2.1
The Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020 (the Bill) proposes the introduction of two new warrants into the Surveillance Devices Act 2004 (the SD Act) and one new warrant into the Crimes Act 1914 (the Crimes Act). This section of the report addresses issues universal, or near-universal to the three proposed powers despite the warrants themselves having specific differences and belonging to different Acts. Where chapter three to five will address warrant-specific issues, this chapter addresses issues common across the warrant types and broader issues.
2.2
This chapter will discuss the necessity and proportionality of the powers, the offences to which they apply, the assistance order framework, oversight and review of the powers. These are all issues considered by the Committee to be overarching matters across the proposed warrants rather than power-specific issues.
A new type of power
2.3
The Law Council said the Bill represented a change in focus for the Australian Federal Police (AFP) and Australian Criminal Intelligence Commission (ACIC), saying:
The bill proposes major and, respectfully, novel expansions of the existing powers of the AFP and ACIC, which merit detailed scrutiny. The new powers depart sharply from the traditional focus of investigative powers on the collection of admissible evidence of specific offences.
2.4
The AFP however said prosecution and criminal action was only one function of the AFP itself with the Commissioner telling the Committee:
I want to emphasise that disrupting crime is a core business for the AFP. There is a misconception that disrupting crimes means that an investigation will never proceed to prosecution. This is simply not true. Many of our disruption efforts still result in the prosecution of offenders.
The best example of this is our unrelenting efforts in covering illegal drugs imported to Australia. We can simply seize the drugs at the border and arrest an offender or two, if we identify them at that point, but we can also take a different approach to disrupt the harmful effects of drugs in our community. We seek to discover who sent the drugs, who bought them and their distribution points. We take law enforcement action at an appropriate time, but we also disrupt the immediate impact of drugs entering our community, identify a larger number of offenders and have a better chance of reducing future harm.
But, in the online environment, we’re far more restricted in how we can track illegal activities in this way. We can assume an identity and interact with offenders. We can get targeted warrants to intercept their communications and access their data, and, with the TOLA industry assistance framework, we can get help to open the front door. But we’ve still got one hand tied behind our back because we cannot identify what their distribution point is and what criminal network they belong to; understand what they are communicating, due to encryption; move things around inside their network – that is, modify data – or take control of their distributors to collect evidence. And, in many cases, we may not even know where the distribution network is.
2.5
The AFP additionally said:
Criminals should not be able to conduct serious crimes online and get away with it just because our laws have not kept pace with changes in technology.
2.6
From an administrative and resourcing perspective Telstra said the powers were new and a ‘significant change’ to existing carrier and internet service provider (ISP) warrant processes and capabilities which would require the development of new warrant management processes to enable carriers and ISPs to provide assistance in executing the warrants.
2.7
Twitter noted this Bill placed the new powers across two existing acts and commented on the consequences of this. Twitter said data disruption warrants (DDWs) and network activity warrants (NAWs) amended the SD Act whereas account takeover warrants (ATWs) amended the Crimes Act. Twitter said this led to divergent approaches to accountability, issuing authorities, and extraterritorial application causing ‘inconsistent and irreconcilable standards’. Home Affairs said this was to maintain conformity with existing powers and they deliberately considered where each power should be placed in existing acts.
2.8
The powers were described as extraordinary by the Law Council because:
They go further than collecting evidence for prosecution into a realm where they are actively doing things to that data, either by way of preventing access or by destroying it, which would include destroying other peoples’ property, their computers and so on, so that’s a big next step. It’s extraordinary in this other way because of the operation of computers. Computers now do everything for us. They are so directly involved in all of our personal, business and other lives that there’s a vast field of information there available for people to collect if they’re authorised to do that.
2.9
The Digital Industry Group Incorporated (DIGI) said the Bill should be viewed as an extension of the Telecommunications and Other Legislation Amendment Act (the TOLA Act) because the Bill ‘provides law enforcement with greatly expanded powers that increases the incentive to use the tools available to them under the TOLA Act. DIGI said the Bill was inexplicably linked with the TOLA Act as a service provider could be required to provide the same assistance under an Assistance Order from this Bill and a Technical Assistance Notice under the TOLA Act. DIGI said assistance requested under the Bill would not receive the same protections and processes built into the TOLA Act. DIGI recommended the Government make clear the intended relationship between this Bill and the TOLA Act.
Necessity and proportionality of the powers
2.10
Several submissions discussed both the necessity and proportionality of these powers, which were often characterised as extraordinary and novel. It was generally accepted that these powers were new and there was a requirement for the AFP and ACIC to address the threats identified above. There was then substantial debate as to whether these powers were an appropriate means of addressing the threat landscape.
2.11
The Australian Information Industry Association (AIIA) said:
The AIIA supports the intent behind this legislation that seeks to disrupt and frustrate the commission of serious offences online. The AIIA joins with other industry groups in urging the government to ensure that the guardrails and thresholds associated with this legislation are managed appropriately and that the government considers no only the civil liberty implications of the Bill but also the feasibility and implications of assistance and compliance for the technology sector on both an individual and global level.
2.12
It was from this starting point that the debate moved to whether the powers were necessary and proportional in terms of the Bill itself. More specifically, the Law Council said there were two components to necessity. Firstly whether the powers themselves were necessary compared to existing powers, and secondly the necessity for a particular warrant in particular circumstances for a particular case. It was the general argument of the Law Council that necessity was not present in this Bill.
2.13
The Law Council said the necessity of the proposed powers had not been clearly or adequately established as a threshold issue. The Law Council said they were concerned the proposed scope of the new powers was disproportionately broad compared to the threats of serious and organised cybercrime to which they are directed. In relation to child exploitation and terrorism offences the Law Council said:
That really is at the heart of the cautious approach that we’re adopting towards this. We can see, in some instances, such as child pornography and probably terrorism offences, just to take the two cases that are signalled the whole issue of the necessity of this and the proportionality of it is much clearer because of the seriousness of the offences.
