1

According to https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf companies could be required to enhance their software to allow for spying. They would enforce this via a "technical capability notice".

However, in Section 317ZG (p.84) they should not be compelled to build "systemic weaknesses". What is the difference here?

Changing software to allow spying leads to a weak system, or is it not?

Note: this is not specifically about encryption. This is covered separately in the bill.

  • It looks like you are needing guidance on the legal wording and definitions in the bill, which is not a security question. – schroeder Dec 14 '18 at 10:42
  • @schroeder I am not asking for the legal implications, nor seeking legal advice. It's about whether "systemic weaknesses", which I consider a technical term in this context, can mean something else than building a "weak/crackable/spyable system". – Marcel Dec 14 '18 at 10:50
  • But the language is in the context of the bill. What you consider to be "weaknesses" is not the important point. It only matters what the bill intends. – schroeder Dec 14 '18 at 10:54
  • 1
    You and I might both agree that building in the functionality the bill requests is a "weakness", but that's meaningless in terms of complying with the bill. – schroeder Dec 14 '18 at 10:56
2

Nobody knows.

The relevant parts of the bill:

317ZG:

(1) A technical assistance request, technical assistance notice or technical capability notice must not have the effect of:

(a) requesting or requiring a designated communications provider to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection; or

(b) preventing a designated communications provider from rectifying a systemic weakness, or a systemic vulnerability, in a form of electronic protection.

(2) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to implement or build a new decryption capability in relation to a form of electronic protection.

(3) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to one or more actions that would render systemic methods of authentication or encryption less effective.

...

For the purposes of subsections (4A) and (4B), an act or thing will, or is likely to, jeopardise the security of information if the act or thing creates a material risk that otherwise secure information can be accessed by an unauthorised third party.

So, a company can't be forced to break an encryption algorithm, or introduce a vulnerability that affects everyone equally. But...

317B:

systemic vulnerability means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.

systemic weakness means a weakness that affects a whole class of technology, but does not include a weakness that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.

They can be compelled to break the encryption used by a specific person, or introduce a vulnerability into encryption as used by a specific person.

Key escrow could be considered a technology that satisfies both criteria, although it carries the risk that the stored keys could be stolen by an unauthorized third party. It's up to the courts to decide if this constitutes a "material risk". There are other techniques that involve installing backdoors for everyone and then only activating a particular backdoor, but they carry the same risk as key escrow, plus the additional risk of independent discovery of the backdoor. Again, this is something the courts will need to rule on.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.