Home Open Sauce Encryption laws: wishful thinking at its best

Author's Opinion

The views in this column are those of the author and do not necessarily reflect the views of iTWire.

Have your say and comment below.

Encryption laws: wishful thinking at its best

It is one thing to stand before a podium, as Moses did on the mount, and promulgate laws. It is quite another thing to put those laws into effect, especially when they cover encryption.

Prime Minister Malcolm Turnbull, no doubt, has good intentions in announcing laws to force companies to decrypt communications in the event that they are needed to crack cases involving criminals and terrorists.

The best that the Australian Government can hope for is to, as usual, create an atmosphere of fear and hope that that dissuades the "bad guys" (whoever they are) from using commonly available encryption. Politicians have used fear to control the masses from time immemorial and one should not be surprised that the tactic continues to be used.

Don't trust me when I say that with encryption it is an all-or-nothing option; listen to the way Troy Hunt, a well-known independent security consultant, laughed when asked whether politicians understand cryptography better than the actual practitioners.

It's not Hunt alone who acknowledges that the genie is out of the bottle as far as encryption goes.

Here's what Open Whisper Systems, the company behind the encrypted messaging app Signal, pointed out some time ago: "We've designed the Signal service to minimise the data we retain about Signal users, so the only information we can produce in response to a request like this (from law enforcement) is the date and time a user registered with Signal and the last date of a user's connectivity to the Signal service."

Signal is headed by noted cryptographer Moxie Marlinspike. The company added: "Notably, things we don't have stored include anything about a user's contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user's groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user's groups), or any records of who a user has been communicating with."

OWS is not alone in this. Apple, for instance, does not want to know anything about users' communications. Its software encryption routines are being linked more and more to hardware as well, making it even more difficult to get at the original content.

Britain last year passed what has come to be known as the Snooper's Charter, draconian laws that are said to be similar to what Australia intends to pass. New Zealand passed a law in 2013.

But we are yet to hear of any cases similar to the San Bernardino case in the US — where the FBI tried to force Apple to decrypt information on an Apple iPhone 5C belonging to a terrorist — in either of these countries.

To use an analogy, it is one thing to turn water into wine. Turning it back into water is not half as easy.

The only thing that will result from laws like these is more business for firms like the Israel-based Cellebrite who claim to be able to crack encryption. The company earns a little more than half a million dollars of Australian taxpayer money right now. Expect that figure to rise.

And as with the use of guns — the number of shootings by police always increases when they are provided with weapons as a default option — expect the number of cases where the authorities want to engage companies to try and crack encrypted messages to soar.


Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

· How does business security get breached?
· What can it cost to get it wrong?
· 6 actionable tips



Ransomware is a type of malware that blocks access to your files and systems until you pay a ransom.

The first example of ransomware happened on September 5, 2013, when Cryptolocker was unleashed.

It quickly affected many systems with hackers requiring users to pay money for the decryption keys.

Find out how one company used backup and cloud storage software to protect their company’s PCs and recovered all of their systems after a ransomware strike.


Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.


Popular News