Australian Data Breach Consultation

The Commonwealth Government has released its Australian Privacy Breach Notification discussion paper [PDF] regarding potential introduction of mandatory data breach notification. Submissions are sought by 23 November 2012.

The Attorney-General's media release indicates that "it was timely for a public discussion on how legislation might deal with data breaches, such as when private records are obtained by hackers. Australians who transact online rightfully expect their personal information will be protected". Quite so.

In the introduction to the paper the Attorney-General comments that -

One of the ALRC’s [2008 For Your Information: Australian Privacy Law and Practice ] recommendations was that a mandatory data breach notification scheme be introduced. In responding to this recommendation, the threshold question that must be asked is whether the introduction of such a scheme is warranted. For example, it may be the case that the existing voluntary guidelines issued by the Office of the Australian Information Commissioner are working effectively enough. If there is to be a mandatory data breach notification scheme, how do we make sure it gets the balance right between the public interest in mitigating the adverse effects of data breaches while ensuring we do not create an overly burdensome compliance requirement on entities that make their business from collecting, storing and using personal information?

The paper indicates that

A data breach occurs when personal information is improperly accessed, obtained, used, disclosed, copied or modified. 

It goes on to comment that

There have been several significant and high-profile data breaches in recent years. 

As noted recently, at least one of those breaches appears to have completely bypassed the attention of AFP cybercrime czar Gaughan, perhaps because he has been busy misconstruing German data protection law.

The paper asks what notification requirements government agencies and large private-sector organisations should have to meet when they suffer a data breach, including -

• Should Australia introduce a mandatory data breach notification law? 
• What kind of breaches should trigger notification requirements? 
• Who should decide whether notification is necessary? 
• What should be reported and how quickly? 
• How should a notification requirement be enforced? 
• Who should be subject to a mandatory data breach notification law?
• Should there be an exception for law enforcement activity?

The paper advances seven arguments in favour of 'retaining the existing position', ie not implementing mandatory data breach notification -

• the additional costs of compliance for entities would be too onerous; 
• there are sufficient commercial incentives for entities (eg reputation) to have high standards of data security and to voluntarily notify the OAIC where appropriate; 
• the voluntary OAIC guidelines are operating effectively, and more entities are using them after voluntarily contacting the OAIC; 
• many organisations do not have the capability of detecting whether data loss has occurred, and whether there has been a significant impact or harm caused by such data loss; 
• some organisations already voluntarily report certain categories of incident to law enforcement agencies and CERT Australia; 
• the connection between data breaches and identity theft has been criticised as being overstated ; and 
• data breach disclosure laws have marginal effect on the incidences of identity thefts 

The incidents highlighted in this blog over the past three years (eg involving Medvet, Sony, AICD, Vodafone, Telstra and other blue chips) suggests that several of those arguments are problematical.

The paper goes on to articulate "four broad goals" regarding mandatory data breach notification.

A. Mitigation of consequences of breach

First, by providing advice to those who have had their privacy infringed, that person will have an opportunity to take corrective action to change or otherwise ‘resecure’ the information. This could be called the ‘mitigation objective’. For example, to change passwords where those passwords have been hacked or to cancel credit cards if their details have been stolen. The ALRC considered this to be the primary goal to be achieved. However, such a rationale shifts the onus away from the organisation that has suffered the breach and onto a person who may be ill-equipped or unable to correct the consequences of the breach. For example, in cases where an individual’s health information has been accidentally uploaded to the internet, it may not be possible to rectify the breach even if it has been subsequently taken down.

B. Deterrence/incentive to improve data security

Secondly, requiring notification may act as an incentive to the holders of personal information to adequately secure or dispose of that information. In other words, the adverse publicity occasioned by a notification may deter poor handling of such information, and increase the likelihood that adequate and reasonable measures are taken to secure it. This could thus be called the ‘deterrent objective’. The ALRC viewed this as more of a secondary objective, although it has been part of the rationale for data breach notification laws in many other jurisdictions. With respect to agencies, this objective is consistent with guidelines issued by the Government under the Protective Security Policy Framework. These guidelines highlight the need for agencies to understand and address their responsibility to minimise the risk to the public when transacting online with the Australian Government. The failure by an agency to adequately notify the public of a data breach could place the public at risk. A mandatory data breach notification requirement would ensure all agencies take action to minimise the risk of harm to the public.

C. Tracking of incidents and provision of information in the public interest

A third goal would be to provide better information to government and the public on the scope and frequency of data breaches. This ‘informational objective’ is essentially a correction of the market failure by which organisations have insufficient incentives to disclose incidents of data loss, even though such losses may cause harm to others.

D. Maintaining community confidence in legislative privacy protections

Finally, there is what could be called a ‘public confidence’ objective. Even where the harm of a data breach to individuals is minimal, there is a chance individuals will feel deceived or disempowered in the absence of notification. Mandatory data breach notification may bolster public confidence that the Government is taking individual privacy rights seriously.

We need more than mandatory reporting, underpinned by penalties for non-reporting or dilatory reporting. Tony Burke, ag chief of the Australian Banking Association, is reported as commenting that mandatory data breach reporting would lead to

 an unwarranted loss of confidence in Australia’s payment systems to the detriment of all.

Attempting to notify individuals potentially affected could lead to significant levels of community concern, disproportionate to the actual level of risk, which could well be zero. 

Mandatory reporting in isolation may well lead to what I have elsewhere characterised as data breach fatigue. What is essential is attitudinal change among data custodians through public shaming and penalties that are sufficient to motivate organisations to safeguard personal information through for example adequate vetting of staff and partners and through maintenance of network intrusion detection systems.

