On October 15, 2026, the Australian Parliament introduced legislation that would create a new Digital Duty of Care. The legislation’s stated purpose is to better protect Australians from online harms by requiring online service providers to take reasonable steps to keep Australian users safe on their service.

Strong cybersecurity is foundational to achieving the lawmakers’ goals. As explained in the comments submitted to the Australian Senate Environment and Communications Legislation Committee, the Center on Cybersecurity Policy and Law (the Center) strongly supports the Australian government’s goal of protecting users from online harm. The Center is concerned, however, that some provisions in the draft legislation could inadvertently weaken cybersecurity in ways that would make users less, rather than more, safe.

Specifically, the Center recommends three core amendments to the proposed legislation: First, establish an affirmative cybersecurity safeguard, to protect against measures that ultimately make users less safe. Second, require that any proposed directives issued under the law be subject to independent review to ensure compliance with this affirmative safeguard. And third, clarify that the duty of care does not require providers to create access to communications that it is not otherwise technically capable of accessing, or to otherwise weaken security protections for the purpose of determining whether a communication is harmful or lawful.

Cybersecurity Is Integral to Online Safety

Rapid development in artificial intelligence is making it exponentially easier to commit sophisticated online frauds, scams, and other cyber-enabled attacks at scale. This exacerbates an already significant threat. 

The Australian Federal Police reports that criminal networks are using AI to create entire fake investment ecosystems, including fabricated platforms, reviews, performance data, advertisements, and media coverage. As of July 2026, Australians had already reported more than $45 million in investment-scam losses that year. In FY26, the Australian Securities and Investments Commission removed more than 19,400 online scams, 182% more than the previous year. ASIC noted that the sharp rise in these scams follows the rise in AI use. The net effects are staggering: Australians lost $2.18 billion to scams in 2025, according to the National Anti-Scam Centre. 

Artificial intelligence can amplify these risks by reducing the time and effort required to identify vulnerabilities, develop exploits, and scale social engineering campaigns. 

Given these risks, the Australian Government has issued Secure by Design guidance, which emphasizes that cybersecurity should be embedded in the design, development, and operation of products and services from the outset. The digital duty of care should reinforce that approach.

Cybersecurity Should be a Required Affirmative Safeguard

The proposed legislation (section 26A) suggests several matters to be considered when determining whether an action or measure is “appropriate and effective” for purposes of complying with the duty of care. The list includes the nature of the relevant material, the expected effectiveness of the proposed measure, whether it is proportionate to the identified risk, and the impact on the security of the online service.

Impact on security should not just be one factor to consider among many. Instead, the section should be revised to add an affirmative and explicit cybersecurity safeguard given its core role in protecting online safety. Specifically, the framework should establish a bright-line rule: a measure should not be considered appropriate or effective if it creates a systemic weakness or vulnerability, weakens encryption or authentication, or materially increases the risk of unauthorized access to otherwise secure information.

Australian legislation and regulatory guidance already recognize that government requirements should not create systemic cybersecurity weaknesses. For example, section 317ZG of the Telecommunications Act 1997 and related Department of Home Affairs guidance prohibit measures that weaken encryption or authentication, create backdoors, or prevent providers from addressing vulnerabilities. The Bill should apply the same principle to the digital duty of care and any remedial direction issued by the Commissioner. 

‍

Our Recommendations

The Center recommends three changes to better integrate cybersecurity into the proposed framework:

1. Establish an explicit cybersecurity safeguard. The digital duty of care should prohibit the authorization or requirement of measures that would introduce a systemic weakness or vulnerability, weaken encryption or authentication, or materially increase the risk of unauthorized access.
2. Require cybersecurity review of regulatory measures. Before issuing regulations or other applicable measures under the duty of care, the Commissioner should be required to obtain an independent assessment of their cybersecurity implications and ensure that they comply with the affirmative cybersecurity safeguard.
3. Clarify that the duty of care does not require general monitoring of communications. The framework should make clear that providers cannot be required to create access to communications that it is not otherwise technically capable of accessing, or to weaken security protections for the purpose of determining whether a communication is harmful or lawful.

The Center strongly supports Australia’s goal of protecting users from online harms. These recommendations are critical to ensuring that the effort to protect users does not inadvertently have the contrary effect of weakening online protections.