Contents

Introduction and Summary 1

The Role of Technology and Encrypted Communications 2

The Use of Recommendation Algorithms and the Role Companies Play 4

Conclusion. 6

Endnotes 6

Introduction and Summary

The Information Technology and Innovation Foundation (ITIF) is pleased to submit these comments in response to the Parliamentary Joint Committee on Intelligence and Security’s inquiry into the nature and drivers of radicalisation in Australia.[1] ITIF is a nonprofit, non-partisan public policy think tank committed to articulating and advancing pro-productivity, pro-innovation, and pro-technology public policy agendas around the world that spur growth, prosperity, and progress.

Encryption, particularly end-to-end encryption (E2EE)—a form of encryption in which only the parties sending and receiving an encrypted message can decrypt it—has repeatedly found itself at the centre of public safety debate.[2] Privacy and security experts, civil liberties advocates, and tech companies argue for the importance of encryption to protect private communications and sensitive data, while law enforcement and national security agencies claim that encryption makes their jobs more difficult. However, regulatory efforts to weaken encryption ultimately harm law-abiding individuals and businesses far more than criminals. Law enforcement should continue to use proven investigative methods to obtain information from devices, metadata, and other available sources, rather than compelling companies to weaken or break encryption.

Recommendation algorithms have more recently found their way into this debate. While recommendation algorithms pose legitimate policy challenges in the context of radicalisation, broad restrictions undermine or eliminate their many beneficial functions. Instead of taking blunt approaches that ban or disincentivize the use of personalized recommendation algorithms, policymakers should promote targeted interventions that empower users to shape their content experience, encourage responsible innovation, and support appropriate transparency and independent research into potential risks.

The Role of Technology and Encrypted Communications

Various law enforcement and national security agencies have advocated for mechanisms that would allow governments to access encrypted communications under lawful authority. These are sometimes described as “front doors” or “backdoors.” A front door is a publicly acknowledged mechanism designed to enable authorized government access to otherwise encrypted data, typically subject to a court order or other legal authorization. One approach is key escrow, in which a trusted third party securely holds a copy of, or access to, encryption keys that can be used to decrypt data under specified conditions. A backdoor generally refers to a mechanism that bypasses or weakens normal encryption protections to enable access, often without being publicly disclosed.

Either mechanism can introduce security risks that bad actors can use to circumvent encryption. No technical mechanism can guarantee that access to encrypted communications granted to authorities will be used only for lawful purposes while eliminating the risk of unauthorized access. Any mechanism that enables exceptional access can create additional vulnerabilities that malicious actors may exploit: Any door that opens for the “good guys” can also open for the “bad guys.” Key-escrow systems are particularly vulnerable to insider attacks or human error, as they rely on third parties to guard access to encryption keys.

Australia’s Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (TOLA) grants law enforcement and national security agencies the power to request or compel assistance from tech companies to access encrypted communications with a valid, independently approved warrant or authorization. It prohibits the government from requiring companies to weaken overall encryption security.[3] Public reporting shows that authorities have used these powers relatively sparingly. Between 2019 and 2020, Australian law enforcement agencies issued 11 Technical Assistance Requests, which ask companies to assist law enforcement voluntarily.[4] Between 2023 and 2024, the Australian Federal Police issued two Technical Assistance Notices, which require companies to assist law enforcement.[5] Notably, none of the requests or notices were connected to counterterrorism initiatives.

An independent report published in 2021 found that TOLA had the potential to result in “significant economic harm,” both in Australia and globally, by increasing business uncertainty, harming the brand image of providers with operations in Australia, and decreasing trust in digital services. The estimated direct economic impact was approximately AU$1 billion, and a survey of 79 companies, 54 of which were based in Australia, found that 36 percent of those impacted by TOLA stated that the law negatively impacted their risk environment, 20 percent said the law negatively impacted their business, and 21 percent believed it would negatively impact future operating costs.[6]

There are far more law-abiding individuals and businesses who reap the privacy and security benefits of encryption than there are criminals, terrorists, and extremists who use encryption to evade law enforcement. Governments themselves often use the same technology as the private sector and would suffer a similar loss of privacy and security. Vulnerable individuals, including victims of abuse and the LGBTQ community, use encryption to communicate privately and seek support without fear of reprisal.[7] Journalists also use encrypted messaging services to communicate with confidential sources.[8]

While many recent calls to weaken encryption cite concerns about child safety, encryption is also an important tool for children, protecting their privacy and security and giving them the agency to explore sensitive topics without fear of surveillance. [9] Restricting children’s access to encrypted services assumes that every child lives in a safe, supportive home environment, but unfortunately, many do not. The Australian Child Maltreatment Study, published in 2023, found that 62.2 percent of the Australian population have experienced at least one type of child maltreatment, including physical abuse, sexual abuse, emotional abuse, neglect, and exposure to domestic violence.[10]

Meanwhile, efforts to weaken commercial encryption will not eliminate law enforcement’s concerns surrounding radicalisation. Terrorists and extremists who have already demonstrated a willingness to break the law will not restrict themselves to providers that comply with the law. Some groups may continue to use less secure technologies, especially in the short term before alternatives become more widely adopted, which would make it easier for law enforcement to gain access to some information.

