Authorities would need a fresh warrant before ordering companies to assist or build a new capability to access electronic communications
Industry groups including the representative of tech giants Facebook, Google, Twitter and Amazon, have backed several Labor amendments to the government’s encryption bill.
Under Labor’s plan, law enforcement agencies would require a fresh warrant before ordering tech companies to assist or build a new capability to access electronic communications and the bill’s prohibition against creating a “systemic weakness” would be strengthened.
Those amendments were backed in a submission signed by the Communications Alliance, Australian Industry Group, Australian Information Industry Association and Digital Industry Group Inc, which represents the international tech giants in Australia.
The industry groups also warned that new spying powers could be accessed to investigate “relatively minor offences”, and called for the threshold to be raised from offences punishable by three years in prison to those with a maximum of at least seven years.
Although the Telecommunications (Assistance and Access) Act passed parliament in the final sitting week in 2018, the joint standing committee on intelligence and security will continue its scrutiny of the law.
Labor passed the bill with government amendments in the Senate, putting its own improvements on the back burner after the Coalition won a high-stakes game to force the bill through before summer.
The industry groups said it was clear government amendments were “drafted in haste” and were distributed only in the early hours of 6 December, the day the bill passed.
“Almost inevitably, there remain, in our view, significant problems with the amendments and other elements of the legislation,” they said.
The industry groups warned that Australian companies might now have difficulty exporting their products, and international companies would be wary about entering the Australian market, “making both Australian businesses and government agencies vulnerable to cyberattack and data breaches”.
Under the current law, agencies require a warrant or other authorisation to intercept electronic communications but do not require an additional court order to issue notices that can force tech companies to spy on their own users or build capabilities to crack encryption.
The industry groups argued this level of oversight was insufficient and it was “only appropriate that the far-reaching powers granted by the legislation are supervised by an eligible judge”.
Government amendments have clarified that a systemic weakness – which companies cannot be asked to build – is one that “affects a whole class of technology, but does not include a weakness that is selectively introduced to one or more target technologies that are connected with a particular person”.
The industry groups labelled this definition “difficult to understand, ambiguous and … significantly too narrow”.
They backed Labor amendments, which prohibit actions which “would or may create a material risk that otherwise secure information would or may in the future be accessed, used, manipulated, disclosed or otherwise compromised by an unauthorised third party”.
The industry groups argued that many safeguards can be sidestepped by law enforcement agencies labelling a request “urgent”, warning that is “something that it is easy to imagine agencies would almost invariably do”.
They also cited concerns the law creates loopholes that allow agencies to mandate metadata retention, warning that if the new encryption bill powers are used law enforcement agencies may not need a special warrant to access journalists’ metadata.
They concluded that the law needed further amendment to “ensure that the legislation does not weaken existing cybersecurity structures, that it balances security and privacy considerations and minimises unintended consequences”.
The Coalition has promised to consider Labor amendments to the bill, but the attorney general, Christian Porter, has questioned whether they “genuinely reflect the recommendations of the parliamentary joint committee on intelligence and security”.
The Communications Alliance chief executive, John Stanton, said he “[looked] forward to the government honouring its public commitment to have further amendments considered, in the interests of the cybersecurity of all Australians”.
The Ai Group CEO, Innes Willox, said the legislation was “poorly understood”.
“It is urgent to minimise and clarify these impacts through sensible amendments and engagement with the wide range of affected industries,” he said.