Australia's spyware law could expose phones to exploitation, business group warns

Peter Dutton’s proposed legislation to expand the government’s surveillance capabilities into telecommunication devices through the inclusion of spyware risks could create “systemic weakness or vulnerability” that would be open to exploitation, Australia’s peak industry group has warned.

The Australian Industry Group has responded to the call for consultation on the assistance and access bill by warning of unintended consequences from the home affairs minister’s push to force telcos and tech giants, including Apple, Samsung, Google and Facebook, to include concealed “backdoors” into devices and messaging platforms.

In introducing the legislation last week, Dutton said the aim was to better equip law enforcement agencies to deal with new technologies, which he said were being “increasingly misused and indeed exploited” by “criminal syndicates and terrorists”.

In his speech, Dutton said the bill would give authorities “additional powers for overt and covert computer access”, which included “the use of software to collect information directly from devices”.

The government claims it is not asking companies to build weaknesses into their operating systems, but to either allow approved authorities access to existing weaknesses or install software or systems on individual devices to allow access.

In its submission, the Ai Group warned the government could inadvertently be providing criminal organisations with more tools, even if it was just a “one-off firmware update targeted at that suspect and no one else”.

“We are of the view that introducing any type of technical capability or functionality to grant access to a user’s hardware or services potentially creates a systemic weakness or vulnerability,” the group’s submission says. “Once developed, it may be capable of extension to any and all users and could also create an opening for others to take advantage of new and existing weaknesses in the system.”

The Ai Group submission follows similar criticisms from the Digital Industry Group on the draft exposure bill released last month, which also warned the bill risked opening devices up to attack.

The Ai Group also questioned the broadness of government definitions included in the legislation, such as “designated communications provider” and “eligible activities”.

“We would be concerned if broadly and vaguely scoped legislation could compel companies to build security vulnerabilities into their products – this would affect all users of that product and result in weaker security for everyone,” the industry group warned.

It also advised of international considerations, given the government could be creating “domestic laws that may be ineffective, out of step and and overreaching with other relevant jurisdictions”.

“At worst, applying a stricter regime in Australia than overseas could impact Australia’s digital capability and competitiveness, impeding network innovation, discouraging business presence in the Australian market, and leaving Australia behind,” it said.

“Additionally, this law could create a conflict for organisations operating in multiple jurisdictions if indeed it conflicts with data protection laws in operation in another country.”

Australia’s internal spy agency, Asio, and the department of home affairs can access encrypted data through existing laws, by using decryption techniques. The new legislation seeks to speed up the process.

Labor has so far urged caution with the legislation, but has not ruled out supporting it.

Similar legislation in the UK is now being reviewed and revised after it was successfully challenged over privacy concerns.