Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697641700576.pdf (Australia)
Members of the Parliamentary Joint Committee on Intelligence and Security.

Thank you for the opportunity to provide supplementary submissions to the Committee.

I would like address some of the evidence given previously during the October 19 hearing.
Before doing so, I’d like to state that I respect those who have given evidence to the Committee so far, and although I strongly disagree with many of the points that were presented by the members of law enforcement, that doesn’t detract from my appreciation of the work that they do.

I would like to thank them for their ongoing efforts in keeping all Australians safe.

Before I address specific comments or evidence given in the first hearing I’d like to address an overarching concern.
The conversation, and the general “sales pitch” of this Bill has been about terrorism and child sex offences.

I find this slightly disingenuous.

Not because I’m questioning the motives of those who have given evidence, but because the Bill, in its current form, is far too broad and it encapsulates almost any offence.

The kind of power law enforcement will be granted, should this Bill be passed, should only ever be used for the most serious of offences.
In fact, the Bill should explicitly state which offences the Bill would apply to.

However, at the moment, it gives law enforcement a blank cheque in regards to how they can apply these new powers.

The Bill should not use the term “national security” as it is also far too broad and open to interpretation.

I will return to this point on numerous occasions throughout this submission.
I’d like to start by addressing the consultation process, as I know the Committee were eager to So a detailed and comprehensive consultation learn if this was adequate.

Mr Hansford stated: “ process was undertaken over many, many months ”.

Unfortunately I cannot directly comment on ​ whether the process prior to the Bill being introduced was adequate, although from all evidence given in the first hearing, and based on the submissions, it appears as though it wasn’t.
Most of the larger tech companies who made a submission have been highly critical (some scathing) of almost every aspect of this Bill.

Privacy advocates too have been critical.

It therefore stands to reason that the initial consultation process was inadequate.

I am, however, in a position to comment with certainty in regards to what took place after the Draft Bill was released to the public in mid August 2018.

The public consultation process lasted less than four weeks.
This is not an adequate amount of time to authentically engage with the general public given such a complicated Bill.

This leads me to my next point.

Mr Hansford stated: “ We received 15,000-odd submissions.

The majority of these submissions were formulaic in their response.

They were in ”.

I take serious offence response to surveys whereby you copy and paste submission responses ​ to this statement for the following two reasons.

Democracy is all about what the people want.


A small amount of people within Australia have been made aware of this Bill, and yet, of those who are aware, a large percentage of them have opposed it.

It shouldn’t matter how they’ve expressed their opposition / concern, it should only matter that they did so.

Disregarding the concerns of the people because their responses were “ process.

Further to this, and my second point, writing a detailed response takes time.

Time a lot of people simply do not have.


They want to be heard, but simply cannot engage on a level that ministers and department heads can.

I wrote a detailed response to the Home Affairs ” goes against the democratic formulaic ​ Review of the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018Submission 28 - Supplementary Submission ​ ​ ​ Department, and made a submission to this Committee and both took hours upon hours of my time.
I don't then have to get another warrant once I get to the Much of the talk of the first proceeding was based around the issue of warrants and authorisation of law enforcement to enter premises and search for evidence of a crime.

Mr Colvin of the Australian Federal Police used an example of arriving at the premises of a suspect with a warrant and being faced with a difficult door or safe and asking a trained locksmith to assist in opening the lock.

He stated: “ front door before I open the door.


At the moment, though, what we are proposing here and what some of these submissions are suggesting is that's what we should do ”.

The reason that the ​ submissions are suggesting that warrants (one issued by a judicial officer) be required for both TANs and TCNs is because they are, in fact, granting law enforcement with new powers.

Even if the assertion by Mr Colvin is that “ ”.


As a software developer, I These powers are not new ​ respectfully and strongly disagree.

