We haven't been forced to add anything. The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth.

We pride ourselves on telling the truth to our customers, and we're quite clear that if we receive an Australian warrant for access to information about one of our customers, then we respond. That's different from adding backdoors.

Our submission asks that the law be updated so we're allowed to talk about any surveillance capabilities that we may be asked to add, but not about which users are being surveilled. That way our customers know exactly what we are capable of.

Right now we haven't received any capability requests (TCN) which is the bit we're concerned about, because if they required us to add features to the product without telling all staff about them, that would make it hard to maintain and ensure security as things were refactored. And any staff who DID know about it would have to be extra careful about what they say anywhere, because they could inadvertently leak something about the capability.

We expect the law to be updated soon, and hopefully this will be addressed. Until then - honestly, nothing has changed. We still operate under exactly the same process - if we receive a warrant from Australian Federal Police we respond. If we receive any other type of request, we point them to the AFP and the mutual assistance treaties that are appropriate. But it's impossible for you to verify that, because if something HAD changed, we'd have lie - and that's frustrating to us.

> Right now we haven't received any capability requests (TCN) which is the bit we're concerned about

I would be INCREDIBLY cautious about making statements like that. The penalty for discussing the existence or nonexistence of a notice under the new legislation is 5 years imprisonment. You can give 6-month statistical information, but you should have stated it that way if that's what you were doing.

I really, honestly hope you spoke with your legal council before making statements like that (I personally will not make statements like that until I get legal advice about how it should be stated to avoid a 5-year conviction).

Given that you're able to inform us currently that you've not received any capability requests, would it be legal and feasible for you to set up a warrant canary? I don't know if Australia has the same protections against compelled speech as the US [1, 2] which theoretically allow one to function, but if so, it might help encourage people to stay.

[1] https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of...

[2] https://en.m.wikipedia.org/wiki/Wooley_v._Maynard

Warrant canaries are explicitly disallowed under this legislation (you cannot comment on the existence or non-existence of a notice and there are strong restrictions on what sort of statistics you can provide).

In fact, I'm a little worried that they just said they have received no TCNs -- while you can provide aggregate statistical information over a 6-month window, if you get it wrong you're looking at a 5-year gaol sentence.

We have no real free speech laws (there is common law about it but that can be overridden by legislation). There is freedom of political speech, but that's a much weaker bar. Funnily enough, parliament has actual freedom of speech.

The second sentence of this comment is the only one that matters, unfortunately.

Yeah, I know - that's pretty much what we said. There's no way to distinguish between the two as an outsider. We're really strong on not doing security theatre nonsense:

https://fastmail.blog/2017/12/05/the-fastmail-security-minds...

So we're not trying to pretend anything about the legal framework - when we said "nothing will change" up front, we meant it - and when we say "nothing has changed" now, we also mean it. But we can't pretend that we couldn't be forced to say that if things had changed either, because that would be dishonest.

I was wondering, with these new laws, did FastMail consider to operate (partly) in other countries?

For example if FastMail has servers in Amsterdam (NL). Would it be possible to let customers decide on which servers they want to host their mail, so that it falls under the local (or EU) laws?

Thank you in advance for taking the time to reply here.

With the caveat that I'm far from an expert in this domain, as I understand it FastMail would have to comply with the laws of the country they're based in, as well as any country they'd have as customer or hosting provider.

I imagine the only solution is to move the entire company to another country, but I'd very much like to hear from people who do know what they're talking about.

Unfortunately "mercer" below is right - we need to comply with the laws of Australia regardless of where our servers are. The "Amsterdam server" idea is a red herring that doesn't change the legal landscape.

> The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth.

Why not report the opposite on a regular basis?

"We're happy to report that we haven't been forced by authorities to implement a backdoor in our systems."

That way, when you stop writing that every week or month or what have you, everyone paying attention will know you've been forced to add a backdoor and might be gagged.

Warrant canaries are unfortunately illegal in Australia in this context [1].

[1] https://boingboing.net/2015/03/26/australia-outlaws-warrant-...

They are illegal, but you're posting the wrong link (that's about journalist warrants). The legislation in question explicitly states that you cannot comment on the existence or nonexistence of a TCN, TAN, or TAR.

If you regularly report "We don't do X" and then cease reporting, it's equivalent to saying "We're now doing X".

To be fair, this is basically the software developer's dilemma in reverse. You're building out systems for areas of business with no domain expertise. End users constantly wonder why the developers built the software in such profoundly stupid ways.

