The Australian Government believes that it needs a golden key to backdoor encryption within Australia via legislation. The Brits and the Yanks have both already had a nudge at this and both have conceded that requiring a backdoor to encryption is not viable but this will not stop the Australian Liberal Party from trying.
Digital rights experts have described the proposal as "ludicrous" as Cyber security minister Angus Taylor stating that the legislation would be presented for public comment within the next quarter. While the Australian Government has not detailed how it expects to gain access to encrypted data, companies may be penalized if they don't kowtow to the new laws. There is nothing to be discussed here that hasn't been said before other than the Australian Government sincerely believes it can force companies to divulge encrypted data to authorities on demand.
Related Stories
Apple argues stronger encryption will thwart criminals in letter to Australian government
Apple has long been a proponent for strong on-device encryption, most notably for its iPhones and the iOS operating system. This has often frustrated law enforcement agencies both in the US and overseas, many of which claim the company's encryption tools and policies are letting criminals avoid capture by masking communications and securing data from the hands of investigators.
Now, in a letter to the Australian government, Apple says it thinks encryption is in fact a benefit and public good that will only strength our protections against cyberattacks and terrorism. In Apple's eyes, encryption makes everyone's devices harder to hack and less vulnerable to take-overs, viruses, and other malicious attacks that could undermine personal and corporate security, as well as public infrastructure and services. Apple is specifically responding to the Australian Parliament's Assistance and Access Bill, which was introduced late last month and is designed to help the government more easily access the devices and data of criminals during active investigations.
Letter here (#53), or at Scribd and DocumentCloud.
Also at Ars Technica, Engadget, 9to5Mac, and AppleInsider.
Police told to avoid looking at recent iPhones to avoid lockouts
Police have yet to completely wrap their heads around modern iPhones like the X and XS, and that's clearer than ever thanks to a leak. Motherboard has obtained a presentation slide from forensics company Elcomsoft telling law enforcement to avoid looking at iPhones with Face ID. If they gaze at it too many times (five), the company said, they risk being locked out much like Apple's Craig Federighi was during the iPhone X launch event. They'd then have to enter a passcode that they likely can't obtain under the US Constitution's Fifth Amendment, which protects suspects from having to provide self-incriminating testimony.
Also at 9to5Mac.
Related:
California Lawmaker Tries Hand at Banning Encryption
New York Judge Sides with Apple Rather than FBI in Dispute over a Locked iPhone
FBI Chief Calls for National Talk Over Encryption vs. Safety
Hacker Decrypts Apple's Secure Enclave Processor (SEP) Firmware
Federal Court Rules That the FBI Does Not Have to Disclose Name of iPhone Hacking Vendor
Law Enforcement Agencies Increasingly Cracking iPhones Using "GrayKey"
Australian Government Pursues "Golden Key" for Encryption
When's A Backdoor Not A Backdoor? When The Oz Government Says It Isn't
Five Eyes Governments Get Even Tougher on Encryption
FBI Used Cooperative Suspect's Face to Unlock His iPhone
With the Australian Labor Party caving in on the proposed encryption law that will allow Australian police and agencies to access private data directly from vendors, the new proposed laws are now agreed in principle to introduce government level snooping of user messages and encrypted files. Agencies like ASIO or the Australian Federal Police will have the ability to request that telecommunications and tech companies help them with their investigations and compel companies to build ways to allow targeted access to encrypted communications data.
Previously: Australian Government Pursues "Golden Key" for Encryption
Five Eyes Governments Get Even Tougher on Encryption
Apple Speaks Out Against Australian Anti-Encryption Law; Police Advised Not to Trigger Face ID
Australia follows New Zealand to demand passwords
New Australian Push For Encryption Backdoor in Wake of Alleged Terrorist Plot
In response to the news of what's going on in Australia, Derek Zimmer over at Private Internet Access' blog covers split key cryptography and why government back doors don't/won't/can't work. Attempts to regulate cryptography have been going on for a long while and each try has failed. He starts with recent history, the cold war, and follows through to the latest attempts to stifle encryption. These past failures give a foundation which can be applied to the current situation in hopes of understanding why cryptographers around the world are universally against these kinds of schemes.