Although I feel comparing locksmiths in the physical world to software / hardware developers in the digital world is fundamentally flawed, I will continue with that example to make my point that these powers are, indeed new.
In the locksmith example, this Bill would not only allow law enforcement to ask a locksmith with help opening a difficult lock, but would grant them power to approach a lock manufacturer (e.g.
Lockwood), and force them to manufacture a new lock (one they never intended to make as part of their product line) with security vulnerabilities, install it at the premises of a suspect (or even offer it as a new product to all consumers), forbid them to discuss this newly created lock or face jail time and fines, and finally, should they refuse, they could again face jail time and fines.

Given that simple example, it’s difficult to see how the powers that this Bill grants, are “not new”.
To further this point, I’d like to reference a comment made by the Chair in the previous Committee hearing.

“ point was that the legislation itself does not undermine the warrant regime which underpins our interception legislation, as it stands.

Any request for assistance must first have a warrant, and so, therefore, it must be targeted.

” This statement, while true, doesn’t address the fact that the ​ powers that this Bill does grant, are so broad, it devalues the whole warrant process to begin with.
In my previous submission (Submission 28), I provided multiple examples of just how difficult it would be for small and medium sized software and hardware developers to comply with both TANs and TCNs.

As a result of this, if this Bill were to become legislation, I would urge this Committee to ensure that each time a Technical Assistance Request, or a Technical Capability Notice is issued, it requires a warrant issued by a judicial officer.
Doing so would allow the company being issued to present a counter argument for why they shouldn’t be required to fulfil the Request / Notice.

The reason for this is simple, there are technical details required to understand the system / software / hardware that the individual tasked with issuing a Technical Capability Notice will simply not understand.

As Mr Colvin stated: “ cooperatively with industry because we know that nobody knows their systems better than they do ”.
Breaking encryption (or writing any type of software for that matter) is not as simple as ​ flicking a switch or breaking into an off-the-shelf lock, it’s complicated at the best of times, it’s time consuming, it carries with it financial expenses, and above all, the Bill grants the power to legally compel someone to write software (or develop hardware) they never intended to.
In my role as a software developer, I have spent months on projects that management assumed We want to work My Review of the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018Submission 28 - Supplementary Submission ​ ​ ​ ​ would take only a short number of days.

These gross underestimations are made by managers who know the systems I work with and their constraints.

They certainly know it better than a superintendent does.
This is why the number of law enforcement agencies who can issue Notices should be low, the types of crime they can be issued for should be specific, and the type of services providers / software companies should be minimal.

I’d like to draw your attention to something I said earlier in regards to the scope and areas in which this Bill should be applied.
Mr Lewis of the Australian Security Intelligence Organisation stated: “ I remind you that ASIO with the assistance of partners, particularly police, have disrupted 14 terrorist attacks since 2014.

Our insights into around half of these investigations relied heavily our ability to access the communications of would-be terrorists.

But now, due to the diminishing capability and without the assistance of this legislation, ASIO cannot maintain this level of assurance in our ability to thwart attacks ”.
Mr Colvin of the Australian Federal Police ​ Serious criminals, including terrorists and child sex offenders, are using technology to stated: “ prevent police from using the powers granted by the parliament to lawfully access criminal communications.

Right now, as we have reported, over 90 per cent of data that is lawfully intercepted by the AFP uses some form of encryption ”.

I do not doubt their assertions here that ​ encryption is being used more regularly by those who wish to do us harm.
However, what this statistic fails to mention is that more and more Australians are using encryption when communicating.

These numbers are not specific to suspected terrorists.

Apple’s iMessage is end-to-end encrypted by default.

Whatsapp messages are also encrypted by default.

This just highlights what our society currently values most, privacy.

It also highlights the inherent risk of breaking strong encryption, it will harm everyday Australians.
In addition, if the primary areas of concern for both ASIO and the AFP are in regards to child sex offenders and terrorists (as clearly stated above), why is this Bill so broad?

Why is almost every single type of crime accounted for in the Bill’s text?

