CLACHERTY, Justin, Leadership Team, Future Wise

DREYFUS, Dr Suelette, Executive Director, Blueprint for Free Speech

MURRAY, Mr Angus, Chair, Policy Committee, Electronic Frontiers Australia

[15:22]

CHAIR: I welcome representatives of the organisations who made a joint submission on behalf of civil society, including Electronic Frontiers Australia, Digital Rights Watch, Future Wise, Access Now and Blueprint for Free Speech. Although the committee does not require you to give evidence under oath, I should advise you that this hearing is a legal proceeding of the parliament and therefore has the same standing as proceedings of the respective houses. The giving of false or misleading evidence is a serious matter and may be regarded as a contempt of parliament. The evidence given today will be recorded by Hansard and attracts parliamentary privilege. Do any of you have any comments to make on the capacity in which you appear?

Mr Murray : It might be prudent to note that I'm also a Vice President of the Queensland Council for Civil Liberties and a co-author of the joint councils for civil liberties submission.

Dr Dreyfus : Blueprint for Free Speech is an Australian NGO. We are a free speech organisation. I also hold an academic appointment at the School of Computing and Information Systems at the University of Melbourne.

Justin Clacherty : Future Wise were part of the joint submission headed by Digital Rights Watch and we also made a submission of our own. Separately from that, I run a small company that does electronic design and software design.

CHAIR: I now invite you to make an opening statement before we begin discussion.

Mr Murray : Before the committee is a profoundly important bill, the Telecommunications and Other Legislation Amendment (Assistance and Access) Bill 2018. This bill has a real potential to alter this country and affect future generations. This includes those who are not yet aware of the serious impact that this bill presents to the fundamental rights that Australians ought to expect and enjoy and be able to enforce. I again thank this committee for the opportunity to address the issues contained within the bill. I will welcome the committee's questions; however, as requested, I firstly wish to make a few brief comments in summary of the submissions relevant to my appearance.

This bill has the potential to profoundly impact the future of Australia and our future generations. By that, I directly mean Australian children and their children to come. It is incumbent on me and you, in your capacity as members of this committee, members of your electorates and individuals who call this great country home, to ensure that we are considering the future and the way that actions today may affect that future. In this context, our security is important. However, we must be constantly vigilant to ensure that security does not become a catchcry for the dissolution of basic human rights. Australia does not presently have a federal and enforceable human rights legislative framework. Unlike other Western democratic countries, we are lacking domestic legislation that properly implements international instruments that serve to identify and protect fundamental human rights, including an express right to free speech and privacy.

With respect, the extremely short consultation period for submissions into this bill and the rapid progression of this process is comprehensively wrong. This process has been rushed without reason and progressed without proper and prior consideration. This alone should justify the committee's serious scrutiny. Absent a consolidated and enforceable human rights legislative framework, this bill simply should not be accepted. Should the bill be passed, it is relevant to note that the joint submission by these organisations contained 38 recommendations, and these recommendations, as they were put before the Department of Home Affairs in the initial consultation on the exposure draft, have been endorsed by the UN Special Rapporteur on the right to privacy, in his submission.

In essence, our recommendations, should this bill be progressed, are broadly that further consultation should occur to allow proper expert and public scrutiny and consideration of this bill; greater judicial oversight is required on all aspects of this bill; the scope of the bill must be reduced; and there must be greater reporting obligations contained within this legislative framework. In addition to our written recommendations, we also recommend that, should the bill pass, a two-year sunset period apply and be implemented.

I welcome the committee's questions and the opportunity to elaborate on our submission, and I believe my colleagues have introductions as well.

Dr Dreyfus : Thank you for the opportunity to speak today. I'm here as one of the authors of this joint civil society submission into the inquiry. The civil society groups around Australia have come together in an effort which has been coordinated by our fellow not-for-profit NGO Digital Rights Watch. The Digital Rights Watch lead author, Lizzie O'Shea, was unable to appear here today.