2.14
Home Affairs said the tradecraft of criminals had evolved alongside communications technology. They said the growing use of the dark web and anonymising technologies was hampering investigations into serious crimes and existing electronic surveillance powers did not allow agencies to fully engage in the fight against serious crimes. They said:
Investigations into online criminality must adapt if our agencies are to continue to do the job we expect of them – keeping Australians safe.
2.15
The Human Rights Law Centre (HRLC) made the following observation of surveillance powers such as these:
Surveillance powers intrude on individual privacy, have a chilling effect on the exercise of political rights and disproportionately impact marginalised and vulnerable communities. Each time further surveillance powers are contemplated, this committee and other oversight bodies should ask whether the proposed powers are (a) strictly necessary, (b) carefully contained and (c) fully justified. We believe that the bill in its present shape does not satisfy those criteria.
2.16
The Law Council made an observation that was shared amongst many submissions, that law enforcement agencies needed powers that were adapted to the specialised context of cyber-enabled offences, but the necessity and proportionality of these powers required careful scrutiny. The Law Council said:
We’re also concerned that the new powers are disproportionately broad compared to the threats of serious and organised cybercrime to which they are directed.
2.17
There was substantial debate between submissions as to the necessity and proportionality of the powers. The Cyber Security Cooperative Research Centre (CSCRC) said the extraordinary powers were proportionate and appropriate to the threat. The NSW Council for Civil Liberties (NSWCCL) discussed the ‘cumulative effect of repeated widening of the powers of law enforcement and spy agencies to monitor Australians.’ DIGI said they believed the Bill did not adhere to the principles of proportionality or necessity. The HRLC said:
The explanatory memorandum and commentary by the minister indicate that the powers are intended to only be used in cases of the most severe wrongdoing, yet the bill doesn’t reflect that.
2.18
The Uniting Church in Australia Synod of Victoria and Tasmania (the Uniting Church) said surveillance and covert operations by law enforcement agencies against severe crimes were already permitted in the offline world and were an essential tool in law enforcement agencies’ ability to curb serious organised crime. The Uniting Church said:
It is the view of the Synod that the Commonwealth Government would not be honouring its human rights obligations under the treaties it is party to if it were to give ultimate priority to the right to privacy of those suspected of committing serious human rights abuses and crimes to the point of undermining the ability of law enforcement agencies to be able to effectively prevent such abuses and crimes.
2.19
The Uniting Church further said:
We are increasingly seeing people using technology and being provided with technology tools to defeat law enforcement. Some of those providers are wilfully engaging helping to defeat law enforcement efforts. So there is a need to look at powers that allow law enforcement to protect the basic human rights of Australians – and hopefully collaborate more globally to protect the human rights of others, because, when an Australian is using a live webcam to abuse a child in the Philippines, that’s something we should be actively trying to stop.
2.20
The Cyber Security Cooperative Research Centre (CSCRC) said:
We are now at a critical point where we as a society need to decide what kind of world we want to live in. Central to this must be the notion that all crime, whether committed online or offline, should be treated the same and the rule of law must be applied equally. If passed, this legislation will play a key role in countering serious cyber-enabled crime…While the powers contained within the bill are undoubtedly extraordinary they are proportionate and appropriate in relation to the scale and seriousness of the threat posed.
2.21
The CSCRC further outlined the requirement of the powers, noting ‘as it stands bad has the upper hand. The criminals are the ones with power’.
2.22
Some submissions questioned the requirement for the powers all together with the New South Wales Council for Civil Liberties saying ‘it is far from clear there is any shortcoming with existing powers that creates the need for additional powers’. The NSWCCL said given ATWs in particular were intended to support existing powers that it would indicate ATWs were not justified when weighed against ‘potential pitfalls’.
2.23
The Office of the Australian Information Commissioner (OAIC) said the powers were ‘wide-ranging and coercive in nature’. Specifically the OAIC said:
These powers may adversely impact the privacy of a large number of individuals, including individuals not suspected of involvement in criminal activity, and must therefore be subject to a careful and critical assessment of their necessity, reasonableness and proportionately. Further, given the privacy impact of these law enforcement powers on a broad range of individuals and networks, they should be accompanied by appropriate privacy safeguards. The OAIC considers that the Bill requires further consideration to better ensure that any adverse effects on the privacy of individuals which result from these coercive powers are minimised, and that additional privacy protections are included in the primary legislation.
2.24
The Queensland Council for Civil Liberties, Liberty Victoria, Electronic Frontiers Australia and the Australian Privacy Foundation (QCCL et al.) said the Bill provides similar power to that introduced by the TOLA Act.
2.25
The Law Council recommended amending the Bill to introduce a sunset clause of three years and a PJCIS statutory review of the powers prior to the sunset date.
Human rights and journalist concerns
2.26
The QCCL and others said they did not believe Australia had an adequate federal human rights framework and if the Bill came into effect that Australians did not have sufficient safeguards of their fundamental rights to protect them from abuse of power by authorities. The HRLC said the absence of a ‘robust human rights framework’ meant they could not endorse the expansion of AFP and ACIC powers to include these warrants.
2.27
Home Affairs said there was an error in the explanatory memorandum (EM) regarding human rights compatibility and the human rights compatibility statement would be amended accordingly.
2.28
Mr Paul Templeton said there were no provisions in the Bill for journalists which could damage the person and their reputation which would affect their career.
2.29
Home Affairs said DDWs, NAWs and ATWs apply ‘equally to all individuals, including lawyers and journalists, noting that the powers can only be used where rigorous legislative thresholds are met’. Home Affairs additionally noted all three powers did not override the principle of client-legal privilege.