The discussion and the way this Bill has been spoken about by law enforcement and the Home Affairs Department has focused solely on terrorism and child sex offences, and more recently, as a result of terror incidents, has been called “ legislation.
But the Bill strays so far from those two things in its text, that it could be used for any crime that a law enforcement department saw fit.

Should this Bill pass, it needs to be explicit in the areas and crimes in which it can be applied.

The areas should be explicitly stated as solely terror related offences and child sex offences.

In addition, the term “national security” should be excluded, as it is open to interpretation.
The Bill should also limit the number of agencies who can request a TAN and a TCN.

” urgent ​ I’d like to address the discussion around mass surveillance by responding to questions and statements made during the first hearing on October 19.

Firstly, I’d like to respond to the following question by the Chair of the Committee.
CHAIR: “ bill operate outside our current warrant regime, which would prevent what people have said in the media—that this is somehow going to enable mass surveillance of the Australian public; is ” In response I’d like to compare this Bill to the Telecommunications that a fair comment?

​ (Interception and Access) Amendment (Data Retention) Bill of 2014.
And how, in 2014 and 2015, we were sold on the idea that the Bill was a way for law enforcement agencies to access My question is: at no point does this Review of the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018Submission 28 - Supplementary Submission ​ ​ ​ ​ the data of terrorists and those involved in serious crimes.

However, based on data released by the federal government in 2017, it is clear that this is simply not the case.
In less than one year after its introduction, metadata was requested 57,166 times.

Of those requests, only 4454 (or 7.7%) were for investigating terror related offences.

Less than 8 percent.

Terrorism was cited as one of the driving factors when the Bill was introduced and being considered by the Parliamentary Joint Committee.

Now, in 2018, we have learned that telecommunication companies are receiving approximately 1000 requests for metadata each day.

That’s 365,000 requests each calendar year.


My assumption (based on current data and trends), is that this number will continue to grow year on year.

Mass surveillance was of great concern when the Bill was introduced in 2015.

However, we were assured by government and law enforcement that the Australian people had nothing to worry about and mass surveillance wouldn’t occur.
Given what we know now, and how the previous legislation is being used, it’s hard not to see the parallels between the Telecommunications (Interception and Access) Amendment (Data Retention) Bill of 2014 and the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018.

Additionally, it’s hard to see this Bill not resulting in further surveillance of the Australian people.

Secondly, I’d like to respond to Mr Lewis of the Australian Security Intelligence Organisation.
He stated: “ I want to make some remarks around what I think is some misinformation that has been floating around with regard to mass surveillance and back doors.

I want to assure the community that this is not a case of ASIO seeking to intercept and/or collect communications on Australian citizens en masse.
Again, I remind you that, as the Director-General of Security, I am committed to protecting the democratic principles we enjoy in Australia and I want to assure the public that ASIO has no interest in and, more importantly, no capacity to—and we certainly don't have the legislative basis to—undertake what is commonly ”.

My question to Mr Lewis is, if this is the case, why is this Bill referred to as mass surveillance ​ so broad?

Mr Lewis continued: “ Let me give you a sense of the scale.
The proportion of data that ASIO is interested in is very, very small.

ASIO's current digital data interception collects and accounts for less than 0.003 percent of the total volume of data downloaded by all Australians.

”.
”.

If this Bill is intended to be targeted to This is an infinitesimally small amount; it's very targeted ​ those who are trying to commit serious terror related offences, why is the Bill’s text so broad, yet the examples given as to how this legislation will be applied are always so specific?

If there is ”, let’s limit the scope of this Bill.


When the threshold for en masse genuinely no intent to survey “ ​ getting a warrant (one not issued by a judicial officer) is low, mass surveillance becomes easier and the norm.

Therefore I feel it is wrong to claim that this Bill will not enable greater surveillance, or, it will, at the very least, lead us to a future where surveillance continues to increase.
Because of this, if this Bill should pass, my recommendations would be as follows: judicial warrants should be required each time a TAN or a TCN is approved, the crimes they are allowed to be used for should be extremely limited, the types of software and hardware a TAN / TCN can be applied to should be clearly defined, and finally the agencies who can request them should be low.

