The Assistance and Access Act 2018 (AA Act) will require online service providers to respond to requests for information about users and their activity.
Not surprisingly, this has led to protests from Australians concerned about how their digital privacy could be at risk, especially in the wake of scandals across the globe where governments and others have been found to be using special backdoors to access data that was supposedly encrypted.
The community of cryptocurrency enthusiasts, investors, and developers have been at the fore of resistance to the AA Act, given the risk it poses to the founding blockchain principles of security and anonymity.
Background to the law
According to the Australian government, the AA Act is meant to address the challenges that encryption creates for law enforcement agencies. For example, if law enforcement is investigating a cybercrime or any incident where evidence could exist online, they want to be able to pull records from online systems with minimal resistance.
To that end, the AA Act will allow government agencies to submit three types of requests to communication providers. The first is a Technical Assistance Notice, where the company would use an encryption interception tool they've already developed. The second is a Technical Capability Notice, where the company would be required to build a new interception tool based on government specifications. The final option is a Technical Assistance Request, which is not compulsory.
These requests can be issued to internet service providers (ISPs) or any organization that provides an online service, such as a web host or app developers. If the company fails to adhere to the request, then it will be in breach of the Act and liable to be fined or face other penalties.
Potential impact on crypto
The AA Act will be unlikely pose a direct risk to the viability of Bitcoin or other cryptocurrency exchanges. When a user exchanges digital credit or makes an online purchase, the funds are transferred based on encryption keys and wallet addresses. That process should continue unaffected. However, Australian developers working on blockchain projects could be impacted in a negative way. Their users and customers expect to have trustworthy platforms — not ones that can be legally compelled to build backdoors for government surveillance should they be asked.
Encryption is usually talked about in the context of hacking and cybercrime. Blockchain transactions need to be kept anonymous and encrypted so that outside attackers cannot infiltrate the market and steal funds. But with the Australian government adding regulations to how encryption is handled, the risk for everyone has increased dramatically.
At the center of the cryptocurrency concerns is the impact of a Technical Capability Notice, which would involve an agency demanding new functionality to be added to an encrypted system. Essentially this lets the government make their own loopholes and backdoors into websites, databases, and applications. For blockchain developers, making such changes could result in new software vulnerabilities that hackers can use for nefarious purposes.
Preserving privacy
For those consumers concerned with how the AA Act will affect the websites and applications they use on a daily basis, the first step toward maintaining digital privacy is to invest in a reliable virtual private network (VPN) client.
VPNs offer an entire layer of encryption for all internet requests sent from a computer or mobile device. When you are connected to a VPN, your data traffic is encrypted before it hits your ISP and is then handled by the VPN provider at the other end of the secure tunnel.
There are many solutions on the market right now yet it's important to find ones that operate in countries that don't endorse citizen surveillance and won't be blocked. When selecting one, be sure to research their reputation when it comes to encryption and data sharing. You should always connect to a VPN client before performing a cryptocurrency transaction or accessing your digital wallet.
Without an encrypted VPN, your Bitcoin and other digital currency can be at risk of hacking. For example, if an intruder manages to take over a router on a public wi-fi network, they will be able to scan your traffic and intercept your web requests. VPN encryption makes it impossible for hackers to decode your data.
But VPN providers are classified as communication services, so_ there is a chance _that they too could be held accountable for the AA Act. If an agency demands data about users or activity, VPN companies may need to develop tools for sharing such information. For this reason, users may choose a VPN provider with endpoints located across the globe so that internet traffic can be routed outside of Australia and not fall under the jurisdiction of the AA Act.
The path ahead
Within the AA Act, there is some good news for blockchain developers and supporters of the cryptocurrency community. Specifically, the legislation will block any notice or request that will require a company to introduce a systemic vulnerability into their website or application.
Essentially this means that companies should not need to develop new tools that could create higher risk for themselves or their customers.
However, there is sure to be debate over what constitutes a systemic vulnerability. These types of arguments will likely end up in court, and there is a concern that the people ultimately making the rulings may not have the technical knowledge needed in order to make an informed decision.
There's also the question of how the AA Act will interact with the General Data Protection Regulation recently instituted by the European Union. That piece of legislation requires all international web services to declare how they store and share user data. If Australian developers are forced to create backdoors into their systems, then it will be difficult for them to comply.