[LINK] Brandis rushes to release telco metadata for civil proceedings

[David Lochrin]

On Monday 26 December 2016 09:51:01 Frank O'Connor wrote:

> I wrote this reply about three days back but for one reason or another it has been held up by the Moderator … I think David received it, but it wasn’t posted into the List … so I’ll just reply again and see if it takes ...

Yes, I did receive it but I think I was the only addressee in the headers - end-of-year gremlins again!

> I still seriously disagree with much of what you say, (on network, technical, operational and legal grounds), and think you are vastly overestimating government capabilities and underestimating the security/technical difficulties of VPN interception (basic traffic analysis and metadata extraction is one thing, but getting into the contents of heavily encrypted packets in which even the metadata is buried is another), but can’t see any point debating the matter as we have drifted seriously off the course of my original missive… which was concerning the AG’s intent to provide data to litigants in civil actions.

Before we (or I) became immersed in technical details, I was almost going to observe governments have a choice between monitoring metadata and user content.  Metadata is easier to manage en-mass and probably provides most of the intelligence information needed to justify more direct action, such as infiltrating spyware onto a subject's computer or physically raiding premises.  But metadata will be useless if a VPN service (one which completely hides the raw packet and its addressing) is effectively employed.

My discussion of the technical aspects began with a statement by Christian on Thursday 22nd at 14:46:
> Also, I am aware that http://www.austlii.edu.au/au/legis/cth/consol_act/ca191482/s3la.html has compelled a person in Victoria to release their SSH Private Key to an interstate host already so these types of technical controls are less effective now.

If VPNs become widely used by persons of interest to the intelligence services than we can expect some pushback.  President Clinton's attempt to implement "key escrow" was defeated because it would so weaken commerce on the 'net, in which governments also have an interest.  And any scheme which relies on government control of 'net security would be so easily defeated it would look silly.


> Happy Christmas one and all …"

Hear, hear!

David L.