Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Australia Privacy

Australian Law Enforcement Pushes Against Encryption, Advocates Data Retention 88

Posted by samzenpus from the laying-down-the-law dept.
angry tapir (1463043) writes "Australia is in the middle of a parliamentary inquiry examining telecommunications interception laws. Law enforcement organisations are using this to resurrect the idea of a scheme for mandatory data retention by telcos and ISPs. In addition, an Australian law enforcement body is pushing for rules that would force telcos help with decryption of communications."
This discussion has been archived. No new comments can be posted.

Australian Law Enforcement Pushes Against Encryption, Advocates Data Retention More

Australian Law Enforcement Pushes Against Encryption, Advocates Data Retention

Comments Filter:

  • nothing new here. (Score:1)

    by Anonymous Coward
    ACC et al always recommend such laws, so far they always get rejected, they aren't practical or cost effective. It would be the same if you asked the FBI or CIA about such laws. I would expect nothing less from them as their goal is to monitor and apprehend criminals and to remove roadblocks from doing that, there job is not to protect privacy, thankfully the privacy advocates are also questioned in the inquiry and they recommend the other extreme, in the end we end up with something in the middle.

    • It'd be really nice if we could respond to these various laws that keep getting proposed and shot down by passing a preemptive rejection of all future laws in the same vein, requiring say a supermajority vote to pass any legislation containing rejected provisions. It wouldn't be a perfect solution, but it would mostly shut down the "maybe we can buy enough votes *this* year" folks, as well as the "let's sneak a surveillance provision in as a rider on this agricultural bill" shenanigans.

      • Re: (Score:1)

        by MrNaz ( 730548 )

        What you describe is a "law above laws", that serves as a guide to legislative actions and that reflects the underlying values of the society that we don't want legislated away by the whims of the parliament of the day.

        This is the role of the constitution. And yes, the modern world does need a right to private communications or something similar to be included, because the current protections included in it just don't cover the manners in which modern abuses of power can manifest.

    • thankfully the privacy advocates are also questioned in the inquiry and they recommend the other extreme, in the end we end up with something in the middle.

      "the middle" is not always right. When it comes to privacy, it isn't. Annoying how people are so readily willing to sacrifice individual liberties in the name of 'compromise.'

  • Reason to use end-to-end encryption (Score:5, Informative)

    by DrYak ( 748999 ) on Thursday April 24, 2014 @04:50AM (#46831119) Homepage

    Add this as reason #2'175 on the long list of why one should definitely use end-to-end encryption.

    If you use a well designed end-to-end encryption, that has been validated by cryptologist (think OTR [cypherpunks.ca] for chat, ZRTP [wikipedia.org] for voice), I doesn't matter what the quality of the underlying link is or if telcos are helping breaking the link.

    Best part? These technology can work over your already existing systems (though ZRTP can't work over Skype's voice and video. It only works over SIP or XMPP/Jingle - i.e.: the standards that the whole rest of the internet is using).
    So you can OTR encrypt your chats over your Google Talk's XMPP session.

    And there are clients supporting them either out-of-the-box (jitsi [jitsi.org], adium [adium.im]) or with a plugin (pidgin [pidgin.im]), over your existing accounts (XMPP like Google Talk, or any random SIP provider).

    • Re: (Score:3)

      by Craefter ( 71540 )

      Good idea, it works right up to the moment when it is a crime if you use non-government approved encryption methods.

      • Re: (Score:2)

        by jonwil ( 467024 )

        If I know Tony Abbot and co, there are government law drafters who have been given the task of taking the UK RIP act (the one that lets them send you to jail for refusing to hand over encryption keys) and invent a similar law that fits the Australian system.

        All in the name of fighting "Terrorism", "Child Pornography" (that TV star who recently went down for being a kiddy fiddler will probably be used as an example of the sort of people these laws are intended to stop), "Organized Crime" (bikie gangs, gun vi

        • Jail and keys (Score:5, Informative)

          by DrYak ( 748999 ) on Thursday April 24, 2014 @06:06AM (#46831355) Homepage

          If I know Tony Abbot and co, there are government law drafters who have been given the task of taking the UK RIP act (the one that lets them send you to jail for refusing to hand over encryption keys) and invent a similar law that fits the Australian system.

