Senator LUDLAM —Thank you for providing us with what you have. Given what you have just told us during the in camera hearing, I am interested in knowing, firstly, about the status of this paper. Is this a copy of what was given to industry or has this been prepared for the committee?

CHAIR —Which paper, Senator Ludlam?

Senator LUDLAM —I am holding up a yellow paper that was provided yesterday.

Ms Smith —That was provided to you in confidence.

Ms Kelly —It is representative of the information that was provided to industry, but it is the next iteration following consultation with industry. No, that has not been provided to industry.

Senator LUDLAM —But it is derived information.

Ms Kelly —Yes.

Senator LUDLAM —Is it the intention that the consultation for the data retention proposal is going to stay out of the public domain? We have had several groups give evidence to us saying that they had been cut out of the loop. At what point are you actually going to bring civil society into the debate?

Ms Kelly —We are still considering the merits of a data retention proposal. There has been absolutely no decision made at the moment as to how we will progress it. So there is actually no decision.

Senator LUDLAM —But is it the case then that once you have made your mind up to do it you will present a fait accompli to civil society groups, or do you think perhaps the groups like the Privacy Foundation, or Liberty Victoria or some of the groups that have given evidence today and last week might actually have a valuable perspective about whether this is a good idea at all rather than plugging in once you have made your minds up?

Ms Smith —No, the department is definitely committed to an open and transparent consultative process once we get to that point and acknowledge that there is strong public interest in these issues.

Senator LUDLAM —Are you acknowledging that now?

Ms Smith —I have always in my work acknowledged the public interest in these issues.

Senator LUDLAM —But I mean this one specifically. So you are not saying that you are waiting until you have made a decision about whether or not you will go ahead and then you will consult, because that is not consultation, it is a briefing. To be clear why I am taking this line of questioning, and I did last time as well, you have got law enforcement agencies with a very clear request for having these data sets, and you have given us some examples. You have got internal government agencies providing information and you have got industry participants who you are asking, ‘Is this possible? How would this work?’ and you have left out civil society groups who might have a view about whether this is wise or a good idea. When will they be brought into the debate?

Ms Kelly —In regard to the development of this particular issue, to date we are still not at a point where we think it is suitable to actually go out for that further consultation. In any policy development, you have to look at the outcome you are trying to achieve, the problem and how to address the problem, and you have to talk to the key stakeholders to see what is viable. When I say key stakeholders, I am talking about the agencies and the industry that are going to be primarily working to effectively build a solution. We do not want to pre-empt consultation with the public until we have a view around what that could possibly be.

Senator LUDLAM —I am sorry to nag about this stuff, but because this is about the records of everybody, whether you are a suspect or not, I would have thought the public would be a key stakeholder in this. It is not that this is a specialised proposal for tracking down certain kinds of offences; this actually affects everybody who lives here and people who do not.

Ms Kelly —Correct. The idea is to have something to consult them on, holistically.

Senator LUDLAM —Okay, I take that point. Commander, can you step us through the trigger points in these investigations where you need to obtain certain kinds of warrants. In relationship mapping, you might have a warrant out for a particular person who will give you an associate network of 20 other people. Do you need to then go out and acquire 20 other warrants? What do you do when people broaden these investigations on the periphery?

Ms Smith —That is actually a law issue—I am happy to answer if that is all right.

Senator LUDLAM —Okay.

Ms Smith —Yes. In fact, you must get 20 more warrants after you are satisfied that each of those people is necessarily an appropriate target to obtain a warrant over. For example, if they are intercepting one person’s communications and through that interception they know that there are possibly 20 other people who have an interest in the same level of crime, they have to satisfy either a court to get a warrant or the AAT that that person’s communications are such that they would be in the furtherance of the investigation. Every single time a target becomes of interest, you must go back to the first stage. You cannot just say that there is a known association here with someone we already have a warrant on; you must go back to the first base every single time.

Senator LUDLAM —Presumably, you get a proliferation of warrants as you go through big investigations.

Ms Smith —Yes, but often they do not go to the warrants; they will go to the call data first to see if there is a true association with that person or if there was just a one-off telephone call.

Senator LUDLAM —I think that is the distinction I am trying to get clear: how far can you go on the metadata without having to acquire a warrant? How much access do you have without specifically having to go to that administrative set?

Ms Smith —This is getting in camera again.

Senator LUDLAM —Is it?

Ms Smith —Yes.

Senator LUDLAM —I would have thought that was a legal question.

Ms Smith —From the legal perspective, if there is a target about whom there is a belief that they are in breach of criminal laws, they can access the records that exist at the time from the provider which could be any level of information for any period of time.

Senator LUDLAM —Tens of thousands of records; all sorts of things.