Fakers

The SMH reports that "A Bangladeshi national faces up to 35 years behind bars after being arrested and charged by Australian Federal Police over false identification charges".

Md Mahfuzur Rahman was reportedly charged with

• being in possession of over $100,000 in the proceeds of crime, 
• four counts of possessing a false foreign passport (a maximum jail sentence of 10 years),
• one count of being in possession of false identification (maximum sentence of  five years).

It is alleged he was in possession of a passport stating he was born in 1987. However his fingerprints allegedly match those of a person with the same first and last name but different middle name, born in 1979.

The  brief account provides insufficient information for much analysis and Rahman has of course been reportedly charged rather than convicted, so we can only speculate about the $100k.

Potential precedents for prosecution under s 21 of the Foreign Passports (Law Enforcement and Security) Act 2005 (Cth) for possession of a false foreign passport include Tomov v The Queen [1011] WASCA 189, Nikaghanri v The State of Western Australia [2009] WASCA 192 and Salman v Director of Public Prosecutions (Cth) [2011] NSWCCA 192.

Finnis's Justice

'What is the Philosophy of Law?' asks John Finnis in 1 Rivista di Filosofia del Diritto (2012) 67-78.

The answer it seems is that the philosophy is that expounded by Finnis in an echo of de Maistre. He claims that -

The philosophy of law is not separate from but dependent upon ethics and political philosophy, which it extends by that attention to the past (of sources, constitutions, contracts, acquired rights, etc.) which is characteristic of juridical thought for reasons articulated by the philosophy of law. Positivism is legitimate only as a thesis of, or topic within, natural law theory, which adequately incorporates it but remains transparently engaged with the ethical and political issues and challenges both perennial and peculiar to this age. The paper concludes by proposing a task for legal philosophy, in light of the fact that legal systems are not simply sets of norms.

If, like me, you are underwhelmed by the way that Finnis confuses personal idiosyncracies for timeless truths you might want somewhat more substance than a whinge about the supposed "oppression of critics of homosexual conduct" or scarewords such as communism.

Finnis concludes

Though, as has been said above, law and legal philosophy has a quasi-distinct domain and technical character, the very idea (concept) of law (an idea without which no laws will be made or maintained) is so dependent upon wider principles of moral and political thought and philosophy that neither law nor its philosophy can avoid engagement with the ethical and political issues and challenges of the age. Particular aspects of our law‘s content (including its procedural rules and institutions) can ameliorate, or in other cases harm and exacerbate, our community‘s common good. The legal instrumentarium can, not infrequently, provide an easy route to destructive social changes, as the apparatus of human rights litigation has, in many places, provided an easy route to abortion, euthanasia, damaging immigration, and same-sex marriage, to the oppression of critics of homosexual conduct, and to other destructive evils. But what social elites desire can very often be achieved without much resort to that instrumentarium, or even in defiance of it. 

It seems to me that the task of legal philosophy today is twofold. It must keep clear its intrinsic relationship with, and dependence upon, all the truths of moral and political philosophy, not least by providing a constant critique of every form of legal philosophy that denies or distorts that relationship. And by its mastery, and its foundational explanatory understanding, of the law‘s technical instrumentarium it must remain in a position to criticize and expose – in the hope of deflecting -- every manipulation of it for purposes destructive of the common good, a good that includes but is not exhausted by the upholding of juridically cognizable rights. 

Of special importance in the coming decades will be a recovery of awareness amongst legal philosophers that law‘s paradigmatic form, the ius civile, is the law of a people, posited by a constituent act (or constitutive custom) and ongoing legislative acts of their self-determination as a people, acts which can and should be consistent with their obligations to do and respect right (human rights, as contained in the ius naturale) and their responsibilities towards other peoples and those other peoples‘ self-determination, rights and needs. Just as countless thinkers in the nineteenth and twentieth centuries too casually assumed the justice of communist notions of a propertyless community, notions inadequately attentive to the long-term conditions of a sustainable, prosperous and just society of free persons, with the result that countless millions of people suffered more or less directly from the application in their polities of these errors of practical thought, so likewise many thinkers today too casually assume (explicitly or implicitly) the justice of quasi-communist notions of a borderless humanity, notions incompatible with the long-term conditions of a sustainably just and civilly free political order and Rule of Law. Even in the short term, this kind of error of practical thought results in the kind of political community increasingly familiar, whose peoples‘ multi-cultural internal diversity of ultimate allegiances is both promoted and countered by an ever-growing apparatus of security and surveillance, a severe diminution in freedom of political and intellectual discourse, and an explosion of law-making and regulatory bureaucracy indifferent to the benefit of having a society whose self-determination takes in large measure the form of that sharing of expectations which Ulpian and Aquinas called common custom. 

Practitioners of the philosophy of law may be especially susceptible to this kind of error, to the extent that they envision legal systems simply as sets of norms, rather than as the principles, norms and institutions adopted by a people extended in time and in territorial bounds, in more or less adequate fulfilment of its moral responsibility to do so.

FIM and its discontents

'Economic tussles in federated identity management' by Susan Landau & Tyler Moore in (2012) 17(10) First Monday considers federated identity management (FIM), which "enables a user to authenticate once and access privileged information across disparate domains".

