Since December 2018, Australia's law enforcement and intelligence agencies have had a legal toolkit for getting at encrypted data: the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (Cth), usually called the Assistance and Access Act or the encryption laws. Parliament passed it on 6 December 2018 and it took effect within days. The Act lets agencies ask, and in some cases compel, technology and communications businesses to help them access data that encryption would otherwise keep out of reach.
The regime exists because agencies say encryption is hiding serious criminal activity. The Department of Home Affairs reports that over 95 per cent of ASIO's most dangerous counter-terrorism targets use encrypted communications, and that encryption affects intelligence coverage in nine of ASIO's ten priority cases. Agencies such as the Australian Federal Police and state and territory police forces want a lawful way in, without weakening encryption for everyone else.
That means the law is not aimed at telcos only. If your business provides an online service, develops software, hosts customer data or supplies communications equipment, you could one day receive a request or notice under the regime. This article explains how it works: who can issue what, what is voluntary and what is compulsory, the limits agencies must stay within, the secrecy rules that apply once a notice arrives, and the traps that catch businesses out.
Who can ask, and who gets asked
The framework involves three groups of players.
- Issuing agencies: the "interception agencies", being the Australian Federal Police, state and territory police forces and other law enforcement agencies, together with intelligence agencies such as ASIO, ASIS and ASD. Each can seek industry assistance in support of its lawful investigations.
- Recipients: businesses that fall within the broad definition of a "designated communications provider". That includes carriers and carriage service providers, providers of electronic services such as messaging, email and cloud services, software developers, and manufacturers and suppliers of equipment and devices. Home Affairs describes the reach as covering the full scope of companies that supply communications services and devices in Australia, including providers based offshore.
- Overseers: the Inspector-General of Intelligence and Security (IGIS), the Commonwealth Ombudsman, the Parliamentary Joint Committee on Intelligence and Security (PJCIS), the Independent National Security Legislation Monitor, and independent technical assessors appointed for capability notices.
The definition of "designated communications provider" is deliberately wide. A software-as-a-service business, an app developer, an e-commerce platform holding customer accounts, or a hardware importer can each be in scope. You do not need to be a licensed telecommunications carrier to receive a notice.
The three instruments: a request and two notices
The regime is built around three instruments that escalate in seriousness: a technical assistance request (voluntary), a technical assistance notice (compulsory) and a technical capability notice (compulsory, and the most demanding). Identifying which one you hold is the most important first step, because the consequences differ sharply.
Technical assistance requests (TARs)
A TAR is a request, not a command. An agency may issue one where it believes you can provide the assistance, and compliance is voluntary; the agency is required to tell you that. The law limits the purposes for which a TAR can be issued: safeguarding national security, protecting Australia's foreign relations and economic well-being, or assisting the enforcement of serious Australian or foreign criminal offences.
A TAR might ask you to supply customer data, create a version of your software with certain behaviour enabled or disabled, or give an agency administrator access to information you host. You are not required to act, and there is no penalty for declining. Even so, treat it seriously: it signals an active investigation, and the request itself is a useful preview of what a compulsory notice might later require.
Technical assistance notices (TANs)
A TAN is compulsory. It can only be issued to a designated communications provider, and it works with the capability you already have. Examples include removing electronic protection from a product (such as switching off end-to-end encryption for a targeted account), providing technical information about how a product or service operates, ensuring that obtained information appears in a particular format, or changing certain features of your service.
TANs may only be issued for the purposes of safeguarding national security or assisting the enforcement of serious Australian and foreign criminal offences. A TAN cannot require you to build new capability, as that is the role of a technical capability notice, and it must be reasonable, proportionate, practical and technically feasible. The agency must consult you before issuing a TAN, with an exception only where the matter is urgent and you waive the consultation. Declining to comply is not an option: failing to comply with a TAN is a contravention with serious consequences, including criminal exposure. The precise exposure changes as the Act is amended, so it is a question for legal advice at the time.
Technical capability notices (TCNs)
A TCN is the compulsory step-up. It requires you to build new capability into a product or service so an agency can carry out its lawful activities. A notice might, for example, require you to build a feature that generates custom reports on data patterns relevant to an investigation.
TCNs are issued at the most senior level, through the Attorney-General, and carry the strongest safeguards. If you ask, the Attorney-General must appoint two independent assessors, one with technical expertise and one who has previously served as a judge, to assess whether the notice should be given. The assessors weigh reasonableness, proportionality, practicability and technical feasibility, and whether the notice is the least intrusive measure that would achieve the agency's legitimate objective. They must give the greatest weight to whether the notice would require building a systemic weakness or vulnerability. The Attorney-General must have regard to their report, though is not bound to follow it. Under the Act's compensation arrangements, providers are compensated for the reasonable costs of complying with a notice.
When a notice arrives: what happens next
The process after service can be mapped in steps.
- Service: A request or notice is sent to your registered address or registered email. If you are a sole trader it will come directly to you; a company receives it at its registered office.
