They can only compel companies within (incorporated in?) Australia is my understanding, not foreign companies. This is a sad day for a government going out of control; I didn't elect representatives to be this over-reaching or to ignore the wishes of the people like this; again under that old chestnut guise of "Terror!". Doesn't even need a warrant, just a nod from an ex-magistrate, and I'm sure the right ones can always be found.

But I suspect this'll be a testbed for the other Five Eyes; if the public don't make a big noise, I'd expect to see this in the UK, US, NZ and Canada etc pretty soon.

Signal would have to find a way to send a special app to you which does not encrypt or specially encrypts in order to funnel data to AU government. If it does not, it becomes illegal. Considering signal warns people if the key changes, it probably means Signal is now illegal as it might be physically/mathematically impossible to satisfy the law.

Secure communication is now illegal in Australia.

Or they'll have the carriers in Australia push an OS update that specifically exfiltrates your Signal session keys to the government.

Then it won't matter what Signal does or doesn't do, they can still get what they want.

> Or they'll have the carriers in Australia push an OS update

One of many reasons you should not have your carrier control your OS update channel.

I haven't checked the text that passed but I think non-feasibility is a defense. Which might mean that this just inspires a new round of canarying and end-to-end encryption wrapping to defeat the bill. However presumably there are very few companies willing to die on that hill, and it may be too expensive to fight those battles.

Australia can't enforce its laws on a foreign company, especially considering Signal doesn't generate any revenue in Australia (afaik). Best they could do is find some way to block it (like the great firewall of China does with any sites/services that won't comply with their filter demands).

Compromised version dropped onto phone of a target? Most people are reliant on App Stores for their apps, so that will be a likely vector. We don’t run checksums on desktop software, let alone software from App Stores.

How easy is it to target a play-store update? I doubt google allows binaries to be targeted to individuals, so you'd need to push the update to a rather large set, and have the update only activate for the target.

That isnt very covert.

They’d probably try to compel app stores to support individual targeting as a first step. If the Australian versions haven’t shut down in the next few weeks, it’s a pretty sure bet that they’ll have been compromised.