Australia passed an assistance and access law a couple of years ago that forces messaging providers to provide access to E2E encrypted messages. But of course Signal and WhatsApp can’t do it because of the nature of the encryption.
In a completely dystopic move towards a surveillance state the government in Oz has been on tech companies’ cases to give them back door access.
Better not to be complacent. These things start as just winning easy political points but erode digital citizen rights over time as we normalize surveillance states.
You need to keep in mind that the tech media in Australia is just as rabid for clicks as the mainstream media, if not more rabid.
What the bill requires is that companies give targeted assistance where they can do so without compromising anybody else's security.
For example removing or weakening E2E encryption is absolutely not permitted by this bill, let alone required.
What might be permitted, for example, is adding a hard-coded list of account IDs to an app and if a user is in this list, the app sends plaintext to law enforcement. This would not impact anybody save the people who have been targeted.
Comments
Australia passed an assistance and access law a couple of years ago that forces messaging providers to provide access to E2E encrypted messages. But of course Signal and WhatsApp can’t do it because of the nature of the encryption.
In a completely dystopic move towards a surveillance state the government in Oz has been on tech companies’ cases to give them back door access.
Better not to be complacent. These things start as just winning easy political points but erode digital citizen rights over time as we normalize surveillance states.
The consequences of the bill were widely misreported. From the day it was passed it had strong exceptions. Have a look at section 317ZG: http://www5.austlii.edu.au/au/legis/cth/consol_act/ta1997214...
You need to keep in mind that the tech media in Australia is just as rabid for clicks as the mainstream media, if not more rabid.
What the bill requires is that companies give targeted assistance where they can do so without compromising anybody else's security.
For example removing or weakening E2E encryption is absolutely not permitted by this bill, let alone required.
What might be permitted, for example, is adding a hard-coded list of account IDs to an app and if a user is in this list, the app sends plaintext to law enforcement. This would not impact anybody save the people who have been targeted.
Yes, I'm certainly not suggesting that we need to wait for this to become law. Just for something with more signal in it.