australia phone
Will the new australian telecoms bill allow to compel companies to build spy functionality into their software?
<p>According to <a href="https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf" rel="nofollow noreferrer">https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6195_aspassed/toc_pdf/18204b01.pdf</a> companies could be required to enhance their software to allow for spying. They would enforce this via a "technical 
capability notice".</p>

<p>However, in Section 317ZG (p.84) they should not be compelled to build "systemic weaknesses". What is the difference here?</p>

<p><strong>Changing software to allow spying leads to a weak system, or is it not?</strong></p>

<p>Note: this is not specifically about encryption. This is covered separately in the bill.</p>

<p>Nobody knows.</p>

<p>The relevant parts of the bill:</p>

<h1>317ZG:</h1>

<blockquote>
  <p>(1) A technical assistance request, technical assistance notice or technical 
  capability notice must not have the effect of:</p>
  
  <p>(a) requesting or requiring a designated communications provider to 
  implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection; or</p>
  
  <p>(b) preventing a designated communications provider from rectifying a systemic weakness, or a systemic vulnerability, in a form of electronic protection.</p>
  
  <p>(2) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to 
  implement or build a new decryption capability in relation to a form of electronic protection.</p>
  
  <p>(3) The reference in paragraph (1)(a) to implement or build a systemic weakness, or a systemic vulnerability, into a form of electronic protection includes a reference to one or more actions that would render systemic methods of authentication or encryption less effective.</p>
  
  <p>...</p>
  
  <p>For the purposes of subsections (4A) and (4B), an act or thing will, or is likely to, jeopardise the security of information if the act or thing creates a material risk that otherwise secure information can be accessed by an unauthorised third party.</p>
</blockquote>

<p>So, a company can't be forced to break an encryption algorithm, or introduce a vulnerability that affects everyone equally.  But...</p>

<h1>317B:</h1>

<blockquote>
  <p><strong>systemic vulnerability</strong> means a vulnerability that affects a whole class of technology, but does not include a vulnerability that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.</p>
  
  <p><strong>systemic weakness</strong> means a weakness that affects a whole class of technology, but does not include a weakness that is selectively introduced to one or more target technologies that are connected with a particular person. For this purpose, it is immaterial whether the person can be identified.</p>
</blockquote>

<p>They can be compelled to break the encryption used by a specific person, or introduce a vulnerability into encryption as used by a specific person.</p>

<p><a href="https://en.wikipedia.org/wiki/Key_escrow" rel="nofollow noreferrer">Key escrow</a> could be considered a technology that satisfies both criteria, although it carries the risk that the stored keys could be stolen by an unauthorized third party.  It's up to the courts to decide if this constitutes a "material risk".  There are other techniques that involve installing backdoors for everyone and then only activating a particular backdoor, but they carry the same risk as key escrow, plus the additional risk of independent discovery of the backdoor.  Again, this is something the courts will need to rule on.</p>