FIM’s proponents, who see the technology as providing security and ease of use, include governments and leaders in the IT industry. Indeed, a cornerstone of the current U.S. government’s efforts to secure cyberspace is its “National Strategy for Trusted Identities in Cyberspace” (U.S. Department of Commerce, 2011). Yet adoption of federated identity management systems has been slow.

From disputes over liability assignment for authentication failures to concerns over privacy, there have been many explanations for the slow uptake of federated identity management systems. We believe the problem is embedded in stakeholder incentives. We present an economic perspective of stakeholder incentives that sheds light on why some applications have embraced FIM while others have struggled. To do so, we begin by briefly analyzing seven use cases of successful and unsuccessful FIM deployments. From this we identify four critical tussles that may arise between stakeholders when engineering a FIM system. We show how the successful deployments have resolved the tussles, whereas the unsuccessful deployments have not.

Landau & Moore conclude -

In seeking to understand why federated identity management systems have not yet succeeded in the broad way anticipated at the beginning of the last decade, many have pointed to the uncertainty surrounding liability as a major obstacle. We believe this mischaracterizes the problem. Instead, we have argued that liability fits within larger set of economic tussles that arise between stakeholders in any engineered system.

In order for a federated identity management system to succeed, all parties in the system must gain. Otherwise at least one has no incentive to participate. A user has to gain through ease of use, access to more services, greater privacy, or improved security. A Service Provider has to gain by acquiring more user data (the Facebook model), in the ability to reach to larger markets, or by insulation from liability for failures (as happens in some instances of credit card usage). An Identity Provider must also gain from the system. The gain in control of user data and of the user authentication process are obvious benefits to the Identity Provider, but those gains must be offset by granting some benefits to the Service Provider and user.

Considering the situation from the economic perspective of gain, it is clear that the early enterprise–oriented systems such as the Liberty Alliance protocols did not provide sufficient value to the individual so as to create widespread adoption (e.g., in the open Internet). However, certain instantiations such as InCommon or the NIH Federated system did provide such benefits; in those cases, uptake was high (it might be argued that in those two instances the users did not have alternatives, but the fact remains that the systems provided clear advantages to users).

Privacy, interpreted here as user control over personal data collection, should also be viewed from this perspective. Upon examining what has been produced in the market so far by OpenID, Facebook, and Google+, users have been ignored in the tussle over who controls user data. To handle this, some have proposed identity management systems such as Higgins (2009) or User Managed Access (Kantara Initiative, 2011), in which control over transactional information resides with end users, who control what data to share with Identity and Service Providers. The issue of control is a complicated one. Ease-of-use and user-data privacy are often in conflict. The success of the Kantara Initiative User Managed Access and similar projects depends critically on easy methods for users to control their data.

Government regulators and policy–makers also have a role to play if user privacy is to be included in successful systems. Here European data privacy commissioners have been active; their negative response to Passport and positive one to the Liberty Alliance protocols were important in the early days of federated identity management systems. We suspect that the best prospect for achieving user privacy in future FIM deployments will require an active role by policy–makers in advocating on behalf of users, who are largely voiceless in current debates over FIM proposals. The recent Facebook IPO, and the new economic pressures that will result from the social network becoming publicly owned, may accelerate regulators’ efforts in user privacy protections.

What are the lessons for the future?

Federated identity management systems exhibit a number of economic tussles, of which liability for failures is only one. As in any complex engineered system, the tussles cannot be resolved separately. Liability must be viewed as part of a larger set of economic conflicts occurring between the user, Identity Provider, and Service Provider. This provides an opportunity for resolving the liability problem, which properly belongs in the context of other tussles. Seeing liability this way creates opportunities for compromise. We are therefore optimistic that taking the broader view of all tussles may actually simplify the liability problem.

Another way to put this is that if the Identity Provider accrues (most of) the benefits, it would be natural to also expect the Identity Provider to accrue (most of) the risk. At one level, that is obvious; at another, by isolating the various tussles, this provides room to determine the bargaining that must arise between the three players. Of these, only two, the Identity Provider and Service Provider, are typically in the explicit negotiations; the users, of course, walk with their feet (or in this case, their fingers).

Another observation is that the payment–card networks have largely overcome liability issues between stakeholders and deployed a highly successful, if technically imperfect, system. When systems have failed to succeed commercially, it is usually caused by an unfair distribution of responsibilities and benefits between Identity Providers, Service Providers and users. One cannot expect any technology, including FIM, to solve irreconcilable incentive incompatibilities on its own. The key to success lies in setting the rules of the platform so that each stakeholder derives benefit from cooperation.

A key function of payment–card networks in e-commerce has been their ability to authenticate users for completing transactions. The early participation of American Express in the Liberty Alliance shows that even though there is less active participation now, there was initial interest by the payment-card industry in federated systems.

Payment-card networks already provide a usable solution to authenticating payments, the primary requirement of many e-commerce applications. This weakens the business case for many aspiring identity-management solutions, particularly given the strong network effects present in two-sided markets and the high fixed costs of deployment. Furthermore, a widely deployed FIM system might commoditize payment processing, particularly if their main competitive advantage is ubiquitous authentication of cardholders.

Thus we conclude with an open question: can payment-card networks peacefully coexist with a successful, widespread deployment of a federated identity management system, or will the present success of payment-card networks prevent federated identity management systems from taking off in the open Internet?

A Meat Pie Anton Piller Order

A nice instance of the Anton Piller order in Australian Football League & Ors v Hard On Sports & Ors [2012] VSC 475 regarding trade marked sporting memorabilia.

