Chapter 2 Telecommunications Interception

2.1                   In its discussion paper, the Attorney-General’s Department (AGD) notes that the current Telecommunications (Interception and Access) Act 1979 (TIA Act):

...reflects the use of telecommunications and the structure of the telecommunications industry that existed in 1979 when the Act was made. Many of these assumptions no longer apply, creating significant challenges for agencies in using and maintaining their investigative capabilities under the Act.[1]

2.2                   Therefore, the Australian Government has proposed a series of reforms to the telecommunications interception regime that are designed better reflect the ‘contemporary communications environment’.[2]

2.3                   In particular, the AGD identified four aspects of the legislation as requiring reform:

n  Strengthening the safeguards and privacy protections in line with contemporary community expectations;

n  Reforming the lawful access regime for agencies;

n  Streamlining and reducing complexity; and

n  Modernising the cost sharing framework.[3]

2.4                   This chapter will examine each of those proposals.  Before doing so, the Committee notes the evidence from interception agencies and the AGD that these proposals should be considered in the context of a holistic revision of the TIA Act:

The magnitude of current and anticipated change to the telecommunications landscape means it is now timely to consider whether the privacy needs of Australians and the investigative needs of law enforcement and national security agencies are best served through continuous ad-hoc change or whether the time is right to put in place a new interception framework that squarely focuses on the contemporary communications environment. The Department considers that holistic reform would establish a new foundation for the interception regime that enables users and participants, as well as the broader Australian community to understand their powers, rights and obligations.[4]

2.5                   The Committee’s view on whether a new interception regime is necessary will be provided following the consideration of the individual proposals for reform of the TIA Act.

Strengthening the safeguards and privacy protections

2.6                   The AGD discussion paper expresses a desire to examine the ‘safeguards and privacy protections under the lawful access to communications regime’ in the TIA Act.  In particular, the discussion paper seeks to examine:

n  The legislation’s privacy protection objective;

n  The proportionality tests for issuing warrants;

n  Mandatory record-keeping standards; and

n  Oversight arrangements by Commonwealth and State Ombudsmen.[5]

The legislation’s privacy protection objective

2.7                   As the discussion paper notes, the interception of telecommunications is ‘a powerful and cost effective tool’ for law enforcement and intelligence agencies. However, the discussion paper also notes that the ability to intercept telecommunications data and content must be balanced with the protection of privacy:

The primary objective of the current legislation governing access to communications is to protect the privacy of users of telecommunications services in Australia by prohibiting covert access to communications except as authorised in the circumstances set out in the TIA Act.[6]

2.8                   The discussion paper proposes that the safeguards and privacy protections of the interception regime be strengthened ‘in line with contemporary community expectations’.

2.9                   Many of the submissions and much of the testimony provided to the Committee focused upon the privacy impact of proposals for reform of the TIA Act, with submitters and witnesses noting that one of the primary objectives of the telecommunications interception regime is to protect the privacy of people against the intrusion of interception.

2.10               The proposal for a privacy objective drew broad support, from privacy advocates, private submitters, law enforcement and investigative agencies alike.  The Western Australian Police stated:

It is recognised that the privacy protection objective is a fundamental principle which underlies the TIA Act. It is important to protect the privacy of users of telecommunications services by prohibiting covert access to communications except as authorised by the TIA Act.

…

The introduction of a privacy focus objective clause into the TIA Act is appropriate, and would ensure that privacy protection is a consideration in the interpretation and application of the law.[7]

2.11               The Law Council of Australia expressed strong support for the introduction of a privacy focused objects clause, and made several suggestions of possible provisions on which it could be modelled:

Such a clause could be modelled on Article 17 of the International Covenant on Civil and Political Rights (ICCPR) which provides that:

n  ‘No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.  Everyone has the right to the protection of the law against such interference or attacks.’

Article 8 of the European Convention on Human Rights (ECHR) also provides a possible model for such an objects clause. It provides that:

n  ‘Everyone has the right to respect for his private and family life, his home and his correspondence.  There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.’[8]

2.12               The NSW Council for Civil Liberties indicated that a privacy objective would provide an interpretive aid to issuing authorities when considering warrant applications:

A privacy objective should be introduced into the legislation, as the Government proposes. It should be made clear that the privacy objective limits the operations of government agencies as well as those of other persons. This will assist judicial authorities to be tougher in their scrutiny of warrant applications. [9]

2.13               The AGD discussion paper refers to strengthening privacy protections in line with contemporary community expectations, but provides no detail on what those expectations are.  On that point, Privacy Victoria submitted:

…it is important that we consider what ‘contemporary community expectations’ regarding privacy actually are. For example, in 2007 the Office of the Privacy Commissioner commissioned a survey into community attitudes to privacy.  This survey was undertaken at the cusp of the social media boom. In the survey, 86% of respondents felt that it was a serious breach of privacy where a government department monitors an individual’s activities on the internet, recording information on sites visited without the individual’s knowledge. Similarly, 50% were more concerned than two years previous (2005) about providing information over the internet. I consider that these numbers would be greater today, given the mass of information collected by electronic means.[10]

2.14               The Information Commissioner suggested that the Privacy Act 1988 reflects community privacy expectations:

The OAIC considers that the Privacy Act 1988 (C’th) (Privacy Act), as the privacy oversight instrument the public is most familiar with, reflects existing community expectations. Accordingly, incorporating the core principles and values that underpin the Privacy Act into the other privacy accountability frameworks will help ensure that they remain consistent with community values and expectations.[11]

2.15               While supportive of a privacy objective, the Western Australian Corruption and Crime Commission noted the need to balance privacy with investigative needs:

The Commission supports the primary objective of the TIA Act which seeks to protect the privacy of individuals who use the Australian telecommunications system. The TIA Act does this by making it an offence to intercept communications passing over the telecommunications system. However this needs to be balanced against Australia's law enforcement and national security interests.[12]

2.16               Similarly, Privacy Victoria assisted the Committee by noting the need to balance other considerations:

Privacy is not an absolute right. A balance must be struck between privacy and other rights, including the public interest in protecting the safety and security of Australians.  This balancing act is a central tenet to privacy legislation around the world, and at times privacy must give way to other public and private interests.[13]

2.17               The Committee recognises the dual objectives of the TIA Act: to protect the privacy of communications by prohibiting unlawful interception, while enabling limited interception access for the investigation of serious crime and threats to national security.  Express recognition of these objectives within the legislation would provide clarity of the purposes of the legislation and some interpretive guidance. 

 

Recommendation 1

The Committee recommends the inclusion of an objectives clause within the Telecommunications (Interception and Access) Act 1979, which: n  expresses the dual objectives of the legislation – §  to protect the privacy of communications; §  to enable interception and access to communications in order to investigate serious crime and threats to national security; and n  accords with the privacy principles contained in the Privacy Act 1988.

 

The proportionality tests for issuing warrants

2.18               The AGD submission outlined the factors which must be considered by an issuing authority prior to issuing telecommunications interception warrants:

The independent authority may issue the warrant if satisfied from the facts outlined in the affidavit that:

n  there are reasonable grounds for suspecting that the person is using or is likely to use the service;

n  that information obtained under interception would be likely to assist the investigation of a serious offence in which the person is involved;

n  and having regard to:

§  the privacy of any persons likely to be interfered with by interception;

§  the gravity of the conduct being investigated; and

§  the extent to which other methods of investigating the offence have been exhausted or would prejudice the investigation.[14]

2.19               Submitters expressed support for the existence of the proportionality tests within the TIA Act, but expressed frustration about the absence of detailed proposals on which to comment.  For example, Mr Bernard Keane stated:

The paper is unclear about exactly what ‘strengthening’ is intended beyond a review and consideration of ‘a privacy focused objects clause’.  Strengthening privacy laws and reviewing checks and balances is of course unobjectionable; but AGD has failed to even clearly describe its thinking on this important issue.[15]

2.20               The Law Council of Australia noted that one way to strengthen the privacy protections within the TIA Act is to ensure consistent consideration of the impact of privacy before any power under the TIA Act is exercised:

…the requirement to consider the extent to which the exercise of a power will interfere with personal privacy currently applies to the issuing of certain TIA Act warrants, but not all.

For this reason, the Law Council supports the inclusion of a single, consistent privacy test in all warrant applications and in all authorisations to intercept, access or disclose telecommunications or telecommunications data.[16]

2.21               The Australian Federal Police (AFP) expressed support for strengthening the proportionality test for telecommunications interception warrants, noting that the current formulation has ‘becoming increasingly out of balance to the changes in the way people communicate, the technology available to communicate and the use of that technology to commit crime’.[17]  As a result, the AFP:

…sees benefit in strengthening the existing proportionality test to include consideration of the overall community good served by the investigation for which the interception is sought.[18]

2.22               The Western Australia Police submitted that ‘the current provisions of the TIA Act provide sufficient scope for the proportionality test to be properly applied’[19] and did not seek change to the proportionality test.

2.23               The Committee notes the useful discussion of proportionality tests provided by the Human Rights Law Centre in its submission:[20]

Put broadly, general provisions setting out a proportionality analysis require that any limitation of rights be reasonable and demonstrably justified in a free and democratic society.

2.24               The Committee considers the TIA Act must continue to require the consideration of proportionality in authorising the use of telecommunications interception as an intrusive investigative technique.  Given the evidence cited above the Committee believes it is appropriate that a review of the TIA Act’s proportionality tests be carried out. Any review of the proportionality tests must consider a range of matters to be included in the test, including the gravity of the conduct being investigated, the privacy intrusion of proposed investigative activity, the public interest served by the proposed investigative activity, and whether other less privacy intrusive investigative techniques would be effective.

2.25               The Committee further considers there would be merit when reviewing the proportionality tests to examine the application of those tests across the range of powers in the TIA Act (interception, access to stored communications, and access to telecommunications data).

 

Recommendation 2

The Committee recommends the Attorney-General’s Department undertake an examination of the proportionality tests within the Telecommunications (Interception and Access) Act 1979 (TIA Act). Factors to be considered in the proportionality tests include the: n  privacy impacts of proposed investigative activity; n  public interest served by the proposed investigative activity, including the gravity of the conduct being investigated; and n  availability and effectiveness of less privacy intrusive investigative techniques. The Committee further recommends that the examination of the proportionality tests also consider the appropriateness of applying a consistent proportionality test across the interception, stored communications and access to telecommunications data powers in the TIA Act.

