Australia gave police power to compel sysadmins into assisting account takeovers – so they plan to use it
- Reference: 1631595457
- News link: https://www.theregister.co.uk/2021/09/14/identify_and_disrupt_bill_australia/
- Source link:
The law also requires sysadmins to help those account takeovers.
The force (AFP) stated its intentions in light of the late August passage of the [2]Surveillance Legislation Amendment (Identify and Disrupt) Bill 2021 , which was first mooted in December 2020. While the Bill was subject to consultation, few suggestions were incorporated and in August the Bill sped through Australia's Parliament after two days of superficial debate with many suggested amendments ignored.
[3]
As detailed in its [4]explanatory memorandum , the Bill was aimed squarely at helping investigators to act against users of encrypted services.
[5]
[6]
"Cyber-enabled serious and organised crime, often enabled by the dark web and other anonymising technologies, such as bespoke encrypted devices for criminal use, present a direct challenge to community safety and the rule of law," the memorandum states. "For example, on the dark web criminals carry out their activities with a lower risk of identification and apprehension."
Encryption, the memorandum adds, makes it "technically difficult, and time and resource intensive, for law enforcement to take effective action."
The AFP will be relentless in using the law and its powers to remove unlawful content from the dark web and other forums
Australian legislators think local law enforcement agencies need "effective powers of response" that reflect the environment in which they now operate. Those tools were delivered in the form of three new types of warrant, namely:
Data disruption warrants that allow the AFP and the Australian Criminal Intelligence Commission (ACIC) "to disrupt data by modifying, adding, copying or deleting in order to frustrate the commission of serious offences online";
Network activity warrants that "allow agencies to collect intelligence on serious criminal activity being conducted by criminal networks";
Account takeover warrants "to provide the AFP and the ACIC with the ability to take control of a person's online account for the purposes of gathering evidence to further a criminal investigation".
Once the AFP or ACIC have such a warrant – or an emergency authorisation that allows the powers of the law to be used without a warrant – they can compel sysadmins to help.
As the exploratory memorandum explains, once the AFP or ACIC have their warrant they could "become aware of a system administrator who has knowledge of how to access the forum but is not necessarily involved in the conduct on the forum.
[7]
"The AFP or the ACIC could use this knowledge by obtaining an assistance order … and compelling the administrator to assist them by providing access.
"Assistance orders only compel individuals, including the target, to provide access to computers or devices to assist in disruption, in the same manner as a search warrant compels individuals to provide access to a premises to assist in a search," the memorandum states. The orders do not remove the right to freedom from self-incrimination.
Yes, dear reader, if granted those warrants mean the AFP and ACIC can take over an account and delete or modify content created by the accountholder. And if they can't do that themselves, sysadmins are required to assist.
[8]Australian cops, FBI created backdoored chat app, told crims it was secure – then snooped on 9000 users' plots
[9]Australian police suggests app to record consent to sexual activity
[10]Australia rules Facebook page operators are legally liable for user comments under posts
[11]Apple stalls CSAM auto-scan on devices after 'feedback' from everyone on Earth
It's impossible to argue against the strongest possible action against those who create or consume child sex abuse material.
But the new law has found some critics. An [12]advisory report [PDF] written by the bi-partisan Parliamentary Joint Committee on Intelligence and Security offered 34 recommendations – among them that sysadmins who are the subject of an assistance order can't be imprisoned as a way of enforcing the order.
[13]
Australia's Information Commissioner [14]recommended many amendments, most on grounds that the law endangers the privacy of those not targeted by investigations, or could result in the removal or disruption of resources on which users rely.
Those recommendations were largely ignored.
Digital Rights Watch [15]labelled the law dangerous because it is exercised without targets being informed they are the subject of a warrant. Australia's Human Rights Law Centre [16]expressed the opinion that the Bill's powers are "unprecedented and extraordinarily intrusive" and "should have been narrowed to what is strictly necessary and subject to robust safeguards" as the Joint Committee recommended.
