (Score:2)
This is pretty stupid, for two reasons: First, there are enough cases where keys exist temporarily and cannot be reconstructed (e.g. all DH-established keys) and second, it allows users to find out what exactly was intercepted, by using a new key for every unit of data.
That it is also completely unethical and only worthy of a totalitarian regime (where the "sophisticated criminals and terrorists" have taken over the government) is just the icing.
Australia (Score:2)
Land of the seriously fucked.
Your wildlife all wants to kill you, your government wants to turn you back into one big penal colony.
Viva la revolution!
fascist regime (Score:1)
God save the Queen and the fascist regime.
Tony Abbott and his strong arm tactics.
He uses secrecy for the governments actions
and is pushing his conservative, fascist agenda.
Good luck with that (Score:1)
Abbott and his mates can legislate Pi to be 22/7 for all I care though they will have to convince the senate. Anyone who depends on modern technology to conduct business will just move elsewhere just as manufacturing has. The poor bastards like me who are too tied down to consider moving will just work around their stupidity as we always have. Fortunately unless my fellow Australians have gone completely insane he will be out after one term and the Libs can take a broom to the arsehole conservatives who hav
Re: (Score:2)
So you want the Labor party back in so Stephen Conroy can force internet censorship through for the sake of God and children? Unfortunately Liberal and Labor are just as bad as each other nowdays. I suspect the only thing that could be slightly worse would be the Palmer United Party getting in.
Just when you start to think that all the parties are as bad as each other, the other lot gets in and proves that no, they're even worse. Rinse (preferably with disinfectant) and repeat.
New Australian flag (Score:1)
New Zealand is going (maybe) to get a new flag (new FLAG, I said, oh what this isnt 4chan, nevermind) well anyway the Enzedders are planning a nice black flag with a silver fern leaf. Like the logo of their football team, the All Blacks. Classy.Very nice.
I would like to see as new Australian flag which replaces the English cross (the combination of wales england and scotland crosses) (oh there's a thought... what if Scotland _does_ leave the United Kingdom. Does this mean all the ex-commonwealth countries h
One of the penalties (Score:2)
"One of the penalties for refusing to participate in politics is that you end up being governed by your inferiors." ~ Plato
Re: (Score:2)
Re: (Score:2)
This is Australia. Mandatory voting means not participating requires a bit of effort.
L2L (Score:1)
> "Because, 'sophisticated criminals and terrorists.'"
When speaking in post-l33tspeak, one wouldn't put a comma between "because" and the unqualified phrase because stupid.
Re: (Score:2)
Thoughts. (Score:2)
Re: (Score:2)
When I was 19 I was using Gnutella. I had started to work out a peer-to-peer network service that would act as a majorly encrypted world wide web.
What I had was actually quite robust. I didn't think up a good message distribution scheme. The first one I modeled was a hyperbuck--a nested buckminsterfullerine, fully connected, with each level outward connecting singly to the corresponding node inside; it was N+8 to reach anywhere for N levels, which scaled too linearly. I inverted this--made each node
SSH tunnel inside VPN? Possible solution? (Score:1)
Anyone ever heard of a one-time pad (Score:1)
VPNs? (Score:2)
What about VPNs hosted outside of Australia? I'm guessing that this is pushback by the Aussie branches of content providers. Too many people are bypassing their local high prices by getting iTunes and Netflix from the USA over VPNs.
If they think that 'bad guys' are going to rely upon a service's key management for nefarious communication, they are nuts. All the criminals/terrorists are going to use end to end encryption on top of any other transport service.
George Brandis (Score:1)
The crack smoking is strong in this one.
Really, you shouldn't take what Georgio says too seriously, after all America passed a law that effectively made VPNs illegal (exact language was it was illegal to obscure the source and destination of a transmission). The result of which was absolutely bugger all. The reason for that being that today, without VPNs, everything would fall apart. Georgio takes it a little differently saying that you have to let us in to your VPN so we can unencrypt your transmission. Th
That's ONE choice (Score:1)
Just once when a bad guy says "2 choices" I'd like the lead character to go "No, that's 1 choice between 2 options!" punching the guy in the face on each number.
Re: (Score:1)
All languages share that characteristic, you insensitive clod.
Re: (Score:2)
Re: (Score:1)
Is English not your first language? In this language we have jokes.
Re: (Score:3)
Here's the third: Take your business elsewhere.
The world is a large place. Someone might want to tell Mr. Bigwig that his laws mean jack in all but one country.
Re:Take your pants down (Score:5, Insightful)
Here's the third: Take your business elsewhere.
The world is a large place. Someone might want to tell Mr. Bigwig that his laws mean jack in all but one country.
Except that this trend towards increased government surveillance of the general populace by government intelligence and LE agencies, often in blatant violation of their nations' own laws and founding documents & principles, is a global phenomenon, particularly in the West, and no longer limited to a handful of dictatorships and totalitarian nations.
Blowing this stuff off because "just switch to a foreign provider" is short-sighted.
Individual freedom around the world, particularly digital privacy/security against intrusive, and often illegal by their own laws, digital spying by governments against their own citizens, is on a downward trend as the US and other Western nations grow increasingly paranoid and authoritarian.
