Controversial hacking powers handed to authorities in 2021 have never had an effective main safeguard, a statutory review has determined, after finding dozens of warrants are being handed out by untrained individuals.
The landmark review of the Surveillance Legislation Amendment (Identify and Disrupt) Act 2021 was tabled Monday with recommendations for drastic changes to how warrants are issued and new restrictions on who can apply for them.
But it stops short of recommending the removal of powers like covertly monitoring people online, deleting their data or locking them out of accounts, after finding they have helped identify and disrupt serious crime.
The ‘SLAID’ Act passed in 2021 with bipartisan support, handing authorities extraordinary powers to tackle cyber-dependent and cyber-enabled crime under new warrants:
- The data disruption warrant (DDW) allows the Australian Federal Police (AFP) or the Australian Criminal Intelligence Commission (ACIC) modify, add, copy or delete data to disrupt online crime
- The network activity warrant (NAW) Allows the AFP or ACIC to collect intelligence about a ‘criminal network of individuals’ or any person electronically connected to that network
- The account takeover warrant (ATW) allows the AP or ACIC to seize control of a person’s accounts to gather evidence
Experts have warned the powers are an overreach and risk making the authorities “judge, jury and executioner”, and were calling for them to be allowed to sunset.
Independent National Security Legislation Monitor Jake Blight’s new review found the powers are “extraordinary and invasive” but have been “effective in helping to identify and disrupt serious crime, including in cases where other powers would have been ineffective”.
The effectiveness of the safeguards was a “different matter”, however, with the review finding the main shield – the warrant issuing system – has never been fit for purpose.
“This is largely because the current system is based on a process designed over a century ago for basic property search warrants,” Mr Blight’s review said.
“Unlike those early warrants, SLAID Act warrants involve the use of advanced technical capabilities and can give agencies access to large amounts of information about many people from many computers…. The information that is collected under them is rarely used in evidence, so a person affected by a warrant effectively has no recourse to judicial review.”
The review shows that all DDWs and NAWs have so far been issued by a small group of Administrative Review Tribunal members even though judges can also issue them. Only magistrates can issue ATWs.
The current reliance on ART members – who issue the warrants in a personal capacity in addition to their normal workload without access to relevant training or technical advice – opens the decisions up to allegations of forum shopping or a lack of expertise, the review found.
Fewer than 50 SLAID warrants were issued in the first three years, the review found, but none were ever denied.
The authorities told the review the powers were used judiciously and have helped disrupt serious crime like cyber offences, fraud, child exploitation material, organised crime and terrorism.
But only one arrest is known to have resulted from any of the warrants and public reporting on outcomes is limited to protect methods and current investigations.
Mr Blight, who received evidence in private and had access to classified reports to ministers said he was satisfied the powers have been effective and used in situations where other warrants probably would have been ineffective.
Mr Blight has recommended maintaining the powers but with an overhaul of how the warrants are granted.
The recommended system would use panel of retired judges to issue the warrants, with input from public interest monitors and technical advisers, and greater consideration of the lifecycle of sensitive data being intercepted.
Mr Blight also recommended lifting the offence threshold for warrants from three years to five years, revoking ACIC’s access to DDWs, a new statutory duty of candour, and greater transparency and accountability.
“In my view these changes are needed to make the warrant issuing system fit for purpose for technologically complex and invasive warrants such as those authorised under the SLAID Act,” he said. “The proposed changes can also be expected to increase public confidence in the use of warranted powers for law enforcement and criminal intelligence.”
The cost of the changes would be modest, Mr Blight said, and deliver a more efficient system as well as more effective.
The review paves the way for the Albanese government to stop the legislated sunsetting of the powers next year, but the act is likely to be examined by the powerful Parliamentary Joint Committee on Intelligence and Security before then as well.
Also looming over any changes to SLAID powers is the governments ongoing work on electronic surveillance reform. The umbrella project is expected to replace current surveillance laws with a single act and had been expected to be revealed by 2023. It remains ongoing.
Do you know more? Contact James Riley via Email.