The new proposal touted by the NSA, GCHQ, The Australian government and others is a simple evolution of Key Escrow. The proposal is key escrow with split-key cryptography, which is just key escrow with extra steps. There is still a "Golden Key" that can decrypt all messages from a particular service, but this time, two or more entities have pieces of that key. The concept, popularized by a Microsoft researcher, is said to solve the problem of abuse, because all parties have to agree to decrypt the messages.
Earlier on SN:
Australia Set to Pass Controversial Encryption Law
Apple Speaks Out Against Australian Anti-Encryption Law; Police Advised Not to Trigger Face ID
When's A Backdoor Not A Backdoor? When The Oz Government Says It Isn't
Australian Government Pursues "Golden Key" for Encryption
and more
(Score: 3, Interesting) by Anonymous Coward on Monday June 18 2018, @09:45AM (11 children)
From the same turds who:
1. Hate fibre optics because Rupert felt threatened by the nbn
2. Seriously expect non Australian online stores to collect and remit gst to the Australian government.
So yeah. Golden crypto backdoor keys. Fits right in to their bazaar world view.
(Score: 0) by Anonymous Coward on Monday June 18 2018, @10:06AM (1 child)
lol, and it goes on .. how's their climate change policy this week? We still on schedule for TA's "clean coal" roll out? Sadly I thought this one would end with Brandis moving on ..
(Score: 0) by Anonymous Coward on Monday June 18 2018, @10:54PM
The highly opposed mine in qld to sell coal to India for next to nothing is still going ahead
(Score: 0) by Anonymous Coward on Monday June 18 2018, @10:27AM (1 child)
Government crooks around the world are attempting legislative and judicial overreach rather than recognising that they are losing the ability to collect sales, purchase and import taxes.
(Score: 0) by Anonymous Coward on Tuesday June 19 2018, @09:43AM
Actuality it was the "must register with the ato proving owner name, address, contact phone, business license id etc" that has them running for the hills
(Score: 0) by Anonymous Coward on Monday June 18 2018, @10:56AM (1 child)
Freudian slip or deliberate satire from down under?
(Score: 2) by requerdanos on Monday June 18 2018, @03:39PM
I thought it was an odd way to say "supportive of bustling free trade" but that didn't quite fit the context.
I would say instead that their world view is unusual, odd, or downright bizarre. But to each his own.
(Score: 4, Insightful) by JoeMerchant on Monday June 18 2018, @11:08AM (2 children)
Turds are the same the world over. I believe it was Indiana that legislated pi to be 3.0 exactly.
🌻🌻 [google.com]
(Score: 0, Insightful) by Anonymous Coward on Monday June 18 2018, @11:32AM (1 child)
That was caught before the vote.
And it wasn't legislating pi to be 3.0, it was a new, proprietary, way of teaching math that Indiana (assuming you got the state right) got a chance to be the first state to implement. It got stopped exactly because some math guy explained to the legislature that under this new way of teaching math, one way of calculating pi would end up with 3.0 (or was it 4.0), but that wasn't even the worst. A different way of calculating pi would end up with 9 as a result. Yes, nine.
(Score: 3, Informative) by tangomargarine on Monday June 18 2018, @03:54PM
3.2, actually. The bill was some numbnuts thinking he had successfully found a way to square the circle, which is right up there with perpetual motion as logically impossible things.
https://en.wikipedia.org/wiki/Indiana_Pi_Bill [wikipedia.org]
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
(Score: 0) by Anonymous Coward on Monday June 18 2018, @07:43PM
Oops, bizarre. I was tired...
Still kinda funny given current world circumstances. Libs and web gst. Trump and his trade tariffs.
