Lies, Damned Lies and National Security
Posted by Jacques Chester on Tuesday, April 15, 2008
So yesterday I lost my temper at a monumentally silly bit of policy making on-the-run by the new ALP government. After that tantrum I learnt that there was both more — and less — than met the eye.
To start with, let’s review what Julia Gillard said yesterday to start the whole shitstorm:
“We want to make sure that they are safe from terrorist attack,” Gillard said. “Part of doing that is making sure we’ve got the right powers to ensure that we can tell if there’s something unusual going on in the system.”
Any changes to the Telecommunications Act would be based on national security and not “an unseemly interest in people’s private emails”.
As I and others pointed out yesterday, companies already have this power. They own the equipment and generally, control of email and web access is a contractual rider. It couldn’t make a difference to detecting terrorism (or indeed any other criminal activity) over what already exists.
I was angry about the proposal, mostly because of the tragic ignorance it highlighted. So I decided to ring my local member’s office. They told me to ring Julia Gillard’s office. Her office told me to ring the Attorney-General’s office. And there I found out what the proposal actually was.
What is Actually Going On
Let’s take a slight detour into the Telecommunications (Interceptions and Access) Act 1979. This Act makes it illegal for an unauthorised person to intercept or listen into stuff being carried over a telecommunications system:
6 Interception of a communication
(1) For the purposes of this Act, but subject to this section, interception of a communication passing over a telecommunications system consists of listening to or recording, by any means, such a communication in its passage over that telecommunications system without the knowledge of the person making the communication.…
7 Telecommunications not to be intercepted
(1) A person shall not:
(a) intercept;
(b) authorize, suffer or permit another person to intercept; or
(c) do any act or thing that will enable him or her or another person to intercept;
a communication passing over a telecommunications system.
As you might expect, there’s pages of exceptions. Telco workers testing the line at the local phone node, for example, are exempted; so too coppers clutching a fistful of warrants. But not included are companies watching email passing in and out of their systems.
You see, most companies have a setup like this one:
See that bit in the middle? The filtering-and-maybe-storing bit? The legal question at hand is whether that’s an interception under the terms of the Act. If it is and an employee has somehow evaded signing the standard forms for IT access, then the company is in direct contravention of a fairly serious bit of Federal legislation. If not, no worries.
Instead of letting this come up in some future court case, the government decided simply to legislate the problem away by expanding the exempted class to include companies who scan emails and web traffic. That’s it, that’s the whole damn thing.
Except that …
ZOMG TERRORISTS!!1!
Julia Gillard, or Robert McClelland, decided to turn this into being tough on terrorism. In technical terms their argument is apparently that without email scanning, companies will be compromised. Some of those companies might be important institutions. Then, terrorists! Also, Estonia!
Here’s the problem: either these two Ministers of the Crown don’t understand what they’re talking about, or they’re doing a hyped beatup which backfired, or both. Because by drawing the long bow they looked like idiots, rather than people closing a boring loophole to save a bit of lawsuit angst.
But just to sink the slipper a bit more, it should be pointed out that most infrastructural IT is not connected to the Internet. Rail has its own fibre, power plants have closed LANs, banks rent ISDNs and dark fibre for their needs and so on. What’s really at stake here is the possibility of end-user PCs being turned into zombies; machines which can be controlled remotely by persons with nefarious purposes. This is possible mainly because Windows has a promiscuous, insecure-by-default model of security — though don’t tell Gillard that or she’ll announce Microsoft will be investigated by the AFP for aiding and abetting terrorists.
Editorial Incompetence
Now it took me about 15 minutes to find out what this was about. I noticed absolutely no such checking by the journalists. Actually, they didn’t cover themselves with glory at any point. None of them asked pertinent questions that every nerd was screaming at the top of his or her lungs. Probably because they know about as much as the Ministers do. So they took their half-baked conception of a half-baked spin exercise to the smart people who were, when given sour biscuits, justifiably angry and inclined to spit.
This story did not break late in the afternoon. It broke in the morning, at the very start of the news cycle. Journalists had all day to double check what the policy was about. I reckon “Minister Full of Shit And We Prove It” would have made a great evening news followup, compared to “Minister Doesn’t Understand Shit And Neither Do We”.
Not that this is any great shock. Any specialist in any field is used to journalists routinely botching, over-simplifying or flat out fibbing about the meaning of a news story in their world. Doctors are inundated by parents every time some quack remedy is promoted or a new miracle cure pronounced based on preliminary small-group trials. Lawyers see the legal process and legal arguments misrepresented by ignoramuses with dozens of lawyer friends from their uni days. Computer scientists, sysadmins, software engineers and allied nerds are sick of every. damn. story. about computer problems including the cliched fingers-on-keyboard-in-darkened-room shot, with a voice over comprehensively butchering any semblance of correctness.
