I have spent the last ~2 hours reading the 100 page explanatory document [1], these are some of my thoughts.

The bill pretty explicitely talks about ASIO. I don't think these laws will be used for much less than espionage, or possibly deep corruption cases. For example, right now ASIO dont have the power to remove a computer to inspect it. That actually surprised me (what would not surprise me is that they routinely do this anyway). In many cases I dont see why physical access is required though, I am sure ASIO are capable of hacking most routers/IoT devices, possibly even laptops, just using known methods (are drug-lords really that up to date on L1TF?). The biggest issue I have is that the granting of warrants always comes down to whether some judge or minister thinks its all good. Although, in one of the sub-sections they say the Attorney-General can delegate their powers to a senior ASIO officer, so this is a C-suite level person inside ASIO likely to have these powers (note that they explicitely point out that this person can not further delegate that power, so these decision makers are direct reports to the Attorney General presumably).

On the topic of getting people to give up passwords and/or keys, it says that agencies have "the ability to compel persons" to hand them over... whatever that means. Does "compel" mean, breaking fingers compel? I am pretty sure this is with a warrant.

There are provisioms for situations where evidence may be lost, or other dire circunstances, where they can request things orally and immediately, but they do have reporting requirements around such circumstances.

Probably the most alarming thing is the technical notices. With these, they can basically ask first, but if required - demand - tech companies to add in back-doors. They try to deny it but thats what they are. It is pretty explicit that they cant compel companies to introduce 'systemic weaknesses', so its not about making product wide easter eggs that give you root permissions. I think they mean more like "put a clause in your code that when Dr Evil logs into WhatsApp, and only Dr Evil, it forwards all comms to us." Thats pretty strong power, and not really a systemic weakness is WhatsApp, but most definitely fits the definition of a back door to me. They say companies will be compensated on a 'no loss, no profit' basis. One kind of nice limitation on this is that it will definitely be expensive for ASIO to do this. Companies are in some ways incentivized to restrict their acts to single customers, because if ASIO want to monitor 10 people, well that requires 10x the budget doesnt it.

This was my first time trying to read law. If you read law as code, then law is TERRIBLY written. This amendment is the worlds most ancient pull-request system, putting this into VC would make it much clearer for all involved. There is no concept of a dependency tree, instead other acts are referenced at will and with no version lock to say whether that definition is still current. I suspect there are a lot of regression fails when they write new legislation, unless someone is pouring over all other acts looking for things which reference the act we want to change.

TL:DR; I'm gonna let this go through to the keeper. Writing law is complex. Ultimately it always comes down to, can we trust our government and public institutions, as well as our companies, to do the right thing? How much must we bind ourselves as a society, to ensure that they cannot abuse us? Its tough. I tend to think that the 99% of the people writing these laws, and the officers enforcing them, aren't monsters or evil people - they are my fellow Australians.

[1] https://www.homeaffairs.gov.au/consultations/Documents/expla...