Category: Australia Tech News

Quick Read

• The UK government is accused of issuing covert orders to Apple for data access.
• Apple has contested these demands in the Investigatory Powers Tribunal.
• Civil rights organisations warn that the government’s actions breach human rights.
• The case raises alarms regarding national security and privacy.
• Apple has removed specific security features in the UK to resist compliance.

The Dispute Over Data Access

In a developing legal conflict, the UK government’s secretive strategy to gain access to encrypted data from Apple has drawn considerable backlash. This incident began in January of the previous year when Britain purportedly issued a technical capability notice (TCN) to Apple, demanding a backdoor to encrypted cloud backups belonging to US and UK citizens.

Legal Obstacles and Human Rights Issues

While there has been no official acknowledgment from the British government, Apple has escalated the issue to the Investigatory Powers Tribunal, a specialised judicial body. Legal professionals and civil rights organisations like Privacy International and Liberty argue that these demands infringe on human rights and threaten security.

Secrecy and National Security

The British government upholds a firm policy of neither confirming nor denying the presence of TCNs, citing national security reasons. Neil Sheldon, speaking for the government, asserts that straying from this policy could aid hostile entities by disclosing which operators are subject to TCNs.

Apple’s Position on Encryption and Security

Apple has openly expressed its dedication to user privacy, underscoring the security hazards of creating a backdoor for any government. The tech powerhouse has no access to the encrypted data safeguarded by its Advanced Data Protection feature, which it has since revoked from the UK in defiance of the government’s requests.

Summary

The ongoing legal proceedings underscore the friction between national security and individual privacy rights. While the UK government remains reticent about its actions, the case has ignited a broad discussion on the implications for digital privacy and security.

Q: What is a technical capability notice (TCN)?

A: A TCN is a legal directive issued by the government requiring companies to adjust their systems to facilitate access to encrypted data.

Q: Why is Apple contesting the UK’s TCN?

A: Apple contends that adhering to the TCN would weaken security and jeopardise user privacy by introducing vulnerabilities that could be exploited by malicious actors.

Q: What is the Investigatory Powers Tribunal?

A: The Investigatory Powers Tribunal is a UK court that addresses cases concerning surveillance and privacy, offering a venue for individuals and organisations to challenge governmental surveillance actions.

Q: How have civil rights organisations reacted to the TCN?

A: Civil rights organisations such as Privacy International and Liberty argue that the TCN infringes upon human rights and public justice, advocating for increased transparency and public discourse.

Q: What could the potential ramifications be for UK users?

A: UK users may encounter diminished privacy protections if companies like Apple are compelled to comply with governmental requests for data access, raising broader concerns about digital rights.

Optus Assesses Regulation of Smart Glasses in Retail and Workspaces

Optus is currently evaluating new cybersecurity protocols that could result in regulating or even banning smart glasses in its stores and offices. This assessment was disclosed by Corien Vermaak, Optus EGM security and risk, during an event for the cybersecurity firm Zscaler.

Emphasis on Privacy and Disclosure

Vermaak pointed out that the focus is moving from an outright prohibition to ensuring that users disclose when these devices are actively recording. This strategy corresponds with the escalating concerns regarding personal privacy and the necessity to raise awareness about technology in sensitive settings.

Heightened Public Anxiety

Public anxiety over smart glasses has been increasing due to their potential misuse, especially in scenarios that compromise personal privacy. These devices have gained a negative reputation with derogatory names like “glassholes” because of their intrusive nature.

Increased Availability of Low-Cost Devices

The Australian market has encountered a surge of affordable, less reliable smart glasses. This increase prompts inquiries into the safety and privacy risks associated with these products, particularly as their services and ecosystems are not as well understood compared to established brands like Meta.

Government Actions and Future Directions

The recent ban by the NSW government on smart glasses at public pools, especially those used by children, has established a precedent and fueled dialogue surrounding privacy. Optus is thoughtfully reflecting on these changes as it develops its own strategies.

Future Considerations

Vermaak suggested that Optus is not prepared to execute a total ban yet. Instead, the emphasis may be on mandating users to disclose their use of smart glasses, akin to seeking approval for recording in virtual meetings. Furthermore, the importance of device security labeling is anticipated to rise as part of the federal government’s strategy on cybersecurity.

Conclusion

Optus is reassessing its stance on smart glasses considering privacy issues and market developments. Although a complete ban isn’t ruled out, the current focus is on fostering transparency and disclosure. This approach is consistent with broader government initiatives to improve security labeling and promote public awareness about digital safety measures.

Q: Why is Optus thinking about regulating smart glasses?

A:

Optus is contemplating regulation due to privacy issues and the growing accessibility of inexpensive, less secure smart glasses in the marketplace.

Q: What is the core focus of potential policy modifications by Optus?

A:

The core emphasis is on ensuring disclosure when smart glasses are active in recording, rather than implementing a blanket ban, to tackle privacy concerns.

Q: How has government action affected Optus’ policy deliberations?

A:

The NSW government’s prohibition on smart glasses in pools has underscored privacy concerns and prompted Optus to consider analogous regulations.

Q: Are any security measures being proposed for smart glasses?

A:

Indeed, potential security measures include mandating a visible notification when the device is recording and enhancing device security labeling.

Q: What significance does public perception have in this matter?

A:

Public perception is crucial; the improper use of smart glasses has led to negative opinions and apprehensions about personal privacy, driving discussions on policy.

Q: Is a full prohibition on smart glasses anticipated?

A:

At present, Optus is not contemplating a full ban but is concentrating on disclosure and transparency as primary strategies.

Dan Jermyn from Westpac.

