The new metadata law ¹ was passed in the Senate today, and there has been an uproar of anger in my group of friends.

That's the wrong reaction. Not because this is a good law — I think it's a pretty stupid law, especially because there's no evidence that metadata retention counters terrorism or helps law enforcement. No, I think it's the wrong reaction because there's much worse to get angry about. The problem is not that phone companies and ISPs will track what we do; the problem is that so many other groups already do that... and they're beyond the reach of this law.

Private companies already track us wherever we go on the internet and they keep more of our data than they should. They even track us when we're walking through shopping centres. Spy agencies deliberately undermine our security and largely ignore the laws we're all subject to because they have their own laws so broad that they have a "blank cheque to carry out whatever activities they deem necessary". Professional criminals steal our data to commit fraud in our names. Where do they steal that data from? All those repositories of data so many groups have on us.

What we need is not protection from our government, but protection from all of the above. The problem is that so many of those groups operate beyond Australian law, or any law, and so nothing our Parliament does will make much of a difference.

The best way to combat this mass surveillance of our technology is, in fact, better technology. New products and services are harder to spy on than before. A few years ago it was trivially easy for someone to spy on the messages you sent from your phone; now end-to-end encryption on iPhones makes it very difficult — though that security could possibly be circumvented, my guess is that it's so difficult that spying on messages between iPhones has probably largely stopped.

What we need to do now is to decide where we will draw the line on future laws.

The technologies being introduced into smartphones and other devices to protect us from a wide range of threats will also make this metadata retention law increasingly irrelevant. Once the law becomes a complete farce it will either need to be dropped, or our right to circumvent it would need to be taken away.

That's the line which we should not let Australia cross: forcing us to use technologies that cannot be secured against spies and foreign companies who don't adhere to our laws. I'm not particularly concerned about the current law because it doesn't increase our risk very much. But if ever the law changes to prevent us doing everything we can to protect ourselves and secure our data, then I'll be out on the streets protesting it as loudly as anyone else...