Hacker News new | past | comments | ask | show | jobs | submit login
Microsoft says encryption laws make companies wary of storing data in Australia (abc.net.au)
120 points by technion 2 hours ago | hide | past | web | favorite | 36 comments





I have migrated to Australia many years ago and I have recently become eligible to become a citizen. However I’ve heard stories of tech companies refusing to hire Australians because of the AA Bill, so I’m holding it off for now. The problem seems to be the provision that a tech worker can be coerced by the Australian Government into creating a backdoor, and they are not authorised to disclose it to their employer. I don’t want to hurt my future employability. On the one hand, if I had my citizenship then I could vote at the next elections, but on the other hand the AA Bill has been supported by all major Australian parties so I feel powerless.

Is this true ? There is no way I am hiring an Australian citizen then.

That's one of the biggest things that lawmakers here couldn't seem to understand - tech companies have high mobility across borders. Even if a law has no teeth, why would Microsoft store data in Australia when the next country over can still serve data for the region? It just creates too much risk, from a privacy and PR standpoint. Startups will be more adverse to founding in Australia as well. It just creates a black mark on their record from the start. These data laws were very poorly planned by the Australian Government.

I think that "high mobility across borders" is an assumption based on existing trade regulations. From recent developments it's clear countries can and do force companies to do things they don't want, and companies will do it because they can't or won't lose access to consumers in those markets.

For example, Apple has begun storing Russian user data in Russia in compliance with Russian data storage laws (https://venturebeat.com/2019/02/01/apple-will-reportedly-sto...), and Google is still working on its censored search engine in China.

Of course, if nobody else does this, this means you may have older software on your systems or less priority in development roadmaps or whatever as your country is an edge case, and you can probably say goodbye to market leadership and have to coast on your existing advantages. However, if everybody begins to cartelize the Internet, you may not lose as much in comparison to everybody else, since you will no longer be the edge case but the common case, and it will be a bad time to start a company or store data anywhere you go at any time. Companies will simply have to live with the geopolitical reality. In this sense, the Internet devolves into a suboptimal Nash equilibrium, where everybody has data localization laws and nobody will want to loosen up because storing your citizen's information on servers in another country will leave your citizens vulnerable. If this happens, the large homogeneous markets with a single language, government, and economy (U.S/China) may have an advantage.

This is sad, and I hope they reverse this law. An open Internet is good for economic and societal dynamism (and as a civilization is tautological to organized chaos, slowing that down weakens said civilization), and I wouldn't know how to work backwards to where the Internet should be. In the meantime, maybe this will lift some open source, decentralized communications means past some threshold of viability.


Some customers demand to know which jurisdiction their data is stored in, so it isn't as simple as "move it somewhere friendlier".

You have control if you are running your own services on top of the main cloud providers, but if it is in O365 or GMail/GApps it used to be a different story, and this precluded their use by a bunch of .au organisations (universities, Govt departments) early on.

So now some of these orgs that need to have data stored in .au for privacy reasons (among other reasons) are subject to these new badly formed laws in some kind of twisted catch-22.


Australia's lawmakers just need to amend the law so that it doesn't matter where the data is stored, as long as the company operates within their nation's borders.

I'd like to see how the Australian government handles things when MS cancels all their Windows and Office licenses.


They can do what Russia does and some of Europe do and require AU citizen data remain in AU.

Ironically OpenSSL started in AU because the crypto (export) laws of the US were too stringent:

* https://en.wikipedia.org/wiki/SSLeay

Now it's the opposite?


Same goes for the Bouncy Castle Java APIs: https://en.wikipedia.org/wiki/Bouncy_Castle_(cryptography)

I was about ready to move all my email over to Fastmail before this happened. But not now.

For what it’s worth, email is not a private protocol/platform - some degree of encryption-at-rest and privacy-respecting SOPs can give services like Fastmail a fairly good screen against private malicious actors, but you should never count on email as a means of communication to have any decent way of protecting you from state surveillance, especially when you live under the jurisdiction of the state surveilling you.

Though that’s not to say that we should accept these laws as they apply to email services lying down. Any reason to refuse to use the services of Australian companies when foreign services of similar quality exist gives those Australian companies all the more reason to press the government to reform these laws on the grounds that they’re losing valuable business for negligible gain to national interest. If the government doesn’t listen to individual constituents, it might listen to companies which are hurting in their back pockets.


There was a thread I made about ProtonMail v FastMail and this one point came up at the top. However ProtonMail’s inability to support standard clients without an awkward bridge app seems to take edge off it.

https://news.ycombinator.com/item?id=19372882


ProtonMail's bridge program is a bit of a kludge, and their proprietary protocol (rather than seeking IETF standardization) prevents implementing the protocol in the MUA.

I'd love to have a privacy-respecting mail hoster, but the ProtonMail bridge program is too unattractive to make the switch.

