The focus of this report is to assess the available evidence of the impact on the Australian and global economies of the Australian Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (better known as “TOLA”). TOLA created a framework by which law enforcement and intelligence agencies, or LEIAs, could request or require information technology providers, or in the terminology of TOLA – Designated Communications Providers (DCPs) – to provide assistance in accessing the content of encrypted data, which may involve sharing of confidential company information or the development of new capabilities.
Our analysis leads us to conclude that TOLA has the potential to result in significant economic harm for the Australian economy and produce negative spillovers that will amplify that harm globally. By significant, we mean economic harms measurable in the multiple billions of dollars that are broad-based and likely to be (primarily) realised in coming years.
Section 3 provides a brief overview of TOLA’s history and legal impact. After an abbreviated and fast process, TOLA was passed in December 2018. Subsequently, TOLA has been subject to multiple reviews, each of which has recommended modifications to the legislation and its application. Section 4 explains the critical role that encryption plays in securing digital data and highlights some of the technical implications of introducing expanded capabilities to circumvent encryption. Section 5 addresses the potential economic impacts of TOLA. The conclusion that emerges from this analysis is that TOLA risks incurring significant future economic costs that are unlikely to be offset by future compensating economic benefits. This conclusion is warranted even though a precise quantification of the net economic impact is not feasible based on the data and research available to date, in part due to the opacity that TOLA creates.
There are numerous mechanisms identified by which TOLA may impose economic harms. For example, TOLA increases business uncertainty. Second, TOLA can harm the brand image of DCPs with operations in Australia that are vulnerable to the threat TOLA poses for the digital security of their products and services.Internet users, concerned that their data may be rendered less secure due to TOLA may opt to take their business elsewhere. Such responses can reduce DCP revenues and increase DCP operating costs as DCPs adopt work-around strategies to offset the TOLA-related threats. These direct effects need not be limited to DCPs that receive TOLA notices: they may be incurred by DCPs in anticipation of receiving a TOLA notice or by other entities concerned about the impact of TOLA. Those entities need not be limited to DCPs but may include their customers. In aggregate, these direct and indirect effects are likely to be broad-based and accumulate over time as effects ripple through the economy. Third, perhaps the single biggest source of adverse e