Home Affairs plays down encryption law fears and promises to help industry cover costs

The home affairs department has sought to allay concerns about encryption legislation rushed through parliament at the end of 2018, promising to help pay for the costs of new surveillance capabilities and to consult industry on implementation.

In January the department contacted industry participants seeking help to write guidelines for the new regime of compulsory notices to access the electronic communications of people suspected of crimes or build new capabilities to help break encryption.

The telecommunication (assistance and access) bill passed the parliament in the final sitting week with Labor support due to security agencies’ concerns that encrypted messaging posed an “urgent” threat to law enforcement.

Despite becoming law on 8 December, little is known about the practical application of the new powers because the act prohibits communications providers from disclosing details of law enforcement demands for assistance.

On 9 January, the department’s assistant secretary of national security policy, Andrew Warnes, wrote to industry participants stating that notices could be issued “on an ad-hoc basis, in response to an operational imperative or to deliver a capability to aid investigations”.

He sought to reassure them the laws “are designed to be impact-neutral for providers as, by default, compliance is done on a no-profit/no-loss basis”.

The act contains provisions which state that communications providers do not have to pay the “reasonable costs” of compliance, with costs to be agreed with a negotiator or determined by an arbitrator.

Warnes said the laws are “inherently targeted” because providers cannot be asked to “make the services they deliver less secure for general users or prevent a provider from rectifying any weaknesses they have identified”.

“The legal operation of the measures is expressly cast to disallow activities that would jeopardise wider information security – even if the activity would enable targeted access to the communications of a person of interest.”

Despite the assurances, industry fears that without further amendments to clarify the scope of “systemic weaknesses” – which they cannot be asked to build – the notices to build new capabilities will compromise other users.

Kishwar Rahman, Australian Information Industry Association general manager of policy, told Guardian Australia it will work with the government but its members have “no confidence that the act rushed through parliament at the end of last year will provide sufficient safeguards and protections to the data and communications of everyday Australians”.

“The proposed powers are unprecedented, their remit unnecessarily broad, and the consequences of their use completely unknown,” she said.

Rahman warned that the reputation of Australian industry “will be undermined if Australian hardware and software manufacturers are vulnerable to hacking as a result of constructing new features or modifying existing ones in response to notices issued under the act”.

She said AIIA members will use “all available mechanisms to push back if the overly broad notices impact the security or privacy of their customers”.

Under a deal with Labor, the Coalition amended the law to give companies the ability to dispute a technical capability notice, with a former judge and a person with technical expertise to judge whether a proposed back door is “reasonable and proportionate” or is an impermissible “systemic weakness”.

Amendments clarified that a “systemic weakness” is one that “affects a whole class of technology” but experts such as Patrick Fair, a partner at law firm Baker and McKenzie which represents telecommunications providers, have labelled the definition a “nonsense”.

AIIA will make a submission to the parliamentary joint committee on intelligence and security, which is still considering the law, calling for a judge’s consent before a technical assistance or capability notice can be issued, as proposed by Labor.

Labor’s amendments would also clarify that a “systemic weakness” is one that “would or may create a material risk that otherwise secure information would or may in the future be accessed, used, manipulated, disclosed or otherwise compromised by an unauthorised third party”.