Applicable offences
2.30
All three new powers apply to ‘relevant offences’. For ATWs this is at proposed section 3ZZUJ, for NAWs this is at proposed section 27KK(1)(b)(ii), and for DDWs this is at proposed section 27KA(1)(a) of the Bill.
2.31
While NAWs and DDWs are proposed to be included in the SD Act and ATWs are proposed to be included in the Crimes Act, the definition of relevant offence within each is substantively the same and as such is addressed as a universal issue across the three powers. The definition for NAWs and DDWs, by virtue of being in the SD Act, is slightly broader than ATWs in the Crimes Act. The definitions of relevant offence across the three new proposed powers are defined and clarified in Appendix C (Relevant Offences) which shows the relationship between this Bill and existing acts.
2.32
It is worth highlighting the definition of ‘relevant offence’ is already categorised in existing legislation, namely the Crimes Act and the SD Act and what this Bill proposes is to extend those existing categories to the new powers rather than defining or creating a new term. For an ATW a relevant offence is a serious Commonwealth offence or a serious State offence that has a federal aspect. For DDWs and NAWs a relevant offence is the above, as well as several other offences listed in section 6 (Definitions) of the SD Act.
2.33
Home Affairs said the definition of relevant offence was not static and would expand when Parliament enacts new offences that meet the three-year threshold, or increased the maximum penalty for an existing offence. They said:
Given the speed with which technology and digital crimes are evolving, listing specific Commonwealth and State and Territory offences as ‘relevant offences’ would require frequent legislative amendment and would cause the threshold to be out of data as State and Territory legislative changes are made.
2.34
While the EM clearly articulated the purpose of these powers to be towards the most serious of offending, as many submissions noted the definition of ‘relevant offence’ is significantly more broad than just the offences listed in the EM as being the focus for these powers. This issue of relevant offences was perhaps one of the most substantial for this inquiry, with many submissions arguing that the category was too broad and encompassed too many minor offences.
2.35
The Committee heard evidence that debated what a serious offence was, evidence about how minor offences are an important strategy for law enforcement dismantling of serious organised crime, and evidence for legislative coherence and consistency. In simple terms the oft-repeated argument from Government was that these new powers would be placed within the existing warrant frameworks with common definitions to ensure legislative consistency. The equally commonly repeated argument from industry and other groups was that these powers were extraordinary and therefore the existing categories were not appropriate.
2.36
The AFP said the relevant offences definition meant the powers could only be used for offences under investigation that carried a penalty of three years’ imprisonment or more. The NSWCCL also said the warrants would apply to any Commonwealth offence with a maximum term of imprisonment of three years or more. NSWCCL however said:
This is an extraordinary catch-all, encompassing fauna importation, fraud, and importantly, such vaguely worded offences as ‘communication and other dealings with inherently harmful information by current and former Commonwealth officers’ under sections 121 and 122 of the Criminal Code.
2.37
The NSWCCL recommended ATWs in particular be restricted to specific offences such as child sexual abuse, terrorism, and trafficking of drugs and firearms and the application of ATWs to any Commonwealth offence with a maximum term of imprisonment of three years or more be removed.
2.38
The QCCL and others said the Bill would operate in contexts other than just national security by section 3ZZUK of the amendment which defines ‘relevant offence’ as a serious Commonwealth offence or a serious State offence that has a federal aspect. QCCL and others said this included numerous offences and provided an exhaustive summary of applicable offences.
2.39
The Uniting Church noted the AFP would be unlikely to target minor offences due to their own resourcing constraints:
Either you take the view that law enforcement agencies will appropriately target their resources – so even though you can cite all these offences that are more minor and take the view that law enforcement will waste resources chasing them instead of more serious offending – or you trust them to use it more actively in well-targeted means.
Division by category of offending
2.40
Several submissions discussed the idea of amending the Bill and the de facto definition of relevant offence in the Bill to encompass certain offence types or categories. The practical effect of this amendment would be not to draw the definition of relevant offence from the Crimes Act or SD Act but to establish a new category of offences specifically for the purposes of these powers.
2.41
The Law Council recommended eligible offences should be: limited specifically to match the stated policy intent of targeting criminality of the most serious and harmful kind; and prescribed exhaustively in primary legislation so that the addition of further kinds of offences is subject to specific Parliamentary approval.
2.42
The Law Council said these offences should be: indictable, punishable by a maximum penalty equivalent to the threshold for telecommunications interception warrants pursuant to section 5D(2)(a) of the Telecommunications (Interception and Access) Act (the TIA Act) (according to the Law Council being seven years’ imprisonment or more); and the offence covers certain subject-matter. The subject-matter required would be: offences against the security of the Commonwealth per Chapter 5 of the Criminal Code; offences against humanity and related offences in Chapter 8 of the Criminal Code (including child exploitation and human trafficking); and possibly certain offences in Chapter 9 of the Criminal Code (including serious drug, weapons and criminal association offences) and possibly certain offences in Chapter 10 of the Criminal Code (including certain money laundering and cybercrime offences).
2.43
QCCL and others additionally recommended the definition of ‘relevant offence’ be re-defined to include an exhaustive list of specific serious offences. The CSCRC recommended the Bill specify types of crime to which the Bill applies. CSCRC said this would ‘allay fears of misuse of the warrants for less serious crimes and perceptions of legislative creep’. The CSCRC suggested the inclusion of classes of offences that are defined for the powers but noted there could be technical drafting issues that presented in doing so.
2.44
When asked about their preference of either limiting relevant offences to a category of offences or an imprisonment term, the Law Council said their preference would be to have both. The HRLC said whilst they also preferred a category and minimum term classification, if they had to decide between the two they would preference relevant offences being a category of offences.
