People accessing the internet at McDonald’s and Westfield in Australia could be targeted for surveillance by police under new encryption legislation, according to the home affairs department.
A briefing by the department, obtained under freedom of information, reveals that police can use new powers to compel a broad range of companies including social media giants, device manufacturers, telcos, retailers and providers of free wifi to provide information on users.
The Telecommunications Access and Assistance Act, which passed parliament in December, prompted warnings of legislative overreach, particularly due to the large number of offences with a prison sentence of three years, which bring suspects within reach of the new powers.
Despite warnings from the tech sector it would harm Australian companies and a promise from Labor to amend the law, the re-election of the Morrison government means it will continue in its current form – at least for this term of parliament.
The departmental briefing gives examples of potential targets for technical assistance and technical capability notices, which give law enforcement agencies the power to compel cooperation from “designated communications providers”.
Social media companies including Facebook, search engine Google, equipment providers including the Apple store, cloud computing providers, providers of free wifi including McDonald’s and Westfield, and “any Australian retailer who offers a mobile phone application for online shopping or offers an application for mobile viewing” are named as potential targets.
The Communications Alliance chief executive, John Stanton, said it was “no surprise” to see the “enormously broad range of players” that are classified as communications providers.
“It’s been a concern from day one,” he said. “The only thing consumers will know is if there is a weakness introduced into the system, their provider won’t be able to tell them about it. It’s not something that would readily engender trust.”
Stanton noted the legislation extended to “companies outside Australia”, such as component providers, which would not be familiar with the regime.
The briefing also provides examples of what type of assistance authorities can lawfully require, including: a social media company helping to automate the creation of fake accounts; a mobile carrier increasing the data allowance on a device so surveillance doesn’t chew up users’ data; blocking internet messages to force a device to send messages as unencrypted SMSes; and a data centre providing access to a customer’s computer rack to allow installation of a surveillance device.
Stanton said “one of the more concerning examples is the installation of software on to a network that’s been developed by agencies”.
“The service provider isn’t necessarily going to know what that software is capable of doing, and what risks it presents to the security of its network and its customers.”
The legislation prohibits agencies from requiring a “systemic weakness” be built into products. Stanton noted that although this precludes a weakness in every phone of a particular model, the law suggests if agencies “require installation on every iPhone in NSW – that wouldn’t be a backdoor. But by any sensible construction it would be.”
The briefing states that notices are “not intended to be issued to persons within an organisation” but rather the entity as a whole, attempting to address tech industry fears that individual employees could be forced to assist without informing their employers.
Asio has said it needs the new powers because encryption technology is affecting 90% of its priority cases, harming the spy agency’s capability. The briefing warns that by 2020 most communications will be end-to-end encrypted.
Police are already using powers in the encryption legislation, although the first reported uses have been the threat of higher penalties to coerce criminal suspects to unlock digital devices such as phones.