Before I speak to the substance, I think it's important to elaborate on what Angus said about the processes surrounding this bill, which have thus far been really far from adequate; in fact, they've been quite poor. My colleagues have elaborated on the dismissive message it sends from governments to the community to rush things, and I note that the committee will, unfortunately, not be able to hear from a number of additional expert contributors to our submission today because of the short notice. I don't think it's a good recipe. I think that rushing things through in this way is not democracy; it's faux democracy.

Some years ago, Blueprint for Free Speech used to make regular and detailed submissions to parliamentary committees here in the Australian parliament, including this one. We stopped doing that, and we stopped doing it because we are a small organisation with limited resources and, like many community organisations we spoke to, we felt that parliament simply wasn't listening. Whether you're a fan or a foe of Donald Trump, that historic change of baton illustrates what happens when the capital stops listening. We hope that our view will be changed here today.

It is the substance of the bill that elicited the huge response from a diverse group of consumer representatives; human rights and other civil society organisations; and industry, technology and telecommunications companies. It is quite interesting to see the broad spectrum of organisations that have made submissions expressing concern about the bill. Often academics, civil society and these technology companies will be at odds on a set of issues, and yet we find so much common ground in our concern about this bill, which should say something. We urge the government not to rush such far-reaching and complicated legislation and to take all the necessary time to engage with the numerous issues raised by the groups.

The Australian public has also responded, which is remarkable given the technical complexity about this bill. Nearly 15,000 people voiced their concern to the exposure draft, speaking out in defence of strong encryption and the right to communicate securely. A public survey by the Alliance for a Safe and Secure Internet shows an overwhelming majority of Australians are deeply alarmed by this bill. A significant majority—greater than 80 per cent—of people asked are concerned about the powers implied in the encryption bill which could allow the government to force companies to change their products or services to enable the interception and collection of someone's personal data without their knowledge and without the authorisation of a judge. Nearly three-quarters—greater than 74 per cent—of people surveyed are worried that the government's attempts to undertake more cybersurveillance of criminals and terrorists could make the data of all Australians, including health care, banking and other very personal information, less secure. Greater than 84 per cent of Australians polled say it is important or very important that anything the government does to combat crime should not create weaknesses in Australia's online security systems and make it easier for criminals and terrorists to cause further harm to everyday Australians.

We collectively maintain that this bill, in its current form, would legislate powers that are excessively broad, poorly defined, and lack sufficient accountability and transparency. Protecting the public from harm is a priority for all of us here and everyone who contributed to this submission. But the reality is that the bill has the potential to make Australia less safe, despite its stated objectives to the contrary.

There is forever a struggle between offensive and defensive when you consider the security of a country. But this bill substantially shifts power to the offensive camp at the expense of the defensive camp. In doing so, it also changes the balance of power in the relationship between the state and the citizen. It is a fundamental change in which the state takes away a piece of personal control over or responsibility for an individual's technological life.

I train people in cybersecurity. I train journalists, computer science students and members of the public. I'm one of a tiny piece of the movement happening across Australia to raise the cybersecurity posture of our whole society. We need dedicated engineers and educators to do this, not laws that weaken the defensive tools our society needs.

Australian institutions, universities, companies and, as you may well know, government departments get hammered by foreign cybersecurity attacks. These are well documented in the media. Building or perpetuating any holes in the defence is a bad strategy for dealing with this. Instead of trying to ram this legislation through the committee process and the parliament, the government needs to sit down with the stakeholders over time, engage in the details and collectively come up with a workable, reasonable proposal that meets the objectives of helping enforcement agencies be more effective in the digital age. Law enforcement has a plethora of tools to use, including HUMINT gathering. Instead, this bill effectively opens the door, potentially, for mass surveillance by the state, depending on its execution.

It has until now been economically relatively costly to surveil a target. This forms one of the checks and balances. It has created the right incentive: only pursue a target when there is a good reason. This bill may change the economics of that. We know from history that when a capability is enabled governments will use it whether they should or not.