(Which is not to say that IMAP itself isn't a mess, but MUAs have gotten it to work, and we'd like for whatever other protocol we move to instead to also be an open standard.)


I run the bridge and it's really a non-issue. It runs in the background without a peep and auto-configures my mail client. Easy.

> ProtonMail’s inability to support standard clients without an awkward bridge app

Isn't that one of the pros of Protonmail? All the data is encrypted and decrypted on the client. There is no way to have mail apps access the data without a piece of software that handles the encryption.


Unless you only send email to yourself, the hole in that idea is that all the recipients have a copy of your email.

I guess it’s just the way you look at it, and maybe even what your priorities are in choosing an email service. To me at least, I’m thoroughly disinterested in an email service which doesn’t implement IMAPS.

From what I understand, Australia (and other nations) don't give their citizens explicit rights, such as to personal and property privacy.

Australians have very few constitutionally guaranteed rights (compared to countries such as the US). The Constitution only gives us the right to vote, the right to a trial by jury, and freedom of religion (and a few others). But many more rights, including extensive privacy rights, exist in statute law and elsewhere.

The main argument against adding more rights to the Constitution, is: "we don't want to end up with obsolete rights that do more harm than good, and that are virtually impossible to get rid of, like the US with its right to bear arms".


The U.S. actually goes a step further... the only rights the constitution actually spells out are the rights of government. Most encroachments have been under the guise of "interstate commerce" or "taxation" in general...

> The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people.

As to the bill of rights, so long as the police are armed and can act with impunity... imho, the populace should be able to be armed. I don't personally own a firearm... I also don't spew racist rhetoric. I am a strong believer in all civil rights.


Maybe if the police in America wasn't armed to the teeth and scared of being blown away by armed populace they wouldn't act like they do. For a country who keeps guns to hold governments accountable, your government is just a unaccountable as everyone else; if not more so.


In the US there's no explicit right to vote.

Of course “they” would say that. Easier to sell than enshrining rights in the constitution makes it impossible for us to encroach on those rights ;) tin foil stay strong

> like the US with its right to bear arms

I find this funny because the SCOTUS basically can change the Constitution whenever they want.

The second amendment only states that the United States itself has a right to bear arms in order to defend itself (have a Militia)[0]. It didn't provide citizens the right to personal protection by guns until a 2008 Supreme Court case [1].

0: https://www.constituteproject.org/constitution/United_States...

1: https://en.wikipedia.org/wiki/District_of_Columbia_v._Heller


You find it funny because you have a misunderstanding over what the constitution says. It doesn't say that the state has external threats and so needs a militia, which is what would be implied by your 'state defending itself' reading. It says a militia is necessary to secure a free State, and so we can't infringe the right to bear arms. That doesn't just mean external threats, and in fact is rooted in the idea that the people are the defense of their community and the holders of their government.

That means it's not about the State defending itself, it's about the people defending the free State. The Heller case simply extended the existing individual right to own guns in order to protect their free State to that of protecting your person and home.

SCOTUS didn't change the Constitution however they wanted. That's ridiculous. They applied existing law to a situation they were asked to judge.


"... shall not be infringed" because of the need for a "well regulated militia," not for said militia.

It's an example of why the right is needed. Especially given the people raised a violent coup against their own government. These people were not in favor of disarming the public in general... to interpret it otherwise would be effectively changing the law.


> the right to vote

Yeah, but they mess even that up by making it obligatory. :)


Involuntary voting means that religious and other special interest groups cannot easily use their organizations to out-vote the more apathetic citizens. And therefore serious parties must target the center, or close to it, with policy.

I see this as an advantage of compulsory voting over other systems. Especially when voting is quick and painless, usually taking no more than 10 or 20 mins on a weekend every three years or so.


You have to go. you don't have to pick. Makes it difficult for states to disenfranchise people through budget cuts.

People have a legal right to both personal and private property under Australian law. I’m not sure where you got that idea.

The comment was referring to privacy presumably search and enter

On an aside it appears Australia has done away with the self incrimination protection laws Is that a right in most democratic countries?


I'm interested to know what the farmers whose properties get taken by mining companies have to say about that.

Though genuinely unsure and curious as to whether that's a separate legal (or perhaps media reporting) issue.


To be fair this isn’t solved via constitutional rights in the US either - look up eminent domain law.

This happens in a lot of countries and is a problem. That doesn’t mean that rights to private/personal property aren’t guaranteed by law in Australia, just that the law is skirted by monied interests. The farmers you talk about would likely be able to fight this in court if they had means - but such is the nature of late capitalism, money buys you political power and legal clout.

We don’t have a bill of rights, but we’re hardly a totalitarian state. Nanny state, maybe.

Who could have guessed that laws which turn encryption into a legal quagmire in Auatralia would make companies that do encryption things less interested in working in Australia ...



Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact

Search: