Invasive surveillance powers are being used without proper justifications or record keeping, a new review shows, leading to calls to reign in authorities that are covertly accessing Australians’ private communications.
The report by the Commonwealth Ombudsman found repeated instances of police forces and other authorities failing to demonstrate they had followed the laws in exercising powers to access data and metadata last year.
It is the latest in a series of warnings by the Ombudsman about authorities not understanding or adhering to legal requirements, with one expert calling the lack of progress “completely unacceptable”.
Controversial reforms to telecommunications laws allow the authorities to access telecommunications data like text messages, emails and voicemails, and related metadata, or compel providers to provide access.
Dozens of inspections by the Ombudsman last year revealed many of the safeguards proponents used to justify the reforms — such as necessity thresholds, mandated privacy considerations, record keeping and authorisations — are being ignored or misunderstood.
In one instance, the Northern Territory Police accessed telecommunications data relating to a journalist and their source on four occasions without the judicial warrant required.
In another, Victoria’s corruption authority failed to justify its access of historic and prospective data to required thresholds. On the Ombudsman’s recommendation, it has reviewed and quarantined data.
The Ombudsman is also reserving a finding on whether the Australian Criminal Intelligence Commission met its thresholds, after determining its governance and policy frameworks have not translated into effective practice.
The report shows “sloppy” levels of governance and compliance in the use of surveillance powers, Electronic Frontiers Australia chair John Pane said.
“It appears to be showing thematic findings in relation to not understanding how these powers should be exercised,” he told InnovationAus.com.
The Ombudsman warns of “systemic behaviours” like complacency and “lax” attitudes driving non-compliance, and criticised four police forces for failing to act on his recommendations in earlier reports.
Victoria, Queensland, Northern Territory and Tasmanian police forces have not addressed the Ombudsman’s findings over several inspection periods.
Mr Pane said the “recidivist activity” was “completely unacceptable” and concerning.
“They’re not reinventing the wheel,” he said. “They’re putting in place basic controls to ensure that police also act in a way that complies with the law.”
Without the controls and records, the risk to privacy and judicial fairness increases, Mr Pane said.
“I think that’s what the report shows is lack of accountability.”
Check box compliance
Electronic Frontiers Australia led a push by digital rights groups to try and stop the most recent covert surveillance powers, aimed at encrypted communications.
Passed with bipartisan support in 2018, the powers allow agencies to request assistance, compel it, or even require communications providers to develop the capability to assist.
The controversial powers were rushed through Parliament in 2018 in part to help reduce a terrorism risk. However, the powers have never been used to investigate a terrorism offence but are increasingly being deployed to investigate other serious offences.
The Ombudsman last year inspected six agencies use of the powers, finding the NSW Police to be far and away the biggest user, accounting for 53 of the 69 voluntary technical assistance requests (TAR) issued in 2023-24.
TARs are granted on a discretionary basis, with the chief officer or delegate required to consider things like proportionality, reasonableness and feasibility.
The Ombudsman found the NSW Police did not do this adequately and often relied on adopting the considerations of applying officers and simply signing and dating applications.
“We noted that the applications also contained pre-ticked check boxes that purportedly demonstrated that authorised officers had considered the matters required by… the Telecommunications Act,” the Ombudsman’s report said.
The NSW Police have a “different view” on this interpretation of the Act, the report said, but has “enhanced” its forms in response to the Ombudsman’s finding.
The Queensland police were also criticised for using TARs when they already had lawful access to the data elsewhere and for relying on them for up to 12 months at a time.
Do you know more? Contact James Riley via Email.