The highest level question here is: why are we here? What is the purpose? The higher purpose, it seems, is to give Australians a safe and free and liberal Western democracy. That's why the security organisations exist. The security state should not become an end in itself. If you take away our civil liberties, one by one, to always expand the powers of the security state, you end up without the freedoms you were so eager to protect in the first instance—you defeat the whole purpose.

I can't imagine how hard it is to be a politician worried about keeping your citizenry safe day and night, but you have to have balance. We want security, but not at any price. North Korea is a very safe place. It's just not a place that most Australians would want to live because the freedoms we take for granted have been taken away in the name of security.

In summary, this bill overreaches, allowing too much of the state into people's private lives. The thresholds are too low and too vague. They can be abused. The safeguards are poor by design. The bill should contain some positive elements, I would argue as well, marking what spaces citizens can claim as their own, free from surveillance. There is poor accountability in the regimes in this bill, particularly those born from a lack of reporting and transparency from that.

It's illustrative that there's no comprehensive regular reporting and transparency regime to the public in the bill. We want to know, and you elected officials should be told each year, how many requests are made; how many are approved; how many expired; how many are renewed; how many are rejected; how many people are targeted? What's the average length of time of surveillance? These are all very important public figures that should be reported regularly and on time so we can understand, if there is a surveillance regime in place, how it is working and how it is impacting. We note that under the previous Attorney-General, reporting of telecommunications intercepts has been late.

Like the reporting requirements, the bill uses vague parameters. Terms like 'systemic weakness' or 'vulnerability' are wafty.

There is a cost associated with this proposed bill. It will be the companies who bear this initially, but ultimately it will end up being passed on to consumers, as these costs are. One wonders whether we should be paying government to compromise our privacy rights and our security. This bill intrudes upon consumer rights. Consumers have a right to a secure product which is transparent in its security and which doesn't hide known secret flaws in some fashion.

I have one final point, which as far as I know has not been made in the public debate thus far. It is broader point. If Australia goes down this path, it facilitates other less rule-of-law countries potentially to follow. These countries have fewer human rights safeguards than Australia. Mandating law enforcement agencies having the ability to access or compromise secure communications is a slippery slope. One degree of compromise inevitability leads to another, greater degree. It's a slippery slope because any given country's adoption of such a mandate uses the country's analogous adoption as a justification for their own. In other words, they argue that Australia is doing it so it must be a good or acceptable thing to do. Other countries may therefore follow suit. Some of these countries don't have Australia's rule-of-law culture, which provides at least minimal protections. So when Australia does it, a number of its South Pacific or Asian neighbours may do it as well. In these countries, without the same protections, this lack of safeguards may cause rampant abuse. If you truly want to be a leader in the Asia-Pacific region, you need to understand this. You need to act as though your new domestic law creates signals and models for your developing neighbours. Although Australia primarily adopts laws to protect and advance its own interests—the bill is portrayed this way—Australia has an interest in seeing democracy and freedom in other countries, particularly in Asia-Pacific neighbours. Doing so provides a different sort of security for Australia. This neighbourhood security is equally important. By adopting this bill, Australia will, on the contrary, contribute to unfree countries' lack of freedom by helping them to justify their own surveillance or persecution of anyone they feel threatens them. That might be journalists or human rights activists or such people. There are many unintended consequences of this rushed bill, all of which are a good reason to walk back from passing it at this time. Thank you.

CHAIR: Thank you, Dr Dreyfus. Mr Clacherty?

Justin Clacherty : Thank you for the opportunity to speak today. I echo the concerns of Suelette and Angus in much of what they've said. I would also like to take the opportunity to express my disappointment with the way in which this bill has been drafted and the accompanying consultation process. The bill was drafted with no consultation with civil society and, on reading it, likely with no consultation with experts in the field, whether academic or professional. The department requested feedback on the draft bill, giving little time for adequate investigation, analysis and written communication of the details and ramifications of such far-reaching legislation. Despite this, almost 15,000 individuals and organisations made submissions to the department.

