Anti-encryption laws 'imperil' cross-border data access deal with US

Australia's controversial encryption busting laws could put a spanner in the works of the government obtaining a bilateral agreement with the United States for cross-border data access, a coalition of American tech giants and civil liberties organisations warn.

The warning comes in a submission [pdf] from a coalition of large technology companies to the parliamentary joint committee on intelligence and security which is currently undertaking a mandatory review of the Assistance and Access Act that was passed under urgency last year.

The coalition includes Amazon, Google, Facebook, Apple, Twitter and Cloudflare and US civil liberties organisations.

It claimed US Congress was unlikely to go along with a bilateral agreement with Australia under the recently passed Clarifying Lawful Overseas Use of Data (CLOUD) Act.

The CLOUD Act came about as a way to regularise cross-border data access, so as to end a multi-year legal battle between the US government and Microsoft over emails stored on servers in Ireland. 

Australia is keen on a bilateral CLOUD Act agreement, as it would bypass the current awkward and slow Mutual Legal Assistance Treaty (MLAT) mechanism for access to data on US servers.

"Encryption is essential to protecting the human rights of privacy and free expression, but with Australia’s new Assistance and Access Act of 2018 undermining digital security, the risks and threats to these human rights increase dramatically," the coalition states.

"The law imperils security protections that dissidents, human rights activists, and others rely on, and is particularly a risk for journalists who need to ensure the security of their sources".

Lack of judicial or independent reviews and the broad discretion given to Australian security agencies under the encryption-busting laws also raises concerns for the coalition, along with the secrecy provisions the new law bring in that include indefinite non-disclosure orders.

Taken together, the coalition says the laws "undermine substantive and procedural protections for privacy and civil rights" and threaten the country's ability enter into a bilateral agreement under the CLOUD Act.

Australia should either repeal or substantially amend the laws to make them compatible with human rights obligations, and to add accountability, transparency and reporting, the coalition said.