mnot’s blog

Design depends largely on constraints.” — Charles Eames

Thursday, 6 December 2018

Australian Assistance and Access Bill 2018: Amendments

Filed under: Australia Politics

In a great hurry, Australia’s house of representatives today passed the controversial Assistance and Access Bill 2018. However, there were some last-minute amendments slipped in. Currently, it’s being debated in the Senate.

I suspect not many people (including our representatives) have had a chance to read them, so I’m going to use this post to try to summarise, based upon a reading since the draft amendments were published early this morning (!) and my existing knowledge of the bill (read this for context).

I am not a lawyer, etc., and I’ve probably missed or misunderstood things. Corrections and proposed additions welcome on Twitter.

I’m only going to focus on Schedule 1 – the part about industry assistance – for now. I’ll be using the (number) notation found to identify individual amendments in the amendments document (PDF), since they don’t provide links to individual items (hint, hint).

General Changes

First, I’ll jump around to cover some non-specific, overall changes in the bill.

Amendment (1) kicks things off by making #aabill Schedule 1 effective the day it receives Royal Assent (i.e., the Governor General signs off), instead of a day that’s Proclaimed sometime in the nine months afterwards.

Amendment (3) schedules the legislation for review by the Independent National Security Legislation Monitor after 18 months of operation.

UPDATE: Penny Wong has submitted some amendments on behalf of the opposition in the Senate, to make the review immediate.

There are a number of changes to require more written records of various actions (too many to list), and corresponding notifications. However, it appears soft; failing to keep records or notify is called out in a number of places as not invalidating these instruments, and there’s this interesting addition in (81):

(2A) Despite subsection 13.3(3) of the Criminal Code , in a prosecution for an offence against subsection (1) of this section, an IGIS official does not bear an evidential burden in relation to the matters in subsection (2) of this section, to the extent to which that subsection relates to subsection (5) of this section.

(2B) Despite subsection 13.3(3) of the Criminal Code , in a prosecution for an offence against subsection (1) of this section, an Ombudsman official does not bear an evidential burden in relation to the matters in subsection (2) of this section, to the extent to which that subsection relates to subsection (5A), (5B) or (5C) of this section.

As I understand it, that means that IGIS and the Ombudsman don’t bear the evidential burden to prove that an exception to the disclosure provisions of this law apply to them. I don’t know enough to say that it’s a get-out clause, but it does seem… odd. If you know why they need this protection, please tell me.

(85) allows communications providers to request authorisation to disclose information about the TANs and TCNs they receive, from the party they received it from.

Finally, way down in (138), a new level of oversight is established as 317ZRB; the Commonwealth Ombudsman may inspect records to determine compliance and write a report – as long as the report doesn’t expose operational activities or methodologies, or prejudice an investigation or prosecution. The report must be tabled in Parliament by the Home Affairs Minister.

When I Use A Word…

A number of the following amendments adjust the definitions in the bill, some with interesting effect:

Jumping down to (89) further refines the meaning of systemic weakness in 317ZG:

(4A) In a case where a weakness is selectively introduced to one or more target technologies that are connected with a particular person, the reference in paragraph (1)(a) to implement or build a systemic weakness into a form of electronic protection includes a reference to any act or thing that will, or is likely to, jeopardise the security of any information held by any other person.

(4B) In a case where a vulnerability is selectively introduced to one or more target technologies that are connected with a particular person, the reference in paragraph (1)(a) to implement or build a systemic vulnerability into a form of electronic protection includes a reference to any act or thing that will, or is likely to, jeopardise the security of any information held by any other person.

(4C) For the purposes of subsections (4A) and (4B), an act or thing will, or is likely to, jeopardise the security of information if the act or thing creates a material risk that otherwise secure information can be accessed by an unauthorised third party.

UPDATE: Penny Wong has submitted some amendments on behalf of the opposition in the Senate; one to rescind the changes in (16), (17), (86) and (90) (I think the intended target was (89)?) and one to rewrite 317ZG completely.

Technical Assistance Requests

Technical Assistance Requests, or TARs, are a polite request to a cooperating provider to share information or a capability they already have; effectively they formalise the relationship and give the provider some indemnity.

