Angus Taylor Cybersecurity Minister

Cybersecurity Minister Angus Taylor

The government has partially unveiled its long-awaited plans to establish backdoors in encrypted communications despite insisting it will not seek such backdoors. This slip-up happened via a clumsily reported version of a speech by junior minister Angus Taylor that hinted at the government’s preferred approach to undermining encryption.

The government has long claimed it intends to defeat encryption but without forcing encryption manufacturers such as the big tech companies to insert backdoors into encryption systems that could be stolen from security agencies, as has happened in recent years to both the CIA and the NSA. Many encryption systems in any event have no centralised system to backdoor, but simply provide end-to-end encryption on devices themselves. Others, such as Signal, are provided by organisations specifically established to prevent governments from violating privacy, and who would never co-operate with any decryption effort.

It seems, however, that the government wants a pseudo-backdoor that potentially poses exactly the same threat to security as a backdoor: it wants to be able to force service providers (and presumably hardware and app manufacturers, as necessary) to secretly install malware on devices that would enable authorities to see communications in unencrypted form. According to the government’s drop to a News Corp journalist, encryption can be overridden by “dropping surveillance code into a suspect’s phone” because “at some point in any transmission or the storage of data, that data is decrypted”.

What this means is that Papers Please Pezzullo’s officials would require your mobile provider, perhaps in conjunction with your phone manufacturer, to help get malware onto your phone that would log your keystrokes and/or take screenshots and send these to authorities without you being aware — if they have been unable to physically access your device in order to install such malware directly. There would be no systematic breach of encryption, but a breach of a device’s security settings, presumably with the approval of the manufacturer of the device and operating system.

Police-installed malware has been around for many years — and the past illustrates exactly what kind of problems can result. The most famous example of police-planted malware was the Bundestrojaner, malware used by German police that was uncovered in 2011 and shown to have massive security flaws, potentially allowing a third party not merely to access the targeted device (in that case, a computer) thereby destroying the evidentiary value of whatever was on it, but even allowing access to the police database to which information was being sent by the malware. Supposedly, the government also intends to dramatically escalate the punishment of people who refuse to provide passwords to authorities. 

To the extent that such malware would also require the overriding of security protections already installed on mobile devices by the manufacturer, it would also create opportunities for malicious actors to use the same exploits on any similar device — exactly the problem that avoiding direct backdoors is intended to avoid.

How the government’s legislation will address these challenges remains to be seen; despite the careful drop to a friendly journalist, we apparently won’t see the legislation for several more weeks.