Journalists really do take themselves seriously, and like Arts Council grantees, wonder why nobody else will join in the acclaim. Here’s a clue, ladies and gents, it’s because you’re jokers.
So Now What?
It might have helped if Julia Gillard had any sort of technical background. But she was a lawyer and union hack. It would have helped if Robert McClelland had some sort of technical background, but he was a lawyer and union hack too.
In actual fact, the Parliament is stuffed to the rafters with lawyers. There are a smattering of other professions (including, you may not have heard this two dozen times already, a doctor!) present but the lawyers tend to wind up in ministries and positions of influence.
Politics suits lawyers. The lawyerly skills of argumentation, forensic disputation and the ability to believe in nothing but prosecute a case for anyone are all useful to the professional politician. Meanwhile the stereotypical engineer, programmer, physicist, chemist, biologist, architect etc are not argumentative, confrontational, glib or able to adopt whatever argument is facing most into the wind. Reality is a hard taskmaster.
I think we need more nerds in Parliament. Programmers, scientists, engineers: anyone of a technical or scientific background is desperately needed in organs of law making and policy. Because it’s pretty damn clear that the lawyers and hacks don’t understand them when time comes to announce policy.
This entry was posted on Tuesday, April 15th, 2008 at 11:56 AM and filed under Geeky Musings, IT and Internet, Journalism, Politics - national.
Follow comments here with the RSS 2.0 feed.
Apologies. Comments and trackbacks are both currently closed.
Microsoft will be investigated by the AFP for aiding and abetting terrorists.
Could be good actually. The incompetent investigating the insane.
Posted on 15-Apr-08 at 12:15 pm | PermalinkNeither Fairfax nor News Ltd covered themselves with glory on this story, but I’d give the prize for alarmist hyperbole to this guy (I found the piece by Googling “Julia Gillard”).
Now all we need is an Australian Nerd Party logo and we’re in business!
Posted on 15-Apr-08 at 12:25 pm | PermalinkGummo;
In the NT there was a multi-party group for promoting women getting into politics. They ran seminars on speaking to the media, how to campaign etc. It’s been very successful in making the NT Parliament one of the best in the country for gender balance.
I think a program like that is needed. Something non-partisan, perhaps a joint program of Engineering Australia, the ACS and others. I’ll be yakking to my uncle who used to run the Engineers Aust. branch here a few years back.
Posted on 15-Apr-08 at 12:32 pm | PermalinkGreat post!
I haven’t been very impressed with Labor’s IT policies so far – this and the intent to try to censor the internet don’t encourage much confidence in their technical understandings of the issues.
Will see how they go on the issue of encouraging the use of open source and open standards based software as previously they seem to have been quite supportive.
Posted on 15-Apr-08 at 1:08 pm | PermalinkGood to see there’s someone following up a story like this… :-/
Gummo: something like this? :p
Posted on 15-Apr-08 at 1:19 pm | PermalinkI suspect Jacques that amongst other things, most politicians are incapable of answering a question “I don’t know”. Including, apparently, Julia Gillard. Prime ministers and deputy prime ministers are expected to know everything about everything and they encourage that mentality by blathering on instead of giving a truthful answer that it’s being handled by the appropriate minister and they’re too bloody busy to be across everything.
I’ll suspend judgement on McClelland until I know what he, as opposed to a spokesperson, actually said.
Posted on 15-Apr-08 at 1:42 pm | PermalinkNice work, Chester.
I was beginning to sweat over the apparent inadequacies of ECHELON until the truth came out yesterday arvo. WTFF? The government is recruiting companies to read employees’ email? What Le Feuck is going on at DSD and ASIO? Who’s running this Michael F. Mouse operation? Und so weite.
Pissing away tax dollars on secretive sigint networks is fine, particularly when they piss off the frogs; pissing away tax dollars on secretive sigint networks that can’t find their arse with both hands? Not so much.
Posted on 15-Apr-08 at 1:50 pm | PermalinkKen;
At least Kevin Rudd has the sense to say “I’ll get back to you on that”.
Posted on 15-Apr-08 at 2:05 pm | PermalinkJulia Gillard was a “union hack”? How so? Robert McClelland was a “union hack”? How so?