CompSci Academics James Jin Kang and Jumana Abu-Khalaf, both of Edith Cowan University, [17]opined that the law could, unhelpfully, see the AFP or ACIC use zero-day exploits to enact warrants – weakening security for all.
A common theme among critics is that Australia already has plenty of laws that allow the AFP to access systems, and even compel service providers to circumvent encryption, making the new law excessive. Another scenario of concern is "forum shopping" whereby investigators could be denied access to use of one law by a judge, so turn to another judge and try a different law that delivers essentially the same outcome.
The AFP seems not to be bothered by the debate: its announcements stated it will "be relentless in using the law and its powers to remove child sex abuse material and unlawful content from the dark web and other forums". ®
Get our [18]Tech Resources
[1] https://www.afp.gov.au/news-media/media-releases/afp-target-child-sex-predators-sharing-abuse-material
[2] https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6623
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YUBy5gIFq6ehNvOlDARgWQAAABU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://parlinfo.aph.gov.au/parlInfo/search/display/display.w3p;query=Id%3A%22legislation%2Fems%2Fr6623_ems_cdf486bc-4c7c-475f-89cb-78af48798af8%22
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YUBy5gIFq6ehNvOlDARgWQAAABU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YUBy5gIFq6ehNvOlDARgWQAAABU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YUBy5gIFq6ehNvOlDARgWQAAABU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/06/08/operation_ironside_anom/
[9] https://www.theregister.com/2021/03/18/consent_app_idea_nsw/
[10] https://www.theregister.com/2021/09/08/australia_facebook_comments_liability_ruling/
[11] https://www.theregister.com/2021/09/03/apple_scanning_pause/
[12] https://parlinfo.aph.gov.au/parlInfo/download/committees/reportjnt/024617/toc_pdf/AdvisoryreportontheSurveillanceLegislationAmendment(IdentifyandDisrupt)Bill2020.pdf;fileType=application%2Fpdf
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YUBy5gIFq6ehNvOlDARgWQAAABU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://www.oaic.gov.au/engage-with-us/submissions/surveillance-legislation-amendment-identify-and-disrupt-bill-2020-submission-to-the-parliamentary-joint-committee-on-intelligence-and-security/
[15] https://digitalrightswatch.org.au/2021/09/02/australias-new-mass-surveillance-mandate/
[16] https://www.hrlc.org.au/news/2021/8/25/insufficient-safeguards-in-new-surveillance-law
[17] https://theconversation.com/facebook-or-twitter-posts-can-now-be-quietly-modified-by-the-government-under-new-surveillance-laws-167263
[18] https://whitepapers.theregister.com/
Re: Tsk tsk tsk
Yes, because, like Australian privacy, its fallen down a well!
Evidence m'lud...
If the police can hack an account willy-nilly, including changing content, then I put it to you that any 'evidence' is planted.
Re: Evidence m'lud...
".................then I put it to you that any 'evidence' is planted."
Which is why they want the law - back to stitching up "crims" who they don't have real evidence about.
How easy will it be to slip a few naughty pics into someone's social media / email account and then bang them away for kiddie porn.
Re: Evidence m'lud...
Stitching up protesters, rival politicians, personal enemies, the inconvenient husband of their mistress ...
The number one way to discredit a whistleblower is to accuse them of a sexual crime.
"Won't somebody think of the sysadmins..?"
I'm all for locking the child porn creatures up forever and cracking down on crims, but once again it's another twang of the Public Heartstrings being used to undermine the security and privacy of the largely-innocent masses.
The grey area around how they will force reluctant sysadmins to 'help' is an area of some concern.
As always...
Lets do it to save the kiddies.
Stepping stones...
...towards law enforcement under the new world order.
Also will be used to enforce religious viewpoints when church and state joins at last, which will happen.
2018, 5 eyes
It stems from the 2018 meeting of 5-eyes, where they decided because "Privacy Is Not Absolute" they could/should backdoor encryption.
https://9to5mac.com/2018/09/03/five-eyes-privacy-encryption/
Sep. 3rd 2018 : "An international network of intelligence agencies has told the tech industry that ‘privacy is not an absolute’ and that the use of end-to-end encryption ‘should be rare’ … The statements were made in a joint communiqué and statement of principles following a meeting of the so-called Five Eyes nations – the US, UK, Canada, Australia and New Zealand."