 

Mandatory record-keeping standards

2.26               The AGD discussion paper outlines the current TIA Act record-keeping requirements:

Record keeping and accountability obligations require law enforcement agencies  to keep records relating to documents associated with the warrants issued and particulars relating to warrant applications (such as whether an application was granted or refused) and each time lawfully intercepted information is used, disclosed, communicated, entered into evidence or destroyed. Agency heads must also report to the Attorney-General on the use and communication of intercepted information within three months of a warrant ceasing to be in effect.  The Attorney-General’s Department must prepare an annual statistical report about the use of powers under the TIA Act, which the Attorney-General tables in Parliament.[21]

2.27               The AGD discussion paper goes on to argue ‘the current regime is focused on administrative content rather than recording the information needed to ensure that a particular agency’s use of intrusive powers is proportional to the outcomes sought’.[22]  The AGD therefore recommends:

Consideration should be given to introducing new reporting requirements that are less process oriented and more attuned to providing the information needed to evaluate whether intrusion to privacy under the regime is proportionate to public outcomes.[23]

2.28               Two submissions suggested that a streamlined reporting regime could lead to significant weakening of oversight.  For example, Mr Bernard Keane stated:

An alternative view is that ‘inflexible’ and ‘one size fits all’ provisions ensure that agencies cannot try to avoid reporting obligations and report in a manner that will enable meaningful comparisons over time and with other agencies. For relatively minor regulatory requirements, a ‘co‐regulatory approach’ such as that proposed by AGD might be appropriate, but given the serious nature of the issues on which law enforcement and intelligence agencies are being asked to report, it is wholly inappropriate to leave it up to agencies themselves to determine exactly how and what they report within a general remit. This would represent a significant weakening of accountability in an area where there is already too little scrutiny.[24]

2.29               The Committee received evidence from law enforcement agencies regarding the application of the existing record-keeping requirements.  For example, the AFP stated:

The AFP believes the current legislated scheme needs review. It may have reached the point where it is too focussed on administrative requirements, rather than providing the basis for Parliament and the Ombudsman to ensure agencies are using the powers in the Act in a way that is consistent with the principles underlying the Act. There would be value in redrafting the legislation to include simplified, comprehensible and meaningful accountabilities and annual reporting obligations to enhance community understanding of the regime and its safeguards.[25]

2.30               In support of this observation, the AFP cited the example of the requirement to provide a certified copy of each warrant despite the obvious efficiencies provided by email or facsimile communications.[26]

2.31               Similarly, the Western Australia Corruption and Crime Commission submitted:

The Commission fully supports a robust regime of mandatory record-keeping standards for agencies exercising powers under the TIA Act. The Commission acknowledges that effective oversight of agencies' use of these powers requires appropriate record-keeping standards sufficient to show compliance with the legislation. However it is the view of the Commission that many of the requirements of the current Act create unnecessary duplication of records and the creation of further records which no longer serve the original purpose of ensuring compliance with the Act and the creation of a robust compliance regime.[27]

2.32               The Law Council of Australia expressed support for streamlining the record-keeping requirements of the TIA Act to ensure they provided effective accountability:

The Law Council strongly supports efforts to ensure that the reporting requirements and oversight mechanisms contained in the TIA Act are ‘…attuned to providing the information needed to evaluate whether intrusion to privacy under the regime is proportionate to public outcomes’, as suggested by the Discussion Paper. This may involve review and reform of the different procedural and administrative requirements currently contained in the TIA Act relating to reporting, and to the role of the Commonwealth Ombudsman and his or her State and Territory counterparts. It may also involve consideration of additional or alternative mechanisms to enhance accountability under the TIA Act.[28]

2.33               The Law Council of Australia cautioned against ‘removing requirements for agencies to collect and record certain information about the exercise of their powers under the Act’ citing the example of the register of warrants maintained by the Secretary of the AGD.[29]

2.34               The Committee strongly supports the need for record-keeping requirements as a means of ensuring meaningful oversight and accountability.  The TIA Act enables law enforcement and security agencies to exercise intrusive powers.  It is vital to the ongoing ability of those agencies to use those powers to be able to demonstrate adherence to the accountability requirements of the TIA Act.  During the inquiry, the Committee received assurance from the Commonwealth Ombudsman’s office and the Inspector-General of Intelligence and Security of the high level of accountability discharged by the interception agencies.[30]

2.35               The Committee acknowledges, however, that record-keeping is not an end in itself, and must be designed to provide substantive rather than administrative accountability.  The Committee is satisfied that there is scope for achieving efficiencies by reviewing the existing reporting requirements without undermining accountability.  Further, the Committee considers there is scope to enhance accountability by removing otiose reporting requirements.

Recommendation 3
	The Committee recommends that the Attorney-General’s Department examine the Telecommunications (Interception and Access) Act 1979 with a view to revising the reporting requirements to ensure that the information provided assists in the evaluation of whether the privacy intrusion was proportionate to the public outcome sought.

 

Oversight arrangements by the Commonwealth and State Ombudsmen

2.36               The AGD discussion paper outlines the present oversight arrangements for law enforcement agencies:

Oversight of law enforcement agencies’ use of powers is split between the Commonwealth Ombudsman and equivalent State bodies in relation to interception activities.  The Commonwealth Ombudsman inspects the records of both Commonwealth and State agencies in relation to stored communications.  This split in responsibility contrasts with the Surveillance Devices Act 2004, where the Commonwealth Ombudsman inspects all agencies.[31] 

2.37               The AGD goes on to note that the prescriptive form of the TIA Act oversight provisions ‘impede the Ombudsman’s ability to report on possible contraventions and compliance issues by prescribing detailed and time limited procedures that need to be checked for administrative compliance, rather than giving the Ombudsman scope to determine better ways of assisting agencies to meet their requirements.’[32]

2.38               The Committee received submissions from law enforcement agencies expressing support for the review of the oversight arrangements to clarify the roles played by different oversight bodies.  For example, the Western Australia Police stated:

The TIA Act currently creates a system based on dual oversight by both Commonwealth and State Ombudsman. The role of the oversight body, and the scope of inspection, could be better defined within the TIA Act.

For WA Police, stored communications are inspected by the Commonwealth Ombudsman, annually. Inspections of all other TI Warrants, and the corresponding revocations, destruction of, and associated record keeping, is conducted by the State Ombudsman, on a regular basis.

On occasion, the Commonwealth Ombudsman has made comment on the content of an affidavit in support of an application for a stored communications warrant, and has questioned the appropriateness of the application. WA Police is of the opinion that the determination of the application, and the appropriateness or otherwise of the information contained in the affidavit is a matter for the issuing authority, not the oversight body. It is noted that the issuing authority has the power to receive information in both written and oral form.

An examination of the existing oversight arrangements, the clarity of the role, and the practicality of a single oversight body is supported by WA Police.[33]

2.39               Similarly, Telstra noted a desire for consistency of oversight arrangements:

Telstra agrees that there must be consistent and practical arrangements put in place to enable oversight by both Commonwealth and State Ombudsmen aimed at strengthening the safeguards and privacy protections under the TIA Act and the Telco Act to ensure the security and privacy of customer communications.[34]

2.40               The Office of the Australian Information Commissioner noted risks inherent in the fragmentation of oversight arrangements:

…the OAIC notes that the fragmentation of existing oversight arrangements can make it difficult for the public to discern which oversight body is responsible for overseeing the access and interception activities of a particular law enforcement agency. The OAIC is mindful that the nature of the activities undertaken by law enforcement agencies may mean that, in certain circumstances, it is not appropriate for these activities to be made public. In these circumstances, it is particularly important that effective oversight arrangements exist to ensure that these agencies are not exceeding their lawful authority and to give the public confidence that their personal information is being handled in accordance with contemporary community expectations. The OAIC suggests that providing the public with clear information about which oversight bodies are responsible for overseeing the access and interception activities of specific law enforcement agencies would provide a more appropriate level of transparency.[35]

2.41               The Law Council of Australia noted its support for consideration of a model similar to the Surveillance Devices Act 2004 (Cth) whereby the Commonwealth Ombudsman would be the sole oversight body for law enforcement agencies under the TIA Act:

The Law Council supports consideration of this model for potential application to the TIA Act warrant regime, which currently imposes inspection and reporting obligations on State bodies in respect of State agencies’ interception activities under the TIA Act. However, if a reform of this nature is to be pursued it must be developed in consultation with State and Territory Ministers and should not detract from the other reporting requirements outlined in the TIA Act…[36]

2.42               The Committee believes that reviewing the TIA Act oversight regime to ensure the application of consistent standards of accountability and a single perspective on best practice is warranted. On the evidence before it, the Committee was not persuaded that the Surveillance Devices Act model is appropriate. The Committee is also aware of significant jurisdictional issues inherent in progressing this matter..

Recommendation 4

The Committee recommends that the Attorney-General’s Department undertake a review of the oversight arrangements to consider the appropriate organisation or agency to ensure effective accountability under the Telecommunications (Interception and Access) Act 1979.  Further, the review should consider the scope of the role to be undertaken by the relevant oversight mechanism. The Committee also recommends the Attorney-General’s Department consult with State and Territory ministers prior to progressing any proposed reforms to ensure jurisdictional considerations are addressed.

 

Reforming the lawful access regime for agencies

2.43               The second aspect of the legislation in need of reform identified by the AGD discussion paper is the current lawful access regime.  The AGD identifies several areas for specific examination. First, it seeks to reform the lawful access to communications regime contained in the TIA Act by ‘reducing the number of agencies eligible to access communications information’. Second, it seeks to standardise warrant tests and thresholds. Third, it seeks to expand ‘the basis of interception activities’.[37]

Reducing the number of agencies eligible to access communications information

2.44               The AGD discussion paper states that a reduction in the number of agencies able to access communications information is contemplated ‘on the basis that only agencies that have a demonstrated need to access that type of information should be eligible to do so.’[38]

2.45               A range of submissions cited with approval the proposal to reduce the number of agencies able to access communications information, but noted the difficulty in identifying which agencies should have these powers removed.  Ms Stella Gray commented:

Reducing the number of government agencies which have access to individuals’ private communications, reduces the ability to abuse the TIA.  However, there is insufficient detail here on which agencies are being considered for reduction in such powers.[39]

2.46               Similarly, Liberty Victoria submitted:

Liberty Victoria agrees that lawful access by agencies to telecommunications data ought to be restricted to protect the privacy rights of individuals. Liberty Victoria agrees that reducing the number of agencies able to access sensitive data is, in principle, important and necessary. Liberty Victoria would, however, like to understand further how the Government proposes to determine which agencies are able to access this data, to ensure that there are real and substantive security benefits proportionate to the greater privacy risks that arise when information is more widely disseminated.

The Discussion Paper’s suggestion that agencies must have a ‘demonstrated need’ to access information, while a good suggestion (indeed, a suggestion that one would have hoped already applied to agencies’ access to personal information), is too general to offer a detailed response. For example, it does not indicate how ‘need’ would be demonstrated as opposed to ‘operational convenience’..[40]

2.47               The Attorney-General’s Department outlined to the Committee which agencies have access to telecommunications information:

Currently, access to telecommunications data is regulated by Chapter 4 of the TIA Act, which permits an ‘enforcement agency’ to authorise a C/CSP to disclose telecommunications data where it is reasonably necessary for the enforcement of the criminal law, a law imposing a pecuniary penalty, or the protection of the public revenue. There are separate provisions enabling access for national security purposes.

An enforcement agency is broadly defined as all interception agencies as well as a body whose functions include administering a law imposing a pecuniary penalty or administering a law relating to the protection of the public revenue. In practice, the range of agencies that are enforcement agencies and which authorise the disclosure of telecommunications data is very broad and includes Shire Councils, Government Departments and Agencies such as Centrelink and bodies as the Royal Society for the Prevention of Cruelty to Animals (RSPCA) (which plays a role in investigating assaults and other criminal acts against animals).[41]

2.48               The Committee noted that in 2010-11 there were 251,631 requests for access to telecommunications data from a variety of agencies including police forces, anti-corruption bodies, Commonwealth and State and territory departments, local shire councils, animal protection authorities, roads authorities, revenue offices, and child support agencies.[42]

2.49               Ms Irene Graham submitted that the range of agencies able to access stored communications and communications data should be reduced:

The range of agencies should certainly be reduced, and probably most especially by deleting all, or most, of the civil and pecuniary penalty agencies that acquired power to obtain access to stored communications when the ‘stored communications’ warrants were introduced in 2006 (although such agencies were not and still are not authorised to obtain interception warrants).
…
There absolutely does need to be a competent review conducted into which of such agencies have a clearly demonstrated need to access stored communications and/or telecommunications ‘data’ in specific circumstances, together with consideration of the type of offences and the penalties that apply to any offences in relation to which such agencies claim ‘a need’.[43]

2.50               Telstra submitted the TIA Act could be amended to differentiate between types of telecommunications data, with limited agencies being permitted to access sets of data considered to be more sensitive:

Telstra believes there is some merit in adopting a two-tiered communications data access regime to address potential risks of allowing access to customer data for the investigation of lesser offences. Under this type of regime, data readily available through C/CSP customer information systems could be provided under the current threshold test and would potentially remain accessible to a larger number of enforcement agencies and LENSAs [Law Enforcement and National Security Agencies].