          To be "jailed for refusing to reveal keys" requires that there ARE EXISTING keys in the first place.

          Modern encryption like OTR and similar are based around "perfect forward secrecy [wikipedia.org]". They DO NOT use stable cryptographic key on purpose, instead they rely on "ephemeral keys" (in the case of OTR, that's DHE [wikipedia.org]).
          There's no real key to be handed over.
          (Also because there's no real key to be handed over, DHE needs to be paired with something else to authenticate guarantee against MITM attacks.
          The web use public keys for that (RSA is a popular thing). In the case of OTR, instead of keys they use "Socialist Millionaire [wikipedia.org], it doesn't rely on any actual key)

          (That's part of the discussion around Lavabit, had they used PFS, they would be able to simply handle their key and switch to newer. The NSA wouldn't be able to decrypt anything with the old keys (if DHE or ECDHE was used instead) and they wouldn't be able to further impersonate Lavabit if the revealed keys was revoked/updated. Saddly Lavabit used classical public key crypto and all communication would have been retro-actively hosed by revealing the key.
          It's also part of the discussion around Heartbleed. If heartbleed has been used to retrieve keys, sites using classical PK would be more compromised than sites using DHE/ECDHE : the former had all they communication retro-actively hosed, the latter can only be impersonated in the future until they leak is discovered and the key revoked/changed)

          Of course, as mentioned by the parent-poster, this is all shiny and nice in the math/crypto world, but...

          it works right up to the moment when it is a crime if you use non-government approved encryption methods.

          The Australian government could make a future law making mandatory to use special forms of crypto, that DO use keys (say bye-bye to DHE/ECDHE or at least ECDHE with a secure elliptic curve) and that require the key to be deposited in a government-accessible escrow (like requiring the password to be transmitted crypted with a government-own public key, or requiring ECDHE with government-compromised curve).

        • Re: (Score:2)

          by rdnetto ( 955205 )

          If I know Tony Abbot and co, there are government law drafters who have been given the task of taking the UK RIP act (the one that lets them send you to jail for refusing to hand over encryption keys) and invent a similar law that fits the Australian system.

          They'd be a bit late.

          -- http://en.wikipedia.org/wiki/K... [wikipedia.org]

    • Re: (Score:2)

      by Znork ( 31774 )

      Isn't google dumping XMPP completely in less than a month?

      • All I've been able to find is that they are removing it from their video and voice chat (hangout, google voice, etc) systems and that they may disable the federation system (allowing google users to chat with non-google users). Do you have any references to them closing the xmpp chat altogether?

        • Bug post from a user using XMPP with Hangout [askubuntu.com]. It works but offline message aren't supported (as Hangout instead use Gmail for history storage).

          I also had a link with a citation from author explaining that hangout is still an XMPP derivative under the hood, but I lost it :-(

          • Other than offline messages, that post seems to imply that they are still using XMPP and that things like OTR encryption should still work just fine.

      • Re:Reason to use end-to-end encryption (Score:4, Funny)

        by wonkey_monkey ( 2592601 ) on Thursday April 24, 2014 @06:18AM (#46831387) Homepage

        Isn't google dumping [insert service here] completely in less than a month?

        Very probably.

      • They are dumping the "Google Talk" brand for their chat and moving to the consolidated "Google+ Hangouts" service.
        That service, according to its authors, works on a modified XMPP.

        Currently:
        - pidgin (and other XMPP users) can log with XMPP even if they switch to hangouts.
        - Google+ Hangouts doesn't accept server-to-server communication (you can only chat with other Google users. You need a separate account, for example @jabber.org, to be able to chat with the rest of the XMPP network) [*]
        - Google+ Hangouts us

        • Extra note:

          One of the things that don't work with Facebook and the new Google Hangout's, namely lack of history, doesn't make that much sens with OTR anyway.
          OTR use ephermeral encryption. There's no permanent key.
          If you access old encrypted history (what would be contained in GMail and visible in the full blown Hangout+ app, for example) there's no way to decypher it, the information doesn't exist anymore.
          (That's the whole point of Diffie-Hellman used in OTR and the whole Perfect Forward Secrecy: there does

    • We used to use paper envelopes with glued or wax seals, and the government guaranteed they would deliver the letter unopened. You could verify both in the era when that was current technology. For the king's spymaster to read your mail, he had to get an order from a judge to authorize it, and employ a fair bit of skill to replace the broken seal or envelope. Similarly, "pen registers" of who you communicated with also required judicial permission, but weren't detectable.