The Court notes that

Australian football is one of the most popular sports in Australia, and attracts a very large number of supporters throughout the country who follow the AFL Competition and support a favoured AFL Club. 

The following may described as the relevant “meat-pie” statistics: in 2011, there were approximately 800,000 registered participants playing the sport in Australia. An additional 45,000 registered participants play Australian football in countries outside of Australia. In 2011, the national television audience of AFL matches was approximately 4.7 million each week. The AFL Grand Final is estimated to attract a worldwide broadcast audience of over 30 million people. An aggregate of 6.763 million people in 2005, 6.736 million in 2006, 7.05 million in 2007, 7.082 million in 2008, 6.985 million people in 2009, 7.147 million people in 2010 and 7.139 million people in 2011 attended matches conducted by the AFL.   

I accept that by reason of the popularity of Australian football, the AFL Competition and AFL Clubs, there is demand amongst AFL Supporters for memorabilia relating to the AFL Competition and AFL Clubs and their players (“AFL Players”), particularly memorabilia signed by AFL Players, including signed guernseys, shorts, football boots and other playing apparel, posters, prints, cards, photographs, lithographs and plaques, many of which are placed in frames for hanging on walls (“AFL Memorabilia”).

The AFL holds 278 registered trade marks relating to the AFL Competition and the AFL Clubs, including the word AFL, the full and shortened name of each AFL Club (eg Collingwood Fotball Club and Collingwood Magpies), the nickname of each AFL Club (eg Magpies) and images of the AFL premiership cup and the Brownlow Medal, each oregistered in respect of a broad range of goods and services that include paper, cardboard, posters, printed matter, albums, autograph books, photographs, mounted photographs, picture frames, works of art, signboards, display boards, display stands and show cases, clothing, leisure wear, sportswear, uniforms, shirts, sports shirts, jumpers, sweaters, guernseys, jerseys and associated wholesaling/retailing.

Hard On Sports [HOS] and its "controlling mind and will" Mr Sumiga are alleged to have engaged in sale of unauthorised AFL products. The Court noted claims that

The memorabilia market in Melbourne has a number of unlicensed suppliers of memorabilia that use AFL Images and AFL Trade Marks and engage directly with players or through their management companies to secure signatures outside of the conditions of the current AFL Commercial Operations Guidelines. The obtaining of these signatures is done without the knowledge or approval of the AFL. … 

HOS has 30,000 to 40,000 pieces of memorabilia on site. The Official AFL Memorabilia program only sells 7,000 to 10,000 pieces of year. While HOS also deals in memorabilia for other sports, its stock holding is 90% AFL products. … 

Australian football supporters who wish to purchase Official AFL Memorabilia knowing that the funds from their purchase will go back to the game and their AFL Club are misled when they purchase unofficial AFL memorabilia. He says on the other hand, no funds from unofficial AFL memorabilia go back to the AFL and by extension to the AFL Clubs. The funds are usually distributed to the players who sign the unofficial AFL memorabilia outside the terms of the official process, the person who arranged for the creation of the product and the retail outlet that distributes the product. [C]onsumers don't easily recognise the difference between Official AFL Memorabilia and unofficial memorabilia especially where they are designed to look the same.

Given concerns about loss or 'leakage' of the contested products in litigation involving claims of passing off, copyright infringement, trade mark breaches and other matters the Court made an Anton Piller order as follows -

Interlocutory injunction 

The Defendants and each of them, whether by themselves, their servants, agents or howsoever otherwise, be restrained until the trial of the proceeding or further order from procuring the creation of, keeping, distributing, offering for sale or selling memorabilia which is not authorised by the AFL, including:

(a) guernseys bearing AFL Trade Marks which were applied without the AFL’s consent; 

(b) guernseys, shorts, football boots and other playing apparel signed by current or former AFL Players placed in frames bearing trade marks which are substantially identical with or deceptively similar to AFL Trade Marks including “AFL”, AFL club names, club nicknames, club logos and/or images of the AFL premiership cup or Brownlow or Norm Smith medals; 

(c) posters, prints, cards, photographs, lithographs and plaques: (i) incorporating reproductions of substantial parts of AFL Photographs; and/or (ii) placed in frames bearing trade marks which are substantially identical with or deceptively similar to AFL Trade Marks including “AFL”, AFL club names, club nicknames, club logos and/or images of the AFL premiership cup and/or Brownlow and/or Norm Smith medals.

Search Orders (pronounced on 9 October 2012)

By 10 October 2012, the independent solicitors deliver to the Plaintiffs' solicitors:

(a) all of the things retained pursuant to undertaking (3) given by the independent solicitors in Schedule B to the search order of Justice Vickery made on 10 September 2012 (Search Order) save that the Plaintiffs shall return to the Defendants from who premises such goods were obtained any irrelevant documents, within 7 days of receipt of the above listed things; and 

(b) the keys to the locks to the storage unit rented by the independent solicitors at Kennards Self Storage located at 159 Racecourse Road, Flemington, Victoria (Storage Facility).

The independent solicitors be otherwise released from undertaking (3) given in Schedule B to the Search Order. 

The Plaintiffs' solicitors keep secure each thing delivered up to them pursuant to paragraph 1 of this order and they only use these things for the purposes of this proceeding. 

The Plaintiffs' solicitors are permitted to make copies of any documents or photographs of any things (as the case may be) and may disclose to the Plaintiffs any information that is acquired from reviewing these things and provide the Plaintiffs with copies of such documents or photographs. 

Until trial or further order of the Court, the Plaintiffs' solicitors are to retain the keys to the locks to the Storage Facility.