Under this construct, access to more intrusive communications data, e.g. URLs, IP addresses or ‘created’ tailored data sets proposed under the data retention regime, would only be provided to a limited number of LENSAs and would require higher approval thresholds to be satisfied.[44]

2.51               An alternative approach was submitted by the Australian Mobile Telecommunications Association and Communications Alliance in their joint submission:

The Associations believe that rather than looking to define the number of agencies that are eligible to access communications information (that being content and transactional data), a preferred approach should be to reserve access to communications information solely for purposes of addressing instances of serious crime or threats to national security. The nature of the crime/threat in each instance would then determine the type of information required, and the agency/agencies who are eligible to obtain access. If this approach is taken it will be important to be clear about what constitutes ‘serious crime’.[45]

2.52               The Committee was not able within the confines of this inquiry to examine the justification for each enforcement agency to be able to continue to access telecommunications data.  It was clear from the evidence however that the present definition of enforcement agency, being broad and inexhaustive, leaves the potential for many agencies to request access to telecommunications data without independent scrutiny other than from the telecommunications providers who receive those requests.  This is not an acceptable burden to place on telecommunications providers, nor is the Committee convinced that this is an effective accountability mechanism.

2.53               The Committee considers the appropriate mechanism to justify access to telecommunications data is the threshold at which access is granted.  The threshold acts to establish the level of gravity of the conduct which must be under investigation before the privacy intrusion of accessing telecommunications data can be justified.

2.54               The Committee is satisfied that access to telecommunications data for serious crime and threats to security is justified.  Access for agencies not enforcing the criminal law or investigating security threats should be subject to further review.

Recommendation 5
	The Committee recommends that the Attorney-General’s Department review the threshold for access to telecommunications data.  This review should focus on reducing the number of agencies able to access telecommunications data by using gravity of conduct which may be investigated utilising telecommunications data as the threshold on which access is allowed.

 

Standardise warrant tests and thresholds

2.55               In its submission to the Committee, the AGD addressed possible changes to the tests for telecommunications interception warrants, specifically the threshold at which interception warrants are available:

Warrants relating to accessing real-time content are traditionally limited to investigating an offence that carries a penalty of at least seven years imprisonment: a ‘serious offence’ as defined in section 5D of the TIA Act. Section 5D is an exhaustive list which includes offences by reference to other Commonwealth legislation (such as an offence against Part 10.7 of the Criminal Code Act 1995) or of a certain type (such as murder) or involving certain conduct (such as trafficking in prescribed substances) all of which generally require at least seven years imprisonment.

…

The Department considers that these requirements should not change: access to real-time content should continue to be subject to an independently issued warrant for the investigation of a serious offence.

…

The Department is concerned that the growing complexity of section 5D of the TIA Act is inefficient in terms of police resources needed to clarify the application of the provision in specific circumstances and, more importantly, potentially privacy invasive in its lack of clarity about how and …

The Department considers that the interception regime would offer greater privacy protection if the distinction between stored and live warrants was removed and if a standard threshold for both content and stored communications warrants was introduced.[46]

2.56               The issue of a standard threshold for TIA Act warrants attracted significant evidence for the Committee’s consideration.  Many submitters acknowledged the potential administrative efficiencies to be gained from standardisation, but objected to the potential for warrant thresholds to be lowered.  For example, Liberty Victoria submitted:

Standardisation of interception warrant tests must not compromise human rights – Liberty Victoria recognises that there may be operational benefits in standardising various warrant tests. However, we are concerned to ensure that any standardisation process does not compromise human rights in the name of operational efficiencies. In particular, we oppose any reduction of the general threshold for interception so that it applies to offences with maximum penalties of less than 7 years’ imprisonment.[47]

2.57               The Committee also received extensive evidence from law enforcement agencies regarding the complexity of the present threshold for telecommunications interception warrants.  For example, Victoria Police submitted:

The definition of serious offence pursuant to section 5D of the TIA Act is long, complex and outdated and it excludes offences which should be so classified. There are offences Victoria Police routinely investigates that are serious in nature, but are not specified in the definition or only become serious offences if they meet certain additional conditions such as being part of a series of offences, involve substantial planning and organisation and sophisticated methods and techniques.

Offences that are serious in nature but are not captured in this section include blackmail and perverting the course of justice, where an investigative method such as telecommunications interception would assist in the investigation of offenders charged with serious crimes attempting to arrange false alibis or have witnesses change their statement and/or provide false evidence.[48]

2.58               Similarly the Western Australia Police submitted:

At present, under the TIA Act, it is not possible to obtain an interception warrant with respect to offences which carry a penalty of less than 7 years imprisonment but which may be preparatory to more serious offending. For example, precursor or preparatory crimes could include selling unregistered firearms, pervert the course of justice or stealing a motor vehicle. The ability to intercept communications in relation to precursor offences may assist in the prevention of more serious offending.

WA Police would welcome an examination of the current definition of serious offence and serious contravention contained in the TIA Act (section 5D and section 5E). The current definition is complex and unwieldy, and requires simplification.[49]

2.59               The appropriate threshold for access to the content of communications is a complex issue.  As noted by the Australian Competition and Consumer Commission, stored communications warrants are available for pecuniary penalty offences in addition to the threshold set by a period of imprisonment:

In the main, telephone interception is limited to investigation of serious offences under criminal law where the conduct is punishable by seven years’ imprisonment or more. In contrast, stored communications warrants can be issued by a judge for serious contraventions of civil or criminal law involving a fine or pecuniary penalty equivalent to at least $19,800 (individuals) or $99,000 (businesses), as well as for serious criminal offences capable of interception.[50]

2.60               Rather than lowering the existing threshold, the Law Council of Australia advocated lifting the relevant thresholds:

The Law Council is of the view that it is appropriate for the offence threshold for stored communication warrants to be reviewed and raised to apply only to criminal offences. Consideration should also be given to raising this threshold to ‘serious offences’, as defined in section 5D of the TIA Act, in recognition of the private nature of stored communication information and to better align the stored communication warrant process with that required for telecommunication interception warrants.[51]

2.61               As stated by the Inspector-General of Intelligence and Security, ‘proposals to standardise security warrant tests and thresholds must take into account the nature of each of these warrants and the level of intrusiveness.’[52]

2.62               The Committee notes that there are differing penalty thresholds within the TIA Act, and between the TIA Act and other electronic surveillance powers (such as the Surveillance Devices Act 2004).  The appropriate threshold for access to telecommunications and access to stored communications (whether they be combined under a single test) requires a careful consideration of the:

n  proportionality of the investigative need and the privacy intrusion;

n  gravity of the conduct to be investigated by these investigative means;

n  scope of the offences included and excluded by a particular threshold;

n  impact on law enforcement agencies investigative capabilities, including those accessing stored communications when investigating pecuniary penalty offences; and

n  privacy impact.

2.63               The Committee is not able, upon the evidence before it, to reach a final position about the appropriate threshold for access to telecommunications and stored communication.  Rather, the Committee is attracted to the proposal from the AFP for a further review to consider this issue:

The appropriateness of these separate warrant tests and offence thresholds should be reviewed taking into consideration the contemporary use of communications in society generally and by persons of interest in the commission of crime, and the nature of the technology underpinning telecommunications and internet communication services. A key example of this is the increasing use of stored communication as a means of covert communication.

From a law enforcement perspective such a review needs to take into account the basis of the gravity of the conduct; the increasingly ubiquitous nature of telecommunications content and stored communications as evidence of the commission of an increasing number of offences that cause significant harm to the community, and the transitory nature of that content. It may be that the differentiation currently imposed between the two forms of content is no longer appropriate and that a reviewed and unified threshold would be more appropriate to meet both community expectations and law enforcements needs.[53]

2.64               The Committee notes that telecommunications interception warrants may be issued for the investigation of offences with a maximum penalty of at least seven years imprisonment but stored communications warrants may be issued for the investigation of offences with a significantly lower threshold of at least three years imprisonment as a maximum penalty. There is arguably very little difference in the privacy impact carried out if communications are accessed live via interception or after the communication takes place when accessed with a stored communications warrant. The Committee is of the view that covert access to communications should not distinguish between access methods, and that therefore the penalty threshold should be standardised.

 

Recommendation 6

The Committee recommends that the Attorney-General’s Department examine the standardisation of thresholds for accessing the content of communications.  The standardisation should consider the: n  privacy impact of the threshold; n  proportionality of the investigative need and the privacy intrusion; n  gravity of the conduct to be investigated by these investigative means; n  scope of the offences included and excluded by a particular threshold; and n  impact on law enforcement agencies’ investigative capabilities, including those accessing stored communications when investigating pecuniary penalty offences.

 

Expanding the basis of interception activities

2.65               The AGD discussion paper describes the challenge to the ongoing effectiveness of telecommunications interception as follows:

Telecommunications interception and access to communications data are unique and fundamental tools that cannot be replaced by other investigative techniques.  They are cost effective, timely, low risk and extremely successful tools in obtaining intelligence and evidence.  Substantial and rapid changes in communications technology and the business environment are rapidly eroding agencies’ ability to intercept.  Adapting the regime governing the lawful access to communications is a fundamental first step in arresting the serious decline in agencies’ capabilities.[54]

2.66               The Committee notes the effectiveness of telecommunications interception as an investigative technique.  The Telecommunications (Interception and Access) Act 1979 Annual Report for 2010-11 notes that intercepted information contributed to 2441 arrests, 3168 prosecutions, and 2034 convictions for the 2010-11 financial year.[55]

2.67               The Committee took evidence on the decline in agencies’ interception capability, referred to as ‘going dark’:

In terms of this concept of going dark, it is certainly something that is being increasingly discussed amongst the law enforcement fraternity and it is a recognition primarily of these new technologies that we are unable to intercept for a range of reasons. That is one of the areas that I would respectfully suggest that the committee needs to consider in terms of the ongoing viability of telecommunications interception generally.[56]

2.68               The AFP submitted that the telecommunications environment has shifted considerably since 1979 resulting in significant challenges to interception:

That industry environment no longer exists. Several service or application providers may be involved in any one communication event. Individuals often use multiple devices and applications to communicate and free accounts can be established quickly and with no clear connection to a real life identity. Further, the current approach presupposes that the communications are between people using devices, not machine based communications as may be used through botnets or other internet based crimes where communications content is an important source of evidence. Into the future, given the move from circuit based to IP based telecommunication services, identifying communications between persons will become increasing challenging.

