<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Their real target is the same as it was in the 2008-2010 censorware fight:<div class=""><br class=""></div><div class="">They want to make it clear that this is not territory which is unregulated; that they can and will interfere with it if and when it suits them.</div><div class=""><br class=""></div><div class="">I doubt they even know how and when that interference will happen at this stage. But that isn’t important. It’s all about the agencies sticking their thumb onto an industry segment and saying, “We’re in charge of this.”</div><div class=""><br class=""></div><div class=""> - mark</div><div class=""><br class=""></div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 28 Nov 2018, at 8:25 AM, Robert Hudson <<a href="mailto:hudrob@gmail.com" class="">hudrob@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><br class=""><div class="gmail_quote"><div dir="ltr" class="">On Tue, 27 Nov 2018 at 16:04, Mark Newton <<a href="mailto:newton@atdot.dotat.org" class="">newton@atdot.dotat.org</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><br class=""><div class="">On Nov 23, 2018, at 4:46 PM, Robert Hudson <<a href="mailto:hudrob@gmail.com" target="_blank" class="">hudrob@gmail.com</a>> wrote:<br class=""><blockquote type="cite" class=""><br class=""><div class=""><div dir="ltr" class=""><div class="gmail_quote"><div dir="ltr" class="">On Fri, 23 Nov 2018 at 14:47, Paul Brooks <<a href="mailto:pbrooks-ausnog@layer10.com.au" target="_blank" class="">pbrooks-ausnog@layer10.com.au</a>> wrote:</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
In theory no - this bill doesn't weaken encryption, and explicitly doesn't allow any<br class="">
changes that would weaken encryption.<br class=""></blockquote><div class=""><br class=""></div><div class="">They say that - but I don't believe them. I don't think they even understand what they're suggesting (or if they do understand, they're relying on others not understanding, or not caring). </div></div></div></div></blockquote><div class=""><br class=""></div></div><div class="">I think it’s dangerous to assume they don’t know what they’re asking for.</div></div></blockquote><div class=""><br class=""></div><div class="">To clarify - I was speaking of the politicians. </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><div class=""><br class=""></div><div class="">MPs probably don’t know, that’s true. But they aren’t the source of these Bills: No has ever climbed out of bed in the morning and thought, “Y’know what ASD needs? Unencrypted access to SnapChat. Let’s make it happen.”</div></div></blockquote><div class=""><br class=""></div><div class="">I agree entirely. </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><div class=""><br class=""></div><div class="">MPs also aren’t in charge. PJCIS reliably decides whatever the bloody-hell ASIO and ASD want them to decide. The belief that there are a bunch of level-headed independent-minded politicians <i class="">making decisions</i> is crazy, there’s never been any evidence that that’s true.</div></div></blockquote><div class=""><br class=""></div><div class="">I think you may have missed highlighting the ludicrous notion of <i class="">level-headed independent-minded politicians</i>. I'd put a smiley there, but the current state of our political leadership (if one could call it that) is so abysmal that it's no laughing matter.</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><div class=""><br class=""></div><div class="">These Bills are drafted by the intelligence agencies themselves, and they know precisely what they’re demanding, they know precisely what the flow-on effects will be, and they’ve judged that for their own purposes, the cost/benefit analysis works in their favor.</div></div></blockquote><div class=""><br class=""></div><div class="">This is the bit that I don't get.</div><div class=""><br class=""></div><div class="">They *must* know the effective outcomes of the TAN/TCN/TAR activities is to introduce systemic weakness in the encryption processes they touch. The attack vectors against encryption (be it data at rest or data in flight) are so narrow (given that they're asking for this, we can, I believe, safely assume that they're not able to brute force things at this stage) as to effectively mean "a way to retrieve the keys" or "a back door" - both processes, once established, immediately introduce exactly the kind of weaknesses the proposed bill supposedly protects against (noting the incredibly low standard of proof that needs to be produced here).</div><div class=""><br class=""></div><div class="">And even when they manage to convince Apple, Google, Samsung, etc to hand over unlock keys to phones, and convince Facebook et al to either introduce back doors or back-channels into their messaging apps (they must know the folly of asking a carrier to do anything with an encrypted bit-stream - maybe the focus on carriers is to try to get them to inject unlock code into the bloatware they load on phones), they *must* know that they simply won't magically gain access to communications between criminals (by whatever measure you define criminal, be it terrorist, paedophile, organised crime, etc - anyone who is rightfully the focus of legitimate law-enforcement activity) because any of them with the ability to tie their own shoes will immediately switch to communications processes and systems that are not subject to this bill.