Australia Threatens to Enforce Encryption Backdoors Under Controversial Law
Australia’s government is poised to invoke provisions of the controversial Assistance and Access Act of 2018, potentially forcing technology companies to break their own encryption in order to aid law enforcement and national security investigations. The law, which has drawn criticism for its potential impact on privacy and cybersecurity, grants the government broad powers to compel companies to assist in accessing encrypted data.
The Assistance and Access Act includes three primary mechanisms for engaging tech companies in such efforts:
Technical Assistance Requests (TARs) – These are voluntary requests from law enforcement agencies to companies for help in accessing encrypted data. While companies are not legally obligated to comply, TARs encourage cooperation between government and industry.
Technical Assistance Notices (TANs) – These are compulsory notices requiring companies to assist in decrypting data or providing technical information to law enforcement. This could include access to encryption algorithms, source code, or hardware.
Technical Capability Notices (TCNs) – The most contentious provision, TCNs require companies to build new capabilities—such as encryption backdoors—that allow law enforcement access to data. This order must be approved by the Attorney-General, confirming that it is reasonable, proportionate, and technically feasible.
Threat to Invoke TCN Powers
While the law has been in place since 2018, there is little evidence that the Australian government has ever exercised the TCN provision to force companies to create backdoors in their systems. However, that may soon change. Mike Burgess, the head of the Australian Security Intelligence Organisation (ASIO), recently indicated that his agency may use these powers to compel tech companies to provide access to encrypted communications as part of national security investigations.
Burgess emphasized that any such actions would be targeted and lawful, aimed at individuals under investigation rather than broader population surveillance. “If there are suspicions, or we’ve got proof that we can justify you’re doing something wrong and you must be investigated, then actually we want lawful access to that data,” Burgess said in defense of the potential move.
Privacy Concerns and "Backdoor" Debate
Critics of the law argue that forcing companies to build backdoors into encrypted systems compromises the security and privacy of all users, not just those under investigation. Once a backdoor exists, it can be exploited by malicious actors, foreign governments, or even law enforcement for broader surveillance beyond its original intent.
Burgess rejected the notion that providing access to encrypted data constitutes a backdoor or systemic weakness, suggesting that tech companies could design secure systems that provide lawful access when necessary without compromising the integrity of encryption. However, encryption experts have long argued that any access point created for one party, even with good intentions, weakens overall security.
Read More
Latest