Lawmakers face the same problem in that they're barraged with constant problems from completely different fields that they're unlikely to be subject matter experts in. How do they learn about it? By consulting subject matter experts. Who are these subject matter experts? Well established businesses in their field. This can lead to laws that are incentivized towards large businesses. That's just considering a situation where everyone is working in good faith.

Now consider lawmakers having to cater towards what is currently trending with the populace, kickbacks from companies, pull from different governments/organizations/political parties etc. And it's easy to see why politics is the way it is.

> By consulting subject matter experts.

Experts were consulted, and ignored. A lot of experts came right out and said these laws were insane. The Australian tech industry were not in favour, and the consulted experts were not favourable.

However, the experts that were listened to were the ones who worked for ASIO, who said that these laws were absolutely necessary just for the agency to continue operating, and it was urgent that they were deployed in the last few days of Parliament. So the laws got rushed.

If I had two experts, one of whom was security and one of whom was business, and they disagreed with each other, I would also be listening to the security expert first.

After all, there have been major catastrophic failures because some IT tech followed the orders of a CEO to give them access to a mission-critical system from their insecure home PC. Isn’t that essentially what the whole “but her emails!” (and, it turned out later, his emails) was all about?

Expert shouldn’t be counted in number of votes for/against... If you have FastMail and Atlassian, biggest and most successful startup of Australia who relocated to UK, telling you off with the CEO taking a public stance that the government is crippling progress, then it’s not hard to listen: Your economy will lose big.

It shouldn't work like this either. If two major chemical companies threatened with relocation and their CEOs told the government it is crippling progress unless it seriously relaxes environmental protection laws you wouldn't want the government to just back down.

At best you have some independent experts with no stake in the game, but even then politics will often result in a compromise that is suboptimal for all involved.

You're right. You'd want the government to approach with extreme caution when you have two largely conflicting opinions emerging. You'd want amendments to try and balance need and impact.

Unfortunately, this was rushed through in a matter of days, and in fact the Parliament doors were locked to force an immediate decision, trying to make people throw caution to the wind.

I’m not counting votes either. I’m saying that for all the flaws in how this law was made, the one thing that wasn’t wrong was putting national security over business interests.

(Probably didn’t actually help national security, but that’s a separate problem).

> Experts were consulted, and ignored.

This led to my point, though I made it in a roundabout way. None of these laws are made in a vacuum. When you get a law that seems to cause undue harm to industries or to general consumers, it's unlikely the case that lawmakers wrote up something due to negligence of the issues, but because another entity specifically pushed to have these laws written in this way.

I would expect anybody worth their salt to consult experts from said field they with to bridge into. Otherwise, why the hell are you blindly passing out laws? Sheer incompetence.

"Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act."

I'm reading that as "we don't encrypt customer emails, so we already had to share them." That's consistent with what they've said in the past.

To be fair, they also explicitly point out in their docs that encryption on their end is pointless (since they have the keys) and that you should encrypt your e-mails on the client side with something like PGP (where you control the keys).

E-Mail sucks, that's all. Fastmail is transparent about it and does a good job.

(PS: I still think that they encrypt their storage servers, but again, this will only protect against someone physically taking away their servers, not against a warrant or an intruder.)

Exactly correct. We already share customer emails under limited circumstances and for explicitly requested accounts only (we've never participated in dragnets and we don't believe this legislation will require us to either).

We have a standard process for verifying each request with the AFP and ensuring that they have followed due process to get a warrant for the data. We strongly support (also spelled out in that submission) keeping judicial oversight of requests - which this legislation does still require for the access requests themselves - hence saying that nothing has changed for us, since we have existing capabilities and we already respond to legal requests.

Due process is not the only question though. FastMail users will also be wondering whether the content of their email has to comply with other laws made by the very same lawmakers that have just shown their complete disregard for privacy and a shocking level of technical incompetence.

They understood the impact.

https://www.smh.com.au/politics/federal/bill-shorten-says-la...

They just put their own political skins ahead of good government and passed a law that they knew was flawed. There's been no mention of the touted amendments to fix it, as there is a federal election looming and if either side of politics proposes an amendment, the other will take the opportunity to manufacture a scare campaign and score political points.

In any protracted discussion of US politics, it's pretty common for someone to raise the point that other countries have better voting systems than the one we use, where a winner-take-all paradigm inevitably devolves to a contest between only two dominant parties, and where there is little incentive for the victorious party to form a working coalition with the other. Australia's use of ranked-choice voting is frequently cited as one area where our first-past-the-post system is behind the curve, and in fact we're starting to consider adopting ranked choice voting in some limited areas [1].