2.45
Home Affairs said the danger of carving out particular offences would be the risk of missing things. The Uniting Church additionally said:
The danger with drafting really tightly is there might be very serious human rights abuses and harms occurring to people and wider concerns that then go unaddressed – offending that basically isn’t tackled because the police lack the powers to gather the evidence eventually and to even understand what is going on.
2.46
Countering these issues directly the AFP said limiting the powers to specific listed offences was ‘not workable’. They noted the importance of the three-year threshold for online offences in particular, saying:
A three-year threshold ensures we can investigate all relevant telecommunications and computer offences in the Criminal Code where the majority of offending will be facilitated using computer networks and where evidence will be held in computers.
2.47
The AFP provided the example of outlaw motorcycle gangs where as part of the dismantling process the AFP could disrupt offences within their logistics or administration arms such as importing drugs or money laundering. The AFP said the purpose in these instances would be to ‘attack the outer perimeter of these organised crime networks’ which would allow the AFP to dismantle these networks. Furthermore, the AFP said:
We’re looking at organised crime and organised crime is not focused on one particular form of criminality; we’re looking at polycrime. The syndicates we are investigating now are involved in a range of criminality and we need flexibility in the legislation to apply that legislation to those types of groups.
2.48
The Uniting Church said determining what a serious offence was and what offences these powers should be applied to was a debatable exercise. They provided the example of illegal logging which could have a severe impact on a community in a developing nation but was subject to a relatively minor penalty in Australia. The Uniting Church said:
Trying to list all the crimes that the new warrants should cover would be a massive undertaking, as it would require a review of all laws and an assessment of which would be considered to cover serious criminal conduct.
2.49
Home Affairs said the debate over what a serious offence was had already been answered by Parliament in existing legislation. They said:
We have then added additional safeguards to say that it is not enough to go and get a warrant because it is three years; it has to be of such nature and gravity in terms of the conduct constituting those offences that that information can be sought.
2.50
The AFP said issues of seriousness would be taken into account by the issuing officer for the powers as outlined by Home Affairs in their evidence to the Committee.
Division by minimum term of imprisonment
2.51
Several submissions discussed or debated the prospect of amending the definition of ‘relevant offence’ to in effect raise the minimum term of imprisonment from three years to a higher threshold. There was not an agreed upon higher threshold with several submissions proposing different minimum terms of imprisonment. Again, this would have the effect of creating a new category and definition of relevant offences specific to these three particular warrants.
2.52
The HRLC said they did not put a number of years on what they thought would be improved proportionality because they believed it was a more holistic analysis. The HRLC said:
You could imagine a much stricter bill that still had a three-year threshold or you could imagine a bill with a higher threshold that retained other dimensions of it. We would say there are multiple levers that can be used together to improve the proportionality.
2.53
Fastmail said these warrants were no less intrusive than the TIA Act and the criteria for application of their powers should be similar. Fastmail said to obtain data under the SD Act the offence needed to have a minimum penalty of two to three years whereas under the TIA Act the minimum penalty required was seven years. Fastmail said ‘specifying severity by length of penalty is in keeping with past acts and creates clarity for law enforcement and the judicial system’.
2.54
Home Affairs said raising the offence threshold to an offence punishable by a maximum penalty equivalent of seven years or more was inappropriate. They said it would result in a number of serious offences not being captured by the warrants and provided several examples of offences that would not be covered such as: using a carriage service to menace, harass or cause offence; associating with a terrorist organisation; failing to report child sexual abuse offences; and conduct by Commonwealth officers causing harm to Australian interests.
2.55
Home Affairs quoted the Comprehensive Review of the Legal Framework of the National Intelligence Community (the Richardson Review) which noted that raising the offence threshold for electronic surveillance warrants to apply to seven-year offences would have ‘no particular principled basis, and would amount to simply adopting a ‘highest common denominator’ approach’.
2.56
Where Home Affairs used one part of the Richardson Review to support their argument, they noted another part that was in contradiction with the current Bill. They noted the Richardson Review recommended raising offence thresholds for electronic surveillance powers to five years which would be ‘out of step’ with the current electronic surveillance framework. Home Affairs said they were currently considering how to implement these recommendations from the Richardson Review.
2.57
The Communications Alliance recommended the threshold for the offence be raised to ‘serious offence’ in line with the offence threshold of the TIA Act. The TIA Act defines a serious offence at section 5D. Telstra also recommended the threshold be raised to ‘serious offence’. DIGI noted the Independent National Security Legislation Monitor (INSLM) had previously recommended the offence threshold in the TOLA Act be raised to ‘serious offence’ in line with the TIA Act.
2.58
Home Affairs said it was a misnomer to equate a seven year threshold with the TIA Act as there were a range of exceptions that included three and five year offences. The Uniting Church said raising the threshold to seven years was inappropriate:
You basically say people who are stupid and not technically savvy will get caught because they won’t know how to use tools in the online world that would conceal the harm they’re causing and those who are tech savvy will escape.
2.59
The AFP said they needed operational flexibility as would be provided by the three-year offence threshold. They said:
There are offences even at the three-year level that we believe would be of potential relevance, including the offence of associating with a terrorist organisation, which is a three-year offence.
2.60
The HRLC recommended the Bill be amended to increase the maximum term of imprisonment specified in the definition of ‘relevant offence’. HRLC said this would ensure the warrants were only available where their use would be proportionate to the severity of the alleged offence. The HRLC said the Bill would apply to a range of offences which were ‘wholly unrelated to the purpose of the Bill stated in the Explanatory Memorandum’. QCCL said they did not accept the warrants should be applied to the existing definition of a ‘serious commonwealth offence’.
