TOLA Act
1 min
Australia’s Assistance and Access Act 2018 is among the most far-reaching encryption legislation in democratic countries. It allows authorities to issue: Technical Assistance Requests (TARs) asking for voluntary help; Technical Assistance Notices (TANs) compelling specific assistance within existing capabilities; and Technical Capability Notices (TCNs) requiring companies to build new capabilities. Critically, TCNs can require companies to create technical means for accessing encrypted communications. While the law technically prohibits requiring ‘systemic weaknesses’ in encryption, the definition is ambiguous and companies cannot publicly discuss what they’ve been compelled to do due to secrecy provisions. This creates uncertainty about whether Australian-linked technology products contain mandated vulnerabilities. The law applies to Australian companies and foreign companies with Australian nexus, raising concerns for any software or service developed or operated from Australia.