Pharma Patents

A step to the left, a step to he right, shake it all about. Alongside the Productivity Commission's review of compulsory licensing of patents (and after reviews by ACIP) the Australian government has announced a review of pharmaceutical patents, presumably reflecting debate in Europe about the 1992 Supplementary Protection Certificate (SPC) regime, ie short term extension for pharmaceuticals of patent protection, questioned in the Medeva decision. (Section 70 of the Patents Act 1990 (Cth) provides for 5 year extension for pharma inventions beyond the 20 year term for a standard patent)

The review is to be undertaken by a three member panel: Tony Harris (former NSW Auditor-General) as Chair, Professor Dianne Nicol (Associate Dean, Research, Law Faculty at the University of Tasmania) and Nicholas Gruen (CEO of Lateral Economics and last mentioned in this blog regarding the fatuous Government 2.0 report).

The review will involve consultation with stakeholders and public submissions.

The Terms of Reference indicate that

The review will evaluate whether the system for pharmaceutical patents is effectively balancing the objectives of securing timely access to competitively priced pharmaceuticals, fostering innovation and supporting employment in research and industry. 

Central to this will be an analysis of the pharmaceutical extension of term provisions of the Patents Act 1990 (s.70). The review will also consider whether there is evidence that the patent system is being used to extend pharmaceutical monopolies at the expense of new market entrants. 

In doing this, the review will consider how patents for new formulations are granted, consider the treatment of new methods of manufacturing and new uses of known products, the impact of contributory infringement provisions and the impacts of extending patent monopolies on entry of generic pharmaceuticals into the market. 

Should such evidence be found, the review should provide an assessment of the subsequent impact on competition, innovation and investment.

The panel is expected to provide a final report to Government in early 2013.

In conducting the review and making recommendations the panel is to have regard to:

• The availability of competitively priced pharmaceuticals in the Australian market 
• The role of Australia's patent system in fostering innovation and hence to bringing new pharmaceuticals and medical technologies to the market 
• The role of the patent system in providing employment and investment in research and industry 
• The range of international approaches to extensions of term and arrangements for pharmaceutical inventions Australia's obligations under international agreements (including free trade agreements and the World Trade Organisation agreements) 
• Australia's position as a net importer of patents and medicines 

Data Retention Questions

In discussing the development of the new Australian data retention regime I have recently noted the claim by the Australian Federal Police that people can and should trust that organisation.

That claim is somewhat at odds with testimony to the Senate Legal & Constitutional Affairs Legislation Committee at the 16 October Estimates hearing (video here).

One example is the exchange between Senator Ludlam, AFP Commissioner Negus and AFP Assistant Commissioner (and cybercrime czar) Gaughan.

Senator Ludlam: Are you aware Telstra were recently logging all 3G users' web access over their mobile network and were sending the information to an overseas server for the development of some kind of new filtering product? There have been suggestions that this behaviour by Telstra was in breach of the TIA act and warranted investigation by the federal police. Can you fill us in: firstly, are you aware of the breach I am referring to? 

Mr Negus: I will get the head of our high tech crime unit to come to the table and perhaps give us some more details. 

Mr Gaughan: Senator, this is the first I have heard of that, and I am in regular contact with Telstra. 

Senator Ludlam: True? Okay. Is it the first you have heard that the AFP's intervention was called for, or the first you have heard of that data breach? 

Mr Gaughan: It is the first I have heard of the data breach. 

Senator Ludlam: That is interesting. It might help if I table some material so that you know what I am referring to. I am aware that a number of people did make complaints. It was effectively transferring traffic on Telstra's network to a cloud-hosting provider in the United States, which then potentially exposed Australian data to the Patriot Act, which obviously has very different ideas around privacy protection than we do here. A number of constituents that I am aware of did receive traffic back from the AFP saying, 'We have to prioritise. Our case load is very heavy; we will not be investigating this one.' But, if you are not aware of that, I might come back to that later and give you some material to work with. To whoever wants to take these questions: I am just referring to the national security inquiry that is underway at the moment and is before the joint committee.

It is disturbing, to say the least, that the AFP officer who is assuring us that the organisation is trustworthy and that the proposed legislation is benign seems to have no knowledge of practice that received major coverage in the mass media, in the specialist media and in examination by the Privacy Commissioner.

The testimony continued with Senator Ludlam stating

I am aware you gave evidence on 26 September with a number of other commissioners from around the country …  Can you tell us about the AFP's role in the lead-up to the announcement of this committee? Did you play some part in forming the terms of reference or provide material for the discussion paper that came with the committee?" ... 

Mr Negus: Yes, we certainly could have a look now and get back to you very shortly about that. It was a few days before my appearance. 

Senator Ludlam: All right. Great. Obviously I have got quite a keen interest in this one. You are giving evidence to the joint committee now, which is good. 

Mr Gaughan: We have been involved from the outset in relation to this particular issue, working with the Attorney-General's Department and other Commonwealth agencies, in relation to preparing the discussion paper that was put forward before the committee. Obviously, as a user of the telecommunications interception act, we have a strong interest in where this goes. There has been a number of different meanings convened over the period of time before this paper went forward. There is working group level, where the people are talking about exactly the content of a proposed bill, and there are also more senior discussions in relation to some of the strategic issues that are currently before that committee. 

Senator Ludlam: All right, thank you. Now I am aware that this, at least from the Attorney General's Department's point of view, goes back a number of years: four meetings that they had convened with telecommunications providers. Were the Federal Police involved in those meetings? 

