Australian Law Enforcement Now Forcing Service Providers To Grant Access To Data And Content
We all know the term football," but our definitions vary greatly. For those in the United States, it's a sport that delivers beer ads and concussions with similar frequency. For most of the rest of the world, it's a sport that delivers riots and tie scores with similar frequency. In Australia, the definition doesn't necessarily follow the description. Football" is still soccer," but the sport most resembling football is called rugby." And that sport's resemblance to American football is negligible at best. Rugby most resembles competing gangs of muggers fighting over an overvalued football-esque ball with the intent of securing it and doing things that somehow cause points to happen.
Thank you for coming to my inaugural - and final - TED talk.
This introduction is meant to draw you in so I can talk about something far less violent, but no less important, than world sportsball. [Gestures vaguely.] We're talking about Australian rules" internet. This would be the same internet most of us use. Connections are made. Information spreads. Some of it ends up on personal devices (like cell phones) and IoT doodads (Pelotons, thermostats, in-car navigation systems). Origination and destination are pretty much beside the point. Wherever it is, the Australian government wants access to it.
Perhaps due to its antipodean isolation, the Australian government has made incredible inroads in recent months with the intent of undermining the encryption that protects millions of its citizens from criminals and the shady people they've elected. That's mostly gone now. The Australian government (technically) hasn't demanded encryption backdoors. Instead, it has demanded the next best thing: on-demand access to content. If this demand results in a backdoor, well, the government can hardly be blamed for the actions of platforms and service providers. All the government did was demand access to content. That it's locked up and requires the use of a possibly-universal key can't be the government's fault, right? Maybe these companies shouldn't have worked so hard to protect the information and communications of criminals while providing the same protections to the 99.5% of non-criminals that make up their user bases.
The Australian government has a bunch of new powers - ones the federal police were immediately willing to take advantage of. On top of that, there are a raft of new data retention demands being placed on all sorts of tech companies and providers that require them to log user info they may never have logged or retained in the past.
It's bad. And here's how things are working out for Australians now, as Chris Duckett reports for ZDNet.
When it comes to Australia's encryption laws, two out of the three arms can now be publicly said to have been used, following the release of the Telecommunications (Interception and Access) Act 1979 - Annual Report 2020-21 this week.
In previous years, agencies had only used voluntary Technical Assistance Requests (TAR) to get service providers to help them, but the latest report shows NSW Police in the past year also turned to the first of the compulsory notices available.
That request, used in a homicide investigation, is the first use of a compulsory Technical Assistance Notice (TAN) to force a provider to use a capability they already possess. Assistance notices issued by state-level law enforcement are reviewed by the Commissioner of the Australian Federal Police (AFP).
The Australian government is done asking. Now, it's telling. The government may have eased into its new powers by asking providers to voluntarily" comply with assistance requests, but now it's exercising its compulsory side. Maybe too many Bartelbys are employed at local tech companies. Maybe the government is simply tired of asking for compliance. Whatever the case is, we can probably expect Australian law enforcement to be far less polite in the future when it's seeking information, data, or communications from tech companies.
Requests and demands for data under the new law are funneled through the Administrative Appeals Tribunal. This court has issued 2,900 of the 3,500 warrants under this law, as ZDNet reports. But it appears the agency that acquired the first ever compulsory demand isn't the most reliable of Australian law enforcement agencies. The New South Wales police seems particularly terrible at exercising its new powers, racking up a hit rate that approaches that of unsolicited junk mail.
Of the AAT member number, just shy of 1,700 warrants were applied for by NSW Police with the force only getting 72 from Federal Court judges. Similarly, the AFP had 590 warrants approved by AAT members from its 653 total.
That's not encouraging. While this request may have targeted a serious crime (homicide), the NSW Police's scattershot approach suggests it's trying to turn this supposedly limited power into an all-purpose investigative tool. Fortunately, it appears the Appeals Tribunal is still acting as a solid check against NSW Police abuses.
That being said, the ZDNet article notes it's not terrorists, murderers, and child abusers being targeted with the new powers. Contrary to what was orated during arguments for proxy encryption backdoors, the new powers are mainly being used to tackle the most banal of criminal activity: drug offenses." This is the kind of crime law enforcement has fought for years without the need for encryption backdoors.
Even disregarding the open question of effectiveness of the multi-decade drug war, was it really necessary to give the government the power to demand encryption backdoors to combat it? That it's being used to do regular police work isn't surprising. And neither is the fact that the law's advocates presented an entirely different parade of horribles when pushing for the legislation. But what should be happening now is the calling out of this particular bullshit by legislators who opposed the new powers. And this calling out should be loud, frequent, and persistent. The government shouldn't be allowed to get away with crying terrorism!" just so it can use new powers to do regular police stuff.