Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Parliamentary Joint Committee on Intelligence and Security
26/09/2012
Potential reforms of national security legislation

FLORIAN, Ms Kathleen Mary, Assistant Commissioner Crime, Crime and Misconduct Commission Queensland

[15:00]

CHAIR: I welcome the representative of the Crime and Misconduct Commission Queensland to the table. Although the committee does not require you to give evidence on oath I remind the witness that this hearing is a legal proceeding of parliament and warrants the same respect as proceedings of the House and the Senate. The giving of false or misleading evidence is a serious matter and may be regarded as contempt of parliament.

The evidence given today will be recorded by Hansard and will attract parliamentary privilege. I invite you to make some brief introductory remarks before we proceed to questions.

Ms Florian : Thank you for the opportunity to give evidence. The Crime and Misconduct Commission Queensland is a law enforcement agency created by the Crime and Misconduct Act 2001. Its functions include to raise the standards of integrity and conduct in units of public administration through its misconduct function and to investigate major crime referred to the CMC by the Crime Reference Committee. Types of major crime that may be referred to the CMC include terrorism; criminal paedophilia, with a specific focus on offenders who use the internet for peer-to-peer distribution of child exploitation material; and organised crime of a high threat to Queensland and Queenslanders. We also assist the Queensland police to investigate particular incidents of serious crime through the use of investigative hearings—mostly homicides, Weapons Act offences and outlaw motorcycle gang matters. We also have a function to help prevent major crime and misconduct. We do this by, amongst other things, analysing intelligence gathered in support of our investigations into major crime and misconduct and reporting on ways to prevent major crime and misconduct.

On 8 July 2009 the CMC was declared an eligible authority within the meaning of the Telecommunications (Interception and Access) Act. This declaration gave the CMC the ability to apply for telecommunications interception warrants. But it has only been since May of this year that the CMC has first intercepted data under the Telecommunications (Interception and Access) Act, and so this is an area in which we are only just starting to understand the significant challenges facing data interception agencies.

At a macro level we perceive that the most significant challenges for the CMC moving forward are the challenges associated with: our current inability to obtain a complete picture of a target's communication network and capability. For example, if we were to receive information about a Queensland police officer who was alleged to have corrupt contact with an organised crime figure we would undertake the necessary checks of telephones concerned. If that failed to identify any evidence of connection then an investigation would not proceed, notwithstanding that we are aware that there are several ways in which that communication may have taken place; the use of anonymised networks and darknets to commit child exploitation, drug importation, trafficking offences and money-laundering offences; how to deal with increasing encryption, particularly in circumstances where encryption is increasingly the default setting and, consequently, the decoding implications in dealing with diverse Australian and international network and software service providers; dealing with short and/or inconsistent data retention practices; and, finally, how we cope with the increased and increasing data volumes—how to capture the relevant without drowning in the irrelevant.

At a micro level, we are particularly concerned with our current inability, under the Telecommunications Act, to communicate telecommunications data to the Queensland Police Service for the purpose of commencing disciplinary proceedings against its officers. Our misconduct investigations often capture telecommunications data that support disciplinary offences against police officers. The inability to communicate this data means that disciplinary proceedings will never be undertaken against these officers, despite having obtained evidence to conduct warranting disciplinary action. There is also our current inability under the Telecommunications (Interception) Act to disseminate lawfully intercepted information to public-sector agencies, police and public service for the purposes of obtaining a disciplinary declaration in circumstances where those who are the subject of misconduct investigation resign prior to facing disciplinary proceedings, and the lack of clarity under the current Telecommunications Interception Act around the communication of lawfully intercepted information in the event of a genuine emergency that constitutes a serious threat to life or property.

With regard to all of these concerns, the CMC would welcome legislative reform that achieves a balance between the protection of individuals' privacy as set out by the national information privacy principles and the need to target offenders who deliberately use telecommunications technology to harm others and to evade detection whilst doing so, to provide a lower uniform threshold maximum imprisonment term for a serious offence, to provide consistent information retention standards and time periods for data retention, to provide legislation solutions of a single warrant that can cover multiple communication technologies and that is flexible enough to deal with technological changes currently facing law enforcement agencies—for example, dealing with targets who use multiple services and devices across a wide range of media and across multiple network providers, or attempting to intercept unlawful material such as child exploitation material exchanged by darknets and anonymizers—and to allow for a great flexibility with regard to sharing lawfully intercepted information between law enforcement and public-sector agencies when dealing with individuals facing disciplinary proceedings as a result of allegations of misconduct.

