By Xin Ping
At the June 2017 meeting in Ottawa of the Five Eyes — the intelligence alliance made up of the United States, Britain, Australia, Canada and New Zealand — Australia made a point that the states need to find ways to overcome encryption. A joint communiqué came out of the meeting noted that encryption can “severely undermine public safety efforts” and committed Five Eyes members to working with technology companies to “explore shared solutions.”
Before believing that the Alliance's statement is reassuring, think twice. Every one of us needs encryption when buying things online, using social platforms or managing finances. In the digital age, the technology is the last defense of our privacy, which is also the next prey for spy agencies. Back in 2013, Snowden revealed that the U.S. and the UK had tried to weaken encryption to tap digital communications.
Australia has explored a new path in fulfilling its duty as an Eye. Just one month after the meeting, the Australian government announced that it planned to enact laws allowing Australian security agencies to gain access to the private encrypted messages stored by social media and technology companies, like Facebook and WhatsApp. In December 2018, the Parliament of Australia adopted the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill.
The bill set up a legal framework for law enforcement and intelligence agencies to request or compel the private sector to provide cryptographic assistance. But it met unanimous opposition since the day it was introduced. As legal experts pointed out, required assistance could mean providers were forced to modify their products and services by building and introducing weaknesses and vulnerabilities into them, which could then be exploited by the relevant agencies. One key problem is that weaknesses applied to one device may have many number of unintended consequences, including systematic implications on other devices and the whole supply chain.
At the same time, relevant agencies in Australia has gained so much without losing anything. Thanks to the bill, they have more power in data searching and retrieving as well as punishing whistle-blowers. Their arms can now reach any organization or individual that provides communication services for Australia, whether the company, server or place of manufacture is based within the country or not.
More worryingly, the bill would complicate the exact security issue that it claims to address. Cryptography scholars warned,“by weakening all our security so that they can listen in to the communications of our enemies, they also weaken our security against our potential enemies." UN Human Rights Expert Joseph Cannataci said, the "fatally flawed" legislation is not only technically questionable, but "unduly undermines human rights". Lessons learned should not be buried and forgotten. In 2017, a cyber-attack on Microsoft threw the British National Health Service (NHS) into chaos, but shed light on an ugly truth. According to the New York Times, the U.S. National Security Agency (NSA) has been long aware of the system's vulnerability, but decided against disclosing it to Microsoft to fix. The NSA used the unpatched loophole for its own intelligence purposes, while the British patients paid the price.
Personal data intercepted in Australia doesn’t just stop at the borders. The Five Eye nations are regulated by their agreement to share their data “continuously, currently, and without request”, including “raw” data as well as intelligence that has been analyzed. In other words, Australians are not only fully exposed to their own government, but to the four other countries as well.
But why was it Australia that trailed a new path for the Alliance? The answer may be found in its Constitution, which has no Bill of Rights. That gives the country an advantage in carrying out experiments, and reducing the overall cost of the Alliance in obtaining and sharing intelligence.
Since October 2015, 21 Australian law enforcement agencies have had warrantless access to the stored metadata relating to the phone calls, emails, text messages and internet sessions of all Australian citizens. US journalist Glenn Greenwald, one of the reporters who broke the 2013 story on internet surveillance by the U.K. and the U.S., said Australia was "one of the most aggressive countries that engage in mass surveillance as a member of the Five Eyes Partnership".
Indeed, in a surveillance state like Australia, when you watch your phone, your phone has been watching you.