The overwhelming majority of those submissions voiced grave concerns with the bill and recommended it be scrapped. Less than two weeks afterwards, a largely unchanged bill was rushed through the lower house and put to this committee for further review and submissions. The time frames for this review are also quite rushed. This process makes a mockery of the consultation process and shows a complete disregard, bordering on contempt, for the constituency of this parliament.

While we are privacy advocates, we would like it to be noted that we are not privacy absolutists. We respect the work of law enforcement agencies and understand that at times they need particular tools to do their work. In fact, I have previously helped develop hardware and software surveillance solutions which are used by agencies at all levels within Australia and a number of its allies. However, we believe that these tools should be made available to them only when proven to be both necessary and proportionate, and only under a strictly transparent system with judicial oversight. The bill falls short on these requirements. Additionally, this bill, when coupled with the more than 70 national security bills passed since 9/11, have drastically changes the relationship between citizens and the state. We are citizens, not suspects.

As to the bill itself, it presents significant issues with respect to human rights, particularly privacy. In a country where there are no enforceable human rights at the federal level, these powers have very weak oversight or accountability, which is unacceptable in a Western democracy. In addition, it presents what we believe are significant threats to the economy and jobs, specifically in the technology sector, but more broadly in the trust that can be placed in transactions in a digital economy. It is also worthwhile to note that encryption is not just used in technology and banking sector. Industry is heavily reliant on encryption in sectors such as banking, finance, energy, mining and agriculture. The scope of the bill encompasses any company providing a digital service. The scope of a service goes so far as to encompass something as simple as a website. This broad scope includes small businesses and individuals whose already stretched resources could be seconded to carry out the wishes of law enforcement agencies. It also risks investment in Australian technology companies from sources local and abroad and the ability of Australian companies to sell into markets like the European Union.

From an information security or cybersecurity perspective the bill poses significant risks, so much so that it likely presents a greater risk to national security than it purports to resolve. Law enforcement agencies can ask for details and even source code of systems in an effort to uncover unknown vulnerabilities or zero days, which will almost certainly never be reported back to the companies involved. These vulnerabilities are equally and inevitability likely to be used by criminals and state-sponsored hackers to attack the same systems. In addition, the bill allows agencies to order technical capability notices to force companies to create tools or vulnerabilities to allow these agencies to access systems. The explanatory memorandum notes TCNs will not require a company to create systemic backdoors, yet this is exactly what the bill requires. It has no clear definition of a system, and the scope of those affected is unlimited. It clearly does not take into account the way modern systems are designed, tested and deployed at scale, and it will almost certainly affect the user base of such systems, not just the intended target.

It is clear from reading the bill that the department has either not consulted with anyone in the information security field, let alone experts, or, if they have, they have completely disregarded their input. This bill requires significant rework and time should be taken to assess the economic and security implications of any new drafts put forward. Additionally, stakeholders such as civil society and information security experts should be involved in the process. It is in fact our view that no such legislation be presented until there is enforceable human rights legislation at the federal level through which this, future and previous legislation and actions by the government can be held accountable. I welcome questions.

CHAIR: Thank you for those comments. Am I characterising your position fairly if I were to understand that you would rather the bill not go ahead at all?

Justin Clacherty : In its present form, certainly.

Dr Dreyfus : Yes.

Mr Murray : That's correct.

CHAIR: What I hope to get is a sense of how you would improve this bill now to the point where you would be happy with it. I've got your recommendations here, but just on the public record it would be good hitting the main issues that you have with the bill.

Mr DREYFUS: I need to put on the public record that despite our shared surname, Dr Dreyfus and I are not related, although we have met previously in a professional capacity.

Mr Murray : If I might answer your question, Chair, I take it back to the points I iterated before. There are essentially five aspects, and under each aspect there are a number of sub-aspects, which I'm happy to go through as well. The bill shouldn't go ahead without further, clearer and more transparent expert and public scrutiny. The whole process to date has been rushed. I think that's apparent on everything that has been said by my colleagues and in the large number of submissions that are presently before this committee.