      Over time the technology changed

      • Title: "Letters ~= end-to-end encryption" - We used to use paper envelopes with glued or wax seals, and the government guaranteed they would deliver the letter unopened. You could verify both in the era when that was current technology.

        There's a difference though. In the "wax seal" era you mention, the whole thing still rely on trust. You would need to trust the government, and the government neet to guarantee that the letter gets through unopened.
        The only thing you could hope for is being able to *detect* tampering. Not *prevent* tampering.

        Modern day cryptography is based around a no trust paradigm. The lesser number of people you need to trust, the better.
        (And in the case of OTR, you don't even trust your correspondent. The protocol is

        • Re: (Score:2)

          by davecb ( 6526 )

          I quite agree, the technology changed, and we need to both change with it, and take advantage of it to create stronger guarantees. At the same time, we don't want to depend on a single point of failure.

          I actually think we need a defence in depth. Guarantees offered by an arms-length postal service, technical means of testing the protections, legal protection from the law where the guarantees are breached, and enforcement of the law by independent, arms-lengths police under the oversight of a string cour

          • I quite agree, the technology changed, and we need to both change with it, and take advantage of it to create stronger guarantees.

            And my point of view is that by using decent, suddenly we don't rely on anything else.

            I actually think we need a defence in depth. Guarantees offered by an arms-length postal service, technical means of testing the protections, legal protection from the law where the guarantees are breached, and enforcement of the law by independent, arms-lengths police under the oversight of a string court system. Add to that a technology that makes it impractical for a middleman to leak one's information, and protection against a security service demanding your keys without laying a 20-page "information to obtain" before a non-trusting judge.

            And all this is unneeded in case of good crypto.
            All this would require long pollitical adventure until its finally accepted in law and enacted.
            Meanwhile crypto works as of tofay in the current environment.

            To take again a metaphor: imagine that you want to protect your car against act of vandalism from the government.
            You could either push for the acceptance for a legislation forbiden the government to behave as vandals, and

            • Re: (Score:2)

              by davecb ( 6526 )

              I think we'll disagree on the sufficiency of crypto, but we definitely agree on the necessity!

              Would you say they're ordered? I so I'd want crypto first and laws second, if only because crypto takes less time to write (:-))

    • Two words: network effect.

      I tried switching over my family to an XMPP setup. I installed an XMPP daemon on a home server and made it as easy as I could to get everyone going.

      "Why do I have to do this?"
      "What's wrong with Skype?"
      "This program doesn't look exactly the same, I'm lost!"
      "Oh, you're so paranoid!"
      "If this is so secure, what's this certificate warning about?"
      "Why, are you doing something illegal?"

      Sigh... technology can't fix stupid. Until it "just works", nothing is going to change.

      In their defens

      • Two words: network effect. {...} I installed an XMPP daemon on a home server and made it as easy as I could to get everyone going.

        Baby steps. Having them use an existing facility like XMPP interface to GoogleTalk/Google+Hangouts, or the XMPP interface into Facebook would have been a smaller jump, or the SIP provider to their home telephony (if they use a combined "Internet + IPTV + VoIP" package).
        (Though some would have complained that facebook sticker don't work currently over XMPP)

        Then start handling separately the cryptographic issue.
        (Once everyone is used to have Adium on their Mac to chat with Google Talk and Facebook contacts, i

  • Invading privacy is the crime (Score:5, Insightful)

    by Craefter ( 71540 ) on Thursday April 24, 2014 @04:52AM (#46831135)

    When will common people realize that invading privacy is a crime? Instead there seems to be an acceptance of it being just collateral damage in the war against child porn and terrorists.