Posted on 15-Apr-08 at 2:10 pm | PermalinkThe comments from JG seem to have come from her Today Show interview. It would be interesting to see the whole context of them. I will try and chase that up.
I do cringe everytime the Fed Govt mentions IT based on the wackiness so far, before this.
Posted on 15-Apr-08 at 2:13 pm | PermalinkAmanda;
Gillard worked for Slater & Gordon. That’s union hackery as far as I’m concerned. But I was wrong about McClelland.
I’ve struck out the ‘union hack’ from both because it detracts from my point about lawyers.
Posted on 15-Apr-08 at 2:14 pm | PermalinkExcellent work Jacques. AFAIK the MSM still haven’t corrected/clarified their original story.
However, even if Gillard etc were spinning for all they were worth to introduce a terrorism element, and even if there actually isn’t one, it still doesn’t remove the proposal from being a very real infringement of privacy concern. We still need to know whether the legislation will merely authorise transient storage of emails for virus and spam auto-scanning (which I have no problem with) or whether it will authorise employers to actually read employee emails without their employees’ express consent or knowledge. Even though quite a few employers (though by no means all) require employeees to contractually sign away this privacy right as a term of employment, it’s a significant step to legislate to remove it irrespective of knowledge or consent. Whether there’s a genuine terrorism aspect is really irrelevant to the fundamental privacy issue. I have certainly never signed a document authorising my employer CDU to physically read my emails (as opposed to auto-scanning them for spam and viruses), and I would hope that the academics’ trade union would object strenuously if universities began demanding that academics agree to such surveillance.
Posted on 15-Apr-08 at 3:04 pm | PermalinkThey won’t. They only report “the current story”, and by mysterious coincidence, “media too lazy to make phone call” is never a current story.
Or, if they do, they’ll pick up my own mislabelling of McClelland as a union hack. They’ll snigger a bit about my own mistake and consider it to be a brutal rebuttal.
Posted on 15-Apr-08 at 4:44 pm | PermalinkNice work JC. Amanda may yet prove me incorrect, but I suspect Julia was in full scale spin mode and really should have been taken to task by the MSM (but I guess too many journos have believed their own spin on how smart and sexy she is or something. Bleh.) Then again, the Opposition seemed to have swallowed the line as well given their response.
KP – anyone who wants to read my work email line by line is welcome to. I delete a good half to a third without opening it; don’t want to think of the time it would take some schmuck to read it all. And then, who would read their email?
Posted on 15-Apr-08 at 4:51 pm | PermalinkAs for your second concern, Ken, therein lies a tale. Employers can already read your email. As I noted in my first rant, you need a Mandatory Access Control scheme — at the least — to prevent privacy infringements in a technical fashion. Neither Windows nor Mac OS X can provide that level of security. You need something like SELinux or Trusted Solaris to do the job.
You can of course introduce offences in this area, or simply be narrow in the expansion of the Act to only cover automatic screening, but there is no technical solution which is widely available at the company level to balance both concerns.
There is a technical solution that works at a personal level: encryption. If you and your correspondent use PGP or similar with a suitably large key, no third party can read the contents of the communications. Ditto web browsing and IM over SSL (ie any site with https:// in the URL). The communications can be stored and traffic analysis used, but the content itself is rendered opaque.
Posted on 15-Apr-08 at 4:54 pm | Permalinkstruck out hmm yes I see so uh still there but with a line through it
working for a law firm as a lawyer; unionism definitely definitely
*complains about bad journalism*
Posted on 15-Apr-08 at 5:15 pm | Permalink*deliberately lies in blog*
banana;
Slater & Gordon is a firm which frequently represents unions in lawsuits and there’s a lot of ex-partners in high places in the Labor movement and unions in particular.
It was a mistake on my part, but please, feel free to contrast my honest mistake (and willingness to admit it) with total spinning bullshit.
Posted on 15-Apr-08 at 5:25 pm | PermalinkIncidentally, that’s what “struck out” means. Still there with a line through it. When you cockup on a blog it’s considered good form to admit it but not remove the original offending words for honesty’s sake.
If you’re a journo, you get away with shrugging and ignoring angry letters.
Posted on 15-Apr-08 at 5:27 pm | PermalinkOK, always happy to give someone the benefit of the doubt
Posted on 15-Apr-08 at 5:32 pm | PermalinkI’m sure it’s not really at all like making a statement on something without bothering to research that thing.
banana;
You’re entitled to your opinion that two wrongs make a right.