Mr Gaughan: I have certainly been involved in some of those meetings. That has been with some of the larger telcos, particularly Optus, Telstra, Vodafone and Hutchison in South Australia. Some of those meetings I have been involved in and others I have not. That question is probably best answered by the department. 

Senator Ludlam: No, as for the Federal Police's involvement, they would refer me back to you. Are those meetings ongoing, or have they lapsed while the joint committee does its work? 

Mr Gaughan: I have not been involved in a meeting of that nature for at least six months. 

Senator Ludlam: Okay. Does that mean they are not occurring or your involvement has ceased? 

Mr Gaughan: My involvement is not occurring. Whether they are still happening would be a matter for the department. 

Senator Ludlam: You recently sent Deputy Commissioner Phelan around the country. I am just going to cite briefly from the evidence that you gave a week or so ago. You sent the Deputy Commissioner: ... around the country and he spoke to every jurisdiction about the issues we saw as being important for Australian law enforcement. Why have you done that? Why has the Deputy Commissioner been tasked to do that? 

Mr Negus: Because it was a federal committee, we basically saw that someone needed to take a bit of a leadership role from the law enforcement perspective. It is one of the reasons I asked my fellow commissioners to appear together, so that we could have a bit of a united front, if you like, and put forward those issues from the law enforcement perspective. So, because, as I said, many of the states and territories do use interception and are involved in this process but do not really have a voice, other than providing a submission to the committee, we sent Deputy Commissioner Phelan around to talk to them about issues that we thought were important, seek them and encourage them to actually put a submission into the committee, which most of them did, and answer any questions they may have about how this process is undertaken at a federal level. 

Senator Ludlam: And that evidence, or some of it at least, is now on the public record. 

Mr Negus: I have to say, too, that we put a public submission to the committee—and, again, that is available on the website—and our position is very clear with regard to what we are trying to do here. The information that was provided in camera by Deputy Commissioner Phelan and Assistant Commissioner Gaughan was very much about the operational examples of these issues around methodology. So there was nothing untoward in that regard; it was more things that we would not put on the public record because of our operational capability. 

Senator Ludlam: Yes, I understand that. So that material is also beyond the reach of this committee while we are in public session. I am just interested in the idea that you would send a deputy commissioner around the country to get everybody onto the same page before you gave evidence. 

Mr Negus: I see this as one of the most important strategic issues for law enforcement in the next decade. If we do not get this right, balancing the privacy obligations and the privacy principles that underpin the TI Act 1979, then from a law enforcement perspective, the Australian public are going to have an outcome which is going to be suboptimal. Organised crime, terrorists and other things will get an advantage that I do not think had been anticipated in this regard. We are not seeking additional powers; all we want to do is modernise the TI Act to the context of what is really the communications and telecommunications industry of today. In 1979 when this act was launched, I do not think anyone could have foreseen what this would become in the way that people would communicate in 2012 and beyond. We want something that is technology neutral. We want to protect people's rights and liberties. We do not want additional powers. We still want to make sure that people are obliged to go and seek a warrant from a judicial officer to get content data. But the non-content data—and they are the things that we have been talking about here around the fact that a telephone conversation took place, where it took place and what the numbers were—are the sorts of things that we see as really important to get some consistency across telecommunications carriers and other areas through the use of quite legitimate law enforcement.

Given the vagueness of proposals, noted in this blog and in articles in Privacy Law Bulletin, there is substantive concern regarding the meaning of that non-content data (aka telecommunications traffic data).

Senator Ludlam: Could you provide us with your working definition, written or otherwise, of non-content data? 

Mr Negus: Absolutely. In fact, I have one written down. We could actually tender one. The department has one here which we have worked on. 

Senator Ludlam: I would appreciate that. 

Mr Wilkins: We have a definition here that is probably useful. Particularly if you are going to talk us and some of the other agencies about the same topic, it is actually important that we make that available to you. 

Senator Ludlam: I would greatly appreciate that, with the consent of the chair. 

Mr Wilkins: It is a folio, really. 

Mr Negus: I agree that it would be useful to table this, because there has been a lot of confusion in the media reporting about what is content and non-content data. I think it has unfortunately alarmed many people that some things would be looked at by law enforcement when in fact that is not exactly the case.

That "confusion" extends to the legal community and is not wholly an attribute of media reporting

Senator Ludlam: It certainly alarmed me and I will go into a bit of detail as to why. Chair, are you happy for that material to be tabled and circulated? 

CHAIR: Yes, that is fine. 

Senator Ludlam: Great. Can I just summarise a sketch without having seen the document that you are about to circulate? Is it the case that the definition of non-content data is basically anything except the content of the communication itself, or is a bit more technical than that? 

Mr Negus: Have a look at the definition first, Senator. 

Senator Ludlam: All right. We come back to that in a moment then. Do you think it is appropriate, Commissioner, that that material is at the moment being applied for a bit under two dozen agencies—as the TI(A) Act annual report describes, without any warrants at all? You actually provided us with the paperwork that the AFP is obliged to go through to obtain those. Do you acknowledge that no warrants are required? 

Mr Negus: That is right. As I think I have said to you before, I think the AFP applied for 23,000 of these last year. So if you were wanting to grind the AFP to a halt, then you should implement a warrant scheme to actually do non-content data application—because 23,000 of these would require 23,000 judges to consider affidavits for those to be prepared and for those to be granted. It is an unrealistic expectation. I think there are certainly significant safeguards in place and I am confident that internally within the Australian Federal Police we actually provide a level of scrutiny and accountability to that that we treat very seriously. 