    Don't come with "if you have nothing to hide you don't need privacy" tantrum because I think privacy is an emotional necessity for the development of a healthy brain. Too bad so much will have been lost before before the general public realizes what has been lost.

    • That's the excuse that is being trotted out by our lords and masters. In that context, these moves make sense in their eyes. The debate is whether (a) whether the threat is real (b) it's enough to justify the intrusions by the state and (c) whether the state actually achieves anything by these intrusions. All these points are disputable, but it's unfair to dismiss them without consideration.

      • That's the excuse that is being trotted out by our lords and masters. In that context, these moves make sense in their eyes. The debate is whether (a) whether the threat is real (b) it's enough to justify the intrusions by the state and (c) whether the state actually achieves anything by these intrusions. All these points are disputable, but it's unfair to dismiss them without consideration.

        Fact: If a service provider is capable of giving my information to law enforcement when faced with a legally sound and fully justified search warrant, then they are capable of reading my information without any such warrant. Including information that they have no right or justification to access and that is highly sensitive and could be highly damaging to me if published.

      • No, it isn't, because freedom is more important than safety. Whether the safety is real or not is irrelevant; anyone who would sacrifice such fundamental liberties for safety is a coward who is making their country worse.

    • But they're not "invading privacy"! They just want the option to invade privacy at any time. Biiig difference.

    • Re: (Score:2, Insightful)

      by SuricouRaven ( 1897204 )

      Armchair psychology aside, there are implications for political debate even in free societies. It's difficult to campaign for the legalisation of X (whatever X is) if you cannot do so anonymously, because most of those campaigning for legalisation probably do X and so would become targets for arrest. This also applies if X is merely very unpopular, to the point that speaking in favor of it would result in protests, possible violence, boycotting of business, etc.

    • If I had mod points you'd definitely get one. It seems like, over time, people forget why things like this are important. It is worse now because this new privacy invasion is not in your face. No one is pushing their way into your home to rummage through your things. It's invisible, and many people choose not to see it for what it is and for what it will become.

    • When will common people realize that invading privacy is a crime? Instead there seems to be an acceptance of it being just collateral damage in the war against child porn and terrorists.

      Then take the things into your own hands. The technology is already here, it's called "Cryptography".
      Well designed end-to-end cryptography make so you don't even need to trust your government or anyone else.
      And using ephermal key negociation (like DHE or ECDHE) means that there are no key to be handed over in case someone would like to obtain key through coertion.

      Then you don't need to count on government realizing anything about privacy. They can still think whatever they want, they might think that mass s

    • "When will common people realize that invading privacy is a crime?"

      Probably never, the enlightenment was wrong about how the brain worked, see here:

      https://www.youtube.com/watch?... [youtube.com]

  • If they want to have fun decrypting, lets at least give them a worthy challenge ;)

    I send myself files coded with over 10 different algorythms (use of a bash script to automatise crypt/decrypt.
    code is there: https://github.com/jupiter126/... [github.com]

  • feels like (Score:3)

    by arbiter1 ( 1204146 ) on Thursday April 24, 2014 @05:03AM (#46831165)
    Content industry probably behind this.

  • Sounds like they're copying the law here in the UK. Which for a five-eyes country isn't that surprising.

  • www.computerworld.com.au site (Score:3)

    by gnasher719 ( 869701 ) on Thursday April 24, 2014 @05:25AM (#46831221)
    Tried to post a comment on their site without having an account. Got an error 403 (forbidden). In other words, the guys creating their website and/or server software are clueless twats.

    And every company wanting to avoid the fate of Lavabit must just make sure that they don't have the capability to decrypt customers' data. That way, the company and the customer are safe from law enforcement. (Hiring a lawyer at the right time also helps, and sending keys to a court in a 4 point font doesn't).

  • Random data (Score:3)

    by flyingfsck ( 986395 ) on Thursday April 24, 2014 @06:30AM (#46831439)
    No your honour, it is not encrypted data. My friends and I send random data to each other just for fun... z"dy`e"DG"NkOV83,N:
    • Ia! Ia! Cthulhu Fthagn! Ph'nglui mglw'nfah Cthulhu R'lyeh wgah'nagl fhtagn!

