While America might have the Espionage Act, we have an law (passed a year or two ago) that gives mandatory minimum sentences of >15 years for revealing information about ASIO. And sharing the information (even if it's public) carries the same penalty -- so re-tweeting such revelations is a criminal offense. As is viewing it.

Chilling effect? More like dipped-in-liquid-nitrogen effect.

I hope Australia will have its own Edward Snowden, but the immediate repercussions would be far more severe in Australia.

Realistically, if you were a developer not in the chain of command and asked to do this: Would you? Could you?

You would be knowingly putting your name to a vulnerability, and if someone asks then you have to keep it a secret and feign incompetence. Then if they revert your change you'll have to re-implement it.

If you do tell your superiors (which would be most likely what would happen, even before writing the code) then you would be in violation and could be put in jail.

If you refuse you would be put in jail, or they would go to the next person in their list.

If you think about logistics they'd have to make contact with people in the company to even find out who the devs are who are capable of making a backdoor. That would probably tip off others in the company as to what was happening anyway. You'd think they'd essentially have to serve the whole dev team with the secret order.

I think you could immediately resign. It's not a slavery bill... is it?

There's LinkedIn, there's social media, there's actually keeping a record of who enters and leaves a company's premises. There's heading down to the bar after work on Friday. There's community events and meetups.

And there's the previous backdoors they got into BitBucket/Github/Gitlab/Mercurial/Perforce/etc. And,no doubt, the "LEO Portals" that FAANG and FAANG wannabes already have which they'll just hand over to Australian authorities (probably including local councils and the taxi commission, based on evidence about how the metadata retention powers have been used...)

After the first few times they use these new powers, the people who're gonna come asking are 99.9% likely to know exactly who the person who will write, commit, and code review the backdoor they're demanding... And their direct manager, and the management chain all the way to the C suite...

I think I need to quit this entire industry, maybe take up boatbuilding or something...

But just seeing who's going into the building doesn't tell you exactly who is handling encryption and security in the codebase.

I wonder what the legal implications of just quitting on the spot when asked might be?