In February 2016 the United States government went to a California court and asked it to order Apple to build software that would unlock the iPhone of one of the San Bernardino shooters. Apple refused, the FBI backed away, and the case collapsed within weeks. On its face it was a short, unresolved fight between one technology giant and one law enforcement agency. Yet the question it raised has never gone away: at what point, if any, can a government compel a private technology company to break into its own customers' data? For an Australian business that handles customer communications, that question is no longer theoretical. Australia answered it in 2018 with a law that gives local agencies the power to compel "designated communications providers" to help access encrypted information. This article walks through what happened in the Apple case, explains the Australian law that now does the same work, and sets out what it means for a small or medium business sitting on customer data.
What happened in the Apple case
The dispute grew out of the December 2015 mass shooting in San Bernardino, California, in which fourteen people were killed. The FBI recovered an iPhone 5C used by one of the shooters and wanted to read its contents. The phone was protected by a passcode, and Apple's security design meant that ten incorrect attempts would erase the data automatically. The FBI could not get in, and Apple said it could not get in either. The government's answer was to apply to a federal magistrate for an order under the All Writs Act, 28 USC 1651, in proceedings before the United States District Court for the Central District of California. The order would have required Apple to provide "reasonable technical assistance" by writing new software to disable the auto-erase function, let the FBI test passcodes, and keep the phone's memory readable long enough for a passcode-cracking program to run.
Apple's response was emphatic. Creating that software, it argued, would be a burden on its free-speech rights under the First Amendment to the United States Constitution, because software code is a form of expression. It also argued the demand was "unduly burdensome" and effectively a request for a master key that could unlock any iPhone, not just this one. The government leaned on an earlier case, United States v New York Telephone Co (1977) 434 US 159, in which the Supreme Court had held that courts could compel a telephone company to give "reasonable technical assistance", such as installing a pen register to record dialled numbers. The case was set down for a hearing on 22 March 2016.
The confrontation dissolved before it was decided. A day before the hearing the government asked for a delay, and a week later it asked the court to drop the order entirely. The FBI had found an unnamed third party able to unlock the phone without Apple's help. The case never produced a ruling, so there is no American precedent from it. But it forced the encryption debate into the open and became the reference point for every government that wanted a legal route to encrypted data. Australia was one of them.
The legal question the case left open
The Apple case never reached an answer, because the courts did not decide it. The legal question, stripped to its core, was whether a government can make a technology company assist law enforcement by undermining the security of its own product, and on what terms. Apple's argument that code is speech, and that compelling it to write code therefore burdens a constitutional right, was widely criticised as treating a company as if it held the same individual rights as a person. The case also dramatised the clash between two legitimate interests: national security and the privacy of everyone else who uses the product. The government wanted access to a terrorist's phone; Apple and its defenders pointed out that the tool it was being asked to build would work against every iPhone in the world, not just one.
Neither side won, because nobody ruled. The significance lies in what the deadlock left behind: a gap in the law that many countries, including Australia, then chose to fill with legislation rather than court orders. That is the real, transferable lesson of the case.
Why this matters to an Australian business
If you run a business that provides a phone service, an app, a cloud service, a device, or anything that touches the carriage of customer communications, the Apple v FBI fight is now your fight in miniature. Australian intelligence and police agencies do not need to go to court and argue over a writ. They have a statute that gives them the tools the FBI was seeking.
- Australia passed the Assistance and Access Act (Cth) in 2018: the Act gives ASIO, the Australian Signals Directorate, ASIS and interception agencies a set of powers to get help from the private sector with encrypted data.
- Some requests are voluntary and some are compulsory: the difference matters enormously to how you respond.
- A compulsory notice can carry a big civil penalty: a body corporate can face up to 47,619 penalty units for non-compliance.
- There are real limits built into the law: including a rule that you cannot be made to build a "backdoor" into your own system.
- The law reaches well beyond telecoms giants: the definition of a designated communications provider is broad and can cover comparatively small businesses.
The scheme set up by the Act, inserted into Schedule 1 of the Telecommunications Act 1997 (Cth), runs on three tiers. The first is a technical assistance request, which is voluntary. A customer is entitled to be told in writing that complying is a matter of choice, and that refusal carries no penalty. The second is a technical assistance notice, which is compulsory and requires a provider to do specific things it is capable of doing for a particular investigation. The third is a technical capability notice, which is the most serious: it can require a provider to build new capabilities into its systems so that communications can be lawfully intercepted in the future.