In light of this it is no longer viable to continue to base interception solely on the traditional network identifiers prescribed in the TIA Act. For this reason the AFP considers additional bases for interception such as the concept of communications of interest that relate to the offence under investigation would be of benefit. This concept could include the source of a communication, the destination of a communication, and the type of communication.[57]

2.69               The Committee heard evidence that a proposal for ‘attribute based interception’ would assist in countering the decline of capability caused by technological and counter-security measures.  The Western Australia Corruption and Crime Commission explained the proposal:

Being able to identify particular communications within the service, for example, may allow agencies to exclude or include particular communications through relevant identifiers. For example, if an internet based interception were to be conducted on a user's account the agency may only be interested in particular communications such as those linked to an email address or internet chat protocol. By expanding the basis for interception activity, agencies may be able to exclude other communications thereby better targeting the communications of interest and providing greater privacy protection by excluding other content.[58]

2.70               A range of submissions noted the potential privacy protection which could be achieved by introducing a warrant which better targeted communications on the basis of specific attributes.  Those submissions noted however the need to ensure appropriate oversight and accountability of the proposed warrant type:

The Law Council recognises the challenges existing and emerging telecommunications technologies pose for agencies attempting to accurately identify the communications they intend to intercept or access. For this reason, the Law Council generally supports efforts to develop a warrant regime that focuses on better targeting the characteristics of a communication and enables it to be isolated from communications that are not of interest. However, the Law Council is keen to ensure that any proposed ‘simplification of the warrant process’ does not occur at the expense of specific provisions designed to ensure that each particular device or service to be intercepted or communication to be accessed is clearly identified and shown to be justifiable and necessary, and that it occurs in a manner that has the least intrusive impact on individual rights and privacy.[59]

2.71               Liberty Victoria similarly expressed in principle support subject to appropriate oversight and accountability arrangements:

Liberty Victoria is not at this stage opposed to further consideration being given to expanding interception obligations from the network/service layer to the application layer. Interception at the network/service layer often involves casting the net of information to be intercepted too broadly, with a greater risk of capturing irrelevant and innocent communications. However, any expansion must be accompanied by the adoption of appropriate safeguards and accountability mechanisms.[60]

2.72               Other submissions expressed concern at the potential impact on privacy which may result from expanding the basis of interception:

When viewed in the context of a proportional response to the current threat landscape I do not feel that the expansion of interception activities as outlined in the ToR and discussion paper are proportional to the massive invasion of privacy entailed. The cost to our privacy is too high in relation to a threat that if anything is subsiding and to which it appears the security agencies of our nation have enough tools to combat effectively anyway.[61]

2.73               The AGD submission described the present considerations an issuing authority must address prior to issuing a telecommunications interception warrant:

The independent authority may issue the warrant if satisfied from the facts outlined in the affidavit that:

n  there are reasonable grounds for suspecting that the person is using or is likely to use the service

n  that information obtained under interception would be likely to assist the investigation of a serious offence in which the person is involved

n  and having regard to:

§  the privacy of any persons likely to be interfered with by interception

§  the gravity of the conduct being investigated, and

§  the extent to which other methods of investigating the offence have been exhausted or would prejudice the investigation.[62]

2.74               The Committee received evidence from the Commonwealth Ombudsman and Inspector-General of Intelligence and Security.  No issue of substantive non-compliance by the interception agencies was raised before the Committee.  The Inspector-General of Intelligence and Security did raise, however, a range of issues for consideration should this proposal be adopted:

A key issue to be considered in this proposal is whether the warrants would be limited to interception based on the ‘characteristics’ described in the initial warrant (similar to a service warrant) or whether ASIO would itself be able to vary the warrant to add or remove ‘characteristics’ (similar to a named person warrant). If the proposal is for the latter then there needs to be certainty as to the parameters within which ‘characteristics’ can be added.

…

A further issue is the technological capacity to actually undertake this type of ‘characteristic’-based interception – including whether the carriers should be responsible for collecting, processing and delivering the communications of interest or whether the agencies should be permitted to collect and retain large amounts of information in order to find the communications of interest. It is outside my area of focus to comment on the technology, cost or burden sharing aspects of the proposal. However I would expect to see any regime include appropriate measures to ensure that the content of communications which were not the specific target of the warrant were not retained longer than necessary for ‘sorting’ and to ensure that such information is kept secure.

One of the important accountability and oversight requirements of the current regime is the requirement that ASIO provide a report to the Attorney-General after the expiration or revocation of each warrant. The report must include details of the telecommunications service to or from each intercepted communication was made as well as the extent to which the warrant has assisted ASIO in carrying out its functions. This measure would be particularly important in maintaining oversight and accountability of any discretion to add new characteristics for interception.[63]

2.75               The Committee agrees with the need to ensure that telecommunications interception powers remain subject to appropriate accountability and oversight, including a robust system for obtaining telecommunications interception warrants from independent issuing authorities who have considered the privacy, proportionality and investigative necessity of proposed interception activities.

2.76               The Committee notes the potential for attribute based interception to assist in arresting the decline of interception capability, while also offering additional privacy protections by better targeting communications which are of particular relevance to the serious crime or national security threat which is being investigated.

2.77               Possible attributes which may be used in these warrants include:

n  Time of a communication;

n  Location of a communication; and

n  an identifier or address that uniquely identifies a service or account.

 

 

Recommendation 7

The Committee recommends that interception be conducted on the basis of specific attributes of communications. The Committee further recommends that the Government model ‘attribute based interception’ on the existing named person interception warrants, which includes: n  the ability for the issuing authority to set parameters around the variation of attributes for interception; n  the ability for interception agencies to vary the attributes for interception; and n  reporting on the attributes added for interception by an authorised officer within an interception agency. In addition to Parliamentary oversight, the Committee recommends that attribute based interception be subject to the following safeguards and accountability measures: n  attribute based interception is only authorised when an issuing authority or approved officer is satisfied the facts and grounds indicate that interception is proportionate to the offence or national security threat being investigated; n  oversight of attribute based interception by the ombudsmen and Inspector-General of Intelligence and Security; and n  reporting by the law enforcement and security agencies to their respective Ministers on the effectiveness of attribute based interception.

 

Streamlining and reducing complexity

2.78               The AGD discussion paper also identified the need to reduce complexity in the lawful access regime as a driver of potential reform. As such, it sought an examination of:

n  Ways to simplify the provisions that allow the various agencies to share information and cooperate;

n  The removal of legislative duplication; and

n  The creation of a single warrant with multiple telecommunications interception powers.[64]

Simplifying the information sharing provisions that allow agencies to cooperate

2.79               The TIA Act is drafted in prescriptive terms, based on the premise that interception is prohibited unless authorised by one of the limited exceptions.  The prescriptive nature of the regime continues in the provisions which regulate the use and communication of intercepted information.  The AGD Discussion paper explains:

Information obtained under the Telecommunications (Interception and Access) Act 1979 is subject to more rigorous legislative protections than other forms of information in an agency’s possession.  The provisions are detailed and complex in relation to record keeping, retention and destruction and can present a barrier to effective information sharing both within an agency and between agencies.  This was not an issue when the Act was enacted and applied only to ASIO and the AFP, but with more agencies now defined as interception agencies and the national and transnational nature of many contemporary security and law enforcement investigations, effective co-operation within and between agencies is critical. 

Simplifying the current information sharing provisions would support co-operative arrangements between agencies and consideration could be given to the ways in which information sharing amongst agencies could be facilitated.[65]

2.80               The NSW Police argued that the prescriptive approach inhibits interagency cooperation and impedes agencies’ abilities to cooperate effectively:

Further, the access to and the subsequent use of information is framed throughout the Telecommunications (Interception and Access) Act 1979 as one agency undertaking one investigation which will lead to a prosecution. I think that the act needs to be reformed to reflect new operational realities, including the different functions of agencies within the act and the fact that effective information sharing is a key component of successful investigations. The current information-sharing and dissemination scheme contained in the act is complex, confusing and cumbersome. The current provisions were not designed with joint agency operations in mind and are considered to be overly restrictive, with the default position being to prohibit communication of information that has been obtained lawfully.

Whilst acknowledging privacy concerns—and we do acknowledge privacy concerns and the intrusive nature of telephone interception—a simplified, more permissive information-sharing communication model really does need to be adopted. If agencies are going to be encouraged and properly equipped to perform their functions and to cooperate effectively, then we need to be allowed to disseminate, communicate or share information where there is a legitimate reason to do so. Naturally, appropriate oversight and safeguards need to be and must be incorporated in such a scheme. But, overall, it is the agencies that readily use this legislation that I think are best placed to assist in its reform and the New South Wales Police Force is in an excellent position to provide further input from an operational perspective.[66]

2.81               The NSW Police supported the argument for reform with the following examples of current operational impediments:

As an example, if we were tapping a telephone and, as a result of some information which came across that phone, we had concerns that someone was carrying a firearm on the street but we were not in a position to take any action, we cannot post that intelligence on a warning system for our officers. We would like to be able to put out a warning saying, ‘If you pull this vehicle over with that person driving, be careful—intelligence suggests that they are armed.’

Another example might be where we have an interception operation running and, as a result of that, we come across some information about a child abuse situation. In that setting, we are not at liberty even to advise a child protection authority that there is a telephone interception running. That is because we are not able to use that lawfully intercepted information. That is difficult. We encounter that every day.[67]

2.82               Victoria Police submitted the current TIA Act regime is too restrictive, and inhibits community protection:

While it is important that there are strict controls over the sharing of information, Victoria Police investigators have on occasion found the legislation to be too restrictive. There have been instances where lawfully intercepted information would be of high importance to other organisations providing a function in the service of the community, but Victoria Police is legislatively prevented from providing it. For example, if an interception identifies that a child is at risk of harm from its parents, this information cannot be communicated to child protection agencies. Similarly, where investigators identify the inappropriate dealings of a prison officer, this information cannot be passed on to prison authorities.[68]

2.83               A number of submissions noted in-principle support for streamlined information sharing provisions, citing the need for effective collaboration between law enforcement and national security agencies.  That support, however, was subject to concerns that simplified information sharing provisions should not intrude upon privacy to any extent greater than is necessary for the purpose of the investigation.  The Liberty Victoria submission is illustrative in this regard:

Liberty Victoria acknowledges that there is an increasing need for agencies defined as ‘interception agencies’ – including those responsible for national and transnational security and law enforcement investigations – to share information with one another. The nature of transnational security concerns means that agencies other than ASIO and the Australian Federal Police (AFP) are involved in investigations which impact the security of Australia, as well as Australian citizens within Australia and abroad.

However, as noted above in relation to standardisation of the tests and thresholds relating to warrants, detailed information-sharing provisions may reflect a desire to appropriately balance the right to privacy against security considerations. Careful consideration will therefore need to be given about whether the complexity of information-sharing provisions is justified. In Liberty Victoria’s view, any broadening of scope to allow additional information-sharing between agencies should be taken seriously and with the upmost concern for privacy. Again, while Liberty Victoria recognises the need to facilitate information-sharing between agencies in some cases, there is insufficient detail in the Discussion Paper for stakeholders to comment in detail.[69]

2.84               Similarly, Ms Stella Gray expressed concern that streamlined information sharing did not become unregulated information centralisation:

It is fair and reasonable to assume that if an agency obtains evidence of a crime that is outside their jurisdiction to pursue, they should be able share that evidence with the relevant agency. However, they should only share the evidence relevant to the crime in question. If agencies were allowed to share the entirety of communications intercepted under the original warrant, this would be a clear case of overreach, and has severe implications for citizens’ privacy. It is crucial that all information gathered from warrants remains stored separately as a privacy safeguard. If this aspect of information sharing is not treated with precision, there will be a temptation to create a central database accessible by all agencies, which is a security and privacy risk in itself.[70]

2.85               Mr Bernard Keane submitted that the case for simplified information sharing had not been made:

The argument that information should be more easily shared between agencies is a glib one, and the only justification advanced in the paper is that ‘effective co‐operation within and between agencies is critical.’ This of course is assertion rather than argument; no effort is made by AGD to explain what failings are currently occurring because of the legislative restraints on his intercepted data can be shared.