2.61
After many submissions presented the general argument that three year offences could be lesser or less serious offences Home Affairs said it was a subjective test to determine whether an offence was serious:
Objectively, parliament has set that threshold at three years, and, in our view, there must be some correlation to the seriousness of those offences.
2.62
Home Affairs provided context for the definition of relevant offence, noting:
Each power has been designed to align with the legislative framework in which it sits, and, as much as possible, to align with other powers that agencies are likely to use in conjunction with these new warrants.
2.63
The Uniting Church said they would be concerned if the definition of relevant offence was raised to a higher minimum term of imprisonment. They provided the example of tax evasion and wage theft through ‘phoenixing’ that could have a massive impact on individuals. They said a person dealing with several million dollars’ worth of proceeds of crime has a three year penalty and would not be included if the definition was altered.
2.64
The Uniting Church said if the threshold was increased then it could ‘cut off’ investigation into offences like the negligent laundering of any amount of proceeds of crime. They noted under the current Bill anyway the AFP and ACIC would not be able to apply for these powers for the offence of negligently laundering less than $50,000.
2.65
The Uniting Church noted several offences were often linked and provided the example of a money laundering offence which may tie to other more serious human rights abuses. They said it was important to consider the context in which the offence operated. The Carly Ryan Foundation said:
Various different crimes are often linked. So where there may be child abuse involved, there may be other offences that are layered upon that child abuse. I think three years is adequate.
2.66
The Uniting Church noted the United Nations Convention against Transnational Organised Crime defined serious crime as any offence of four years and above.
2.67
The Uniting Church said:
If the Committee recommends an increase in the threshold it could cut off the ability of the warrants to be used in cases to investigate abuse of public office.
2.68
The Uniting Church said:
The Synod remains of the view that the warrants in the Bill should be available for offences that carry a maximum term of imprisonment of three years or more, in order to allow the AFP and ACIC flexibility in the pursuit of serious criminal activity. It is reasonable for the Committee to trust the AFP and ACIC will use the powers in the Bill to target serious crime, and not for lesser crimes that are unrelated to serious criminal conduct. Even if the AFP or ACIC attempted, on a rare occasion, to obtain a warrant for a lesser criminal matter there are still the safeguards in the Bill that the authorising judge, AAT member or magistrate (depending on the warrant) would need to be satisfied that the application met all the criteria outlined in the Bill.
Assistance orders
2.69
The Committee considered assistance orders as part of this inquiry. These are orders issued to an entity or person to assist in the execution of the warrants proposed under this Bill and were a significant part of the Committee’s previous inquiry into the TOLA Act. These assistance orders can be directed at the subject of the warrant, or a person that can assist with gaining access to the account.
2.70
Home Affairs said assistance orders already exist in relation to computer access warrants. Home Affairs said the assistance order mechanism under this Bill was not intended to allow law enforcement to compel assistance from the technology industry but rather from a person with relevant knowledge of a particular online account (such as a person who uses an online account). Home Affairs said:
Orders requiring assistance already exist in relation to computer access warrants. This mechanism is not intended to allow law enforcement to compel assistance from the technology industry, but rather from a person with relevant knowledge of a particular computer or computer system, or online account in the case of account takeover warrants, to the investigation or operation (such as a person who uses a computer or online account).
2.71
While near-universal across the three powers, this following section will briefly identify where assistance orders are found in the various proposed powers under the Bill before turning to general commentary across the proposed powers.
Data Disruption Warrants
2.72
Proposed section 64B will allow a law enforcement officer of the AFP or the ACIC to apply to an eligible Judge or nominated AAT member for an order requiring a specified person to provide any information or assistance that is reasonable and necessary to allow the law enforcement officer to access and disrupt data held in a computer subject to a data disruption warrant.
Network Activity Warrant
2.73
Proposed subsection 64(6A) sets out the matters to which an eligible Judge or nominated AAT member must be satisfied of in order to grant an assistance order in relation to a network activity warrant. The Judge or AAT member must be satisfied that there are reasonable grounds for suspecting that access to data held in the computer will substantially assist in the collection of intelligence in relation to criminal networks of individuals. The issuing authority must also be satisfied that there are reasonable grounds for suspecting that access to data held in the computer will substantially assist in the collection of intelligence that is relevant to the prevention, detection or frustration of one or more kinds of relevant offences.
2.74
The Explanatory Memorandum states:
Although the SD Act provides for the issuing of warrants permitting covert activity, there may be circumstances in the course of an operation where a person who is not the suspect or target of the warrant will have knowledge of a computer system and be able to provide access to relevant data, without compromising the covert nature of the operation. Alternatively, there may be a point in the operation where the benefits of compelling information from a person in order to enable access to data outweigh the disadvantages of maintaining the secrecy of the operation.
Account Takeover Warrants
2.75
Proposed section 3ZZVG provides that if an account takeover warrant or emergency authorisation is in force, a law enforcement officer may apply to a magistrate for an assistance order requiring a specified person to provide any information or assistance that is reasonable and necessary to allow the law enforcement officer to take control of an online account that is the subject of the warrant or authorisation.
2.76
Existing section 3LA of the Crimes Act allows a constable to make an application to a magistrate for an order requiring certain persons (such as owners or users of a device) to provide any information or assistance to allow law enforcement to access data held in, or accessible from, a computer that has been seized, moved or found in the course of a section 3E search warrant. For example, a section 3LA order may be used to compel a person to provide their password to assist law enforcement in obtaining access to data held in a computer found or seized under a search warrant.
