Re: ART FOI review - myGov Code Generator app source code

--===============4709083248784298339==
Content-Type: multipart/alternative; boundary="000000000000b9d6cd0647750183"

--000000000000b9d6cd0647750183
Content-Type: text/plain; charset="UTF-8"

Probably worth remembering that the basis for determining that something is
exempt from FOI under national security grounds only requires a
determination that the release of the information has the potential to
cause some level of harm/damage to the government or public.

They could very easily block it on the basis that the solution is currently
operational, and a flaw identified by a threat actor on the basis that it
was open sourced would likely result in harm to the public or
government interests. A discussion about technical compliance to ISM
requirements doesn't even come into it.

-Matthew


On Sat, 3 Jan 2026 at 12:46, Glen Turner via linux-aus <
[email protected]> wrote:

>
> 1) a FOI request might not result in the Code Generator source code,
> but FOI should be able to illuminate the decision making around how the
> app came to be, say versus a list of recommended TOTP apps.
>
> 2) a potential claim that the app has a national security sensitivity
> would imply the agency has done a lot of paperwork to meet the
> requirements of a novel national security cryptographic system, and
> some of that may be obtainable by FOI. In particular the list of ISM
> exceptions would be long and fundamental, eg: the TOTP secret key does
> not roll over often enough, the app is fielded onto uncontrolled
> hardware and unmanaged operating systems.
>
> -glen
> _______________________________________________
> linux-aus mailing list
> [email protected]
> https://lists.linux.org.au/mailman/listinfo/linux-aus
>
> To unsubscribe from this list, send a blank email to
> linux-aus-unsubscribe-cunTk1MwBs8iFSDQTTA3OBCuuivNXqWP@public.gmane.org
>

--000000000000b9d6cd0647750183
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Probably worth remembering that the basis for determi=
ning that something is exempt from FOI under national=C2=A0security grounds=
 only requires a determination that the release of the information has the =
potential to cause some level of harm/damage to the government or public.</=
div><div><br></div><div>They could very easily block it on the basis that t=
he solution is currently operational, and a flaw identified by a threat act=
or on the basis that it was open sourced would likely result in harm to the=
 public=C2=A0or government=C2=A0interests. A discussion about technical com=
pliance to ISM requirements doesn&#39;t=C2=A0even come into it.</div><div><=
br></div><div><div dir=3D"ltr" class=3D"gmail_signature" data-smartmail=3D"=
gmail_signature"><div dir=3D"ltr">-Matthew<br></div></div></div><br></div><=
br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=
=3D"gmail_attr">On Sat, 3 Jan 2026 at 12:46, Glen Turner via linux-aus &lt;=
<a href=3D"mailto:[email protected]">linux-aus-cunTk1MwBs8iFSDQTTA3OPd9D2ou9A/[email protected]=
u</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin=
:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"=
><br>
1) a FOI request might not result in the Code Generator source code,<br>
but FOI should be able to illuminate the decision making around how the<br>
app came to be, say versus a list of recommended TOTP apps.<br>
<br>
2) a potential claim that the app has a national security sensitivity<br>
would imply the agency has done a lot of paperwork to meet the<br>
requirements of a novel national security cryptographic system, and<br>
some of that may be obtainable by FOI. In particular the list of ISM<br>
exceptions would be long and fundamental, eg: the TOTP secret key does<br>
not roll over often enough, the app is fielded onto uncontrolled<br>
hardware and unmanaged operating systems.<br>
<br>
-glen<br>
_______________________________________________<br>
linux-aus mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">linux-aus=
@lists.linux.org.au</a><br>
<a href=3D"https://lists.linux.org.au/mailman/listinfo/linux-aus" rel=3D"no=
referrer" target=3D"_blank">https://lists.linux.org.au/mailman/listinfo/lin=
ux-aus</a><br>
<br>
To unsubscribe from this list, send a blank email to<br>
<a href=3D"mailto:linux-aus-unsubscribe-cunTk1MwBs8iFSDQTTA3OBCuuivNXqWP@public.gmane.org" target=3D"_blan=
k">linux-aus-unsubscribe-cunTk1MwBs8iFSDQTTA3OBCuuivNXqWP@public.gmane.org</a><br>
</blockquote></div>

--000000000000b9d6cd0647750183--

--===============4709083248784298339==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
linux-aus mailing list
[email protected]
https://lists.linux.org.au/mailman/listinfo/linux-aus

To unsubscribe from this list, send a blank email to
linux-aus-unsubscribe-cunTk1MwBs8iFSDQTTA3OBCuuivNXqWP@public.gmane.org

--===============4709083248784298339==--