Ms Smith —If it is about a person. It must be an individual person that you are seeking that information on. Every time there is an alleged associate, you must go back and you must access the information about that person and establish that there are known associations with others. But to go one step further, we will need to go in camera.

Cmdr Scott —Can I add to that? The legislative test is quite high. As the department has mentioned, we seek authorisation from a member of the AAT. We need to disclose that traditional forms of investigation have been exhausted and that resort to the telecommunications approach is really a last resort. In our affidavits we have considerable discussion that traditional forms of investigation have not been successful, and it is a requirement in the legislation.

Senator LUDLAM —I presume the use of the word ‘tradition’ is going to have to change as this sort of work becomes more and more mainstream. You have just given us mainstream drug case subjects.

Ms Smith —Yes. It maybe that some crimes are completely online. Paedophilia is an example of this where the communications are generally online. But, still, they will seek to establish that IP addresses are talking to each other before they will go to that next step of seeking information. There are other forms. There are search warrants that may be possible in those cases and they will choose to go to a house and seize a computer. There is also the case of gaining stored communications if they want to get images. From the department’s perspective, we strongly push other methods of investigation, not necessarily traditional methods, because that is what the act requires before a warrant is obtained to access content.

Senator LUDLAM —The examples that you have given us are obviously all entirely legitimate, but people—including me—have concerns about the creation of these very large and extensive data sets that do not presently exist. How are you going to secure those from collateral leakage or access by other people? Will your security be more robust than, for example, the US Department of State? Do you acknowledge that there is a legitimate concern that you are not accessing commercial records that exist already; you are asking industry to create records for the sole purpose of law enforcement?

Ms Kelly —No. Advice from industry is that the majority of information that is included in that draft data set is currently retained. The issue is the length of time it is retained for. Some of the information is retained for days whilst some of it is retained for years. Some of that information is retained for audit and taxation purposes. Each individual industry participant currently holds a vast amount of information on every one of their customers.

Senator LUDLAM —You are asking them to retain it for a lot longer which is why concerns have been put in the public domain from industry about the cost of storage of all this stuff. That was not the nature of my question; my question is: how are you going to secure it?

Ms Kelly —Industry currently has an obligation to store and secure customer information.

Senator LUDLAM —I thought the whole point of this process is that they do not have an obligation to store stuff. These records of home landlines are evaporating and industry are not storing the data sets that you are going to need—all the stuff that you were describing before. Individual records are not kept anymore

Ms Kelly —They currently do not have an obligation to retain or to store information for national security and law enforcement purposes. They currently have an obligation to their customers to ensure that the data is protected. I think that comes under the Privacy Act in regard to securing the information that they collect and retain for their own business purposes. They already have an obligation to their customers to store and secure their information.

Senator CAMERON —I have a number of questions for Ms Smith. But given the time, I might ask that they be taken on notice. I am not sure if you have a copy of the Law Institute of Victoria’s submission?

Ms Smith —I do now, but I have not yet read it.

Senator CAMERON —I do not need you to go through it right now. There are a number of assertions in that submission that I would like clarification on from your perspective. Under the heading ‘Privacy implications under the National Privacy Principles’. It goes to principle 1, principle 4, principle 4.2, principle 8 and principle 10—I may have missed some. I would ask you to look at that and give me the department’s point of view on these assertions made under this submission.

Ms Smith —We certainly consulted at length with the Department of the Prime Minister and Cabinet on the Privacy Act and the National Privacy Principles. We are more than happy to provide you with a response in writing. That is not a problem.

Senator CAMERON —Under the heading ‘Australian Law Reform Commission recommendations’, they point to the recommendation that ‘data be collected only where necessary’.

CHAIR —Senator Cameron, the committee may decide to extend the time of these witnesses with their preparedness. I hear that they are happy to extend. We are not likely to exercise the full time allocated to the next and final witness, ACMA. If you wish to give the witnesses the opportunity to answer your questions right now then please do so.

Senator CAMERON —I think there have been too many issues raised here and I am happy to extend this one if it means we still finish at 4.45 because I have other commitments.

CHAIR —Yes, we will, Senator Cameron. Do you want to ask that question again or are you wanting the witnesses to take that one on notice?

Senator CAMERON —On those issues relating to the National Privacy Principles I think it would be better to get a considered response.

CHAIR —Do you have other questions?

Senator CAMERON —On the Australian Law Reform Commission recommendations the argument being put forward is that the report legislation may be inconsistent with the recommendation that data be collected only where necessary. Do you have a view on that?

Ms Smith —No, I do not really have a view on that because if—and it is a very big if—it is made law, if it was decided that it should be retained and legislated, then it would be necessary. To be honest I have not read this particular submission. I was involved in the original ALRC submission and did a lot of work on that, so I am happy to take that away and give a more considered answer rather than a give a short inappropriate answer.