The most concerning tier, the technical capability notice, is also the most guarded. Before the Attorney-General can issue one, the provider must first be given a written consultation notice setting out the proposal and an invitation to make a submission, and that consultation period must run for at least 28 days unless urgency or impracticality overrides it or the provider waives it. A technical capability notice stays in force for a default period of 180 days, can specify an expiry no later than 12 months, and can be extended by agreement. When its requirements are judged for reasonableness and proportionality, the Attorney-General must weigh the interests of national security and law enforcement against the legitimate interests of the provider, the legitimate expectations of the community about privacy and cybersecurity, and whether the requirements are the least intrusive means available.
Some protections will reassure a nervous data-holding business. A notice cannot require a provider to implement or build a systemic weakness or systemic vulnerability in its electronic protections, and it cannot prevent a provider from fixing such a weakness. In plain terms, the law does not authorise an agency to order you to build a master key or a hidden decryption capability into your product for everybody. A request or notice also has no effect to the extent it would require you to do something for which the agency itself would need a warrant or authorisation under laws such as the Telecommunications (Interception and Access) Act 1979 (Cth) or the Surveillance Devices Act 2004 (Cth). In other words, the agency cannot use you to sidestep its own warrant obligations.
That last point ties directly back to Apple. One of the FBI's justifications was that it needed Apple's help to gather evidence lawfully. Australian law responds by saying: the private provider's assistance cannot be a back door around the rules the agency must itself follow. If the agency would need a warrant to do the act directly, it cannot use a notice to get you to do it for nothing.
For a small or medium business, the practical questions are about recognition and response. Do you know whether you count as a designated communications provider? Are your customer records, app data and device security framed so that a request or notice can be assessed on its merits? Do you have anyone who could tell the difference between a voluntary request you can decline and a compulsory notice you cannot safely ignore?
What you can change this week
There are five things you can do this week to put your business in a defensible position:
- Check whether the Act captures your business: work out whether you provide a carriage service, arrange supply of one, or provide a service that is ancillary or incidental to one. This position drives everything else.
- Label how you hold data: document whether customer data is encrypted in transit and at rest, where the keys sit, and who could in practice recover it. This tells you what you are even capable of being asked to do.
- Build a triage path for requests: decide now who in your business would field a letter or phone call from an agency, and who they would escalate it to before anyone commits to anything.
- Know the difference between a request and a notice: a voluntary technical assistance request can be declined, while a notice carries a penalty for non-compliance. Treating one as the other is how a business gets into trouble.
- Keep an eye on your product's security commitments: because you cannot be ordered to build a systemic weakness, your promises to customers about encryption are not automatically defeatable by a notice, but you still need to be able to show what you meant.
How a lawyer helps when an agency comes knocking
The moment a technical assistance request or notice arrives is not the moment to first look at the statute. A legal practitioner can help in at least three ways. First, they can tell you whether your business actually falls within the definition of a designated communications provider, which is often less obvious than you would expect and can turn on whether you are "ancillary or incidental" to a listed carriage service. Second, they can help you respond to a technical capability notice during the consultation period, where a written submission can shape what the Attorney-General ultimately requires and test whether it is reasonable, proportionate and the least intrusive option. Third, they can advise on compliance without breaking the secrecy and confidentiality obligations that attach to dealings with these notices. Getting that wrong is where a reasonable business can become an unwitting non-complier, and that is precisely the situation where independent legal advice earns its keep.
The lesson Apple never got to test
The Apple case is remembered as a standoff between a giant and the FBI, but the durable lesson is structural: no company should be left to work out on its own, in the middle of an investigation, whether an agency can force it to undermine its own security. Australia settled that question by statute, and the settlement turns entirely on the technical detail of what kind of provider you are and what you are being asked to do.
In short, Australia's Assistance and Access Act gives agencies real powers to compel help from businesses that touch customer communications, but it pairs those powers with limits, consultation rights and a ban on forcing a systemic backdoor. The key steps are to work out whether you are a designated communications provider, separate voluntary requests from compulsory notices, and get advice before you commit to a course of action.