Westpac Adopts AI Tokens for Intranet Enhancement

Westpac has harnessed artificial intelligence (AI) to facilitate a significant technological enhancement, accomplishing a project that normally incurs “low seven figures” for a minimal cost. The bank’s Chief AI Officer, Dan Jermyn, revealed this important milestone during a recent briefing on data, digital, and AI endeavors. This accomplishment signifies an early success in Westpac’s alliance with Amp, which was announced last month.

Collaboration with Amp

The partnership with Amp is intended to transform the manner in which Westpac designs and implements technology. Through the use of AI, the bank aims to bolster major initiatives and rapidly improve digital experiences. The intranet renovation illustrates the efficiency and affordability promised by this collaboration, with the migration finalized for merely $12,000 USD ($16,880 AUD) in AI tokens, demonstrating a clear return on investment (ROI).

The Contribution of AI to Value Generation

Though the specific effects of AI on projects aren’t always transparent, Andrew McMullan, Chief Data, Digital, and AI Officer, stressed the necessity of grasping AI’s contributions in a broader environment. He acknowledged that the value of AI might not always be easily differentiated, as it frequently merges with other data or indicators to improve results.

Oversight of AI Token Application

Cost management is a vital component of AI adoption. Jermyn pointed out that token usage is closely monitored, with AI token trackers set up on desktops to oversee expenditures. The bank is devoted to striking a balance between cost management and the growing use of AI tools, ensuring ongoing value generation.

Anticipated Developments

With the successful implementation of AI in the intranet initiative, Westpac foresees an increase in token utilization. Nevertheless, the collaboration with Amp is predicted to sustain cost efficiencies, with unit economics progressing alongside value generation.

Conclusion

Westpac’s strategic deployment of AI tokens for its intranet renovation has demonstrated both cost-saving and efficient results, due to the bank’s alliance with Amp. By prioritizing speedy delivery and thorough oversight of AI token usage, Westpac is establishing a benchmark for future technological advancements.

Q: What was the initial projected cost of the project?

A:

The initial estimate was in the low seven figures.

Q: How much did Westpac invest using AI tokens?

A:

Westpac executed the project for $12,000 USD ($16,880 AUD) employing AI tokens.

Q: What is the objective of Westpac’s partnership with Amp?

A:

The collaboration seeks to revolutionize technology development and delivery, rapidly enhancing digital experiences.

Q: How does Westpac monitor AI token utilization?

A:

AI token trackers are installed on desktops to keep track of expenses and usage.

Q: What obstacles does Westpac encounter with AI integration?

A:

The primary challenge is managing expenses while ensuring value is generated with the increased use of AI tools.

Q: What role does AI play in Westpac’s projects?

A:

AI combines with other data and indicators to boost project outcomes, even if its exact impact may not always be identifiable.

Q: What future expectations does Westpac hold for AI token utilization?

A:

Westpac anticipates a rise in usage but aims to retain cost efficiencies through the collaboration with Amp.

Cisco’s Major Vulnerability: CVE-2026-76461

Cisco, the leading networking company, has identified a critical vulnerability in its Secure Email Gateway products. Known as CVE-2026-76461, this issue raises concerns due to its potential to allow attackers to run arbitrary commands as root. With a critical CVSS 3.1 base score of 9.8, this vulnerability impacts both physical and virtual gateways, presenting a significant risk to global systems.

SQL Injection: Exploitation Method

Utilizing this vulnerability does not require login information. Attackers can send emails with harmful SQL commands that the gateway executes, circumventing traditional security measures. This gap in the email parsing mechanism enables attackers to run commands with root access, which could jeopardize the whole system.

Cloud Services and Local Devices

Cisco has proactively updated its cloud-based Secure Email services to AsyncOS 16.5.0-780 to counteract this threat. Nevertheless, it is recommended that on-premises users examine their systems for signs of compromise, such as PostgreSQL commands appearing in mail logs. Administrators should also closely inspect firewall and network logs for any unusual data activity.

Immediate Upgrade Required

Since there are no workarounds available, Cisco strongly urges clients to upgrade to the corrected versions: AsyncOS 15.5.5-014, 16.0.4-302, and 16.5.0-780. Furthermore, Cisco has disclosed four supplementary vulnerabilities rated 9.8 and one rated 7.5, advising users of Secure Email and Web Manager to update to versions 15.5.5-006 or 16.5.0-429.

Conclusion

Cisco’s identification of the CVE-2026-76461 vulnerability highlights the urgent need for prompt updates and awareness against advanced cyber threats. With no available workarounds, upgrading systems is the sole method to defend against possible exploitations. Cisco’s quick action regarding cloud services illustrates the necessity of strong security protocols in safeguarding sensitive information and infrastructure.

Q: What is CVE-2026-76461?

A: CVE-2026-76461 is a significant vulnerability in Cisco’s Secure Email Gateway appliances that allows attackers to run arbitrary commands as root through SQL injection.

Q: How do attackers exploit this vulnerability?

A: Attackers dispatch crafted emails that include malicious SQL commands, which are executed by the gateway, bypassing standard security systems.

Q: What steps should Cisco customers take to secure their systems?

A: Customers ought to upgrade to the fixed software versions suggested by Cisco, such as AsyncOS 16.5.0-780, to safeguard against the vulnerabilities.

Q: Are there workarounds for these vulnerabilities?

A: No workarounds are available. Cisco encourages users to upgrade to the most recent versions to ensure security.

Q: How does this impact cloud-based and on-premises systems?

A: Cisco has updated its cloud services, but on-premises users must manually upgrade their systems and check for signs of compromise.

Q: What other vulnerabilities have been announced?

A: In addition to CVE-2026-76461, Cisco has announced four more vulnerabilities rated 9.8 and one rated 7.5, affecting Secure Email Gateway and Web Manager.