…

AGD has offered no justification for violating the long‐standing philosophy that intercepted information should only be used for the purposes for which it was collected, rather than becoming a common treasure trove to be dipped into by all law enforcement and intelligence agencies at will.[71]

2.86               The Pirate Party Australia expressed support for enhanced reporting, but did not support a reduction in accountability:

We support security agencies providing more relevant information about the proportionality of any use of their invasive powers, while opposing any streamlining that reduces the ability of investigative bodies to uncover corruption or abuse of power.[72]

2.87               The AFP submission included several case studies to illustrate that the current prescriptive information sharing provisions impede operational collaboration.  The AFP stated:

The complex and evolving nature of transnational crime means that no one agency can effectively conduct complex investigations. Collaboration is an essential element in achieving operational goals. The TIA Act as it currently stands impedes the effective exchange of lawfully obtained communications information and reduces the efficiency of operational partnerships. Simplified, principle based use and disclosure rules would be more consistent with the modern approach to cooperation between agencies and assist in assuring information obtained under lawful interception is maximised appropriately to serve the public good.[73]

2.88               The Office of the Australian Information Commissioner acknowledged the necessity of information sharing to effective investigative collaboration, but noted the need to ensure clarity of obligations and standards regarding the protection of the privacy of personal information due to fragmented information handling obligations:

[t]he OAIC considers that this fragmentation makes it particularly important that each of the applicable regulatory frameworks setting out information sharing arrangements between law enforcement and intelligence agencies clearly and consistently specifies the nature, scope and limits of the information sharing activities. This includes specifying what protections are afforded to any personal information collected, used or disclosed under the information sharing arrangement.[74]

2.89               Mr Newton noted general support for information sharing simplification, but not if it resulted in a net reduction in privacy protections:

In particular, I would not support a sharing regime which enabled an agency which had obtained evidence for a certain purpose to divulge it to a second agency for a different purpose, if that second agency would otherwise be required to obtain their own warrant.[75]

2.90               The Law Council of Australia submitted it is appropriate that information obtained under the TIA Act is subject to more rigorous legislative protections than other forms of information in a law enforcement agency’s possession:

Sharing this type of information must necessarily be more restricted than sharing other information in order to recognise its particularly sensitive nature and the intrusive impact on a person’s rights and privacy. It could include, for example, details of a person’s most private conversations or the precise location of a person, and may include information in relation to non-suspects or other innocent third parties. Provisions relating to the sharing of this type of information must also reflect limits on the types of officers who are able to have primary access to this information.[76]

2.91               Rather than simplification to enable greater interagency information sharing, the Law Council suggested reforms should look at ‘strengthening and clarifying the existing provisions, recognising that different restrictions on communication, use and disclosure may be appropriate in light of the nature of the information obtained, and depending on what types of agencies are able to have primary access to such information.’[77]

2.92               The Committee supports the need to ensure that any amendments to the information sharing provisions provide appropriate privacy protections.  The Committee understands, however, one of the potential benefits of proposed information sharing reforms is to enable investigative agencies to provide intercepted information to an agency that is responsible for investigating particular criminal activity.

2.93               The Committee supports the view that information sharing provisions should continue to impose appropriate restrictions upon the use and disclosure of telecommunications interception information, having regard to its privacy intrusive nature.  The Committee also supports the need for law enforcement and security agencies to be able to share information to ensure that serious crimes and threats to national security can be investigated in a timely and thorough manner. 

2.94               The Committee is concerned about the proliferation of institutions that gather and share information, and the absence of consistent guidelines and sufficient oversight.

Recommendation 8
	The Committee recommends that the Attorney-General’s Department review the information sharing provisions of the Telecommunications (Interception and Access) Act 1979 to ensure: n  protection of the security and privacy of intercepted information; and n  sharing of information where necessary to facilitate investigation of serious crime or threats to national security.

 

Removing legislative duplication

2.95               The discussion paper notes that legislative complexity has been created by frequent amendments to the TIA Act:

The pace of change in the last decade has meant the Act has required frequent amendment resulting in duplication and complexity that makes the Act difficult to navigate and which creates the risk that the law will not be applied as Parliament intended.[78]

2.96               The Attorney-General’s Department was asked on notice to provide examples of legislative duplication.  The Department noted that it considers that the multiple types of warrants are no longer appropriate for the modern communications landscape:

Key areas of duplication relate to the different types of warrants, including the distinction made between intercepted and stored communications.[79]

2.97               The Department observed that the duplicated nature of warrants leads to other forms of unnecessary legislative duplication:

The oversight, record keeping and reporting provisions which flow from these warrant provisions are also duplicative. For example, in relation to oversight responsibilities, there is dual oversight of State and Territory agencies by both the Commonwealth Ombudsman and the relevant State or Territory oversight agency.

In relation to record keeping and reporting, there are three separate annual report requirements for telecommunications interception warrants, stored communication warrants and access to telecommunications data. In the case of interception warrants there are separate annual report requirements for Commonwealth agencies and State prescribed authorities, there are also two separate reporting requirements for State agencies. The three requirements differ making it difficult to undertake a meaningful analysis and comparison of the different mechanisms. [80]

2.98               The Department presented the overall view that: 

…streamlining and modernising lawful access to telecommunications provisions through the creation of a one warrant regime that regulates access to the content of a communication, together with the flow on effects to the oversight, record keeping and reporting requirements, will remove significant duplication and complexity from the TIA Act and create consistency in the accountability framework.[81] 

2.99               The Committee is of the view that removing legislative duplication would help to make the interception regime easier for the general public, legal practitioners, law enforcement and the justice system to understand and apply.

 

Recommendation 9
	The Committee recommends that the Telecommunications (Interception and Access) Act 1979 be amended to remove legislative duplication.

 

A single warrant with multiple telecommunications interception powers

2.100           The AGD submission states:

The Department considers that the interception regime would offer greater privacy protection if the distinction between stored and live warrants was removed and if a standard threshold for both content and stored communications warrants was introduced. Reliance on the higher seven year penalty threshold has not proved successful in limiting the application of interception powers. On the other hand the three year stored communications threshold underestimates the value of non-voice communications in the contemporary communications environment. A threshold in between these two would recognise the growing importance of non-voice communications and enable interception to be used as a tool in investigating a number of serious crimes that currently fall outside the TIA Act.

A single warrant, and clarification of the concept of serious offence, would greatly enhance the capacity of the interception regime to ensure that interception is only available in defined circumstances.[82]

2.101           Victoria Police supported the proposal for a single warrant, noting in its submission:

It is no longer practicable for warrants to be obtained solely on traditional network identifiers such as telephone numbers or International Mobile Equipment Identifier (IMEI) numbers. A single warrant in which particular identifier(s) could be stipulated (such as a username, webmail address, internet account) would enable the targeting of communications of a suspect without the need for multiple warrants over time on the same target.[83]

2.102           Similarly, the Western Australia Police expressed support for the efficiency and flexibility a single warrant regime would represent:

The creation of a single warrant with multiple TI powers would provide the flexibility to cater for future technological change by having a focus on communications made by an individual rather than the specific technology or equipment used.

WA Police is of the view that the use of a single broad based warrant would simplify an otherwise overly complicated regime. At present, the TIA Act provides for 6 different warrants (service warrant, b-party interception warrant, named person warrant, device based interception warrant, section 48 entry onto premises warrant, stored communications warrant), each of which have specific applicability. The application of the current warrant regime has the potential to cause confusion as police officers are often unsure about which warrant best suits the needs of a particular investigation.[84]

2.103           The Australian Mobile Telecommunications Association – Communications Alliance joint submission noted reservation with the proposal for a single warrant due to the potential for it to shift obligations and due diligence checks onto telecommunications providers:

A telecommunications service provider must be able to clearly determine from the warrant which services should be intercepted in order to properly implement a warrant. For these same reasons the responsibility to identify relevant services should rest with the intercepting agency and not the service provider. Industry also expects that there will be a continuing need for independent oversight of warrant applications prior to them being served on a carrier or carriage service provider. It would not be possible for the oversight process to fully assess the impact of each warrant if the carrier or service provider is subsequently required to make the decisions about what particular services are to be intercepted.[85]

2.104           Similarly, iiNet noted the need for warrants to avoid shifting questions of judgement to telecommunications providers:

The Discussion Paper does not specify what the particular ‘TI powers’ will be (i.e. whether a consolidation of existing powers is intended or the addition of new powers). iiNet believes that it is important that it be recognised that C/CSPs are not State agents, and a clear demarcation should be maintained between CSPs providing access and C/CSPs doing more than providing access. Furthermore, C/CSPs should not be required to make any judgement calls as regards what particular information is required for a C/CSP to comply with a warrant. Therefore, warrants should contain clear and specific terms.[86]

2.105           Interception agencies explained to the Committee, however, that the proposal for a single telecommunications interception warrant would significantly increase administrative efficiency without diminishing accountability:

The current TIA Act requires various types of warrants to access communications lawfully. Additional types of warrants have been created over the years in response to changes in methodologies and technologies. The resultant system is complex requiring detail to be interpreted by agencies, issuing authorities, oversight bodies, and courts. The Commission supports the concept of a single simplified warrant. The relevant thresholds and privacy intrusions are essentially the same where communications are accessed via service device be they stored communications or intercepted in transit. [87]

2.106           A number of submissions expressed cautious support for the proposed single warrant, noting the potential for efficiencies within the warrant process, but noted concern at the potential for the proposal to diminish thresholds.  The Pirate Party submission is an example of this position:

If this single warrant retains a threshold test for serious crimes (with a penalty of 7 years or greater imprisonment) then there should be no obstacle in implementing it. If, however, the threshold is lower than that then there would be grave concerns in allowing it.[88]

2.107           The Tasmanian Association of Community Legal Centres expressed concern the proposal would lead interception agencies to using available powers, rather than the most appropriate power:

In our view the current legislative requirement that law enforcement agencies apply for either a ‘telecommunications service’ warrant (authorising the interception of only one service, such as a single telephone number) or a ‘named person’ warrant (authorising the interception of any telecommunication services or devices that are likely to be used by the person named in the warrant) reduces the risk that law enforcement agencies will use all the powers available to them rather than being used for a specific purpose as currently provided in the powers of the two warrants.[89]

2.108           The issue of the thresholds and how to deliver the appropriate accountability was usefully addressed by the Inspector-General of Intelligence and Security:

Having multiple sets of warrant applications for a single investigation is administratively inconvenient for ASIO and does not necessarily provide the Attorney-General with a clear view of the totality of proposed activities. Any proposal to streamline this and give the Attorney-General a better picture of the situation is worthy of consideration but issues of proportionality and levels of authorisation will need careful consideration.

