In 2018 the Australian parliament passed the “TOLA” Act, expanding the government’s powers to bypass digital data protections, and bringing with it the potential for significant harm to the economy and to trust in digital services and the Internet.

Under TOLA, law enforcement and security agencies can require “designated communications providers,” or other businesses associated with them, to help provide access to the content of encrypted data, even if that means disclosing confidential product information or modifying existing products and services. Given the extreme reach and potential impact of TOLA, we assumed it would have been preceded by a thorough economic impact analysis; we were surprised to find none.

The Internet Society therefore commissioned a team of independent researchers to assess the economic impact of TOLA. This team, Law & Economics Consulting Associates (LECA), has today published its final report – The Economic Impact of Laws that Weaken Encryption.

Financial Impact

The results are striking. One respondent to the research estimated that the cost of TOLA, in terms of damage to trust in its brand, was of the order of $AUS 1 billion in current and forecast sales. Another respondent has said that it is being “materially and detrimentally impacted” by TOLA. These concerns come from domestic and multi-national  organizations alike, illustrating that TOLA has impacts far beyond its home jurisdiction, whether or not that is the intent. When laws like TOLA are introduced in one country and then copied by others, the impacts multiply and spread.

As the report puts it:

“TOLA has the potential to result in significant economic harm [in the multiple billions of dollars] for the Australian economy, and produce negative spillovers that will amplify that harm globally.”

Template for Future Impact Analyses

Australia is not the first country to pass this kind of law, and in fact, TOLA extends the reach of existing Australian laws that define similar powers. The lack of economic impact assessments is all the more striking because of the vital importance of digital security in today’s data-driven economies. We hope today’s report will serve as a template for analyzing similar laws elsewhere around the world, in terms of their impact on business and consumer trust and the wider economy.

Trustworthy technology and online services are critical to every modern society, and while the economic impact will never be the only factor shaping surveillance laws, it cannot safely be ignored.

“While the challenges of estimating the economic impact are difficult, there has not been any significant public research that attempts to quantify the economic impact of TOLA or similar legislation in Australia or elsewhere. However, the lack of such empirical evidence does not imply that there is no significant impact. Instead, it suggests that the burden of proof should be shifted to evaluating the case for why TOLA is expected to yield significant benefits since the risk of significant harms posed by TOLA is clear.”

The full report is clearly organised into legal, technical, and economic analysis sections, backed up by interview and survey data. We hope that the following points encourage you to read more:

• First, many of the respondents said they were simply unsure if TOLA imposed duties on them, and how to ensure they were compliant with the law. That is not a good sign: the law is supposed to deliver predictability and consistency. Uncertainty is bad for business.
• Second, TOLA imposes a duty of silence on those who receive requests: affected organizations can’t say if they have received an enforcement order, or what they have been told to do. This not only limits the information available for estimating the true impacts of the law, it also undermines trust in digital services and the Internet. The technical section of the report is clear: we should take great care if we weaken technical protections and hope to compensate by adding procedural ones.

Holding Policymakers to Account

Encryption protects the safety and data of billions of people, and the security of nations around the world. TOLA is far from the first law of this kind, which suggests that similar laws elsewhere have been enacted without proper analyses of their economic effect, or their impact on trust. Citizens, and the Internet Society’s members and chapters, should be calling for full economic impact assessments of their governments’ policies in this area, especially now that there is a clear example to follow. Citizens should also be assessing the use of these policies relative to their stated aims, and holding policymakers to account if the two do not match.

We encourage you to read the report – The Economic Impact of Laws that Weaken Encryption – and judge for yourself. If you are a policymaker or regulator, whether in Australia or anywhere else, please consider the impacts that legislation like this can have on your economy as well as on many other aspects of society. Threats to strong encryption are threats to us all.

• Learn more about the Internet Society’s work on Encryption.
• Join the Global Encryption Coalition (GEC) to help promote and defend encryption where it is under threat.

Image by Jason Leung via Unsplash