(Score: 0) by Anonymous Coward on Monday June 18 2018, @10:00PM
Speaking of turds; It seems the government disagrees with this [newshub.co.nz] so there's that.
(Score: 0) by Anonymous Coward on Monday June 18 2018, @10:13AM (4 children)
So which is the southernmost state of the USA - Australia or New Zealand? ;)
(Score: 2) by RS3 on Monday June 18 2018, @01:00PM
Antarctica
(Score: 0) by Anonymous Coward on Monday June 18 2018, @07:17PM (1 child)
Some days you do wonder. Both are big big friends with the USA, when convenient.
As for NZ, they are ever following larger cousin Australia's example and shaking the GST stick - have to "protect" the local brick and mortar (where prices start at 2x the global average). They are calling it the Amazon Tax as Kiwis turn to Amazon shopping to get their goodies at affordable prices. Also, it is getting easier to rule the dumbmasses (worldwide) - see recent stories about IQs falling. Jordan Peterson says 1 in 10 are non-functional in modern society [https://youtu.be/5-Ur71ZnNVk], in NZ we are already at 47% [https://www.stuff.co.nz/national/education/104111160].
(Score: 2) by aristarchus on Monday June 18 2018, @11:23PM
Indeed, forsooth! The greatest indicator that a society has become Mitt Romney-level of non-functional is that they listen to Jordan Peterson. So well done, AC, you have produced an irrefutable statement, a tautology, if you will. But you do know that Peterson is Canadian, sort of like the Kiwis of the northern hemisphere? The circle is hereby closed.
(Score: 0) by Anonymous Coward on Monday June 18 2018, @10:51PM
Tasmania
(Score: 4, Informative) by Anonymous Coward on Monday June 18 2018, @10:29AM (1 child)
... is to liberalism what the Democratic People's Republic of Korea is to democracy.
(Score: 4, Insightful) by crafoo on Monday June 18 2018, @03:59PM
Regressive authoritarianism wearing a democratic and liberal mask is the flavor of this decade. All the cool kids are doing it.
(Score: 2) by inertnet on Monday June 18 2018, @10:33AM (2 children)
Politicians messing with 'cyber'.
Why don't we just make everyone use a global encryption key for everything: "OfficialSecretWorldwideEncryptionBackdoorKey"?
Problem solved.
(Score: 0) by Anonymous Coward on Monday June 18 2018, @06:58PM
ROT-13 is super secure, right? Keep banging the rocks together until the coming of the Great Golden Kangaroo...
(Score: 0) by Anonymous Coward on Tuesday June 19 2018, @09:46AM
If all those idiots did was "cyber"ing then the world may be a far better place
(Score: 4, Insightful) by fyngyrz on Monday June 18 2018, @10:46AM (15 children)
FTFS:
Because, you know, it can force them. It shouldn't; the idea runs counter to actual reason and sense; but government, at its root, forces those subject to its laws to do many things, and this could indeed be one of them.
Because one of our human failings is that we keep choosing the rich to run our governments. Or the venal. Or the clueless. Not that any one of those often excludes another.
/me goes back to coding
(Score: 2) by takyon on Monday June 18 2018, @10:49AM (9 children)
Is that crypto code I see? You're down under arrest for illegal encryption related assault on national security.
[SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]
(Score: 3, Interesting) by fyngyrz on Monday June 18 2018, @12:39PM (8 children)
Nope. [fyngyrz.com] :)
(Score: 2) by takyon on Monday June 18 2018, @01:25PM (7 children)
How does the GIMP run on your system? And could an SSD help put a bandaid on your slow applications?
[SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]
(Score: 2) by fyngyrz on Monday June 18 2018, @02:47PM (5 children)
The GIMP, last I looked, is not capable of some of what I have implemented, so it's not really relevant. I don't use it anyway, haven't for years. I suspect it'd run okay; I have a 12/24 core, 3 GHz, 6 display machine with 64 GB of memory and terabytes of drive space.
