[AusNOG] Dutton decryption bill

Paul Wilkins paulwilkins369 at gmail.com
Mon Sep 3 12:16:54 EST 2018


Chris,
I think we can envisage that the proposed regime could be made to work by
issuing content providers with Technical Capability Notices that would
require the content provider to create a secure channel for access to the
clear text, similar to how secure OOB can be enabled for remote users.
Traditional AAA mechanisms could be used to ensure that access is secure,
logged and audited to ensure all accesses have been duly authorised.

That's if the regime is to be well managed, but there aren't provisions
within the bill as currently drafted to guarantee the process is well
managed or that there is adequate oversite. For instance, there's nothing
to prevent LEA turning up at data centers unannounced and demanding
immediate access under verbally issued Technical Assistance Notices.
Subsequent search may never be subject to scrutiny if the TAN requires
suppression of the fact of said search.

Kind regards

Paul Wilkins


On Mon, 3 Sep 2018 at 11:47, Chris Ford <chris.ford at inaboxgroup.com.au>
wrote:

> Paul,
>
>
> I agree with you in general as to the point that if we are happy with the
> premise of the current TIA Act that LEAs should be able to intercept
> communications with a duly authorised warrant, then extending that to
> encrypted services seems a reasonable extension to keep up with technology.
>
>
> However, the current intercept regime is very difficult if not impossible
> for a bad actor to exploit. The intercept points are within the Carrier and
> CSP networks, out of reach of most people. When we move to intercept
> end-to-end encrypted services you either need to break the encryption
> (which thankfully does not seem to be the path anybody is proposing), OR,
> you need to access the clear text at the end point itself. The problem I
> have with this is that the end point is out in user land, often accessible
> to anyone on the internet, and now exposed to exploit by bad actors.
>
>
> --
>
> Chris Ford | CTO
>
> Inabox Group Limited
>
>
> Ph: + 61 2 8275 6871
>
> Mb: +61 401 988 844
>
> Em: chris.ford at inaboxgroup.com.au
> ------------------------------
> *From:* AusNOG <ausnog-bounces at lists.ausnog.net> on behalf of Paul
> Wilkins <paulwilkins369 at gmail.com>
> *Sent:* Monday, 3 September 2018 11:31:14 AM
> *To:* AusNOG at lists.ausnog.net
> *Subject:* Re: [AusNOG] Dutton decryption bill
>
> Bradley,
> The Common Law has always allowed judicial scrutiny of our privacy.
> There's always been the right for judicial search warrants to override
> what's considered one's private domain. I'm supportive of this bill where
> it extends judicial oversite to the cyber domain, which is a gap that
> exists only because legislation/common law has lagged behind technology.
> While at the same time realising that conversations conducted over the
> internet, even if encrypted, are more properly regarded as public
> conversations, than say one you might have in your living room. Whether
> government is going to regulate the internet, the boat has sailed on this
> long ago. The hard line privacy advocates are simply going to be left out
> of a conversation democracy needs to have over not whether the internet
> should be regulated, but how.
>
> What's interesting in this bill is that it goes beyond extending judicial
> writ, allowing law enforcement emergency powers the right to surveil
> suspects. This will be authorised by law enforcement, without judicial or
> governmental oversite. I think this probably goes too far. The best outcome
> for everyone, to protect privacy, and to empower law enforcement to enforce
> laws and to protect citizens rights, would be to limit the scope of these
> new powers to judicial writ.
>
> Kind regards
>
> Paul Wilkins
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20180903/bdfbb526/attachment.html>


More information about the AusNOG mailing list