Posted on 15-Apr-08 at 5:59 pm | PermalinkI think its a good idea to notify (just like video surveillance for example), though I don’t think consent should be required. Too many people out there who believe that email they send is confidential, whereas in reality anybody sitting on the network between you and the receiver can easily intercept it (its a *lot* easier than intercepting a phone call for example).
The best rule of thumb I’ve heard is that you shouldn’t write anything in an email (unencrypted) that you wouldn’t write on the back of a postcard.
I’d encourage people to read my email if the promised to remove the spam
Posted on 15-Apr-08 at 6:14 pm | PermalinkCongratulations on a job well done.
Posted on 15-Apr-08 at 6:31 pm | PermalinkKen Says:
Settle down, Ken. The existing situation in NSW is as follows:
I think that what the Privacy Commissioner says might be incomplete, because I recall some measure introduced a few years ago where employees had to be notified, but I could be wrong if that requirement has subsequently been removed, or was only being discussed and never actually became law.
Posted on 15-Apr-08 at 6:38 pm | PermalinkSecond reading speech for Telecommunications (Interception and Access) Amendment Bill 2008.
Posted on 16-Apr-08 at 3:38 am | PermalinkRobert McClelland:
The need for effective protection of corporate networks was also recognised in the Report of the review of the regulation of access to communications conducted by Mr Anthony Blunn AO. That report was tabled in parliament in September 2005. The Blunn report, as it has become known, recommended that access be allowed to the content of communications, outside of the warrant regime, for the protection of corporate communication systems. Recent media reports highlight the importance of private companies also protecting their networks.
Sounds as if more than a technical amendment is about to take place.
The bills digest on this legislation deals with precisely the issue I canvassed in my previous comment (quote is from A-Gs consultant Anthony Blunn, whose report led to this legislation and eerlier amendments):
However, as the bills digest goes on to note, this legislation does not in fact contain the privacy protections recommended by its own consultant Anthony Blunn:
Posted on 16-Apr-08 at 7:14 am | PermalinkThe relevant passage of the Blunn Report follows:
Posted on 16-Apr-08 at 7:24 am | PermalinkWas responding to clarencegirl, not Ken.
Posted on 16-Apr-08 at 7:25 am | PermalinkWhat’s there to stop would-be terrorists from going to uni, becoming a Microsoft Certified Systems Engineer, joining the (**name your target here**) as a I.T. engineer, and filtering emails to find out the password of the critical system and hitting the Big Red Button?
Posted on 16-Apr-08 at 9:23 am | PermalinkApart from the incompetence of managers being the main threat to critical infrastructure and organizations (primarily because of a lack of understanding of risk management issues and appropriate standards), almost every discussion of privacy in Australian electronic communications systems misses the fact of Echelon, which goes through everything, voice included.
Any right to private electronic communications disappeared years ago.
Echelon Pact countries (including Oz and the US) have been abusing privacy this way for years.
Have a look at the 2001 European Parliament Report on Echelon. Some of the rapporteurs even suggest that the UK should be kicked out of the EU if the UK continues doing this.
This raises a very real issue for Australia: participation in Echelon makes us a primary target for any group (terrorist or national) that wants to hit US SIGINT and military capabilities. It’s likely to be one major reason why Oz agencies got hit in May 2001 by what seemed like a “dry run” electronic warfare attack – one quietly acknowledged by a CIA director as a “horror month”.
And in the preamble to the Europarl report was the apt Juvenal quote: Sed quis custodiet ipsos custodes.
Posted on 16-Apr-08 at 11:04 am | PermalinkOh, on a related note, http://www.privacy.gov.au/publications/breach_0408.html is a new consultation by the privacy commissioner on a code for notifying people of privacy breaches. Unfortunately, “Voluntary” is in the title. Submissions due mid June.
Posted on 16-Apr-08 at 12:20 pm | Permalink[...] — Dave Bath For those following Jacques Chester’s recent Club Troppo posts (here and here) on our Federal Government’s cluelessness on IT security and privacy issues, [...]
Posted on 16-Apr-08 at 12:27 pm | PermalinkChui: In theory, personnel security checks filter out the terrorists.
Any organisation that routinely deals with sensitive information should have a security clearance requirement for IT Systems Administrators. Typically this is one level above the material being handled.
So for Restricted material, sysadmins need Secret clearance, for systems that handle Protected material, they need Highly Protected clearance, and so on.
Posted on 16-Apr-08 at 9:27 pm | Permalink[...] Club Troppo posts by Jacques Chester are worth reading: "Lies, damned lies, and national security" (2008-04-15) and "And then a stupidity occurs" [...]
Posted on 18-May-08 at 4:29 pm | Permalink