…

One interpretation of the proposal in the discussion paper could be that the Attorney-General is to be asked only to agree broadly to ‘interception’ against a particular individual, group or premises for a specified period and to then allow the Director-General of Security or a delegated ASIO officer to decide what form that interception should take during the warrant period (including whether B-Party interception is appropriate). I note that a ‘named person warrant’ currently allows the Director-General of Security to add or remove services from interception coverage during the life of the warrant to enable interception of communications made by or to the specified individual. Any proposal to effectively further transfer the level of decision making from Ministerial level to within an agency needs to ensure that appropriate reviews take place within the agency, make allowance for independent scrutiny and consider external reporting requirements.[90]

2.109           Similarly, the Gilbert + Tobin Centre for Public Law noted the need to ensure that a regime for a single telecommunications interception warrant should continue to ensure proportionality is considered by the issuing authority:

The most recent report of the Attorney-General’s Department into the operation of the TIA Act states that a named person warrant has a ‘high impact on privacy’. It should only be used ‘when necessary and other alternative methods are not available’. Therefore, in the majority of cases, law enforcement agencies obtain a telecommunications service warrant rather than a named person warrant. This is the correct approach. Any intrusions into the right to privacy should be the minimum required to achieve the public purpose. We are concerned that merging of named person warrants and telecommunications service warrants into a single category of warrant would result in law enforcement agencies using all the powers that are available to them (regardless of whether these powers are strictly necessary to investigate the criminal activity).[91]

2.110           The Law Council of Australia also noted reservations about the proposal’s potential to diminish accountability, particularly in the absence of detail within the Attorney-General’s Department Discussion Paper.  The Law Council helpfully indicated some of the considerations which could be addressed if the reform were to be supported:

However, if a proposal of this nature were pursued, the Law Council would suggest that the issuing authority must be satisfied of the following minimum requirements:

n  that any person whose telecommunications are to be intercepted is specifically identified as a legitimate target of suspicion from a security or law enforcement perspective;

n  that each and every telecommunications service or telecommunications device to be intercepted is, in fact, used or likely to be used by the relevant person of interest; and

n  each and every telecommunications service or telecommunications device to be intercepted can be uniquely identified such that relevant telecommunications made using that service or device can be isolated and intercepted with precision.

In addition, the issuing officer should also have regard to:

n  the likely benefit to the investigation which would result from the intercepted information substantially outweighing the extent to which the interception is likely to interfere with the privacy of any person or persons;

n  the gravity of the conduct constituting the offence or offences being investigated;

n  how much the information referred to would be likely to assist in connection with the investigation by the agency of the offence or offences; and

n  to what extent methods of investigating the offence or offences that do not involve intercepting communications have been used by, or are available to, the agency[92].

2.111           The Committee acknowledges the need to ensure that intrusive investigative techniques are exercised only in necessary and justified circumstances, and that the intrusion is proportionate to the conduct being investigated.  A balance must be struck between appropriate checks and balances, and the operational flexibility required to deliver effective law enforcement and protection against national security threats.

2.112           The Committee is of the view that revising the present multiple telecommunications interception warrants into a single warrant regime can deliver administrative efficiencies to interception agencies without removing appropriate accountability and safeguards. 

Recommendation 10

The Committee recommends that the telecommunications interception warrant provisions in the Telecommunications (Interception and Access) Act 1979 be revised to develop a single interception warrant regime.  The Committee recommends the single warrant regime include the following features: n  a single threshold for law enforcement agencies to access communications based on serious criminal offences; n  removal of the concept of stored communications to provide uniform protection to the content of communications; and n  maintenance of the existing ability to apply for telephone applications for warrants, emergency warrants and ability to enter premises. The Committee further recommends that the single warrant regime be subject to the following safeguards and accountability measures: n  interception is only authorised when an issuing authority is satisfied the facts and grounds indicate that interception is proportionate to the offence or national security threat being investigated; n  rigorous oversight of interception by the ombudsmen and Inspector-General of Intelligence and Security; n  reporting by the law enforcement and security agencies to their respective Ministers on the effectiveness of interception; and n  Parliamentary oversight of the use of interception.

 

Modernising the cost sharing framework

2.113           The final area for potential legislative reform identified by the AGD discussion paper relates to modernising the cost-sharing framework.  The discussion paper provided by the AGD proposes that cost sharing frameworks be modernised by aligning ‘industry interception assistance with industry regulatory policy’ and by clarifying the role of the Australian Communications and Media Authority’s role in regulation and enforcement.[93]

Align industry interception assistance with industry regulatory policy

2.114           The terms of reference to this inquiry state the Government wishes to progress the modernisation of the cost-sharing framework to align industry interception assistance with industry regulatory policy.  The industry assistance obligations are contained in the Telecommunications (Interception and Access) Act 1979 (TIA Act) and in the Telecommunication Act 1997.  The discussion paper explains:

In reforming cost sharing, consideration must also be given to the current make‐up of the telecommunications industry. The current requirements are predicated on the existence of one or few industry players and assume that all are resourced on a similar basis and have a similar customer base. This does not reflect industry practice which better suits a tiered model that supports comprehensive interception and delivery capability on the part of larger providers, a minimum interception and delivery capability on the part of medium providers and only reasonably necessary assistance for interception on the part of smaller providers.

A tiered model would also recognise that smaller providers generally have fewer customers and therefore have less potential to be required to execute an interception warrant and less capacity to store and retain information about communications and customers.[94]

2.115           The Department explained that the current cost responsibility principles for the maintenance of effective were established following the 1994 review into the Long term Cost-effectiveness of Telecommunications Interception by Mr Pat Barrett.[95]  The Department also gave an example of a more flexible approach to applying obligations to the contemporary telecommunications environment:

The requirement for all industry participants to have the same interception capability can also be an expensive and unnecessary burden that can act as a barrier to entry to the telecommunications market for new industry players.  Therefore, requiring all service providers to have the same interception capability regardless of size (as in the current system) could have the effect of restricting competition rather than promoting it and stifling innovation (noting that the promotion of the supply of diverse and innovative carriage services and content services is one of the objects of the Telecommunications Act).[96]

2.116           The Department concluded:

The current industry and legislative cost allocation framework is working well, but efficiencies may be able to be made in regards to standardisation of technical and administrative requirements in meeting these obligations.  Opportunities for reducing red tape and achieving regulatory offsets may also be identified.[97]

2.117           The Committee appreciates that the telecommunications environment has evolved rapidly and is significantly different in size, composition and international presence to the industry that existed when the TIA Act was first passed. 

2.118           Therefore, the Committee agrees that there is merit in reconsidering application of the cost-sharing provisions of the telecommunications interception regime to provide a more flexible approach.   

 

Recommendation 11
	The Committee recommends that the Government review the application of the interception-related industry assistance obligations contained in the Telecommunications (Interception and Access) Act 1979 and Telecommunications Act 1997.

 

Clarify ACMA’s regulatory and enforcement role

2.119           The Australian Communications and Media Authority (the ACMA) has the following functions and responsibilities:

The Australian Communications and Media Authority (ACMA) is a government agency responsible for the regulation of broadcasting, the internet, radiocommunications and telecommunications.

The ACMA's responsibilities include:

n  promoting self-regulation and competition in the communications industry, while protecting consumers and other users

n  fostering an environment in which electronic media respect community standards and respond to audience and user needs

n  managing access to the radiofrequency spectrum

n  representing Australia 's communications interests internationally.[98]

2.120           The AGD discussion paper suggested that the enforcement mechanisms available to the ACMA in relation to telecommunications interception regulation should be expanded:

Consideration should also be given to clarifying the role of the Australian Communications and Media Authority (ACMA) in regulating industry obligations under the interception regime.  The ACMA has rarely used its powers to enforce compliance with the TIA Act because the only effective power available to it under the Act is court action.  Court action is usually inappropriate or excessive in the circumstances and unhelpful from an agency perspective because it may publicly disclose that a particular C/CSP is not complying with its TIA Act obligations.  The ACMA’s role could be reinforced by expanding the range of regulatory options available and clarifying the standards with which industry must comply.[99]

2.121           Telstra expressed support for clarifying the ACMA’s enforcement role, also noting the need to ensure appropriate consideration is given to education and dispute resolution roles:

Telstra believes there needs to be clarification as to what role ACMA will have in future in monitoring compliance by C/CSPs with the Telco Act and TIA Act in respect to national security and law enforcement.

The Discussion Paper does not suggest what types of additional powers may be contemplated. Telstra would recommend that whatever agency is given this enforcement role its primary focus should be on undertaking an active role in education and dispute resolution, with any penalty enforcement role being secondary.[100]

2.122           Mr Ian Quick expressed opposition to the proposal due to the potential loss of transparency:

A significant advantage of the current ACMA’s power – going to court– is that it is public and open to scrutiny. If, as the discussion paper suggests –

‘The ACMA’s role could be reinforced by expanding the range of regulatory options available and clarifying the standards with which industry must comply.’

it would be possible – though the paper does not say what the ‘options’ are – that the ACMA could quietly push a C/CSP into doing something it did not want to do. While this may be alleviated by clear standards, any option it has should be open to public scrutiny.[101]

2.123           The Committee did not receive a submission from the ACMA but notes the suggestion from Mr Bernard Keane to review the 2005 report Reform of the broadcasting regulator’s enforcement powers prepared for ACMA by Professor Ian Ramsay.  As Mr Keane noted:

Reform of the broadcasting regulator’s enforcement powers is a valuable analysis of regulatory theory that should provide the basis for an effective regulator’s suite of tools for achieving effective industry regulation. … In particular, it addressed the issue of a lack of ‘mid‐tier’ powers, which is a similar issue to that raised by AGD in the paper in relation to powers to enforce compliance with the TIA Act. On this issue, a power to accept enforceable undertakings, and a power to issue infringement notices, would appear to be two mid‐tier powers worth considering to enable ACMA to enforce compliance without resorting to litigation.[102]

2.124           The Committee notes that an effective enforcement and compliance regime requires a range of sanctions and tools which are tailored to a range of potential conduct. 

Recommendation 12
	The Committee recommends the Government consider expanding the regulatory enforcement options available to the Australian Communications and Media Authority to include a range of enforcement mechanisms in order to provide tools proportionate to the conduct being regulated.

Requirements for industry interception obligations

2.125           The AGD discussion paper outlines the current situation regarding the expression of industry interception obligations:

The TIA Act places an obligation on each C/CSP to have the capability to intercept communications and requires carriers and nominated carriage service providers to submit an annual interception capability plan outlining their strategy for complying with their obligation to intercept and to deliver communications to interception agencies.  The obligation extends to maintaining the capability to intercept communications that are carried by a service that they provide and to deliver those communications to the requesting agency consistent with a warrant. 

However, as networks have become more complicated and the types of services available have expanded, often beyond the C/CSPs’ own networks, challenges have evolved in applying a general obligation.  Consideration should be given towards introducing measures that implement more specific technical requirements to cater for a diverse and sophisticated telecommunications environment.   This includes developing requirements around administrative needs such as the timeliness of cost sharing to agencies and the security measures to be applied to the handling of sensitive information relating to interception operations.  [103]

2.126           The Australian Mobile Telecommunications Association – Communications Alliance supported a ‘high level set of requirements for industry interception obligations to be clear, straightforward and reasonable.’[104] 

2.127           iiNet submitted that it was unclear what was proposed, but that some clarification is necessary:

This proposed reform appears to iiNet to be capable of being very broad. It is not expressly discussed in any detail in the Discussion Paper. Without detail of what this reform would involve, it is difficult for iiNet to provide any meaningful comment, except to say that there should be thorough consultation with industry on these detailed requirements. iiNet believes that consideration of any such reform should include giving consideration to clarifying the scope of section 313 of the Telco Act. The scope of the obligation to ‘give such help as is reasonably necessary’ is vague and uncertain.[105]

2.128           The Western Australia Corruption and Crime Commission expressed support for the potential benefits to be derived from clearly articulated obligations:

The current regulatory regime for industry interception obligations is administratively burdensome for both industry participants and the regulatory agency. The current requirement of industry to prepare and submit interception capability plans which are then assessed annually should be reviewed.