The struggle against such invasive surveillance must likewise be global as these regimes work together both in the actual surveillance and also on the political side to increase their scope and power ever further.
This is particularly true among "Five Eyes" nations like Australia. What good would it do to switch to using services outside the country you're in if all the practical alternatives are just as bad or worse?
Strat
Re: (Score:1)
Re: (Score:2)
The catch is that massive data collection and observation allows all kinds of progress. Is it really so wrong that your car insurance company can tell how fast you drive and whether you leave bars late at night? Or how about a medical insurance or life insurance discount because it is clear that you eat a lot of green leafy vegetables and not Spam sandwiches for lunch? Or how about knowing where your wife and kids have really been all week? Or how about linking cancer rates to locations or habits or even knowing your DNA and how it will tolerate such behaviors? And for crime prevention and punishment it is hard to beat heavy duty surveillance.
"Those who willingly surrender freedom for security deserve neither and will lose both."
Not a student of history or human nature, are you? That's always the refrain of the tyrant; "It's for your own good".
Such beliefs have fueled some of the most horrible atrocities in the history of mankind and killed many tens of millions of people.
A Panopticon that's only available to those in power guarantees those in power become tyrants and the citizens become slaves.
Strat
Re: (Score:1)
Re: (Score:3)
Re: (Score:2)
I'm ashamed to be Australian today. These idiots don't represent most Australians. I'll have to contact my local member of parliament.
Not as ashamed as I am as an American, whose nation is supposed to be at the forefront of individual liberty and as much freedom from government regulation of, involvement in, or monitoring of the average person's life as possible while still maintaining domestic order and performing the duties necessary to conduct foreign affairs.
The further the government of the US strays from and exceeds the powers and scope granted by it's Constitution, the worse things have and will get. Not only for the US and those i
Re: (Score:1)
Don't worry, it's just a shit summary. TFA talks about Microsoft in the context of being a webmail provider.
Re: (Score:3)
dumdidum.. they provide server hosting and internet services..
Re: (Score:2)
Back before Qwest got bought out by CenturyLink, you could pick various DSL providers, and MS was one of them. Don't know if they still do that but MS definitely is an ISP with webmail, Azure, etc.
Re: (Score:3)
Re:Insanity (Score:5, Informative)
People in power trying to stay in power ?
Almost, but this guy doesn't have the brains to think that far.
George Brandis is s sneering scumbag and lying rodent who wants to be Dick Cheney when he grows up, but lacks the compassion, gun skills and wit.
He used taxpayer money to go to a friend's wedding, but has accepted the task of writing a ministerial code of conduct. He's also told the Australian arts community that they don't have the right to refuse funding from corporate sponsors whose ethical values conflict with those of the artists, and plans to punish them if they don't comply.
Re: (Score:2)
lol at the arts funding, he didn't tell them they "don't have the right to refuse funding from corporate sponsors whose ethical values conflict with those of the artists", he just said that if they do refuse corporate donations, the government shouldn't be filling in the fiscal shortfall due to the protest they are making.
If artists want to make a stand over something, good for them, it's their right to do so, but they shouldn't then be able to just fall back on taxpayer dollars by shaking the money bucket,
Re: Insanity (Score:2)
Re:Insanity (Score:5, Funny)
Above is the whooshiest whoosh ever to have wooshed.
Re: (Score:1)
Dick Cheney? Gun skills? That's pretty hilarious. Assuming you are aware of the fact that he managed to shoot his buddy, wearing a bright orange vest no less, while attempting to murder quail -- and no, firing buckshot at hapless tiny birds does not count as "hunting". Apparently the bastard never even apologized.
More power to him if he really was using buck shot (which i seriously doubt) - reduces the chance of hitting the bird radically compared to bird shot... Spot the difference [shootingillustrated.com]
OW! HEY! You could put an eye out! (Score:1)
Re:Insanity (Score:5, Insightful)
This is actually business as usual. If the population of a country forgets to kick their "representatives" in the face whenever they develop delusions, then the government slowly morphs into totalitarianism. The problem is that ordinary people are highly susceptible to manipulation and governments are getting better at it. The "we did not know what was happening"-excuse that so many Germans used after Nazi-Germany was overthrown will not fly this time.
Re: (Score:2)
Re:We need a redesign (Score:4, Funny)
You mean, like, say, end to end encryption?
What a novel idea, you should patent it...
Re: (Score:2)
What a novel idea, you should patent it...
Shhh don't give him any stupid ideas.
Re: (Score:2)
You're right. Considering how computer-savvy our patent office is, he might just get it.
Re: (Score:2)
You mean, like, say, end to end encryption?
End to end encryption doesn't give anywhere near the security many people think. If adversaries (including the government) have access to the communication lines, they can intercept software updates, or take advantage of other vulnerabilities to install software (such as keyloggers, memory sniffers with key extractors, etc.) on the endpoint machines. In fact, they need only compromise one of the computers participating in the communication. So, end to end encryption, although a great idea in theory, real
Re: (Score:2)
This will probably be the next step.
1. Make VPN services illegal in Australia.
That will be fun! This will only work if SSH is banned as well. That means they can only use Telnet. I'm all for it. Let them do this and let us have a good laugh! ;-)
Re: (Score:2)
"Written, Produced, and Directed by the National Security Agency"