2.77
Proposed new subsection 3LA(7) provides for the additional use of information or assistance provided as a result of an order made under section 3LA. Information or assistance provided under section 3LA for an investigation into an alleged offence under a search warrant may be used in the execution of an account takeover warrant that relates to that same investigation. The EM states:
The inclusion of this provision overrides the principle that information obtained under a power conferred by statute can only be used or disclosed for the purpose for which it was obtained. In the case of a section 3LA assistance order, this would be for the purposes of executing a search warrant under section 3E. The intent of this amendment is to ensure that information obtained under a section 3LA assistance order can be used in the execution of an account takeover warrant. Account takeover warrants are designed to complement the use of other investigatory powers, including search warrants, to authorise the taking control of a person’s online account in the investigation of serious offences.
General comment on assistance orders
2.78
The Law Council recommended including in the issuing criteria the requirement to consider whether the person is, or has been, the subject of any previous mandatory assistance orders under multiple regimes. This was, according to the Law Council, likely to prevent ‘forum-shopping’.
2.79
The Law Council noted the existence of similar powers and said existing powers to obtain mandatory assistance orders in respect of computer access warrants can require third parties render assistance in gaining access to data and making it available to law enforcement agencies. They said existing technical assistance requests or technical assistance notices can require the provision of technical assistance or capability.
2.80
The Law Council recommended including an explicit requirement for all mandatory assistance orders to specify material particulars, including the date or time period over which the assistance must be rendered and the nature of the relevant assistance. The Law Council was concerned at the potential breadth of assistance orders as the Bill was currently drafted.
2.81
In response to this point Home Affairs said assistance orders were not standalone orders but could be given in support of an underlying warrant. They said the period for which assistance could be compelled under an assistance order could not extend beyond the scope of the underlying warrant.
2.82
Home Affairs said a key safeguard in the Bill as it related to assistance orders was the requirement for the assistance to be reasonable and necessary which would preclude the use of an assistant order to compel a person to give assistance on an ongoing or repetitive basis.
2.83
QCCL and others said the proposed section 3ZZVG assistance orders were similar to the Technical Assistance Requests (TARs) contained in the TOLA Act and questioned why additional powers would be required.
2.84
QCCL and others said there were no provisions for situations where the provision of assistance would constitute a beach of confidence or the relevant omission which underlies the offence arises as a consequence of a warrant that is inadequately or unclearly drafted. The QCCL and others recommended assistance orders be removed from the Bill.
2.85
Communications Alliance (CA) said a conflict could arise where assistance orders were directed at an individual employee or officers rather than the business user or the platform corporation. CA said the conflict could be between the order and the employee’s work responsibilities or terms of employment. CA recommended the Bill address these issues by requiring that the technology provider organisation be the target of assistance orders and where an individual is compelled to provide assistance providing and paying for independent legal advice.
2.86
DIGI said there was no reference in the EM on the impact of the Bill on service providers. DIGI said they understood the intention of the powers to be that warrants and assistance orders did not apply at the service provider level but because of the broad drafting of the Bill it was likely to directly impact service providers.
Good faith immunity provisions
2.87
The AIIA recommended the Bill be amended to introduce immunity from prosecution for both assisting entities and those employees or officers of assisting entities who are acting in good faith with an assistance order. The AIIA noted the government introduced section 30BE in the critical infrastructure reform process and a similar provision should be introduced into this Bill. The critical infrastructure provision was cited by the AIIA to be:
1
An entity is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith […]
2
An officer, employee or agent of an entity is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith in connection with an act done or omitted by the entity as mentioned in subsection (1).
2.88
AIIA said the imposition of 600 penalty units of 10 years’ imprisonment was disproportionate, especially in the absence of appropriate good faith immunity provisions.
Cost recovery, processes and damages
2.89
The AIIA recommended introducing provisions in the proposed legislation for cost recovery for private entities in relation to the costs they incur in implementing assistance orders. They recommended the provision be enlivened where there is a:
significant loss or extraordinary cost to the assisting entity, whether in repairing vulnerability, restoring service, addressing a human resources burden, or intensive technical impact incurred by the company in complying with an assistance order.
2.90
Fastmail recommended the inclusion of a requirement in the Bill that incidental harm or loss be avoided or fully compensated, and/or an express right of compensation for all losses (not just property and personal injury) from the warrants. Fastmail said this would ensure companies knew the impact of their compliance could be recognised.
Conflict with international laws
2.91
Twitter said compliance by service providers with assistance orders would directly conflict with obligations under laws of other countries where they operate. Twitter provided the example of the United States Stored Communications Act which prohibited service providers providing information absent appropriate Electronic Communications Privacy Act legal process.
2.92
AWS said they were concerned employees might be ordered to do an act under an assistance order which may breach foreign law. AWS said it would be appropriate to make clear in the Bill that any such requirement would be unreasonable or provide a defence for an individual who refuses to do the act. Amazon Web Services recommended an appropriate defence would involve the introduction of a modified version of proposed section 317ZB(5) of the TIA Act in respect to the laws of foreign countries.
Technical feasibility considerations of assistance orders
2.93
Several submissions called for mandatory consultation with industry as part of the assistance order regime (in addition to separate calls for mandatory consultation with industry for the powers themselves). The arguments in favour of technical consultation for assistance orders and warrant execution itself were often similar and sometimes blended.
2.94
Amazon Web Services recommended considerations be introduced into the Bill for determining whether assistance notices from industry were reasonable and proportionate. AWS said this would be similar to that provided in the TOLA Act. AWS recommended these considerations include technical feasibility considerations so as not to allow ‘technical fishing expeditions that put at risk third parties’.
2.95
Amazon Web Services recommended the Bill be amended to include a specific prohibition against ATWs being executed in a manner that would require a person to implement or build a systemic weakness into a form of electronic protection or prevent a person from rectifying a systemic weakness in a form of electronic protection.