</div><div class=""><br class=""></div><div class="">The net result of this bill, like previous thought bubbles as the Internet paedophile filter ("oh noes, Australians can't consume child porn any more, oh well, we'd best wind up our little industry now, without the tiny market that is Australia, we're clearly no longer viable"), will be to send the real criminals, the ones smart enough to do real damage, deeper into the places they're hard to find - they will just be driven further underground, with no material impact on their ability to carry out their goals.</div><div class=""><br class=""></div><div class="">So, what benefit to the intelligence agencies get? The power to track terrorists not capable of finding the safety switch on an AK-47? We seem to be able to do that already, so I'm not sure that's something we can accuse them of wanting. Do they want to spy on law-abiding citizens (which is contrary to the scope of their operational focus for some of them) - Is this their real target?</div><div class=""><br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><div class=""><br class=""></div><div class="">The possibility that the cost/benefit analysis works against other people is also well understood, but they choose to not distract the argument by engaging on that point. Bring it up as much as you like, they just ignore it and talk past it.</div><div class=""><br class=""></div><div class="">For the last decade, there have been arguments about this stuff that have been based on the belief that the Government is too dumb to know what it’s asking for, and that reason will prevail if we just explain it to them with the facts.</div><div class=""><br class=""></div><div class="">In case nobody’s noticed, that approach hasn’t worked, and there’s no indication that it will ever work.</div></div></blockquote><div class=""><br class=""></div><div class="">I only carry this point because I believe it helps to highlight what the REAL desired end-state may be. Because of the technical detail, this won't help to catch competent criminals. It won't help to catch incompetent ones either (because they largely already give themselves up through stupidity and shithouse OpSec). So who is left as the target?</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><div class=""><br class=""></div><div class="">This community has spent years wasting its time by communicating facts to them that they already know, and don’t care about.</div></div></blockquote><div class=""><br class=""></div><div class="">I still don't think the politicians really get it - but I do take the point that faced with taking advice from the departments they preside over, or the public and/or industry associations, when there's simply no negative to ignoring the latter groups, means that we're not going to get listened to.</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><div class=""><br class=""></div><div class="">They also don’t care about compromises: If you give them 50% of what they want, they’ll come back 18 months later and demand the other 50%. That’s how they’ve always worked (cf: data retention: The AA Bill is the grab bag of stuff the A-G couldn’t ask for last time. And if they don’t get it all this time, they’ll be back in 2021 for the next tranche)</div></div></blockquote><div class=""><br class=""></div><div class="">I totally agree with this. What the agencies don't get now, they'll simply play the long game and get later.</div><div class=""> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><div class=""><br class=""></div><div class="">Victory on these matters will never be won by having an argument based on the assumption that they need experts to explain facts and technology to them. The only way victory will be achieved is politically: There needs to be blowback, asking for more will need to cause them pain before they’ll stop.</div></div></blockquote><div class=""><br class=""></div><div class="">So, this needs to become an election issue - it's the only thing the politicians understand. We either need to convince the opposition or the (ever growing) cross-bench that not only will supporting this legislation lead to them not receiving votes in the next election, or that, more specifically, opposing it will result in more vaults (offer the carrot, rather than the stick?). And make them realise that changing their mind later will result in us changing our minds.</div><div class=""><br class=""></div><div class="">Or we form a political party (or we directly infiltrate an existing one) and push a very specific agenda against this sort of thing.</div><div class=""><br class=""></div><div class="">By all accounts, we have until May 2019.</div><div class=""><br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class=""><div class=""><br class=""></div><div class=""> - mark</div><div class=""><br class=""></div><div class=""><br class=""></div></div></blockquote></div></div>
</div></blockquote></div><br class=""></div></body></html>