I have submitted a request for an OAIC review of this decision, with the following reasoning:

The DTA has decided that the documents are exempt under section 47E(d) of the FoI Act, specifically that their release would "have a substantial adverse effect on the proper and efficient conduct of the operations of an agency." I believe this is wrong: "proper" and "efficient" are two very different criteria. In the case of the security and privacy properties of cryptographic protocols, quick accreditation of non-compliant systems by people who do not fully understand the consequences could result in improper (i.e. incorrect) certification of systems that did not in fact meet the intended security requirements of the TDIF. Open examination of both the systems and the accreditation process, by informed members of the public, could substantially improve both the security of the systems and the proper functioning of the certification process.

I have sought access to the documents requested to shed light on concerns that a focus on speedy approvals in the name of efficiency may have resulted in the accreditation of identity services that may not deserve accreditation because they may fail to fully meet privacy and security requirements in the specifications for accreditation.

The decision to deny access should be overturned because based on the reasons provided it does not:
· sufficiently identify and weigh in the balance the full range of public interest factors that favour access;
· sufficiently explain the basis for or the evidence supporting the assertions that disclosure of all of the documents sought could reasonably be expected to prejudice:
· DTA’s ability to obtain confidential information;
· DTA’s ability to obtain similar information in the future; or
· the effectiveness of DTA’s expected regulatory activities.

The supporting statement that: "The system would be undermined if it was generally known the details of the framework, which would in turn affect public confidence in the Digital Identity system" is nonsensical, because the details of the framework are already described in considerable detail on the DTA's website. The DTA argues further that "The release of this material at this time would erode trust the community and agencies have in the DTA that would have a substantial adverse effect on the continuing work DTA are undertaking on the framework." On the contrary, I believe technical input from the public could have a substantial positive effect on the DTA's regulatory process and technology. If the DTA is suggesting that public confidence would be undermined by general public knowledge of the accreditation process or implementation details of accredited identity services, then this suggests that there may be weaknesses in the services or the accreditation system.

The DTA's assessment of factors favouring disclosure is incomplete. Public interest matters favouring disclosure of the requested TDIF information include that it:
· reveals the reasons for government decisions to provide accreditation and any background or contextual information that informed the decision; and
· informs debate on a matter of public importance, including allowing or assisting inquiry into possible deficiencies in the conduct or administration of an agency or official; and
· informs members of the public about the security and privacy properties of the accredited system, thus facilitating informed individual choice about whether to use it; and
· improves the quality of the technical solution by allowing independent analysis and examination of its security and privacy properties.

The DTA's suggestion that disclosure risks "possibly revealing vulnerabilities and operations" indicates that they do not understand the nature of secure systems - revealing the details so that Australian researchers could identify and correct problems would make the system more secure; keeping its details secret will not cause its vulnerabilities to go away.

I have recently actively participated in examination and public discussion of the technical protections of the DTA's COVIDSafe app, and have helped to identify and correct weaknesses. This has both informed public debate and directly contributed to improving the app. I believe a similar open analysis and discussion of TDIF accreditation would also be in the public interest. The case for this is even strengthened by the TDIF's focus on transparency and informed user choice.

I note that the DTA has rearranged and renamed some of their documents since my original FoI application was made due to the release of new version of the TDIF. However, the accreditation in question would have been completed under the previous version and I would argue that this should make no difference to my right of access to the documents requested as it these have already been identified in the context of the decision to refuse me access to them.