Photoshop runs okay too - for Photoshop, anyway. Beats trying to run it on my laptop...
Sure. So can a decently written, relatively lean app.
Photoshop is 100 MB of application, and 237 more MB of frameworks. 337 MB, plus setting it all up which takes quite a few seconds even after the core code is loaded.
This is (presently) 2.6 MB of application, and 17.2 more MB of frameworks. 19.8 MB, and no setup time. About 95% of the roadmap is complete, so that's close to finished size.
The only thing slower than Photoshop on my system is Lightroom, which is positively glacial, and is also being replaced by this app for my DSLR undertakings. Two overweight, slow, unfriendly birds with one stone. :)
My app works better than Photoshop for my purposes. A lot better. If it's useful to others, great. If not, they certainly have other choices. For me, being able to work on my images at speed, comfortably, intuitively... that's worth the time it took to write the app (so far, about a month and a half.) And of course, I have full control over it, and a complete understanding of it, so I can change or add whatever I want. No "phoning home", no "subscriptions", no support issues, no having to deal with someone else's idea of "how things should work", etc.
(Score: -1, Troll) by Anonymous Coward on Monday June 18 2018, @04:16PM (2 children)
it's a shame to see an otherwise intelligent person, who can make things, use a slave platform and make slaveware for it. lazy name too. "i" (well that was original) "toolbox" well that's awfully generic. so the name means "mac doucheware does something". what a waste.
(Score: 2) by fyngyrz on Tuesday June 19 2018, @12:36AM (1 child)
a) I'm writing it in a very portable manner (using Qt / c++) and intend to port it, presuming that the task ends up being reasonable, which is the plan, anyway. I've successfully ported large (much larger, in fact) Qt applications before, so the odds are decent.
b) I'm open to suggestions for the name. Image Toolbox was too long. Hence the iToolBox, but yeah, i-this and i-that.
(Score: 0) by Anonymous Coward on Tuesday June 19 2018, @01:19PM
There's already iToolbox for MATLAB.
(Score: 2) by takyon on Tuesday June 19 2018, @11:36AM (1 child)
Not relevant when you're comparing to Photoshop? Wat?
If it's bit depth that's the problem, that should be solved by now:
https://www.gimp.org/release-notes/gimp-2.10.html [gimp.org]
[SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]
(Score: 2) by fyngyrz on Wednesday June 20 2018, @12:25AM
No, it's not bit depth. They're both okay there. It's things like layered image layer modes and capabilities they (Photoshop and Gimp) don't have, image notation handling, astro-photo tailored goodies, etc. And, of course, the ability to add any custom thing I want now that the main application superstructure is up and running with the initial roadmap goalposts all in the rear view mirror.
(Score: 0) by Anonymous Coward on Tuesday June 19 2018, @10:26AM
(Score: 1, Insightful) by Anonymous Coward on Monday June 18 2018, @11:08AM (4 children)
it actually can't.
if a company implements encryption properly, it cannot decrypt what a third party has encrypted.
and no, this is not like "true scottman" (or whatever the spelling is).
my statement is closer to "gun manufacturers cannot unshoot what a third party has shot using the manufacturer's gun".
(Score: 2) by fyngyrz on Monday June 18 2018, @12:36PM (3 children)
It actually can, because it can force them to provide a back door in the encryption.
Remember: this is companies we're talking about. Not individuals. If companies don't comply (or IOW, as you put it, if they "implement encryption properly"), it will be obvious, and the government can arrange to force them to provide a back door by all manner of means, or put them right out of business. What companies do is public and - eventually - subject to law. What individuals do is not public, and so until there's a reason to look at them, they can get away with it. A company cannot.