Listing the parts that caught my eye:

(23) redefines the relevant objective for TARs to be specific to the party making the request:

(33) adds a new section, 317JC - “Whether a technical assistance request is reasonable and proportionate.” It’s worth highlighting (please excuse some small formatting changes):

In considering whether a technical assistance request or a varied technical assistance request is reasonable and proportionate, the Director-General of Security, the Director-General of the Australian Secret Intelligence Service, the Director-General of the Australian Signals Directorate or the chief officer of an interception agency, as the case requires, must have regard to the following matters:

  1. the interests of national security;
  2. the interests of law enforcement;
  3. the legitimate interests of the designated communications provider to whom the request relates;
  4. the objectives of the request;
  5. the availability of other means to achieve the objectives of the request;
  6. whether the request, when compared to other forms of industry assistance known to the Director-General of Security, the Director-General of the Australian Secret Intelligence Service, the Director-General of the Australian Signals Directorate or the chief officer, as the case requires, is the least intrusive form of industry assistance so far as the following persons are concerned:
    1. persons whose activities are not of interest to ASIO;
    2. persons whose activities are not of interest to the Australian Secret Intelligence Service;
    3. persons whose activities are not of interest to the Australian Signals Directorate;
    4. persons whose activities are not of interest to interception agencies;
  7. whether the request is necessary;
  8. the legitimate expectations of the Australian community relating to privacy and cybersecurity;
  9. such other matters (if any) as the Director-General of Security, the Director-General of the Australian Secret Intelligence Service, the Director-General of the Australian Signals Directorate or the chief officer, as the case requires, considers relevant.

Finally, there are a number of amendments later on that patch in protections against systemic weaknesses for TARs; this seems to have been an oversight in the earlier bill.

Technical Assistance Notices

A TAN, you will recall, is the mandatory version of a TAR; compliance is compelled, but it still has to be a pre-existing capability. Here’s an overview of what’s changed:

(36) adds a really interesting requirement for TANs:

The specified acts or things must not be directed towards ensuring that a designated communications provider is capable of giving help to ASIO or an interception agency.

I think that means that a TAN has to be about a specific case (above in section 2), not just developing a capability for the sake of it.

(38) is a small change with a big effect; the “listed acts or things” for TANs is now a closed set, not an open-ended “include (but not limited to)…”

(39) introduces a requirement for an interception agency of a State or Territory (i.e., the police) to get approval from the AFP Commissioner before they give it to a provider.

(41) gives providers the right to make a complaint about TANs to IGIS or the Commonwealth Ombudsman (depending on who gave it to them). They must be informed of this right.

(43) requires TANs to have an expiry date of no more than 12 months; (44) allows that to be extended with agreement from the provider.

(45) requires that the provider be consulted before a TAN, except when the matter is “urgent” (as determined by the issuing officer).

(50) explicitly includes how intrusive a TAN’s effects are on people whose activities are not of interest in determining whether it is “reasonable and proportionate”.

Technical Capability Notices

Finally, TCNs compel a provider to develop a new capability just for the requesting agency. The high points of changes here include:

(57) is like (38) but for TCNs; it makes the “listed acts or things” a closed set.

(58) removes 317T(8) to (11), which was text that prevented these instruments being used for wiretapping. That seems to have moved to 317ZGA with (91).

While we’re on (91), 317ZGA seems to preclude collecting “addresses.” This seems to be an attempt to reassure people about collecting “Web browsing history.”

(59) requires the Attorney-General to give notice of TCNs to the Home Affairs Minister, and then (62) requires the Home Affairs Minister to tell IGIS or the Commonwealth Ombudsman that the notice has been given.

Like TANs, (63) requires a maximum 12 month expiry on TCNs, and (64) allows them to be renewed, with agreement from the provider.

The original bill required consultation with the provider before giving them a TCN; (68) flips that around so that the provider has to request it in a specified time period. When they do ask for it, (68) specifies that the assessors are appointed by the Attorney-General (one with security clearance; the other an ex-judge), not jointly with the provider, as it was before. The scope of the report by the assessors is much more carefully defined, however.

As with the other instruments, (75) changes the meaning of “reasonable and proportionate” for TCNs to now explicitly include how intrusive they are on people whose activities are not of interest.


Creative Commons