TCNs (which is the primary thing this article is about) won't practically affect email providers, because email providers already have your plaintext emails -- they don't need to implement new capabilities to intercept them. (As an aside, I use Mailbox.org which has a feature to auto-encrypt incoming emails to a PGP public key -- which means that only new emails would be usable with interception.)

However there is now a no-warrant-required method of getting information (in the form of TANs and TARs) which has no judicial overview -- previously they would've needed a warrant. This is definitely a massive concern, but given that you wouldn't have seen a warrant previously (Fastmail would get it) this is not a practical difference to you (obviously it's a massive ethical difference and so on).

But to be honest, I actually hope people stop using Australian services and big companies start backing out of the Australian market. It's the only way our dropkick government will realise how much of an own-goal this legislation was.

I think that section 317ZH specifies that a TAN/TRN/TCN is invalid if a warrant would be required to access the information.

Specifically:

A technical assistance request that relates to an agency, or a technical assistance notice that relates to an agency, or a technical capability notice that relates to an agency, has no effect to the extent (if any) to which it would request or require a designated communications provider to do an act or thing for which the agency, or an officer of the agency, would be required to have or obtain a warrant or authorisation under any of the following laws:

                     (a)  the Telecommunications (Interception and Access) Act 1979 ;

                     (b)  the Surveillance Devices Act 2004 ;

                     (c)  the Crimes Act 1914 ;

                     (d)  the Australian Security Intelligence Organisation Act 1979 ;

                      (f)  a law of the Commonwealth (other than this Part) that is not covered by paragraph (a), (b), (c) or (d);

                     (g)  a law of a State or Territory.*

It’s not the same thing.

Don’t know Australian law, but for a warrant you need to demonstrate probable cause in front of a judge. And that’s a pretty high bar.

The problem is that if a back door exists for government, it necessarily exists for anyone.

Here’s Tim Cook making that point: https://m.youtube.com/watch?v=rQebmygKq7A

I'm aware of that, but in the case of email service providers there is no need for a backdoor. They have access to your emails on-disk since emails are plaintext (in general).

We aren't talking of back doors here.

With an email provider you don't need a back door to get somebody's emails.

I didn't say it was the same thing, and I agree that the lack of judicial oversight makes it incredibly rife for abuse as well as much easier to get.

I said that to you (a user who wouldn't be the target of a warrant) there isn't a practical difference if you're targeted. You wouldn't be able to mount a defence in court anyway.

But of course, it being easier is a very serious problem from a societal perspective.

It depends. Australia is part of the 5 eyes countries. So now via cooperation between security agencies and due to no judicial oversight, I think more people are affected, whereas before this you would have to convince an Australian judge to give you a warrant.

IANAL.

maybe some people cannot get iPhones. Or use netflix or other items that depend on good encryption!

Sure, but the point is that warrants already allowed for access to services that are insecure.

Atlassian is another company that comes to mind here.

Aww man. I've been a super happy user as well for quite some time. What should a privacy concerned customer do?

Given that they store all of your data in plain text, probably run your own email server or use a different service. That's not really changed by this new law and was always the case.

I use fastmail as well, I like their ui a lot. I certainly treat it as the stockpile of plain text messages tied to my real life identity through my credit card that it is though.

I'm an Australian privacy-obsessed Fastmail user, and use them for my family domains and all our primary email. I'll keep using them, because email isn't private in the first place. Any more than snail mail is. Both can be intercepted and read by authorities without you knowing.

For secure communications, you shouldn't be using email in the first place, so these new laws don't change much in that regard (in my understanding, I'm still catching up on the new laws because I have limited internet access right now, I'm happy to be corrected).

This is increasingly not true. SMTP-over-TLS is now the standard, and unless you are trying to imply that TLS is broken, email is far more secure than it used to be.

If it's not end-to-end encrypted, it's not secure in the sense OP clearly means.

Correct: if either mail server is compromised by the government then it may as well be plaintext.