(Score: 0) by Anonymous Coward on Monday June 18 2018, @01:54PM
if it has a backdoor it's not encryption. that was my point.
otherwise I understand that the government can try to do whatever it wants (I *hope* Australians are smart enough to stop it at some point), but I am confident people outside of Australia (and most English speakers are outside Australia) would not agree with the new definition of the word "encryption".
(Score: 1, Redundant) by choose another one on Monday June 18 2018, @02:48PM (1 child)
Actually it cannot force companies to comply - if can force them to comply if they want to do business in Australia. The companies can always shut down or leave Australia instead.
Similarly the government cannot _force_ you to reveal an encryption key - they can, and some will, jail you untill you do, but they cannot actually force you to do it.
Amazon recently pulled their main US site out of Aus over tax, leaving customers with a much smaller selection of stuff from the local Amazon site.
Multiple US (and probably elsewhere, the ones I have noticed are all US) sites have blocked the EU market rather than comply with GDPR rules.
Simply put, if you make business not worth doing it'll stop being done.
When the entire rest of the world has the choice of a creating a new insecure version of https and insecure VPN protocols or just not dealing with Aus, what will happen?
If Aus implements local insecure encryption and manages to get support in will web browsers, will those browsers indicate it as secure or insecure, will there be a new padlock icon overlaid with a man in black with bolt cutters, or will shit just stop working in Aus?
The big question is is Australia a too-big-to-lose market thus creating a significant incentive to comply? If the EU isn't a big enough market to create an incentive to comply with GDPR then I'd suggest Australia is overplaying its hand, big time. But maybe they are dumb enough to keep raising the stakes, forgetting that if everyone else just walks away from the table it's a very lonely game.
(Score: 2) by fyngyrz on Monday June 18 2018, @03:56PM
Yes, obviously. A country's laws apply only in that country, barring treaties that make things more international, such as what the ITU does with radio.
(Score: 1, Insightful) by Anonymous Coward on Monday June 18 2018, @11:43AM (4 children)
If they get their wish, it will be only a few hours, a day at most, before the intelligence agencies of the rest of the world get the “golden key” to Australia, and then give it up to a fortnight or so before the blackhat underground has it too. And then there will be a wave of cybercrime on the entire country such that no one will be able to do anything online without getting hacked. Creating a “golden key" like this will basically place the nation's electronic security hostage to it, making it an extremely valuable target. Far better not to have such a juicy secret like that in the first place: it might make law enforcement’s job easier for a brief time, right until the day the secret gets out, and it WILL get out.
(Score: 2) by fyngyrz on Monday June 18 2018, @12:36PM (3 children)
Yes, but... they're stupid. :)
(Score: 3, Touché) by Runaway1956 on Monday June 18 2018, @01:59PM
Well, next up, do you think we can get them to legislate less gravity? With all the fat people in the world, less gravity would be very helpful. I dunno, maybe reduce it to 70% or something like that?
(Score: 0) by Anonymous Coward on Monday June 18 2018, @11:03PM
Now now the "MyHealthRecord" system is a good idea but forcing it on everyone and uploading their medical records online isn't
(Score: 0) by Anonymous Coward on Tuesday June 19 2018, @10:42AM
If they are smart they could do what Lotus Notes did: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html [cypherspace.org]
Basically all messages are encrypted by a random symmetric key.
The entire symmetric key is encrypted by the recipient's public key so that whoever has the recipient's private key can decrypt and get the whole symmetric key.
X bits of the symmetric key are encrypted by the NSA's public key so that whoever has the NSA's private key can decrypt and get X bits of the symmetric key, then with the NSA's computing resources and other techniques they can determine the rest of the bits and the message.
Yeah maybe people can reverse the private key from the known public key by now but I'm sure it took longer than a fortnight for the blackhat underground to get the NSA's private key... ;)
(Score: 1, Interesting) by Anonymous Coward on Monday June 18 2018, @12:41PM (5 children)
Suspend reality for a second and assume that it is possible to put a backdoor in all products so that only the right folks under the right circumstances can get in.
