Re:The Internet Reacts To Australia's Anti-Encryption Bill
by cyphar on Thursday December 06, 2018 @01:00AM
(#18615788)
I guess you could argue I'm referring to both (though Technical Capability Notice is more obvious).
The only requirement applied to a Technical Assistance Notice is that "the Director General of Security or the chief officer of an interception agency [...] is satisfied that [...] compliance with the notice is practicable and technically feasible" (317P). So if the case officer is "satisfied" it doesn't really matter whether you can practically follow it -- and it's not clear to me what recourse someone has if they are given such a notice.
Now, Technical Capability Notice restrictions are quite odd. I'm not a lawyer, so 317T.8 is pretty obfuscated to me but it appears to support the argument that they cannot require you to modify a telecommunications system so that it "has the capability to enable a communication passing over the system to be intercepted in accordance with an interception warrant". But I simply must not be reading that part of the bill correctly, because that would imply that e2e couldn't be subverted at all -- which obviously is false because that's precisely what the government wants to do. Technical Capability Notices do have review periods (which can be waived if the Attorney-General says it's urgent) and so on, but I'd be quite worried about how much of a say you really have in those situations...
The 317ZG limitations sound good in theory, but as above it feels like it's just word-games to try to avoid criticism.
Given the criminal penalties for disclosure of "technical capability notice information", I wonder how this situation would work if you were the maintainer of a GPLv3 project where not providing the source code would be a violation of copyright law.
The only requirement applied to a Technical Assistance Notice is that "the Director General of Security or the chief officer of an interception agency [...] is satisfied that [...] compliance with the notice is practicable and technically feasible" (317P). So if the case officer is "satisfied" it doesn't really matter whether you can practically follow it -- and it's not clear to me what recourse someone has if they are given such a notice.
Now, Technical Capability Notice restrictions are quite odd. I'm not a lawyer, so 317T.8 is pretty obfuscated to me but it appears to support the argument that they cannot require you to modify a telecommunications system so that it "has the capability to enable a communication passing over the system to be intercepted in accordance with an interception warrant". But I simply must not be reading that part of the bill correctly, because that would imply that e2e couldn't be subverted at all -- which obviously is false because that's precisely what the government wants to do. Technical Capability Notices do have review periods (which can be waived if the Attorney-General says it's urgent) and so on, but I'd be quite worried about how much of a say you really have in those situations...
The 317ZG limitations sound good in theory, but as above it feels like it's just word-games to try to avoid criticism.
Given the criminal penalties for disclosure of "technical capability notice information", I wonder how this situation would work if you were the maintainer of a GPLv3 project where not providing the source code would be a violation of copyright law.