Are Australian legislators really that clueless? There seems to be a very strong incentive against making business with Australian companies.
The words "highly unlikely", however, do not really mean anything and the argument falls down.
Besides that part, most of their text seems quite honest, clear and compelling. Βut I would appreciate that they delve precisely into these "highly unlikely" cases.
They could always decrypt your data. They don't need to add a backdoor, because they've always had full access. Nothing changes at all.
The crucial point of the post concerns the possibility that fastmail developers are forced to introduce secretly a government backdoor. This possibility is briefly dismissed as follows:
> There are also concerns that individual employees may be forced to build a backdoor, without being able to alert their employer. While frightening for anyone working in technology, we believe this fear is largely unfounded [1]. Most organisations have practices (pair programming, code reviews, risk evaluations) that would reveal such behaviour quickly.
The only reason given for the word "unfounded" is an article on zdnet [1], that explains the reasons why these backdoors are unlikely (but does not rule out the fact that they are possible). The word "unlikely" comes from the title of this article.
[1] https://www.zdnet.com/article/australias-encryption-laws-are...
First, compare practical law impacts if you look elsewhere. For example, in the US the gov can get email from providers that's more than 180 days old without a warrant.
Second, Fastmail like Google, Microsoft, and most others has access to your email. They comply with court orders for email like other providers. Fastmail has noted the gov doesn't need a backdoor to get to email. Same with other companies in other countries.
Email shouldn't be used for things that are particularly private to begin with.
To begin with, governments should not be able to access your non-particularly private stuff without an explicit court order.
With a warrant signed by a judge. Also, if the keys are on your device the service has nothing to turn over. The court can't force the provider to engineer in a backdoor.
None of those checks or limitations apply in Australia.
https://en.wikipedia.org/wiki/Protect_America_Act_of_2007#3....
Most people don't include national security investigations in their threat model. The more general risk is a court allowing the executive to cast a broad net to collect information rather than accounts known to belong to targeted, named individuals or groups.
That was the point of this thread.
The Australian law is broader and contains fewer checks than anything comparable in the developed world. It lets law enforcement compel, with no oversight and in secret, any Australian "to re-engineer software and hardware under their control, so that it can be used to spy on their users" [1]. (Australia has no bill of rights [2].)
The American analog is an intelligence agency getting a national security letter [3] stamped by a FISA court [4]. The order can compel disclosure of information on hand, but cannot compel a product to be re-engineered [5].
[1] https://www.eff.org/deeplinks/2018/12/new-fight-online-priva...
[2] https://www.nytimes.com/2018/09/04/opinion/australia-encrypt...
[3] https://en.wikipedia.org/wiki/National_security_letter
[4] https://en.wikipedia.org/wiki/United_States_Foreign_Intellig...
[5] https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute
OTOH this could be unnecessary at large American companies because the needs of national security services may have been engineered in. Thinking of Room 641A [1], etc.
That's voluntary co-operation. The situation is far from perfect in the United States, but Australia is an extreme case.
Not if you’re Ladar Levison running Lavabit in 2013. He opted to shut down the service instead of complying: https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
I moved my addresses over to my own domain (lyndsysimon.com) many years ago, way back when I was still using gmail as my provider. I've since switched a couple of times, and have never had to change my address.
These days I use Protonmail. I like it for what it is, and it checks all of my "privacy" boxes, but the search functionality leaves much to be desired. I understand the technical limitations that constrain that, but I still wish there were more options.
I do not really care about my personal case, here. But I try to maintain a (some say exaggerated) consistency in "paying with my wallet" according to my principles. Since the Australian government provisions seem an unacceptable betrayal to its citizens, the only way that I can make some pressure in favor of them is by visibly boycotting Australian tech companies. If I were an Australian citizen concerned with the AABill I would certainly appreciate this gesture. My fastmail account is just a 80 EUR/year epsilon amount which will not affect the economy in the least. But it is symbolic gesture in the right direction.
I am still undecided on dropping my fastmail account. But if I do I'll try to make as much noise as possible regarding the reasons.