It's confusing, to say the least, and suggestive that an opportunistic and uninformed minister has experienced bureaucratic capture.
In her keynote Security in Government speech yesterday afternoon the A-G indicated that
Another area the Government is working hard in, is the area of privacy.
This Government has taken active measures to provide a robust, predictable and transparent privacy framework that all Australians expect.
Reforms to the Privacy Act will enhance the protections already in place to ensure that, regardless of changing technology, personal information remains secure. You should also be aware that the proposed national security reforms that have received significant media coverage also propose a strict privacy regime that ensures information is only used when necessary and used according to the law.
But there’s more to this story.
To keep pace with the online environment, we also need to make sure our police, security and intelligence professionals are properly equipped to do their work. That’s why I have referred this package of national security reforms to the Parliamentary Joint Committee on Intelligence and Security.
Key areas for consideration include:
- A modern regime for lawful access to telecommunications to ensure that vital investigative tools are not lost as telecommunications providers update their business practices and begin to delete data more regularly and more Australians communicate online in a wider variety of ways
- Whether the Government needs to obligate the Australian telecommunications industry to protect their networks from unauthorised interference because more is being done online than ever before
- An authorised intelligence operations scheme for ASIO officers – so that ASIO officers are afforded the same protection from criminal and civil liability for authorised operations as AFP officers are afforded now.
I want to strike a balance between ensuring we have the investigative tools needed to protect the community and individual privacy. This includes protecting individuals from activities that deeply affect their privacy, including hacking and identity theft.
As you will be aware, there has been a lot of press coverage about one component of the reforms – and that is data retention.
Many investigations require law enforcement to build a picture of criminal activity over a period of time. Without data retention, this capability will be lost.
Many of you will recall the disturbing murder of Cabramatta MP John Newman in Sydney in 1994. Call charge records and cell tower information were instrumental in the investigation and subsequent conviction on Phuong Ngo. These records allowed police to reconstruct the crime scene.
The intention behind the proposed reform is to allow law enforcement agencies to continue investigating crime in light of new technologies. The loss of this capability would be a major blow to our law enforcement agencies and to Australia’s national security.
Apart from data retention there are a number of other aspects to the proposed reforms, focussed on modernising our laws.
Gone are the days when we relied on landline phones, the odd fax or two and mail to keep us all connected. Smart phones allow us to engage with people in our workplace and across the world.
Criminals and terrorists have also benefited from this leap in technology. Our police and national security agencies must be backed by solid legislation, to ensure we are all protected and that criminals can be prosecuted.
And it’s not only about strangers contacting your kids on the internet.
It’s also about protecting the layers of hidden technology driving society like power, water and transport, banks and hospitals.
Another part of the reform focusses on the management of these security risks in the telecommunications sector. Telecommunication networks are critical infrastructure that hold personal data and is an increasingly attractive target to unwanted intrusion.
And, our process is open.
Unlike the Howard Government, I didn’t want to blindside the Parliament and the Australian people by introducing national security reforms into Parliament and rush them through without good advice and public scrutiny.
The Government is putting all options on the table so the Australian public, experts and politicians can engage in this important national debate.
That process has already started with more than 170 submissions from people and organisations of all walks of life having their say.
This will ensure the Government has advice from the experts and will be informed by community views, before making final decisions on these important reforms.
I do want to reaffirm the intention of these reforms. We cannot live in a society where criminals and terrorists operate freely on the internet without fear of prosecution. We cannot allow technology to create a ‘safe haven’ for criminals, or a ‘no go’ zone for law enforcement.
But, this does not mean unfettered access to private data either.
What it does mean are carefully drafted, tested and oversighted national security laws – and this is what I’m focussed on delivering.The reality is, alas, that the Government's proposals have been conspicuously short on detail, so Ms Roxon's preening about transparency is disingenuous. The proposals have been criticised by observers such as myself, by bodies such as the Law Institute of Victoria and by government agencies.
The Office of the Victorian Privacy Commissioner for example commented that
The Australian Government‟s Discussion Paper proposes amendments to existing legislation and additional proposals, both of which threaten to have an adverse and significant effect on the privacy rights of individuals across Australia. This submission considers that, in general, the introduction of intrusive powers suggested in the Discussion Paper fails to achieve those tests of legitimacy, necessity, proportionality and effectiveness. ....
Preserving freedoms under law is part of what it means to guard the national security of a democracy. To diminish freedoms unnecessarily or disproportionately makes the nation insecure.
Secret policing, covert searches, surveillance, information that cannot be tested for accuracy, closed decision-making, absence of independent scrutiny of government agencies: these are all hallmarks of systems of government that democratic nations tend to want to secure themselves against.
Where any such measures are adopted by democracies, they are adopted reluctantly because they are an aberration from the norm, which is freedom and democratic governance. The norm is accountable policing; minimal and overt search, seizure and surveillance; and a presumption of open government, with necessary, clearly defined exemptions subject to independent review.