2.96
The AIIA recommended the government include listed factors that decision-makers have to consider in determining whether industry assistance notices were reasonable and proportionate, including the security of relevant systems and technical feasibility. The AIIA recommended this occur at, for example, proposed section 3ZZUP of the Bill. They recommended an amendment to include factors informed by a holistic awareness of the systems involved, including the security of the relevant systems and technical feasibility. The AIIA said in 2018, due to industry concern, the government included in the TOLA Act provisions that listed certain factors decision-makers had to consider in determining whether the industry assistance notice were reasonable and proportionate.
2.97
Amazon Web Services said the Bill did not provide sufficient protection for individual employees of technology providers and created an assistance regime different from the TOLA Act. AWS recommended the Bill be amended to make clear that where assistance is sought from an individual the assistance request should be both reasonable and proportionate using the criteria specified in the TOLA Act.
2.98
Twitter said they did not store credentials in plaintext form which could make adherence to assistance orders not technically feasible.
Clarification of ‘specified person’ and their duties
2.99
The AIIA recommended the Government clarify the term ‘specified person’ in SD Act proposed sections 64A and 64B(1) (for NAWs and DDWs) and Crimes Act proposed section 3ZZVG (for ATWs). The AIIA queried how these proposed sections would impact the ability for law enforcement to compel ‘specified persons’ to provide reasonable information and assistance to help them carry out a warrant. The AIIA requested additional clarification of the roles and responsibilities of a ‘specified person’ and specifically what ‘provid[ing] any information or assistance that is reasonable and necessary’ could constitute in the context of what law enforcement could compel a ‘specified person’ to do.
2.100
The HRLC said the assistance order powers accompanying the ATWs would require the ‘specified person’ assist law enforcement. They said this could be the person suspected of committing the offence or a person who is, or was, a system administrator for the system including the computer or the electronic service to which the account relates (among others). The HRLC said the ability for law enforcement to compel individuals to answer questions or provide assistance that could expose them to legal ramifications would contradict the right to freedom from self-incrimination. The HRLC said there was a significant divergence from the EM to the Bill itself in this regard.
2.101
The HRLC said it was possible the assistance orders could compel an individual to assist law enforcement to obtain evidence which was against their legal interest. The HRLC recommended the Bill be amended to ensure adequate safeguards for the freedom against self-incrimination. The HRLC recommended a more narrowly worded provision to limit the assistance order to ‘only information or assistance that is strictly necessary for the execution of the underlying warrant’.
2.102
Twitter said it was unclear from the Bill and EM whether the Bill would require service providers and their relevant employees to comply with assistance orders. Twitter said this was due to the definition of ‘specified person’ under proposed section 3ZZVG, subsections (b)(vi) and (c).
2.103
DIGI said there were issues with the scope of assistance orders. They said the pool of ‘specified persons’ for the purposes of these assistance orders was ‘extremely broad’ and could include service providers and their employees. DIGI said there was no reference in the EM to these orders being designed or intended for application to service providers or their employees and recommended this be clarified in the Bill. Mr Paul Templeton said there were no legal provisions or pathway for a person compelled to provide assistance under the assistance order.
Oversight
2.104
Oversight of these powers diverges in some respects but in others is universal. This section of the report addresses evidence received by the Committee that is universal, or near-universal, to the powers. Specific oversight commentary on particular powers will be addressed in later chapters.
2.105
The Bill provides that the IGIS and the Commonwealth Ombudsman (the Ombudsman) will be able to share information where it is relevant to exercising powers, or performing functions or duties, as an IGIS or Ombudsman official. This ensures that where a matter may arise during an inspection that would more appropriately be dealt with by the other oversight body, a framework is in place for the transfer of network activity warrant information, allowing efficient and comprehensive oversight to occur.
Data Disruption Warrants
2.106
Information obtained under DDWs will be ‘protected information’ under the SD Act and be subject to strict limits for use and disclosure. Consistent with existing warrants in the SD Act, compliance with the DDW regime will be overseen by the Commonwealth Ombudsman.
Network Activity Warrants
2.107
The IGIS will have oversight responsibility for NAWs given their nature as an intelligence collection tool. This approach departs from the traditional model of oversight by the Commonwealth Ombudsman of the use of electronic surveillance powers by the AFP and the ACIC. However, the approach is consistent with the oversight arrangements for intelligence collection powers available to other agencies, including the Australian Security Intelligence Organisation (ASIO) and the Australian Signals Directorate (ASD).
2.108
The SD Act currently requires the chief officers of ACIC and AFP to make a report to the Minister as soon as practicable after a warrant issued under the Act ceases to be in force. Section 50 of the SD Act also contains requirements for certain information to be included in ACIC’s and AFP’s annual reports, including the number of applications made for warrants under the Act, the number of warrants issued or refused and the number of extensions applied for and granted and refused. These existing reporting requirements would extend to network activity warrants.
the Bill proposes specific reporting requirements in relation to network activity warrants. Proposed subsection 49(2E) provides that reports to Ministers must contain specific information about a warrant including, but not limited to, the name (if known) of any person whose data was accessed, the extent to which the execution of the warrant assisted the agency in carrying out its functions and details of the compliance with the conditions (if any) stipulated in the warrant.
The Bill also contains record keeping requirements, including provisions governing the destruction of records obtained by accessing data under a network activity warrant. Proposed section 46AA specifies that the chief officers of ACIC and AFP must ensure that every record or report relating to network activity warrant information is kept in a secure place, and destroyed within specified timeframes.22 Consistent with its current practice in reviewing other intelligence warrants, IGIS would inspect these records on a regular basis.
Account Takeover Warrants
2.110
Oversight for ATWs is provided at proposed Division 7 (Inspections) and Division 6 (Reporting and record keeping). For ATWs this is in the form of the Commonwealth Ombudsman exclusively and not the Inspector General of Intelligence and Security (IGIS).