Senator Ludlam: Can you tell me why you think it is appropriate that suspects need to be named and targeted and serious crimes need to be under investigation and warrants need to be applied for for a direct intercept of a phone call but detailed locational data, moment by moment, of exactly where I am at every given moment of every day, should not have any warrant or any of those preconditions applied? Why is one worthy of such protection and the other one is not? 

Mr Negus: One is a far greater intrusion into an individual's personal discussions than the other— 

Senator Ludlam: Commissioner, I strongly disagree. 

Mr Negus: Senator, that is a matter for you, and that is what the committee is actually considering. What I was going to say at the very beginning of this is that this whole information is being considered by another committee, which we have appeared before. We have put a public submission in and we have had a number of our officers appear before that committee. There has been a range of different views expressed, and really it is a matter for that committee to consider all of those and make recommendations accordingly. We are but one player in this process. 

Senator Ludlam: Yes. 

Mr Negus: We have tried to play a coordinating role to look to have the best possible information available for the committee so that they can make an important decision. But, as I said at the beginning—and I do not resolve from it—perhaps one of the most important things that law enforcement will face in the next decade is to get this right in balancing the privacy issues with the availability of data and information to law enforcement to protect the community. 

Senator Ludlam: I recognise that and I understand that. It is also a legitimate role of this committee to put precisely the questions that I am, while you are flying people around the country trying to get everybody on the same page. 

Mr Negus: I reject that, Senator. This is not about getting people on the same page; this is about coordinating a response. We did not tell people what to say in their submissions; we just encouraged them to be part of the debate, and answered any of their questions about what would be the federal process and how this would unfold. So I reject your assertion that we sent someone around in an untoward way to get people onto the same page, because that is not what was actually undertaken.  

Senator Ludlam: I have now got the definition that we are working to, and I appreciate that. It is not just the Federal Police applying for these; it is the tax office, at least one local government authority that I am aware of, welfare agencies, anticorruption agencies and all sorts of folk. Do you concede that you are now able to create very, very detailed real time maps of an individual's social networks, their movements and their transactions— effectively everything about their lives apart from the content of the communications? 

Ludlam has identified a key issue, one that is recognised in much of legal literature. Traffic data allows robust inferences about private lives and about the content of the communications.

Mr Gaughan: Senator, that document that you have in front of you does not talk about web browsing. We are not seeing web browsing as part of that. 

Senator Ludlam: It relates to communications for internet. 

Mr Wilkins: It does not include web browsing. 

Senator Ludlam: It says internet. 

Mr Wilkins: It does not include web browsing. 

Mr Gaughan: Mr Wilkins makes a very good point. Talking about getting into the details of what someone is looking at is arguably content. We are not after content. Clearly what is defined in that is metadata. It is important for us to have that information for us to undertake basic investigations. All of the sworn members in this room have been in the police force for in excess of 25 years, and I cannot recall any investigation that I have been involved in as a constable or the investigations that I have oversighted as an assistant commissioner or the ones that my telecommunications interception arm is involved in that do not use metadata. It is the primary function of law enforcement. The fact that the authorisations as recorded in the annual report have been consistent over the last three to four years in my view shows that the use of metadata is efficient and effective in bringing people to justice. We pay for this information. It is was not effective, we would not be using it; we would be doing something else. 

Senator Ludlam: I am not arguing about its effectiveness. I will read from the sheet that you have just tabled. Part I says 'relates to communications for item 2, internet,' and then it says, 'Information that allows a communication to occur,' and the first dot point there says, 'the internet identifier'. I presume you mean an IP address there. 

Mr Gaughan: Correct. 

Senator Ludlam: It says 'The internet identifier assigned to the user by the provider,' but you are telling us that that would not allow you to identify web traffic. 

Mr Negus: That is right. 

Mr Gaughan: What it does, Senator, is it allows us to identify who has used a particular IP address when they have undertaken a certain activity - for example, downloading child abuse material. 

Senator Ludlam: From the web. 

Mr Gaughan: From the web. If we do not have that IP address we cannot start the investigation. 

Senator Ludlam: I am with you, but I am also profoundly confused. You have just explained that this is not about identifying web traffic. That is now how I read this piece of paper. 

Mr Wilkins: You would need to get a warrant to get that information, Senator. 

Senator Ludlam: You would need to get a warrant to find out, for example, a specific URL that someone had visited - not a copy of the page but the URL? That is not my understanding of how the system works at the moment. 

Mr Gaughan: For instance, how it works in child protection investigations is a very good example. We receive from our international law information agencies what has been accessed - that is, child abuse material - and an IP address. That is all we get. We do not get any other information. We then ask the telcos to identify who has accessed that IP address to enable us to commence the investigation. 

Senator Ludlam: So who held the IP address for a period of time in which content was accessed? 

Mr Gaughan: Correct, but it is in undertaking our specific investigation. We do not go on fishing expeditions. We do not obtain IP addresses and then go seek the internet of what they have looked at. That is web browsing. 

Senator Ludlam: But there would be nothing preventing you. You guys are busy and presumably you do not have time for fishing expeditions. 

Mr Gaughan: Correct. 

Senator Ludlam: But there would be nothing preventing you from doing exactly that. 

Mr Gaughan: As Mr Wilkins said, we would need a warrant. 

Mr Wilkins: The law prevents them, Senator. 

Senator Ludlam: I am not sure that it does. 

Mr Wilkins: It does. 