During the October 19 hearing, there were a number of questions around trying to define exactly what a systemic weakness is.
However, I feel this question, given the broad new powers this legislation will grant, is missing the point of the backlash this Bill has received.

The reason for Review of the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018Submission 28 - Supplementary Submission​ ​ ​ To maintain a safe and secure online the backlash is actually very clear.
Mr Colvin states: “ environment, the bill explicitly prohibits the AFP from using this new framework to force providers to create a systemic weakness in any form of electronic protection.

What is proposed ”.

If this is the case, why isn’t the Bill is a case-by-case solution to specific technical challenges ​ more specific?
As it currently stands, it is open ended, grants new powers (see locksmith example above), and can be applied to almost every crime and enacted by almost every single law enforcement agency in the country.

This doesn’t equate to a “ equates to a blanket legislation that can be abused if there aren’t enough safeguards in place.

This is frightening and of great concern.

There are simply no specifics in this Bill.


Once again, I draw your attention to what I stated above in regards to how many times metadata is being requested from telecommunication companies each day.

It won’t matter how specific each “ ” request is, if there are thousands upon thousands of requests made each year.

case-by-case ​ If this Bill passes, it must set very specific limitations and parameters on how it can be used, for what types of crimes, and who can request a TAN / TCN.
Additionally, the types of service providers that can be asked to respond to a Technical Assistance Request or a Technical Capability Notice should be very limited and explicitly stated.

”.
”.

It’s case-by-case solution ​ Although the following quote pertains to censorship, it encapsulates my position and along with my other concerns, highlights one of the major issues with this Bill: “ That's been the tactic of censors for centuries: they start with someone who is so utterly hated and marginalized that everyone is blinded by their hatred for the first censorship target that they cheer, and forget that ” they're endorsing a principle and power that will then expand.
​ Respectfully, In closing, I would like to highlight the following.

Firstly, numerous Bills and pieces of legislation in regards to security / technology have piqued my attention over the years, however, this is the first time I have felt absolutely compelled to make multiple submissions to this Committee.

That alone shows how dangerous I perceive this Bill to be and how serious I take the consequences that may arise should this Bill be passed, and particularly, should it pass in its current form.
During the 19 October Committee public hearing, the Chair of the hearing stated: “ we're not a communist regime ” when the topic of banning suppliers of 5G infrastructure was ​ mentioned.

While I agree, we are far from a communist regime, I believe this Bill doesn’t just straddle the fine line between government surveillance power and citizen privacy, it oversteps it dramatically.
And more importantly, we have no way of knowing how the powers this Bill grants to law enforcement and government will be used by future governments, and people in power.

In the weeks since the first public hearing, there has been one terrorist attack carried out, and another foiled.

It has been suggested that had this Bill been in place, that these incidents would not have happened.

If that were the case, prior to encryption being readily available, there would have been no terror attacks.
The statistics simply don’t bear that out.

Had this legislation been in place and the incidents still occurred, what then?

Further legislation?

More laws?

More power?

Let’s not panic and use these incidents as a reason to rush this Bill through parliament and into law, as there is no way to guarantee that any law, no matter how aggressive or invasive would stop every attack.

There is no silver bullet (legislation included) to stop terrorism, and even if there was, this Bill certainly isn’t it.
Finding the right balance is important, and I urge this Review of the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018Submission 28 - Supplementary Submission​ ​ ​ ​ ​ Committee to take note of this when considering this Bill and the new powers it grants.
The burden this Bill will place on software developers and hardware manufacturers, the privacy implications it will have for every Australian citizen, and the danger it brings by breaking strong encryption vs the lack of guarantees that it will actually be effective in helping stop future terror attacks, means the balance, as it stands, is wrong.

Because of this, I urge this Committee to reject this Bill wholesale.
Thank you Review of the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018Submission 28 - Supplementary Submission