The security of the Australian nation’s way of life depends on these norms being preserved. ... Fear can make us welcome what should be only reluctantly and warily tolerated. The measures [in the Bill] are an unwelcome necessity for a democratic society that prizes advocacy, dissent and diversity. They ought to be viewed cautiously, their necessity queried rigorously, and the safeguards against their misuse built carefully and applied scrupulously.The Commissioner's submission to the PJCIS inquiry [PDF] commented that -
It is axiomatic that technology has advanced to such an extent that the telecommunications laws drafted in the 1970s can be considered outdated. However, when revising these laws, the goal should not be to lower protections contained within, but rather to standardise and enhance existing protections irrespective of the method of communication (that is, to make the laws technologically neutral). The terms of reference in the Discussion Paper state that this is one aim of the proposals. To that end, I support changes to accomplish this.
However, many of the suggested amendments go far beyond this approach. The terms of reference note that the Committee should have regard to whether the proposed responses contain appropriate safeguards for protecting the human rights and privacy of individuals and are proportionate to any threat to national security. While I acknowledge that many of the proposals in their current format are only considerations, it is my view that many of the proposed changes in the Discussion Paper exceed what is necessary to achieve appropriate balance between national security and other human rights such as privacy. ....
To access a third party‟s computer which has no connection with the target is extraordinarily broad and intrusive. These are powers usually characteristic of a police state. Adversely impacting the privacy of an individual (the third party) should only be permitted in the most extreme circumstances as a „last resort‟ when all other methods have been exhausted. Furthermore, the power to alter (rather than „access‟) a third party computer should not be permitted.
Even with such safeguards and accountability mechanisms (which are not detailed in the Discussion Paper), I cannot support a measure that could severely diminish the privacy of individuals and could cause a chilling effect on the way that individuals communicate and use technology. ....
The proposed data retention scheme, on which the Government is “expressly seeking the views of the Committee”, is perhaps the most controversial and concerning of the proposals in the Discussion Paper. The scheme would be “tailored” and (presumably) require carriage service providers (CSPs) and internet service providers (ISPs) to retain data from users for use by intelligence agencies to predict crimes and terrorism offences.
As noted above, this proposal is characteristic of a police state. It is premised on the assumption that all citizens should be monitored. Not only does this completely remove the presumption of innocence which all persons are afforded, it goes against one of the essential dimensions of human rights and privacy law: freedom from surveillance and arbitrary intrusions into a person‟s life.
While the Government appears to have already withdrawn its support for the proposal, it is necessary to examine the issues. It would appear that public support for this type of proposal is largely absent. As noted in the introduction to this submission, for there to be any extension of intrusive powers, such powers should be legitimate, necessary, proportionate and effective. I fail to see how the proposal achieves any of these. Collecting the data of all Australians does not appear proportionate to the risk of terrorism, nor is it likely to be effective in stopping terrorist acts (described below). Like any information system, would-be criminals and terrorists will either find a way around the technological limits (such as using a Virtual Private Network, encryption services, or an anonymity network such as Tor), or move communications to other non-electronic channels.
The detail in the Paper is scarce. Accordingly, there are multiple unanswered questions:
a. Why has two years been chosen as the appropriate time period for data retention? Is this time period particularly significant for law enforcement? Two years appears arbitrary and without justification.
b. Will it involve actual collection of raw data or merely data relating to what Internet Protocol/web addresses a user connects to? If the former, how will the data be stored, given it is likely to be prohibitively expensive and arguably technically impossible for internet service providers to do? If it is the latter, which would be far less encompassing and of limited utility in comparison to raw data, how does this achieve the goal of stopping terrorist attacks? (For example, if only web access was recorded, and terrorists were conversing on Facebook – how would knowing a user had visited Facebook stop a terrorist attack?)
c. How will the data be secured? Retaining the data would create a massive security risk if an ISP suffers a breach of security, including a significant risk of identity theft. The immense amount of data would also create an incentive for hackers to view ISPs as a target. Unlawful access of this data could cause extensive privacy concerns, given the data is likely to contain a wealth of personal information, including potential online financial transactions.
d. Who will have access to the data? The proposal clearly anticipates ASIO/law enforcement access; however, the ISPs that collect the data will also have access. How will employees of CSPs/ISPs be prevented from accessing what is likely to be an extremely valuable, if not tempting, data source?
e. Will there be a standard format in which the data is required to be kept? How will each CSP/ISP ensure that the data is consistent across all services so that it can be data-mined?
f. How will the information be „linked‟ to a particular person? If multiple people use one computer, how will the system determine which user is which (clearly necessary to determine if a law has been breached)? How will agencies ensure accuracy?
These questions need to be both considered and answered before a genuine debate can be entered into.Bureaucratic convenience should not trump law.