Senator Ludlam: If you can provide us with exactly how that is the case, that would be appreciated. I am sorry, but that directly contradicts— 

Mr Wilkins: I guess we will just have to spell it out in words of one syllable for you, but it does. 

Senator Ludlam: That is a profoundly unhelpful response to the question. If you want to do that, you would be very welcome. I would like to see you try. 

Mr Wilkins: We are trying to be helpful, Senator. We have just explained to you how this is meant to operate. 

Senator Ludlam: This will be a bit out of the AFP's hands, so I can put this to the department a bit later if you like, but of the just under a quarter of a million metadata or communications data requests that were reported in the last annual report, none of that relates to web traffic. If that were the case you would need warrants. 

Ms Smith [Attorney-General's]: The majority of those requests are in relation to subscriber requests—names and addresses and things like that. The internet aspect of that will be in relation to IP addresses. For example, through an intercept they have found out that there are various people accessing it and they will have a number of random IP addresses. They will go to the provider and say, 'Who belongs to these IP addresses?' under a data authorisation. But they have no authority, and the law does not allow them to access the contents of the communication outside a warrant. The TIA act is very clear in its definition of what is a communication, and includes issues like web browsing and anything that goes to the substance of a communication. 

Senator Ludlam: Yes, but I can give you a URL of a web page without disclosing what is on that page. What I am trying to identify now, in words of one syllable, is whether a URL is communications data/metadata or whether it is content. 

Ms Smith: The department has always taken a very conservative approach in relation to URLs to ensure that there is no unintended access to content of communications under data authorisations. 

Senator Ludlam: Are you able to point me to the part of the Act that says it is or is not a URL? 

Ms Smith: There is no definition under the current legislation and, as has already been noted, this is a matter for the PJCIS as far as modernising the legislation— 

Senator Ludlam: It is a matter for this committee as well. 

Mr Wilkins: What we are saying is that is our interpretation of the current legislation, and it would be made very clear in new legislation that that is the case.

There has been no indication of that so far.

Senator Ludlam: That a URL, for the purposes of the way you are currently interpreting these requests, is content and not communications data? 

Ms Smith: Correct. 

Mr Wilkins: That is right.

Discussion then moved to the working group on the data retention proposals. That group may or may not have featured much involvement or consultation with the Privacy Commissioner. We might reasonably expect the Commissioner to have close involvement in the development of proposals that have major privacy implications and that, on the basis of committee hearings over the past three years, are highly controversial

Senator Ludlam: Can we go to the working group you mentioned earlier, Mr Negus. Could you spell out what its task is at this stage? 

Mr Negus: I think Assistant Commissioner Gaughan mentioned the working group; I will pass it back to him. 

Mr Gaughan: Initially it was to discuss some of the things that Mrs Smith has alluded to - the fact that there is no definition of a lot of the issues that are currently open for discussion and debate - and to try to come up with some terms and some words that everyone agreed to. We obviously still have some work to do with that, and the committee has come back to us a number of times in relation to some of those particular issues. The working group was also responsible for assisting and putting together the discussion paper that forms the basis of the PJCIS discussions at the moment. 

Senator Ludlam: Are you able to provide for us the membership of the working group and what its standing is? Is it informal or does it have some standing? 

Mr Gaughan: That is probably best answered by the department. Certainly, the AFP has a member in their group, but it is probably a question for Mrs Smith. 

Mr Wilkins: Do you want us to answer questions on this? We might as well. There is no working group at the moment. It is basically in abeyance. We are basically waiting to see what comes out of the committee, and then we may reconstitute a working group. 

Senator Ludlam: So there was a working group that was stood up to help produce that discussion paper and the terms of reference, and then it was stood down for the time being? 

Ms Smith: No. What the working group did was look at the need to reform the legislation, as Mr Gaughan has said. It was about coming up with some of the challenges that the current legislation faced. The work on the terms of reference et cetera was done by a different group of people. 

Senator Ludlam: Can you provide for us an idea of the working group when it was active; the membership and the duration that it worked for? 

Ms Smith: It was essentially the Attorney-General's Department, the AFP, the Department of Broadband, Communications and the Digital Economy— 

Senator Ludlam: You can put this in writing if you would prefer. 

Ms Smith: Would you prefer us to take it on notice? 

Mr Wilkins: We will take it on notice and make sure we get the names right. 

Senator Ludlam: Particularly on the DBCDE about what officer they were represented by or at what level they were represented. What about the Privacy Commissioner? 

Mrs Smith: We have certainly consulted the Privacy Commissioner on aspects. 

Senator Ludlam: Were they on the working group? Mrs Smith: I am not sure. We will take that matter on notice. 

Senator Ludlam: You cannot recall if they were involved? 

Mrs Smith: It was some time ago because we have moved into the PJCIS phase now. I will have to take that on notice.

Memories are short in A-G's, apparently.

Malcolm Turnbull, the Law Institute of Victoria, senior barristers and bodies such as the Victorian Privacy Commission ("the introduction of intrusive powers suggested in the Discussion Paper fails to achieve those tests of legitimacy, necessity, proportionality and effectiveness") have all expressed strong concern regarding the proposed legislation. The lack of detail, factual inaccuracies and inconsistencies in claims do not induce trust. The arrogance of the head of the Attorney-General's Department is disappointing. Uncertainty about whether there has been meaningful consultation with the Privacy Commissioner suggests that the Government's claims regarding its respect for privacy are hollow. If the Government doesn't think that the Privacy Commissioner is important, why should we?