However, if domestic providers cannot offer true E2EE, terrorists and extremists can find tools from open-source software or foreign providers. If they have the technical proficiency to do so, they can even build their own, since encryption methods are now in the public domain. When terrorists, extremists, and other bad actors use foreign tools, domestic law enforcement and national security agencies lose access to metadata from domestic providers, making it more difficult for these authorities to monitor terrorist and extremist groups.

Law enforcement has alternative investigative methods that can obtain information related to encrypted communications without breaking the encryption itself. These include collecting non-content metadata, seizing and accessing devices to retrieve locally stored messages, obtaining unencrypted cloud backups, and using investigative tools to capture keystrokes or screenshots before messages are encrypted or after they are decrypted on a device. The Surveillance Legislation Amendment (Identify and Disrupt) Act 2021 expanded Australian authorities’ ability to conduct online investigations through account takeover, network activity, and data disruption warrants.[11]

Law enforcement agencies regularly rely on device or account access and human informants. For example, American law enforcement’s Phantom Secure operation relied in part on cooperation by a former employee to gain access to encrypted communication networks used by criminal organizations.[12] A joint investigation between Australia and the United States, Operation Ironside, relied on a purpose-built encrypted messaging platform secretly controlled by authorities that allowed investigators to monitor organized criminal networks and gather evidence that led to multiple arrests.[13] Finally, European authorities took down two encrypted communications networks by obtaining access to servers and devices associated with the services.[14]

The Use of Recommendation Algorithms and the Role Companies Play

Recommendation algorithms use a variety of data—such as the online activities of individual users and those of other, similar users—to order content displayed to users. While much of the debate surrounding recommendation algorithms, especially as it relates to online radicalisation, focuses on social media, many online services rely on recommendation algorithms to suggest content to users, including search engines, streaming services, advertising platforms, and more.

In the context of radicalisation, recommendation algorithms may reinforce users’ existing interests by suggesting ideologically similar content, including more extreme material. Repeated exposure can narrow the range of perspectives users encounter and increase their exposure to more extreme content, although research has found mixed evidence that algorithms systematically lead users from mainstream political content to increasingly radical views. Users’ existing beliefs, viewing choices, subscriptions, and social networks also influence the content they encounter.[15]

Content that attracts substantial engagement within a community may be recommended more widely, potentially exposing other users to extremist ideas. Recommendation algorithms often use engagement signals, such as views, likes, shares, and comments, to help determine which content to promote. However, engagement does not necessarily indicate that content is constructive or positively received. Content that provokes anger, outrage, and controversy can also generate substantial interaction, and systems optimised for engagement may amplify such content without adequately accounting for its harmful effects. This can contribute to more users seeing hate speech and other forms of extremist content.

With such a vast amount of content on platforms, recommendation algorithms are necessary to efficiently and effectively sort, filter, and recommend relevant content to users. Without personalized recommendation algorithms, users would see irrelevant content displayed randomly rather than content tailored to their interests, or they would remain restricted to chronologically displayed content from users they follow, making it far more difficult for users to discover new content.

Policymakers in multiple countries have considered a blunt approach to this complex problem: banning or broadly disincentivizing personalized recommendation algorithms. Examples of disincentives include imposing any form of increased liability on online services that use personalized recommendation algorithms or banning children below a certain age from using these online services. However, these proposals would make online services significantly less useful for users.

Australia’s proposed Digital Duty of Care Bill 2026 addresses personalized recommendation algorithms. The bill refers to these algorithms as “recommender features,” listing them among several design features the bill claims have negative behavioural impacts. It would give the eSafety Commissioner the power to create guidelines for protecting children from these design features. It would also require social media platforms specifically to disable these features for children under 16, though children under 16 are currently banned from creating social media accounts in Australia.[16]

Policymakers should preserve platforms’ ability to innovate in how they recommend and curate content while encouraging greater user control and customization where feasible. Such innovations could give users more ways to shape their experience, including choosing between personalized and chronological feeds, adjusting recommended topics, controlling the balance of viewpoints they encounter, and blocking certain keywords. Artificial intelligence tools could even allow users to describe their preferences in plain language, while parents could have similar control for their children. These approaches can empower users without requiring platforms to censor lawful content or dictate what viewpoints users should see. Some online services already have similar measures in place.[17]

Policymakers should encourage evidence-based research into recommendation algorithms without requiring platforms to disclose proprietary systems or trade secrets publicly. Appropriate access to information about how platforms recommend and moderate content can help researchers and regulators assess potential risks and inform targeted policy responses, while preserving incentives to innovate and avoiding requirements that could undermine privacy, security, or freedom of expression.

Conclusion

Effective policy responses to online safety and national security challenges should account for both the risks posed by digital technologies and the significant benefits they provide. Broad measures that weaken encryption or restrict algorithms impose substantial costs, while offering no guarantee of achieving their intended objectives.

As a general rule, rather than relying on blanket restrictions, policymakers should pursue proportionate, evidence-based approaches that address specific harms while preserving the security and utility of digital services. This includes utilizing targeted investigative capabilities, expanding meaningful user control over online experiences, and conducting additional research to support informed oversight. With this approach, policymakers can more effectively balance public safety and national security objectives with the fundamental interests of individuals, businesses, and the digital economy.

Thank you for your consideration.

Endnotes