The implementation of detailed requirements for industry interception obligations may assist in clarifying requirements and account for technical complexities. The Commission endorses the inclusion of administrative requirements as part of industry interception requirements. In many cases, difficulties or delays in interception are due to administrative, as opposed to, technical limitations.[106]

2.129           The Committee notes that while, in general, a cooperative relationship exists between telecommunication companies and law enforcement and national security agencies, a uniform level of cooperation does not exist across all sectors of the industry. The Committee sees benefit in providing detailed guidance on the obligations imposed on the telecommunications industry to ensure telecommunications providers and interception agencies alike understand the extent of those obligations.

Recommendation 13
	The Committee recommends that the Telecommunications (Interception and Access) Act 1979 be amended to include provisions which clearly express the scope of the obligations which require telecommunications providers to provide assistance to law enforcement and national security agencies regarding telecommunications interception and access to telecommunications data.

 

Clarify that the interception regime includes ancillary service providers

2.130           Although expressed as ‘extending’ the interception regime to ancillary service providers such as Facebook, Google and Twitter, the purpose of this term of reference is in fact to clarify that ­— as the Committee understands to be the case — the existing obligations do apply to ancillary service providers. It is not an extension of existing obligations.

2.131           Although he does not refer to ancillary service providers by name, Commissioner Scipione of the NSW Police Service described the challenges to national security services and the law enforcement community posed by technological change:

A further significant challenge for law enforcement agencies investigating national security and serious criminal matters is the increasing use of sophisticated technologies by criminals. Frankly, organised criminals are now able to operate outside the reach of ordinary telecommunications interception and law enforcement agencies that are dealing with criminals who have access to unprecedented advancements in technology. Legislation that not only fails to adequately recognise this but significantly fails to future proof itself against rapidly emerging technologies is what we are dealing with here.[107]

2.132           The rationale for clarifying the regulatory obligations of ancillary service providers under the TIA Act was stated by the Western Australia Police:

When communication systems were conducted over telephone networks only, as was the case when the TIA Act was written, there was no question as to who was responsible for supplying the interception points. It is no longer simply the case of going to just one telecommunications provider to intercept a persons’ communications. It is now quite feasible for someone to be subscribed to one provider for their telephone traffic and another provider for their Internet. Further, other providers might provide a Voice Over IP (VOIP) telephone service which then utilises a network, or multiple networks of multiple providers to get from point a to point b.

Intercepting an individual’s communications is no longer a simple exercise of only going to the major identified service providers. Regardless of the provider, it should be possible to intercept related Internet traffic for the purposes of investigating serious criminal activities.[108]

2.133           Victoria Police also submitted that the fact that the existing regime applied to ancillary service providers should be made clear beyond doubt:

Monitoring of intercepted communications by Victoria Police routinely demonstrates that services such as these are being used by suspects in furtherance of their criminal activities. Without a mandatory regulatory obligation placed on the providers of these services used in Australia, criminals can continue to communicate without the risk of being exposed to interception. There needs to be legislative parity with the obligations applicable to Australian service providers.[109]

2.134           The Committee notes that the TIA Act facilitates interception and access to telecommunications data by law enforcement and national security agencies.  The TIA Act facilitates this by relying upon the cooperation and assistance provided by telecommunications providers.  The TIA Act does not distinguish between telecommunications providers, but provides a universal telecommunications interception obligation on all providers of telecommunications services. 

2.135           Although the terms of reference requests the Committee to consider whether the existing TIA Act should ‘extend’ to ancillary service providers the Committee believes that the TIA Act does, under its existing provisions, include ancillary service providers. The use of the term ‘extend’ is inapt. The Committee received no evidence on behalf of ancillary service providers which disputed that the TIA Act applied to them. It is not an extension of existing obligations.

 

Recommendation 14

The Committee recommends that the Telecommunications (Interception and Access Act) 1979 and the Telecommunications Act 1997 be amended to make it clear beyond doubt that the existing obligations of the telecommunications interception regime apply to all providers (including ancillary service providers) of telecommunications services accessed within Australia. As with the existing cost sharing arrangements, this should be done on a no-profit and no-loss basis for ancillary service providers.

 

Industry participation model

2.136           The AGD discussion paper suggests the Committee should consider the merits of a tiered regime for industry assistance to intercept communications and facilitate access to telecommunications data:

In reforming cost sharing, consideration must also be given to the current make-up of the telecommunications industry.  The current requirements are predicated on the existence of one or few industry players and assume that all are resourced on a similar basis and have a similar customer base.  This does not reflect industry practice which better suits a tiered model that supports comprehensive interception and delivery capability on the part of larger providers, a minimum interception and delivery capability on the part of medium providers and only reasonably necessary assistance for interception on the part of smaller providers. 

A tiered model would also recognise that smaller providers generally have fewer customers and therefore have less potential to be required to execute an interception warrant and less capacity to store and retain information about communications and customers.  Requirements on industry to retain current information and to assist agencies to decrypt information would greatly enhance agencies’ abilities to detect and disrupt criminal and other behaviours that threaten national wellbeing but should be implemented in a way that does not compromise business viability.[110]

2.137           Ms Stella Gray queried the efficacy of a tiered regime for industry assistance:

A tiered interception-compliance model may simply encourage people to flock to smaller CSPs to evade surveillance, thereby negating the structure of this model.[111]

2.138           iiNet expressed in-principle support for a tiered industry assistance model, noting that it reflected industry practice:

iiNet agrees with the comments in the Discussion Paper that a tiered model would more accurately reflect industry practice. However, iiNet believes that it is appropriate to distinguish between:

n  the legal obligation to provide interception capability; and

n  the manner in which that obligation is complied with by a particular C/CSP.

iiNet believes that the obligation to provide interception capability should apply uniformly to all C/CSPs. However, iiNet believes that there should be flexibility as regards the manner in which a particular C/CSP complies with the obligation to provide interception capability, and the size and resources of the C/CSP should be a relevant consideration in the assessment of that C/CSP’s interception capability plan.[112]

2.139           The Australian Mobile Telecommunications Association – Communications Alliance also expressed in-principle support for a tiered industry assistance model:

Industry favours a tiered participation model, where investment in interception capabilities is based on Agency need and risk, as opposed to the current blanket obligation which requires the deployment of interception capabilities that in some cases are unlikely to be used.[113]

…

The current blanket approach of the TIA Act potentially gives rise to replication of interception capabilities at the carrier, wholesale service provider, retail Broadband service provider and application service layer. A more efficient regulatory framework should be sought, where replication of interception capabilities is not required.[114]

2.140           In contrast, Telstra expressed significant reservations about the proposal for a tiered industry assistance model:

Telstra believes these proposals run the risk of creating an uneven playing field, where the compliance burden would rest disproportionately with larger C/CSPs and the effectiveness of the overall regime is undermined by allowing criminals or terrorists to avoid interception arrangements by acquiring services from smaller C/CSPs.

In relation to the interception cost sharing framework, the Discussion Paper indicates that a new tiered model may be introduced where larger C/CSPs are expected to have a comprehensive interception capability (presumably at a greater cost) while smaller C/CSPs may only be required to have a minimum level capability (presumably at a lower cost). While the Discussion Paper states that one of its aims is to maintain ‘competitive neutrality’ in the industry, it is hard to see how tiered compliance obligations are consistent with this aim. As such, Telstra does not support this proposal.[115]

2.141           In testimony before the Committee, Telstra expanded upon these concerns:

Essentially what we are saying is that it should be a uniform application of obligations. Given the nature of their targets, law enforcement and national security schemes are only as strong as their weakest link. On an uneven playing field criminals and terrorists will inevitably locate their operations where security obligations are the lowest, leaving larger telecommunication operators to incur the costs of greater obligations for no offset in law enforcement or national security gain.[116]

2.142           Mr Mark Newton also opposed the proposal, submitting that a tiered model already applied by informal means:

This proposal is unnecessary, on the grounds that we have it by fiat already. Current industry interception obligations are consultative, and the Attorney-General’s Department doesn’t bother to consult with providers that this proposal would envisage as ‘tier 3.’ I believe considering this proposal is a waste of time, and I don’t support it.[117]

2.143           The Committee understands the proposal to be that all telecommunications providers would remain subject to an obligation to provide assistance to law enforcement and security agencies, but the manner in which telecommunications interception obligations would be discharged would vary according to the risk profile of the telecommunications provider.  As such, the Committee is assured that lower tier telecommunications providers will still maintain interception capability.

2.144           The committee does not favour a tiered approach. However it acknowledges that there may be situations related to practicability and affordability where exceptions for particular industry players are justifiable. However it is for those who seek exemption from the uniform obligation to demonstrate why they should be excused.

Recommendation 15

The Committee recommends that the Government should develop the implementation model on the basis of a uniformity of obligations while acknowledging that the creation of exemptions on the basis of practicability and affordability may be justifiable in particular cases. However, in all such cases the burden should lie on the industry participants to demonstrate why they should receive these exemptions.

 

An offence for failure to assist in the decryption of communications

2.145           The AGD submission explains the rationale and scope of the decryption assistance proposal:

Encryption is becoming widespread in information and communications technology. Criminals and terrorists are increasingly using encryption to avoid detection, investigation and prosecution causing difficulties for agencies to access clear, intelligible communications in their operations.

Encryption can be difficult to manage. It may not always be the case that a person who uses or creates encryption is able to provide assistance with decryption. Often an applications provider, organisation or individual provides encryption services, rather than a carrier. Criminal organisations and terrorists can obtain these services or even create and use their own encryption solutions.

Section 3LA of the Crimes Act 1914 (the Crimes Act) sets out provisions concerning decryption regarding information obtained under search warrants; however this does not extend to communications intercepted pursuant to a warrant under the TIA Act.

In summary, section 3LA of the Crimes Act allows a police officer to apply to a magistrate for a warrant to require a person to provide in accessible form (i.e. in decrypted form) data held on a computer or data storage device, where the computer or data storage device had been seized under a warrant. A warrant may be applied to the person under investigation, an owner of the device, an employee of the owner, a relevant contractor, a person who has used the device, or a systems administrator. There is a penalty of up to two years imprisonment for failing to comply with an order.

A consistent approach to that contained in the Crimes Act would ensure that information lawfully accessed for national security or law enforcement purposes under the TIA Act was intelligible.[118]

2.146           The Committee received many submissions about the absence of clarity as to whom the proposed offences would apply to, and what type of decryption assistance is envisaged.

End users, wholesale service providers, broadband retail service providers and content providers could all potentially play a role in the encryption of communications. Where the provider is based offshore then the matter of jurisdiction also needs to be considered.

Any decryption requirement should also specify that the obligation is to make available, if it is available, the means for decryption, as opposed to the actual content/communications that is to be decrypted.

There must not be a presumption that a person or organisation is capable of decrypting communications. The imposition of sanctions or penalties must be based on proof that the person or organisation is capable of assisting with the decryption of communications and there is evidence they have refused to do so.[119]

2.147           The AFP confirmed in testimony to the Committee that the decryption assistance sought by law enforcement agencies is limited to encryption applied by telecommunications providers:

From our perspective, encryption is a terrific advancement for the Australian community. Because it helps protect people from those who would do them harm in scams and those sorts of things it is a very good thing. What we would be seeking as far as the uptake to the act goes is that, where we have a warrant to intercept particular information going to a particular service, that the service provider provide those encryption keys to us to allow us to undertake that interception under warrant—as I have said—rather than anything else. This is not about people's home encryption. This is about talking to service providers about their providing those encryption keys under warrant for us to then intercept a particular device which has been duly authorised.[120]

2.148           The AFP provided a case study in support of the proposal:

During an investigation into an online paedophile network, it was noted that targets deployed a multiplicity of encryption techniques. They sent messages using an encryption overlay; images were encrypted and ‘hidden’ within other images which were then sent via closed peer to peer networks which also used encryption. Advanced Encryption Standards applications were used on virtual machines (computers within computers). The combined effect meant persons of interest were able to browse the internet without leaving detectable forensic footprints for investigators.