- Verify and classify: Confirm the document is genuine and identify which instrument it is. The classification determines everything that follows.
- Assemble your response team: Because of the secrecy rules below, involve only the people who need to know: the executives who must decide, the technical staff who will do the work, and your lawyers.
- Get legal advice before you respond: A lawyer can check the instrument against the law, confirm what it can and cannot require, and negotiate with the agency.
- Respond: For a TAR, decide whether to help. For a TAN or TCN, plan compliance, or challenge it through the mechanisms below.
- Document everything: Record the assistance given, the staff time and the costs. Compensation depends on being able to show what compliance cost.
Challenging a notice
If you believe a notice is unreasonable, disproportionate or technically infeasible, there are avenues.
- Consultation and negotiation: Agencies must consult before TANs and TCNs (except in urgent cases), which is the natural point to raise feasibility and scope concerns.
- Independent assessment: For a TCN, you can request the two-assessor assessment described above.
- Complaints: You can complain to the IGIS for intelligence agency actions, or to the Commonwealth Ombudsman for law enforcement agencies.
- Variation or revocation: You can seek to have a notice varied or revoked rather than complied with in full.
- Court review: The scope of court review of notices has been contested, and whether judicial review is available in your case is a legal question your lawyer can advise on.
What a notice cannot require
The guardrails are statutory, not merely policy. Home Affairs states plainly that nothing in the legislation can require industry to break encryption. Specifically, a TAR, TAN or TCN cannot:
- require you to implement or build a "systemic weakness" or "systemic vulnerability" into a form of electronic protection, this being the Act's central prohibition in s 317ZG of the Telecommunications (Interception and Access) Act 1979 (Cth);
- require you to build a decryption, interception or data retention capability;
- require access to communications without an existing warrant or authorisation;
- compel an employee to undertake activities without the employer's knowledge.
Every requirement must also be reasonable, proportionate, practical and technically feasible. The Government's stated position is that it will not require companies to do the impossible. If a notice asks for something that crosses these lines, that is the basis for refusing, negotiating or challenging it, and for seeking legal advice.
The secrecy rules: who you can tell
Receiving a request or notice triggers secrecy obligations that reach beyond the named recipient. They apply to your business, its employees, its contractors and the contractors' employees. In general, you cannot disclose that you have received a request or notice, and you cannot disclose its contents.
The exceptions are narrow. You can disclose the request or notice to the people who need to know in order to comply, such as the staff, contractors and suppliers doing the work, and to your legal advisers. You can also raise concerns with the oversight bodies. Beyond that, do not tell anyone without advice: not investors, not insurers, not public relations advisers, not family. Unauthorised disclosure is a criminal matter, and the penalties have been significant since the regime began. The precise exceptions and penalties change as the Act is amended, so the safe rule is to ask your lawyer before telling anyone anything.
Because the secrecy rules apply to employees and contractors as much as to the business, part of responding well is running a tight internal process: a named response team, clear instructions not to discuss the matter, and records kept securely. A single indiscreet email or social media post can create liability for your business and the individual.
Where businesses usually trip up
Several mistakes recur across the businesses that have dealt with the regime:
- Confusing a TAR with a TAN: Treating a voluntary request as compulsory wastes resources; treating a compulsory notice as optional creates liability.
- Letting staff talk: The secrecy rules are the least understood part of the regime and the easiest to breach.
- Assuming a backdoor is being demanded: Notices cannot require systemic weaknesses; if one seems to, that is a ground for challenge, not silent compliance or silent refusal.
- Accepting infeasible requirements: If a requirement is not technically feasible, say so and document why, rather than promising something you cannot deliver.
- Failing to record costs: Compensation depends on evidence; a business that does not track staff time and expenses leaves money on the table.
- Reacting without a plan: The businesses that cope best are those that already know what a request or notice looks like and who to call.
How a lawyer helps
A technology and privacy lawyer works through the process with you at each stage.
- Classification and verification: confirming what you have received and what the law currently requires of you.
- Negotiation: engaging with the agency on scope, feasibility and proportionality before you commit to anything.
- Challenge: preparing submissions for the independent assessment process, seeking variation or revocation, and advising on complaints to the IGIS or the Ombudsman.
- Compensation: building the evidence base for your costs and pursuing what you are owed.
- Compliance: drafting the internal process, briefing staff on the secrecy rules, and managing the response so the business does not breach the law while trying to comply with it.
- Currency: the regime has been amended several times since 2018 and is subject to ongoing review by the PJCIS and the Independent National Security Legislation Monitor, so the precise obligations in force when a notice arrives may differ from the outline above. A lawyer will apply the current law to your situation.
Know which instrument you are holding
The point where most of the risk concentrates is the first hour after service. Whether you hold a voluntary request or a compulsory notice changes what you must do, what you may say and what happens if you get it wrong, and the secrecy rules mean you cannot work the answer out in public. Having a lawyer classify the document and map your options before you respond is inexpensive compared with the cost of a mistaken response to a compulsory notice. If a request or notice arrives, that is the moment to call.