Decision Letter

Written by Claude Haiku 5.5 from the extracted text on 14 Oct 2026. It can miss or misread redacted and scanned pages. Check the source before relying on it.

The ATO decision letter (FOI-2026-00908, dated 31 July 2026) concerns a request for the current Software Bill of Materials (SBOM) for the myID Android application, in SPDX, CycloneDX or other format. The ATO located no existing discrete document and, under section 17 of the FOI Act, created one from its software composition analysis tooling. That SBOM was refused in full under conditional exemption in section 47E(d) (substantial adverse effect on the ATO's operations), on the basis that its component and version inventory could facilitate targeted attacks on the myID service. The decision found public interest factors against release outweighed those favouring access. It noted that myID's third-party licence summary (Annexure A) is already published, and that the app is distributed through Google Play and Apple stores. The letter sets out internal review and OAIC review rights.