Senator CAMERON —That is what I thought. This is the Law Institute of Victoria and they were complaining about the lack of a chance to consult properly. They indicated that they wrote to the department and got a response—these are my words—which was like a ‘go away’ response. Could you advise me what consultation processes are in place for groups like the Law Institute of Victoria?

Ms Smith —As we have mentioned earlier, should the Attorney-General determine that at a time this should be taken forward then there will be open and transparent consultation at that time. When we take legislation through generally and I am not talking about anything to do with what we are talking about today but we generally consult with a very broad range of stakeholders because everyone is very interested in the Telecommunications (Interception and Access) Act. I am not aware of a particular response that we wrote to the Law Institute of Victoria but I am more than happy to look into that.

Senator CAMERON —Ms Smith, I also asked you a couple of questions on notice at the last hearing in relation to Google and breaches of the Telecommunications (Interception and Access) Act. You indicated you would be happy to come back to the committee on these issues. Do you have any responses on these issues that I have raised?

Ms Smith —I believe we provided those responses to the committee last Friday.

CHAIR —They were circulated late yesterday. You might not have caught up with them yet.

Senator CAMERON —I have not seen them yet. If we are going to go a bit longer, I will have a quick look at them and I may have some questions on these answers on notice.

CHAIR —You are the only one with questions remaining. I am not meaning to put you on the spot, Senator, but you are the only one of us with questions remaining of these witnesses, so you decide.

Senator CAMERON —I do not have them in front of me now. I may have further questions on notice arising from those answers. Ms Smith, can you take me briefly to the issue, is it a breach of the Telecommunications (Interception and Access) Act?

Ms Smith —I, like you, will have to read it again and remind myself. I think we have given quite an in-depth response to this particular question and I actually had specific technical people look at it. I think the general view that we have given in this letter that it is certainly not a breach of the TIA Act for which we are responsible. I think it is quite a good response and it goes into quite a lot of detail.

CHAIR —If you do say so yourself.

Ms Smith —If I do say so myself. We do explain why we believe it is not a breach.

Senator CAMERON —It is a lengthy response.

Ms Smith —It is a lengthy response, yes.

CHAIR —Senator Cameron, you may have a couple of minutes because Senator Ludlam now wishes to ask one further question.

Senator CAMERON —That is fine. I will just indicate that I may have some issues arising from the ‘good’ response that I have been told we have got.

CHAIR —Feel free. I think the committee will accept your questions on notice arising out of that if that is how you wish to play it.

Senator CAMERON —I do not really have any other option. The responses came in late yesterday and I have not read them.

Senator LUDLAM —Regarding data retention, maybe this is hypothetical, but why are you only seeking for the metadata to be retained? Why not compel the retention of the content as well—for example, email traffic?

Ms Smith —Given the developments in technology, the data is actually much more important and usable in terms of being able to provide the information that is required. That then may lead on to the higher intrusiveness. Particularly when we are talking about encryption and dealing with that, there is no point in getting the content if you cannot decipher it or use it. The data is actually much more important.

Senator LUDLAM —That is interesting. The metadata is more important for the kind of broad-scale data mining that you are doing. Your research is based partly on what industry tells you it can do—

CHAIR —That is consistent, if I may say, with LIV, I think it was, suggesting that there is a feeling that you are collecting this data simply because you can as opposed to it being necessary and/or appropriate.

Senator LUDLAM —I think the example I put to you before was a bit of a caricature: why not install webcams on all of our shoulders so that you can see where everybody has been just in case one of us turns out to be a criminal? Why not compel ISPs to hold not just the metadata but the contents of the communications as well for those opportunities when you might want to go back and see what someone wrote two years ago in an email?

Ms Smith —Content goes well beyond an email. Content is every voice communication that you make, every email and every IP session. I think that any access to information for law enforcement and national security purposes has to be proportionate, and I do not think the retention of all content would necessarily be proportionate against the amount of information that they would seek to have.

Senator LUDLAM —There are folk putting strong arguments that the existing data retention proposal, such as it is, is already disproportionate.

Ms Smith —We are listening to those arguments and that is essentially what we are considering at the moment.

Senator LUDLAM —Are you able to tell us when we might see some kind of formal public process initiated?

Ms Smith —No.

Senator LUDLAM —Just checking.

Senator CAMERON —Chair, has the secretary received the questions on notice?

CHAIR —They were circulated yesterday afternoon, I am informed, by email, I presume.

Senator CAMERON —I have not seen them yet but will have a look.

CHAIR —I thank the witnesses.

Ms Smith —Thank you. We look forward to the questions on notice.

 

[4.13 pm]