The Economic Impact of Laws that Weaken Encryption

In December 2018, the Parliament of Australia passed the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (better known as TOLA) which expanded government authority and capabilities to circumvent digital data protections. TOLA created a framework by which law enforcement and intelligence agencies, or LEIAs, could request or require information technology providers, or in the terminology of TOLA–Designated Communications Providers (DCPs) – to provide assistance in accessing the content of encrypted data, which may involve sharing of confidential company information or the development of new capabilities.

The focus of this report is to assess the available evidence of the impact of TOLA on the Australian and global economies. Our analysis leads us to conclude that TOLA has the potential to result in significant economic harm for the Australian economy and produce negative spillovers that will amplify that harm globally. By significant, we mean economic harms measurable in the multiple billions of dollars that are broad-based and likely to be (primarily) realized in coming years.

There are numerous mechanisms by which TOLA may impose economic harms. For example, TOLA increases business uncertainty. Studies completed by the US National Institute of Standards and Technology (NIST) in 2001 and 2018 concluded that government-sponsored interventions that reduced uncertainty about digital security resulted in aggregate benefits worth many billions of dollars. By increasing uncertainty among digital market participants as to the best ways to secure digital information, TOLA may forego the realization of analogous benefits.

Second, TOLA can harm the brand image of DCPs with operations in Australia that are vulnerable to the threat TOLA poses for the digital security of their products and services. Customers, which includes both enterprise and mass market Internet users, concerned that their data may be rendered less secure due to TOLA may opt to take their business elsewhere. Such responses can reduce DCP revenues and increase DCP operating costs as DCPs adopt work-around strategies to offset the TOLA-related threats. These direct effects need not be limited to DCPs that receive TOLA notices: they may be incurred by DCPs in anticipation of receiving a TOLA notice or by other entities concerned about the impact of TOLA. Those entities need not be limited to DCPs but may include their customers. In aggregate, these direct and indirect effects are likely to be broad-based and accumulate over time as effects ripple through the economy.

Download Now to read full report.