Officially, they can’t, but you can be absolutely certain that iMessage, WhatsApp, Signal and Telegram are going to be immediately targeted with TCNs (technical capability notice), requiring them to bundle Australian government spyware and requiring that those apps send all conversations to the spyware.

This isn't quite true. The bill allows companies to provide statistics on how many TARs, TANs, and TCNs they've been served within a 6-month window. The obvious problem is that nothing stops them from lying or just omitting that information -- because why would you admit that your software is insecure?

Employees of a company may also be served, and required not to tell their employer. So a company may not know if they are compromised.

I seriously wonder how that would work in practice?

"Hey Joey, will you work on the fizzibizzi feature that does xyz?"

I can't, I have other stuff to do?

"What kind of stuff? This feature is the top priority for the whole team?"

I JUST CAN'T TELL YOU OKAY!!!

Also, you can't ask anyone else on the team for help implementing it.

These backdoors are going to be the worst code possible. What kind of crap quality code do you think a single dev under threat of jail time and the pressure of not being able to communicate with his co-workers or legal representation is going to pump out?

It'll be handy cover though if you get caught introducing your own backdoor code.

"Git says you were the person who introduced this backdoor into our banking platform. We could loose millions though that. Explain yourself now before I call the cops!"

[whilst tapping nose] "I'm sorry boss I've been told not to discuss that with anyone..."

"Say no more. I understand perfectly. ;) Carry on and don't tell the others."

You can speak to a lawyer about it, though I imagine that delaying might cause issues. There is a mandatory 28-day consultation period for TCNs but I imagine that you'd get very little useful protection from that system.

Also there is no criminal punishment for not obeying a notice. There is massive civil liability though, as well as a criminal punishment for disclosing information about the notice.

Can they quit? Or are they effectively being forced to perform labor for the government? This seems like an insanely impossible to enforce proposition.

That's something we'll have to wait and see on, see how the legal world interprets it. However, if it is interpreted that you quitting is not complying, it's fines and perhaps jail time.

There is only civil liability for noncompliance, in the form of massive fines. However there is 5-year imprisonment for people who disclose information about these notices though (unless it follows the aggregated statistics requirements).

I doubt you could introduce backdoors in big software (Messenger, iMessage, WhatsApp) using only one/a few employees - unless everyone who does code reviews happens to live in Australia.

Right, but then the employee can publish statistics about how many TCNs they've received.

They can't provide specifics only ranges. In Division 6, section 317ZF, Unauthorized Disclosure of Information, section 3) subsection 13) a person forced to do one of these TAN/TCN/TCR things can release a count of how many of these TAN/TCN/TCR things. BUT Note: This subsection authorises the disclosure of aggregate statistical information. That information cannot be broken down (a) by agency; or (b) in any other way.

So Division 6, section 317ZF (3) (13) is the ONLY way someone can tell the world what is happening.

That is what I was referring to as "statistics" (that's what the subsection is titled).

Those weren't passed, it went in unamended

I don't think they were amendments -- they are included in the first reading of the bill (Sect 317ZF.13).

I downvoted you because the bill explicitly says it excludes systemic changes that compromise security. Apps will not have systemic spyware, only specific users can be targeted.

Open source apps like Signal would be extremely hard to compromise since no one is going to allow a backdoor commit.

Does this mean that they can only mandate the backdooring of a user's communication if they know who the user is? Doesn't that seem irrelevant to the concerns they've raised in the past of having apprehended a suspect but been unable to decrypt their previous communications?

Warrant canaries.

Not legal in Australia unfortunately (it's a bit more nuanced, but many types of secret warrants are already immune to warrant canaries -- so I'm sure a judge would see that these types of secret warrants probably have the same protections). However they do allow statistical information on how many requests they received in a 6-month window.