I am happy to answer any questions that arise out of the CMC's submission or this opening statement. I will flag that if, at an appropriate time, you would also like to hear detailed case studies in respect of increasing use of encryption, inconsistent data retention capabilities and information sharing with other agencies, then I am able to go in camera in order to do that. I can also flag that I am in a position to brief you, should you wish, on the use of darknets and anonymizers. I accept that there is a lot on the public record already in relation to those issues, but I would prefer to go in camera in order to do so.

Senator BRANDIS: It seems to me that the issue with which you are most concerned in your submission is information sharing between agencies, and I can understand why you say that. Perhaps I could ask you, though, about the question of a data retention regime. This is in no way a criticism, but your submission seems a little equivocal to me. Does the CMC actually have a view on the desirability or otherwise of a two-year mandatory retention regime for meta data?

Ms Florian : We do have a view. We are supportive of a much more extensive and consistent data retention regime. We do not, in effect, have one at the moment.

Senator BRANDIS: It has been suggested that it be two years. Do you have a view about that as the appropriate time?

Ms Florian : I would suggest a more significant period than that. I would suggest five years based purely on our Queensland experience and I make reference to the fact that in Queensland we have the unique offence of unlawful trafficking, which is a continuing offence. There is an offence by a similar name in other states, but that refers to the one-off incident of supply. Our trafficking offences are continuing offences, which can take place over many years, as indeed our money laundering offences do. It makes it very difficult to retrospectively identify evidence of a trafficking offence but then be unable to revisit the data that is held by carriers and capture the relevant evidence of that activity. To give you an example, if an accomplice was to say that a particular person had been trafficking in heroin for a period up to eight years, in order to corroborate the evidence of that accomplice, one of the things that ordinarily we would do would be to go and seek evidence of call charge records and the like which would tend to support the evidence of the accomplice in those circumstances. At the moment we do not have access to those sorts of records for that sort of period.

Senator BRANDIS: Perhaps informed by the Queensland experience, can you advise the committee whether the CMC has a view of appropriate safeguards?

Ms Florian : For data retention?

Senator BRANDIS: Yes.

Ms Florian : Our concerns around data retention are based on our experience about the importance of the accuracy of the data that is retained. I can talk more about that in camera if necessary, including providing a case study on that point.

Senator BRANDIS: Just to focus your thinking though, one of the areas of concern that has been expressed to us by a number of different witnesses is misuse of the retained data in a way that is in violation of the privacy of the person whose data it is. How does the Queensland regime deal with that issue, if at all?

Ms Florian : The data obviously should not be made available for just any purpose. It should be made available only for prescribed purposes, for law enforcement purposes which can be articulated.

Senator BRANDIS: Does access have to be by warrant in Queensland?

Ms Florian : No.

Senator BRANDIS: So who is the authoriser? Is it an officer within the CMC or the police?

Ms Florian : That is correct. If it were the case that we moved to a regime where warrants became necessary to do that, that would have very significant implications for how we conduct operations. It would extend the length of those operations and it would require more staff in order to conduct them. To give you some idea of the sort of figures I am talking about, there were 101 call charge records and 14 reverse call charge records obtained just on one operation that the CMC conducted last year. So, overall you would see that this has become a very necessary tool for the conduct of investigations.

Senator BRANDIS: So far as you are aware, is the regime, as it exists in Queensland at the moment in respect of the two areas you identified, more comprehensive from the point of view of data retention than that operating in any of the other Australian jurisdictions?

Ms Florian : I am unaware that it is any different to that operating in other jurisdictions. We are dealing with the same carriers that every other jurisdiction is who essentially at the moment are applying their own business and commercial interests around what they retain and what they can provide.

Mr RUDDOCK: I am anxious to deal with the in camera matters, and I wonder how you are proposing we should deal with that. I do not know if Ms Florian is going to be here for the rest of the day and we may conclude and do the in camera at the end. It depends.

CHAIR: Ms Florian, would you want to give that evidence in camera here or would you prefer to give that evidence somewhere that is perhaps more private and more secure? When we go in camera, it is not classified; we just close this place up and ask people to leave. So it is not like a classified briefing—we cannot give you that assurance.

Senator BRANDIS: But we would not publish the Hansard.

CHAIR: No, we would not.

Ms Florian : No, I am satisfied that I could do it here.

CHAIR: If we could clear the room, we will continue this in camera.

Evidence was then taken in camera but later resumed in public—