    • That should work... but the fact that the court can order you to disclose your password, and put you in jail if claim you don't remember it, kind of makes me think they'll just say "fuck it" and you'll be sitting in prison indefinitely.

      • but the fact that the court can order you to disclose your password, and put you in jail if claim you don't remember it, kind of makes me think they'll just say "fuck it" and you'll be sitting in prison indefinitely.

        Then use modern day crypto like OTR [cypherpunks.ca].

        OTR use ephemeral keys (in this case it's DHE [wikipedia.org]), so there's no permanent key to begin with that could be disclosed (also no retro-active decryption possible. There doesn't exist any piece of information following whose disclosure, law enforcement could suddenly retro-actively decrypt all the intercepted communication that they have logged during the past years).
        OTR use a key-less authentication system (Socialist millionaire [wikipedia.org]), so there's not even an authetication key, and a

        • Exactly, because using software that makes it impossible for you to comply with the law means you get a "Get Out of Jail Free" card, right? Just wait until the bankers get ahold of this idea!

          • Exactly, because using software that makes it impossible for you to comply with the law means you get a "Get Out of Jail Free" card, right? Just wait until the bankers get ahold of this idea!

            But you comply with the law. The law can require a service provider (like Lavabit) to give all the information that they have, even if it means being in breach of contract with their customer apparently. If you can't decrypt the information, then you complied with the law. If you can decrypt information, then you must decrypt it to comply with the law.

            It's like two shops, one with a video camera running and one without. The shop with the video camera must hand recordings over to the police if there was a

            • It's like two shops, one with a video camera running and one without. The shop with the video camera must hand recordings over to the police if there was a crime in front of the camera. The shop without the video camera doesn't need to do anything, and doesn't have to install a camera just in case someone gets stabbed in front of the shop.

              Yup, nice image. The second doesn't have any record to disclose if ordered by the court. There just don't exist any recording that they could hand over. There security relies on some completely different scheme (say, a heavily armed bouncer/guard) which doesn't involve any camera nor any recording.

              OTR relies on a completely different form of encryption (perfect forward secrecy, powered by ephemeral diffie-hellman) that doesn't involve permanently stored passwords.

              • But the law can still require you to permanently store any ephemeral keys. PFS only works if the ephemeral keys are ephemeral.

  • Wanted: Private information refuge. (Score:1)

    by Anonymous Coward

    It's so sad to see my adopted country, Australia, going down the same drain as the country our family sought economic refuge from, England! At any moment, the AFP could break down the door, nick the disk drives, and put me in the clanger until I hand over the crypto passphrases. Information security is under threat in Australia. Knowing my luck, the NSA has read the IP address for this AC post, given it to their Australian mates at the DSD, and the AFP (Australian Federal Police) are on their way with sledg

  • and steal data so they can help their criminal friends on wallstreet to get richer
  • Comment removed based on user account deletion

    • Why not develop and use technology that protects political engagement and democratic paricipation?

      You mean, like modern-day cryptography ?

      Specially things like OTR [cypherpunks.ca] ?
      That have perfect foward secrecy [wikipedia.org], thanks to DHE [wikipedia.org] ? (i.e.: there's no key that could be disclosed to enable decryption of past intercepted communication) ?
      That use authentication through Socialist Millionaire [wikipedia.org] (which is keyless, meaning that there's no way to proof that past intercepted communication is authentic) ?
      Which simply functions as an overlay, meaning that you can use it as up today above any chat system that you currently already have

  • I'm an Australian and I'd be really pissed off if the government opened, read, copied and kept a record of all my mail as it passed through the post office. I'd be just as pissed off if the elite political class did the same to my phone and internet communications. Of course, we can fight back with encryption, steganography etc., but life's tedious enough already.
  • Noooooo!!! Malcolm Turnbull is a bloody inept cunt!! Muh torrents! ~ Perth

Slashdot Top Deals

Solutions are obvious if one only has the optical power to observe them over the horizon. -- K.A. Arsdall

Close