Why would the bad guys use it for their communications?
(Score: 1) by khallow on Monday June 18 2018, @01:07PM (1 child)
Why wouldn't they? You can't properly budget for criminal activities, if the criminals aren't telling you what they're going to do!
(Score: 1, Funny) by Anonymous Coward on Monday June 18 2018, @02:02PM
You are correct, there is a bug in the original comment.
Forgot to unsuspend reality.
This might not be obvious to someone backing this plan.
Here's the patched version.
Suspend reality for a second and assume that it is possible to put a backdoor in all products so that only the right folks under the right circumstances can get in.
Ok, now go back to the real world with real folks.
Why would the bad guys use it for their communications?
(Score: 0) by Anonymous Coward on Monday June 18 2018, @01:53PM
This is not an accident, control of the good guys is the goal. "Bad guys" and "think of the children" is the sales pitch.
The use of logical fallacies and legislating the mathematically impossible should be instant resignation offenses for the political classes. It might weed out some of those unfit for office and limit the damage, at least a little, of the few remaining.
(Score: 1, Insightful) by Anonymous Coward on Monday June 18 2018, @01:59PM
The trouble with that is that that is exactly what the Government wants. They don't want the bad guys using standard channels with end-to-end encryption for their communications. Because then they have to find ways to filter out the "bad guys" talk from the "good guys" talk (which almost-but-not-quite requires access to the plaintext communications). The current "find a bad actor and then analyze the network traffic" takes them only so far because it implicates their pizza guy as well as the mastermind. They want the bad guys forced off the standard channels into very specific (and taggable in a global-Echelon sense) communications channels and formatting, where they can presume the person guilty (in an intel sense) just for using the medium.
So they win if the bad guys keep using it (which as fingryz pointed out may still happen - many people are stupid), and they win if it drives the bad guys off into doing something more easily trackable.
They only lose if the people insist upon a right to private communications without exception. Which actually is a blow to law enforcement - not saying they should have the right but just that it is easier to prove a conspiracy if you have absolute access to who says what.
(Score: 0) by Anonymous Coward on Saturday June 23 2018, @12:07PM
Because they are dumb. Well, most of the ones that get caught are. Of course, since they are dumb, they'll probably be caught even without backdooring the encryption they use.
(Score: 3, Insightful) by PinkyGigglebrain on Monday June 18 2018, @02:05PM (1 child)
So, when there is a massive data breach because of this government mandated weak encryption and millions of people loose their identities and life savings who is going to to be held liable for the breach? The Company that followed the law and used the weak encryption, or the government for requiring it?
No matter who gets the bill it is still going to be the victims who pay for it.
"Beware those who would deny you Knowledge, For in their hearts they dream themselves your Master."
(Score: 5, Insightful) by choose another one on Monday June 18 2018, @02:57PM
> No matter who gets the bill it is still going to be the victims who pay for it.
That's the beauty of the game of politics, you are only spending other people's money.
Run the economy spectacularly well - the people pay (in tax)
Bankrupt the country - the people pay
Everything in between - the people pay
(Score: 2) by DannyB on Monday June 18 2018, @02:57PM (2 children)
Golden Key is a euphemism for Back Door.
So stop calling it Golden Key. It's a Back Door. One that the government intends to (unsuccessfully) keep secure.
But the road to hell is paved with good intentions. Think of the Children!
To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
(Score: 2) by tangomargarine on Monday June 18 2018, @03:12PM (1 child)
how about Golden Anus
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
(Score: 5, Funny) by Anonymous Coward on Monday June 18 2018, @03:23PM
This is all bad enough without your bringing POTUS into it.
(Score: 2) by aristarchus on Monday June 18 2018, @11:28PM (1 child)
Looks like they already got to c0lo!
(Score: -1, Troll) by Anonymous Coward on Monday June 18 2018, @11:40PM
#freehat
FTFY.