The Australian government proposes a new cybersecurity law, modeled after UK's Investigatory Powers Act, to force tech companies to decrypt messages
Rod McGuirk / AP News :
Context & Ripple Effects
In July 2017 Australia proposed a cybersecurity law explicitly modeled on the UK's Investigatory Powers Act-style approach, aiming to compel tech companies to decrypt messages. The proposal landed amid a broader Western push to pierce end-to-end encryption, and it set the template for what followed.
It did not stay a proposal: by late 2018 Canberra had passed a sweeping anti-encryption bill giving police powers to implant malware and insert backdoors over expert and industry objections, and a later FOIA disclosure showed the law could reach social media giants, telcos, retailers, and Wi-Fi providers.
First-order effects
- Tech companies operating encrypted messaging services in Australia immediately face a legal demand to build decryption capability, forcing a choice between weakening their encryption for Australian authorities or resisting compliance.
- Australian police and intelligence agencies gain a statutory lever to compel assistance from platforms rather than relying on voluntary cooperation.
Second-order effects
- The legislation becomes a reference model other governments can copy, raising the prospect of decryption mandates spreading beyond Australia and putting global platforms under patchwork national demands they cannot satisfy once for all jurisdictions.
- Companies like Apple, WhatsApp, and Signal are pushed into public advocacy against scanning and backdoor mandates — a stance that later showed results when Australia watered down draft rules on detecting abuse content in E2EE services after industry pushback.
Third-order effects
- If the pattern holds, encryption policy settles into a recurring negotiation between states demanding lawful access and platforms defending end-to-end encryption, with the strength of industry resistance shaping how far each mandate actually goes.
- Security experts' warnings about backdoors frame a longer-term structural risk: laws built for targeted access normalize systemic weaknesses in consumer messaging infrastructure.
The trend: Governments are moving from proposing decryption mandates to enacting them, while platform resistance increasingly determines the final scope of those laws.