2.111
The Bill provides for Chief Officers’ 6 monthly reports to the Minister and the Ombudsman at proposed section 3ZZVL. This requires the chief officer of the AFP or ACIC to set out the number of ATW applications made during the previous six months, the number of ATWs issued during the previous six months, the number of ATW variations issued during the previous six months, and the number of emergency authorisations of ATWs issued during the previous six months, amongst other things. The Bill also provides for Chief Officers’ annual reports to the Minister at proposed section 3ZZVM.
2.112
The Bill provides for oversight by the Commonwealth Ombudsman at proposed Division 7. The Ombudsman said the Bill proposed extending the Ombudsman’s oversight role within the Crimes Act to include the ATWs. The AFP said Ombudsman oversight of ATWs was consistent with existing reporting requirements.
2.113
The Ombudsman said the Bill imposed six-monthly inspection and six-monthly reporting obligations to the Ombudsman. The Ombudsman said this did not align with the requirements for other Crimes Act regimes they oversee. The Ombudsman recommended the inspection and reporting requirements for the ATW regime is aligned with the 12-monthly inspection and reporting obligations of the controlled operations regime in Part IAB of the Crimes Act. The Ombudsman said this would better reflect the likely operational intersection between ATWs and controlled operations, and provide the Ombudsman with more flexibility and discretion in managing their oversight functions.
2.114
The IGIS said while the Ombudsman would have oversight of ATWs, the Ombudsman could communicate information obtained in the course of its oversight of these powers to IGIS officials for the purposes of IGIS officials exercising powers, or performing functions or duties as such.
2.115
The Law Council recommended extending the reporting and record-keeping requirements to mandatory assistance orders under proposed section 3ZZVG.
2.116
The Law Council recommended requiring the AFP and ACIC notify the Ombudsman if they cause loss or damage to a third-party, either in contravention of the limits of the authority of the warrant or pursuant to proposed section 3ZZUR(8)(a) of the Bill.
2.117
Home Affairs said additional notification to the Ombudsman of loss or damage was unnecessary.
General comment on oversight
2.118
The IGIS said the Australian Signals Directorate (ASD) may have a role in providing technical assistance to the ACIC and AFP under the DDW and ATW frameworks, and this assistance would fall under ASD’s existing functions and would not be an expansion of ASD’s legislated powers. The IGIS said they would oversee conduct undertaken by ASD in rendering technical assistance to ACIC and AFP in the execution of a warrant under the Bill.
2.119
The Law Council recommended increasing funding for the Ombudsman to enable the effective oversight of the new powers. The Law Council said this funding would be intended to enable the Ombudsman to have an appropriate number of security-cleared staff to perform inspection, investigatory and complaints handlings functions; have appropriate security infrastructure for the highest national security classification that is likely to be generated under the new powers; and access independent technical expertise to enable effective oversight of the powers.
2.120
The Law Council recommended expanding the Ombudsman’s inspection functions. The Law Council said this expansion should be similar to section 8 of the IGIS Act and cover: agencies’ compliance with applicable policies and procedures, as well as legislation; the propriety of agencies’ actions, practices and policies under the new powers; and the compatibility of agencies’ actions with Australia’s international human rights obligations.
2.121
The Law Council recommended conferring a broader inspection function on the Ombudsman to consider the propriety, as well as legal compliance, of the activities of the AFP and ACIC under those warrants to be equivalent to the IGIS.
2.122
The Carly Ryan Foundation said they believed the Bill included appropriate oversight and accountability of the powers. The CSCRC said the safeguards were sufficient. Fastmail however said there was a requirement for increased oversight and accountability. The NSWCCL said ‘Inspector-Generals and Ombudsman offices are not empowered to be a real counter-weight to law enforcement. The abuse of power this Bill enables will happen, as it already has under other laws NSWCCL has opposed’.
INSLM and PJCIS
2.123
The Law Council said neither the INSLM nor Parliamentary Joint Committee on Intelligence and Security (PJCIS) would have comprehensive oversight of the new powers and recommended amending the Independent National Security Legislation Monitor Act 2010 (the INSLM Act) and Intelligence Services Act (the IS Act) to make provision for full oversight by both the INSLM and PJCIS of all three new warrant regimes in the Bill.
2.124
Home Affairs said neither the Committee nor the INSLM should be specifically empowered to oversee the new warrants proposed by this Bill in an operational sense.
2.125
These issues were discussed at greater detail in the submissions received by the Committee for the Review of the Intelligence Oversight and Other Legislation Amendment (Integrity Measures) Bill 2020 (the IM Bill).
Judicial and merits review
2.126
QCCL and others said the Bill expressly precluded judicial or merits review of the decision to issue warrants at paragraph 44 of the Explanatory Memorandum to the Bill. Home Affairs said this was an error in the EM and these decisions would be subject to judicial (but not merits) review.
2.127
Twitter said the Bill was unclear regarding the standards of review and means of appeal available to service providers. DIGI said there should be an opportunity for service providers to challenge the issuance of both the warrants and the assistance orders. DIGI said this would be for situations where the service provider objected to the warrant or particular elements of it. DIGI recommended the Bill be amended in this regard to provide additional guidance on:
1
The grounds on which a provider can object to the issuance of a warrant or an assistance (e.g. conflict of laws or technical inability);
2
To whom a provider should address an objection;
3
The body that would be charged with independently reviewing the objection;
4
The timeframe for objections;
5
The legal status of providers after an objection has been lodged;
6
An indication of the assessment criteria for how such objections will be approved or denied.
Parliamentary privilege
2.128
For each warrant the Bill provides that it does not affect the law relating to the powers, privileges and immunities of any of the following:
(a) each House of the Parliament;
(b) the members of each House of the Parliament;
(c) the committees of each House of the Parliament and joint committees of both Houses of the Parliament.