Subject: [Mtgvenue] Australia and its encryption laws

From: Jay Daley <[email-masked]>
Date: Thu, 10 Jun 2021 15:03:17 +1200

In response to our recent consultation on three possible venues in Australia, we received the following comment:

> Australia has the most draconian anti-encryption laws in the developed world, perhaps in the entire world.
> 
> See, for example, this BBC piece which explains that the government can require access to *all* material,
> and strong encryption is effectively illegal:
> 
> https://www.bbc.com/news/world-australia-46463029
> 
> If we meant what we said in RFC 1984 I don't see how we can meet anywhere in Australia.

I would like to know if the community agrees with this view and that Australia should be excluded as a potential meeting country so long as these laws are in place.

Jay

-- 
Jay Daley
IETF Executive Director
[email-masked]

---

From: Adam Roach <[email-masked]>
Date: Wed, 9 Jun 2021 21:08:52 -0700

While I agree in principle that going somewhere with terrible encryption 
policy is bad optics, I fear the practicality of extending this 
principle to all countries with similar flaws regarding cryptography is 
likely to require either drawing an arbitrary and ever-shifting line 
between which laws are okay and those which are not, or limit us in 
upcoming years to meeting on one of the few areas of terra nullius 
remaining within theoretical reach (e.g., Antarctica, the moon, Mars, 
and some small pockets of unclaimed land near Egypt and near Croatia).

https://cpj.org/2021/05/uk-online-safety-bill-raises-censorship-concerns-and-questions-on-future-of-encryption/

https://www.judiciary.senate.gov/press/rep/releases/graham-cotton-blackburn-introduce-balanced-solution-to-bolster-national-security-end-use-of-warrant-proof-encryption-that-shields-criminal-activity

https://www.gadgetsnow.com/featured/how-indias-demand-for-whatsapp-traceability-is-in-line-with-what-us-australia-canada-and-others-are-already-working-on/articleshow/83026161.cms

The top-line issue is that cryptography is under legal attack all over 
the world, and it may rapidly become untenable to avoid governments who 
have made citizen surveillance a priority over citizen privacy. Folks 
here who do or can do policy work definitely have a role to play in 
shaping what the future looks like, but I don't think it would remain 
tenable for our meetings to avoid all the places that governments are 
making these decisions.

/a

---

From: John C Klensin <[email-masked]>
Date: Thu, 10 Jun 2021 01:08:13 -0400

--On Wednesday, June 9, 2021 21:08 -0700 Adam Roach
<[email-masked]> wrote:

> While I agree in principle that going somewhere with terrible
> encryption policy is bad optics, I fear the practicality of
> extending this principle to all countries with similar flaws
> regarding cryptography is likely to require either drawing an
> arbitrary and ever-shifting line between which laws are okay
> and those which are not, or limit us in upcoming years to
> meeting on one of the few areas of terra nullius remaining
> within theoretical reach (e.g., Antarctica, the moon, Mars,
> https://cpj.org/2021/05/uk-online-safety-bill-raises-censorshi
> p-concerns-and-questions-on-future-of-encryption/
> 
> https://www.judiciary.senate.gov/press/rep/releases/graham-cot
> ton-blackburn-introduce-balanced-solution-to-bolster-national-
> security-end-use-of-warrant-proof-encryption-that-shields-crim
> inal-activity
> 
> https://www.gadgetsnow.com/featured/how-indias-demand-for-what
> sapp-traceability-is-in-line-with-what-us-australia-canada-and
> -others-are-already-working-on/articleshow/83026161.cms
> 
> The top-line issue is that cryptography is under legal attack
> all over the world, and it may rapidly become untenable to
> avoid governments who have made citizen surveillance a
> priority over citizen privacy. Folks here who do or can do
> policy work definitely have a role to play in shaping what the
> future looks like, but I don't think it would remain tenable
> for our meetings to avoid all the places that governments are
> making these decisions.

Adam,

It is a slightly different question but, if we accept your
description of the "top-line issue" and follow your reasoning,
does it not obligate us to be certain that there are plain-text
versions of all of our protocols, strongly encouraging use of
encrypted versions when they are legal and/or feasible, but
avoiding essentially telling people to get off the Internet if
they are in places where strong, end to end (or nearly so),
cryptography is prohibited or prohibited without government
access or back doors.

Without trying to take a position on Jay's question, my
recollection is that we made our meeting in Beijing conditional
on unrestricted access to the global public Internet, including
the use of encrypted traffic.  If we were to follow that
precedent, we should ask the Australian government to exempt
those attending and supporting our meeting from those rules
rather than discarding Australia as a possible meeting site
without making that request.

   john

---

From: Eliot Lear <[email-masked]>
Date: Thu, 10 Jun 2021 10:11:22 +0200

Jay,

Before I respond, can you clarify whether import restrictions would 
prevent software that people trust from visitingAustralia? That is to 
say: if conference attendees show up with VPN software that we have 
reason to believe *isn't* hacked, would laptops be at risk or would 
people be at risk for either being arrested or turned away at the border?

Eliot

---

From: Adam Roach <[email-masked]>
Date: Thu, 10 Jun 2021 09:30:59 -0700

On 6/10/21 00:08, John C Klensin wrote:
> versions of all of our protocols

No, it does not.