By mid 2019: AN0M fake encrypted phone, appears to to be a marketing psychop for that. AN0M was a fake encrypted phone used to demonize encryption, it was used to create the perception that encryption = criminal.
https://www.abc.net.au/news/2021-06-15/no-one-in-america-arrested-in-operation-ironside/100213036
"The US court document showed that by the middle of 2019, the FBI decided it needed greater reach. It struck an agreement with an unnamed third country to install a server to download communications from AN0M devices around the world which would then be copied and sent to the FBI."
That unnamed third country? Australia. There are 3 groups in that [developer][distributor][end users].
The [developer] will be the USA given we can now see the court order and can see the driver for this.
These were given to a handful of [distributors], typically criminals that the police thought got off lightly. They were told they could earn a vast amount of money distributing these phones and collecting cash. I also suspect they were told it was legal.
[End users] claimed to be variously 9000-11000, yet the numbers released per-country suggest a far smaller number. I suspect many [end users] were also agents for the spies there to give the initial monetary incentive to the [distributors],
The end-user case details don't match up, you find repurposed arrests, retold with different dates as if they were AN0M cases. It appears to be a marketing operation. AN0M cases would immediately be challenged, the legal basis for that surveillance you wouldn't want challenged in court. The "king-pin" claim criminal fronting it, is a classic baddie who escaped into the dark underworld at the end. It's shit in there.
So they've rolled out their backdoors for trial in Australia and so now there is a legal basis for hacking the world by 5-eyes.
DO NOT USE 5 EYES SERVICES, KIT, ROUTERS, HARDWARE, FIREWALLS, CLOUD SERVICES, PHONES, VPNs, DEVICES, CDNs, bulk internet connections, ANY OF IT. They are ALL backdoored. You cannot rely on any kind of legal process here. Any false belief in judicial process and review is meaningless now, any contracts worthless.
Also, watch what you say online, measure your words, even in private and even with friends.
United Kingdom, next
https://www.theguardian.com/uk-news/2019/jul/30/five-eyes-backdoor-access-whatsapp-encryption
"[July 2019] British, American and other intelligence agencies from English-speaking countries have concluded a two-day meeting in London amid calls for spies and police officers to be given special, backdoor access to WhatsApp and other encrypted communications."
"GCHQ, the UK agency which monitors and breaks into communications, has suggested that Silicon Valley companies could develop technology that would silently add a police officer or intelligence agent to conversations or group chats"
"[Priti] Patel described the summit as “an exciting moment for the UK” and said the UK was “a global leader on national security and child protection and we are committed to working with our close partners on shared challenges”
[So, the psychop marketing for UK will be a "for the children's" thing. For the Australians it was largely "drugs smugglers". I'm expecting you UK fake NGOs will be doing your part, perhaps a new set of front companies pretending to be 'stakeholders'. Lots of fake harrowing stories from your bullshit writers. I'm expecting Priti Patel to be at the forefront of that marketing.]
The core problem: Trump failed Presidency. Barr goes off on an 'attack the messenger' route, where dissent is the problem, dissent is the reason they failed! Critics are the problem, Tik Tok is the problem, people getting together and dissenting from their chosen path is the problem. People stating that Trump got fewer votes so is not the legitimate President is the problem. Democracy is the problem. Speech is the problem. Freedom is the problem. 5 eyes goes into action to eliminate said freedom, back in 2018, and you're seeing the fruits of that attack, blooming now in 2021.
Re: 2018, 5 eyes
DO NOT USE 5 EYES SERVICES
Other governments are watching closely to see what they can get away with.
Assume all equipment is compromised.
Power
When you create a new power, don't look how it can be used for the benefit of population, but how the enemy can use it against you.
Unless Australia assumes people won't elect a government that will use that instrument to silence opposition and become in power in perpetuity. Unless they already are that kind of government.
Scary stuff.
Tsk tsk tsk
What’s that Skip?
You need help with some encryption?