We also hear frequent arguments in favor of Australia's compulsory voting law as a way to combat the sort of voter apathy that led to the... unexpected outcome in our last Presidential contest.

Stories like this serve as good counterpoints for Americans to raise in those debates, I think. Yes, Australia has implemented a number of progressive electoral reforms... but those progressive electoral policies are obviously not getting them better leadership or better laws. So why should we, in the US, follow their example?

[1]: https://bangordailynews.com/2018/08/28/opinion/contributors/...

That's an interesting notion. Not to follow this tangent to far, but I think that most likely it is a more representative democracy. If you were to ask the people in the US if they want a bill that would allow law enforcement to "read the private messages of terrorist", I'd guess that most people would say yes, not knowing or understanding the ramifications of what the law would mean, or what a clear definition of what terrorist are.

But to the point, I do agree that mandatory voting may be actively harmful as it values all degree of civic engagement the same. That being said here in the states we have actively installed barriers to make voting more difficult. We aren't really getting better leadership or better laws from it.

well, australian voting systems aren’t exactly progressive (it’s just a few steps above the worst case), and neither is the voting populace

id say our government matches closer to our electorate than what the US government does, but we still have only 2 major parties which severely limits choice. there are ways to combat this (NZ, Germany for example)

this example is also a fairly poor one, because it’s possible this law came as a “test the waters” as part of 5 eyes, so it could be followed in other counties. where spying and secrets are concerned, we shouldn’t draw too many conclusions because we don’t know all the facts

It doesn't necessarily have to be enacted in other 5 eyes countries. The specific wording of the law said they can enlist citizens to put in backdoors at the request of other Governments.

Even more absurd is that it also mentions this regarding economic espionage purposes. They legally could ask a developer to commit large scale theft of industrial secrets from say Germany for the benefit of Canadian enterprises. Anyone refusing faces penalties in secret court rooms.

The open ended nature of the wording is staggering.

Actually the political logic on national security legislation here is a little more complicated and not really related to the electoral system or compulsory voting.

National security policy has been used as a wedge issue here in the last 20 years, like in lots of other places. So the raft of security legislation that's been passed since the conservatives took office in 2013 has actually been as a result of both major parties voting together. If the Labor Party (centre-left) opposes security legislation, they're painted as soft on terror, weak on border security, etc.

Security agencies have given a shopping list to the Liberal (i.e. conservative) government - data retention, citizenship, and encryption amongst others. The Libs have put bill after bill forward in an attempt to generate opposition from Labor and thereby get an effective national-security wedge. Some of them have been 'genuine' reforms but some have been less so. Labor knows this of course. But it's ahead in the polls and wants to be a small target come the election, so it has refused to bite. The result has been a bunch of shitty new security laws.

It can be wonderfully disheartening to watch, especially given that lots of people on both sides of politics know perfectly well that they're bad laws but can't say it out loud due to the the politics of it. They're not all idiots who don't understand tech.

So while the electoral system here has delivered slim majorities for successive governments (or indeed minorities at times), it's not really relevant here. When the major parties vote together the laws are going to pass.

Sorry if that's off topic but I find it very interesting, albeit depressing sometimes.

> If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it.

No, that’s not what they said.

Such statements can hurt a business and in this case it would be a pity since the business in question is doing everything they can to serve their customers.

Thank you :)

That is indeed not what we said - though we were pretty sure we would be taken out of context and the "there's a risk of somebody being asked to do this and that creates staff uncertainty" would be seen as "we've definitely already done this" :( Unsurprisingly, that's happened.

If I remember correctly from their statement on this issue before they were baaically unaffected by the new laws as they do not off end-to-end encryption, so they were already open to lawful intercept requests.

Email services claiming e2e encryption are snake oil.

It’s interesting to me how a demographics like that of HN can fall for it.

Agreed. But having encryption at rest on your stored email would be a decent feature.

Now it looks like if FastMail added that, they could be compelled by the government to break it anyway, without notifying the user.

Mailbox.org has a feature like that, where all incoming messages are PGP encrypted to your public key when they're received so there's only a small window where they have the plaintext (and the plaintext isn't stored long-term nor is it stored in a way where they can decrypt it).

The problem is that fundamentally email still provides them the plaintext -- so they wouldn't need to add a new capability or break the design of their at-rest crypto, they would simply have to stash away emails that were requested by a warrant.

The problem is that e2e messaging applications, where there is no way for the server to do this, are going to be in quite serious trouble. They would need to re-design their crypto so they can add additional "backdoor" device keys that let them access the messages, or provide backdoored binaries to the relevant target. And that's what TCNs will be used for -- to compel those kinds of backdoors.