> the use of encrypted traffic

And TOLA, of course, does not prevent this. HTTPS, VPNs, and the use of 
other encryption technologies remains legal. For the sake of clarity, 
here's a fairly concise summary of the controversial provisions of the 
TOLA Act: 
https://corrs.com.au/insights/australias-security-monitor-recommends-changes-to-controversial-anti-encryption-legislation

It is egregious overreach, of course, but has no bearing on the work we 
do during a meeting. Even in the Kafakaesque scenario of Australia 
attempting to issue a TCN for someone visiting for a week, the end 
result would be meaningless: development of the envisioned capabilities 
happens in weeks and months, not hours and days. Setting foot in a 
country does not bind its laws to you forever: I've visited Japan, and 
yet my possession of pseudoephedrine in Texas doesn't put me at legal 
risk from Japanese authorities.

/a

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 11 Jun 2021 09:12:56 +1200

On 11-Jun-21 04:30, Adam Roach wrote:
...
> do during a meeting.

I think that is correct, and I've visited Australia as a private individual several times since that law came in, with my laptop, and I would add that it has no bearing on normal actions by a visitor either. The fact that it rides roughshod over RFC1984 and RFC2804 is a bit beside the point.

(I'm curious to know how the Australian authorities reconciled the provisions of this law with their participation in the Anom sting.)

    Brian

---

From: John C Klensin <[email-masked]>
Date: Thu, 10 Jun 2021 19:29:43 -0400

Adam,

I think you missed my point, for which I acknowledge that this
might not be the right discussion list.  As far as meeting
planning is concerned, I agree with Eliot Lear's rather nice
analysis (posted minutes before your note below) and
appreciation George Michaelson's note posted a few minutes ago.
I would add to both that our own requirements for openness in
conjunction with IETF work (see BCP 78 and assorted "Note Well"
comments) are such that, if it is necessary to protect meeting
materials and conversations from falling into the hands of law
enforcement or the like, we have more serious problems or to
quote a professor colleague from long ago, "maybe they will
learn something".  I can imagine a company being concerned about
an employee conducting confidential company business while at an
IETF meeting, but, we have never made that a criterion for not
holding a meeting and, as Eliot more or less points out,
companies feeling sufficiently secure about their own
communications is not part of RFC 8718.

I was, and remain, concerned about something else, something
that has little or nothing to do with where we hold meetings.
In recent years, the IETF has been very strongly (and
increasingly, IMO) committed to more use of encryption in
support of individual privacy, including privacy from interested
governments.  If Australia's apparently heavy-handed rules
(independent of how they are actually applied) restricts use of
cryptography (or restricts its use without government/ law
enforcement access or back doors) then, if our protocols do not
make provisions that allows people subject to those laws to
conform with them, we are essentially making it impossible for
those people or associated companies to use the Internet while
conforming to our protocols.  That would encourage fragmentation
and/or development of other protocols elsewhere.   It that is
not obviously a good idea (at least to me) and I wish we were
more explicitly considering the tradeoffs involved (thanks to
Eliot for raising a related issue on another list).

best,
 john

--On Thursday, June 10, 2021 09:30 -0700 Adam Roach
<[email-masked]> wrote:

>> does it not obligate us to be certain that there are
>> plain-text versions of all of our protocols
> 
> 
> No, it does not.
> 
> 
>> recollection is that we made our meeting in Beijing
>> conditional on unrestricted access to the global public
>> Internet, including the use of encrypted traffic
> 
> 
> And TOLA, of course, does not prevent this. HTTPS, VPNs, and
> the use of other encryption technologies remains legal. For
> the sake of clarity, here's a fairly concise summary of the
> controversial provisions of the TOLA Act:
> https://corrs.com.au/insights/australias-security-monitor-reco
> mmends-changes-to-controversial-anti-encryption-legislation
> 
> It is egregious overreach, of course, but has no bearing on
> the work we do during a meeting. Even in the Kafakaesque
> scenario of Australia attempting to issue a TCN for someone
> visiting for a week, the end result would be meaningless:
> development of the envisioned capabilities happens in weeks
> and months, not hours and days. Setting foot in a country does
> not bind its laws to you forever: I've visited Japan, and yet
> my possession of pseudoephedrine in Texas doesn't put me at
> legal risk from Japanese authorities.
> 
> /a
>

---

From: Cullen Jennings <[email-masked]>
Date: Thu, 10 Jun 2021 17:54:51 -0600

Australia laws in this area do suck but I think that BBC article is confusing the issue. You can use strong crypto in Australia, but the government can go after the keys, apps and more if the other end is a company subject to the ASSaccess 2018 ( many large internet companies are subject to this law). One of the more technically accurate explanations is 

https://www.thejuicemedia.com/honest-government-ad-ass-access-anti-encryption-law/ <https://www.thejuicemedia.com/honest-government-ad-ass-access-anti-encryption-law/>

So if you think this is a problem for meeting in Australia, it is probably also a problem for meeting any of the five eyes countries. 

Personally, I am fine with meeting in Australia as it is still possible to have secure end to end communications, you just can’t have them with some ends and you can’t trust some software. And by some I mean most. 

> On Jun 9, 2021, at 9:03 PM, Jay Daley <[email-masked]> wrote:
> 
> _______________________________________________
> Mtgvenue mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mtgvenue