Additional members of this network identified and pursued in a related operation took the anti-forensic techniques further and used full disk encryption along with hidden volumes that were disguised using a technique that allowed for plausible deniability of the content, effectively circumventing both interception and search warrant legislation. Persons of interest identified in the investigation included a computer antivirus developer, and a computer networking trainer; their technical expertise was such that they were able to develop and customise their own encryption protocols rather than relying on off the shelf products.[121]

2.149           The Queensland Crime and Misconduct Commission expressed support for the proposal noting the current investigative challenge which encryption presents:

The increased use of sophisticated encryption presents challenges to the CMC. Internet service providers (ISPs) as well as application service providers (ASPs) are increasingly providing end to end encryption. The fact that ASPs can be located anywhere in the world can make it extremely difficult to seek assistance in the decryption of content that may be vital in an investigation. TIA Act reform that envisages law enforcement agencies being able to request decryption assistance where possible from ISP’s, Carriers and ASPs, would potentially allow for greater access to critical evidence.[122]

2.150           A range of submissions raised the prospect that an offence for failing to provide decryption assistance would undermine confidentiality requirements.  The Electronic Frontiers Australia submission was indicative:

EFA is concerned about the possible creation of an offence for failing to assist in the decryption of communications for the following reasons:

n  it undermines the right of individuals to not cooperate with an investigation

n  it poses a threat to the independence of journalists and their sources, particularly in circumstances involving whistle-blowing activity related to cases of official corruption

n  it could undermine the principles of doctor-patient and lawyer-client confidentiality and other trusted relationships

n  there are foreseeable and entirely legitimate circumstances in which decryption of data is not possible, such as where a password has been forgotten and is unrecoverable.[123]

 

2.151           The Human Rights Law Centre submitted that decryption assistance could impose an obligation on suspects to provide a ‘level of assistance to investigators [that] runs counter to the right to remain silent.’[124]

2.152           Mr Ian Quick objected to the proposal on a number of practical and theoretical grounds:

On the practical front, what would an agency do if someone said

n  ‘I can’t remember the password’

n  ‘I’ve deleted whatever the password was that was used for that period, so cannot assist.’

n  ‘I didn’t know it was encrypted, so have no idea what you are talking about.’

n  ‘It’s not encrypted, it’s just random junk (for whatever reason..)’

n  ‘The password I gave you doesn’t work? The file/message must be corrupted,

n  I can’t help you.’

In addition, many communication protocols regularly used on the internet have session keys used for encryption, which are not recoverable by the end user.

What would the agency do? All the responses above might be legitimate, I have certainly experienced every one of them! How would you distinguish between someone who was truthfully saying it and someone who was lying? Surely it would be against the presumption of innocence to fine/jail people who failed to assist unless it could be proven that they could assist – and how could this be done? How would it be legislated?[125]

2.153           The Law Council of Australia gave in principle support for assisting agencies access communications once authorised, but queried whether an offence was the appropriate mechanism:

However, the Law Council also appreciates the need to ensure that officers who have been authorised to access communications can do so in an effective, meaningful way.

To this end, the Law Council does not oppose mechanisms to assist agencies to reconstruct or decrypt the content of communications to which access has been authorised.

It notes for example, that the Telecommunications Act already obliges carriers and carrier service providers to provide such help to agencies as is ‘reasonably necessary’ for enforcing the criminal law and laws imposing pecuniary penalties, protecting public revenue and safeguarding national security.

However, it is not clear on the basis of the information provided in the Discussion Paper that the introduction of a criminal offence, presumably aimed at participants in the telecommunications industry such as carriers and carriage service providers, would be an effective or appropriate response, particularly when other non-punitive efforts may to be available to enhance cooperation between the agencies and the telecommunication industry.

Before introducing criminal liability for failing to assist in the decryption of communications, the Law Council suggests that the PJCIS requests that information be provided by the Attorney-General’s Department that explains whether the proposed offence adheres to the principles contained in the Guide to Framing Commonwealth Offences, Infringement Notices and Enforcement Powers.[126]

2.154           The Committee notes that, like the proposal for data retention, much of the discussion of the proposal for decryption assistance was confused by the lack of clarity on what is being proposed.

2.155           The Committee understands the proposal is for an offence to apply where a telecommunications provider does not provide assistance to decrypt communications where those communications have been encrypted by that telecommunications provider. This will of course only arise in circumstances where the relevant national security agency has established grounds where it is necessary to intercept and decrypt the communication.  That being the understanding, many of the concerns raised by submitters about individuals being subject to the offence, or being forced to provide passwords, do not apply.

2.156           The Committee notes encryption can impede access to telecommunications interception where access to the content of communications has been lawfully authorised.

2.157           The Committee acknowledges, however, that there remains a lack of specificity regarding the scope of the offence and the circumstances in which it may apply.  In this context, the Committee appreciates the guidance provided by the Law Council of Australia in referring to the Guide to Framing Commonwealth Offences, Infringement Notices and Enforcement Powers.

Recommendation 16

The Committee recommends that, should the Government decide to develop an offence for failure to assist in decrypting communications, the offence be developed in consultation with the telecommunications industry, the Department of Broadband Communications and the Digital Economy, and the Australian Communications and Media Authority.  It is important that any such offence be expressed with sufficient specificity so that telecommunications providers are left with a clear understanding of their obligations.

 

Institute industry response timelines

2.158           The Western Australia Police expressed support for the imposition of industry timelines for assistance sought from telecommunications providers:

It is important that telecommunication carriers are capable of dealing with urgent requests for communications data. This is particularly relevant when dealing with stored communications data. It is the practice of some carriers to purge such data after a short period of time. To ensure that evidence is not lost, carriers must have the capability of immediately responding to requests from law enforcement agencies to preserve the data, or alternatively they must have a reasonable ability to store data to until the completion of a police investigation.[127]

2.159           Optus expressed concern if the timeliness proposal was raised as more than a minimum standard:

Optus does not support mandated response times for warrants, unless it is calibrated as a backstop for extremely poor responsiveness. If the objective is to achieve an overall improvement in timeliness, then the focus should be on end-to-end process opportunities, taking into account both the agency activities and the carrier activities. The adoption of more effective and complete B2B electronic transaction processes for warrants by both agencies and carriers could drive substantial improvements in timeliness.[128]

2.160           In relation to requirements for timeliness however, the Australian Mobile Telecommunications Association and Communications Alliance considered the current regime enables the law enforcement and national security agencies to negotiate service levels for the supply of reasonably necessary assistance.[129]

2.161           Similarly, iiNet did not support the proposal, noting an absence of justification:

iiNet submits that imposing specific industry timeframes is unnecessary. iiNet notes that there is no suggestion in the Discussion Paper that industry tardiness is in any way a cause of any of problems for law enforcement agencies.[130]

2.162           Telstra indicated a significant resource implication from the proposal:

Telstra submits that for Government to mandate ‘response timelines’ would also require Government to spend significant funds to support the introduction of a fully automated request management system (as discussed in 8a) for use by LENSAs and C/CSPs otherwise the LENSAs would not obtain the benefits intended from this proposal.[131]

2.163           The Committee notes the need to ensure that telecommunications providers are able to provide timely assistance to law enforcement and national security investigations.  The evidence presented to the Committee, however, was sparse on the question of whether or not such assistance is presently provided in a timely manner.

2.164           The Committee acknowledges, however, that clearly expressed obligations would enable telecommunications providers to better assist the investigative agencies.

 

Recommendation 17

The Committee recommends that, if the Government decides to develop timelines for telecommunications industry assistance for law enforcement and national security agencies, the timelines should be developed in consultation with the investigative agencies, the telecommunications industry, the Department of Broadband Communications and the Digital Economy, and the Australian Communications and Media Authority. The Committee further recommends that, if the Government decides to develop mandatory timelines, the cost to the telecommunications industry must be considered.

 

Revision of the interception regime

2.165           Submissions and testimony provided to the Committee, particularly from interception agencies, indicate a desire for a comprehensive revision of the TIA Act.  For example, the Western Australia Police submission states:

WA Police supports the suggested reform of the TIA Act in its entirety, for ease of understanding and in order to remove duplication. Further, there is a need to update the content of the TIA Act to ensure that the provisions are practical and responsive.[132]

2.166           In its submission, the AGD supports the proposal for comprehesive reform, stating:

The magnitude of current and anticipated change to the telecommunications landscape means it is now timely to consider whether the privacy needs of Australians and the investigative needs of law enforcement and national security agencies are best served through continuous ad-hoc change or whether the time is right to put in place a new interception framework that squarely focuses on the contemporary communications environment. The Department considers that holistic reform would establish a new foundation for the interception regime that enables users and participants, as well as the broader Australian community to understand their powers, rights and obligations.[133]

2.167           The Committee received extensive evidence from interception agencies, privacy advocates and legal practitioners about the complexity of the TIA Act.  Indeed, the Committee’s consideration of the statutory framework supports the conclusion that it is so complex as to be opaque in a number of areas.  That this is the case in legislation which strives to protect the privacy of communications and enabling legitimate investigative activities is of concern.

2.168           The Committee acknowledges, however, the risks associated with comprehensive revision of legislation and that a cautious approach is necessary.  Privacy Victoria noted in-principle support for revision to achieve technological neutrality, but cautioned:

However, when revising these laws, the goal should not be to lower protections contained within, but rather to standardise and enhance existing protections irrespective of the method of communication (that is, to make the laws technologically neutral).[134]

2.169           The Committee did not have the advantage of receiving draft legislation to review.  That being the case, there is an inherent difficulty in recommending comprehensive revision of the TIA Act in the absence of draft proposals. 

2.170           The Committee acknowledges, however, that the TIA Act is complex. It could be improved significantly by providing clear direction on the protections afforded to telecommunications users, and the scope of the powers provided to agencies able to undertake telecommunications interception and access to stored communications and telecommunications data. 

2.171           Implementing the recommendations of this report necessitates a significant revision of the interception regime.  The Committee therefore supports comprehensive revision of the TIA Act.

Recommendation 18

The Committee recommends that the Telecommunications (Interception and Access) Act 1979 (TIA Act) be comprehensively revised with the objective of designing an interception regime which is underpinned by the following: n  clear protection for the privacy of communications; n  provisions which are technology neutral; n  maintenance of investigative capabilities, supported by provisions for appropriate use of intercepted information for lawful purposes; n  clearly articulated and enforceable industry obligations; and n  robust oversight and accountability which supports administrative efficiency. The Committee further recommends that the revision of the TIA Act be undertaken in consultation with interested stakeholders, including privacy advocates and practitioners, oversight bodies, telecommunications providers, law enforcement and security agencies. The Committee also recommends that a revised TIA Act should be released as an exposure draft for public consultation. In addition, the Government should expressly seek the views of key agencies, including the: n  Independent National Security Legislation Monitor; n  Australian Information Commissioner; n  ombudsmen and the Inspector-General of Intelligence and Security. In addition, the Committee recommends the Government ensure that the draft legislation be subject to Parliamentary committee scrutiny.