So when I send my gpg mail, it’s not encrypted?

Yes, it is.

But if this is a feature of a mail service rather than a mail client, then the service has the keys and, given GPG has no perfect forward secrecy, they have the ability to decrypt all emails you send and recieve.

If you go down the road of the mail service owning a mail client that promises e2e, then the issue moves to worrying about the code that runs on your device. If it's webmail, the JavaScript can easily be changed, so you really want a thick client. Then you need to worry about the thick client sending data that it's really not supposed to i.e. can it read your key and send it to $vendor?

Even then, GPG without Perfect Forward Secrecy means that when your key is brute forced or side channel attacked, which we assume will happen, you lose all your secrecy, so you need to think about this as a temporary state.

Note that the key could be client side and the email service could encrypt the email in a way as to not find out your private key.

However, and this is key, a majority of email is sent and received unencrypted via their servers, because that's just how email works.

In other words, email at rest might be encrypted, but most of the email in transit is not. This means that a man in the middle (e.g. the NSA) can still intercept all your communications.

And even with PGP encryption, which is e2e, the meta data is still unencrypted because that's what the email protocol demands. Having the ability to see whom you're communicating with, that's enough in many cases.

Email is simply not a good solution for e2e encryption. If you have secrets to protect, there are now other solutions available, like Signal and even Signal has some issues (like its reliance on phone numbers for identification).

Australia is significantly behind the US in terms of tech, and Australian lawmakers are also significantly behind. Ignorant, and draconian. Not a good mix. With no Bill of Rights to protect people.

It's borderline funny how inept the Australian government is with tech. NBN cost a fortune, and still sucks. My Health Record debacle. New anti-encryption laws, and leaders who think they can change the laws of math. ScoMo forgetting to set his domain on auto-renew... It's been a mess.

* Victorian couple quoted up to $1.2m to connect to NBN Co's fibre service - ABC News (Australian Broadcasting Corporation) || https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-...

* My Health Record: privacy, cybersecurity and the hacking risk | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/jul/16/my-he...

* Scotty Doesn't Know: prankster takes over Scott Morrison's website | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/oct/19/scott...

* Prime Minister Says The Laws Of Mathematics Are Trumped By Australian Law || https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths

Add to this how messed up the visa situation is in Australia, and the crazy high taxes they put on immigrants, and they wonder why their economy can't keep up and homes have dropped 20% in the last 2 years...

They coasted on energy / natural resources for so long, but didn't invest any of the money correctly into tech training / startup scenes. Now that China took their foot off the gas, Australia will be in for a world of hurt.

You forgot the last national census, where they decided our privacy was not that important[1], and they were liberally threatening everyone with severe fines if they didn't fill it out anyway.

So when the most predicable result on the planet happened and twenty million people all tried to fill out the online form on the "census" evening they claimed it was a denial of service attack.

The shame of it was, the ABS had a pretty good reputation up until that point (I believe). Now they're just another joke and have no good will left.

[1] And which today we discover they've cocked it up even more so. https://www.itnews.com.au/news/algorithm-flaw-meant-census-r...

Or the medical record system that's non-searchable since it's just all flattened scans converted to PDFs. Fun. Our tax dollars at work.

> If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it

I interpreted it as they could be forced to secretly add a backdoor, but I guess if they are sworn to secrecy on it, who knows. Maybe it’s time for me to switch from FastMail...

> It's amazing to me that the people who write these laws are the least capable of understanding their impact.

Kind of makes you wonder about the other laws they write that touch things you aren't as familiar with...

I'm not sure what you are trying to say here. The party that pushed for these news laws is the same party that has been opposing real action on climate change for years.

So yes, we do deserve better than these clowns.

Over the past 20 years, most developed nations have been working to reduce GHG emissions, through multiple governments and across multiple industries.

Australia shirked responsibility during the Kyoto protocol, letting the rest of the world tackle this problem.

Australia's current government cannot be solely blamed for this.

Of those 20 years you mentioned, the party we're discussing has been in power for around 14 of them - and the 6 years preceding that. I'd say the party that has been in power for over 75% of the last 25 years - and has actively campaigned against acting to reduce emissions - is somewhat responsible.

But what I don't understand is the relevance of climate change to the topic at hand: the assistance and access legislation harming Australian tech companies. And I'm still not sure what your original point was ("Australia's abysmal record on climate change affords it no sympathy"). Were you saying saying that Australia's tech industry deserves to be destroyed because a slim majority of the country keeps voting for a party that is, among other things, hesitant to act to reduce emissions?