The second aspect is to do with greater judicial oversight. I appreciate that that question has been elaborated on today. I am happy to elaborate on that extensively. Judicial oversight should cover all aspects of the bill.

The scope of the bill should be reduced. As I understand, the intention that sits behind it is the necessary protection of the Australian public from terrorism, sex offences et cetera—the most heinous of crimes. The scope of the bill is significantly broader than that.

There must be significant increases in the reporting obligations that sit under this bill. This bill has the potential, in a country where there is no federal enforceable human rights legislation, to be misused in atrocious manners. I don't say that that is likely under the current situation we sit in. As I said in submissions before, the concern that I have about this is for the future. It is one of steps being taken currently and post 9/11 that may be irretrievable later on down the track. Whether that is in the best interests of Australia in future is a question that I leave to the committee.

Finally, as I said, if the bill were to pass, there should be a two-year sunset, or a period at least from implementation, so if there were issues discovered in the process of comprehensive and candid reporting, that could be addressed. I'm happy to take questions on any of that. I must disclose that I have a legal background. My colleagues mentioned their backgrounds. I have a legal background, and I'm happy to take questions on any aspect of that.

CHAIR: I appreciate that all three of you put a philosophical context around your position, which was helpful. As a Liberal, I'm sympathetic to most of that, by the way. The problem we have has been expressed by the police commissioner this morning: over 90 per cent of the data being lawfully intercepted by the AFP now uses some form of encryption. So the challenge going forward is, how do we disrupt terrorist plots, child sex offenders and the like, especially when by 2020 almost 100 per cent of their communications are likely to be encrypted? That's the question before us. That's the challenge. I'm very interested in your view on how we go about that in a way you would find satisfactory.

Mr Murray : May I take that then allow my colleagues to elaborate on any aspect that I miss? I'll quote from the UN special rapporteur on the right to privacy in response to exactly this question. 'These statistics do not comprise either evidence or argument. Though encryption may affect 90 per cent of ASIO's priority cases, it needs to be asked whether the necessary information or evidence was obtained through other means and whether the information was actually material to the matter at hand. The Department of Home Affairs and ASIO can already access encrypted data with specialist decryption techniques or start or end points where the data is not encrypted.'

To continue to answer your question, with respect to that first concept, I suppose the genesis of this is necessity. I don't quarrel with the fact that some step is necessary to safeguard Australians. But that shouldn't be dealt with in isolation. If security becomes the ultimate prerogative, we dissipate human rights. It needs to be dealt with in more than just necessity. It needs to go to two other points, in my respectful submission: is it an adequate solution to achieve a certain end? And is it proportionate to the reasonable expectations of the Australian community?

I'll expand slightly on each of those concepts—adequacy and proportionality. This has been a rushed process. This is a concept that was introduced, I believe, in 2016 by the former Prime Minister and the former Attorney-General as a war on maths. To my knowledge there was no consultation process that involved civil society in the drafting of the bill. The exposure draft had a limited period of review from experts, industry and civil society. The process that leads to this hearing today has also been expedited, with no real reason provided. The adequacy is something that could be opened up by further consultation with the tech industry, civil society and interested stakeholders. To that, I say there are other means to achieving these end points. There is ample evidence—and I believe the UN special rapporteur deals with this evidence—where education may simply be the key. These tools exist. Law enforcement is simply not educated to understand the means with which they might achieve these and certain outcomes. That's the concept of adequacy..

Proportionality is a difficult concept to deal with in the current climate. We don't have human rights legislation. We are not the United States; we don't have a bill of rights. We're dealing with this in a situation which is essentially a vacuum. The proportionality that sits on this relates to the future. I would struggle to say that this is something I would be comfortable saying to the children of the future: 'Sorry, everything and anything you do can, without your knowledge, be subject to government scrutiny'. I think that is a dangerous path to follow without there being a check and balance that sits over the top of that, and that is exactly the purpose of our judiciary. To cap off and slightly further elaborate on that point I quote from the decision recently handed down by the European Court of Human Rights, Big Brother Watch v United Kingdom:

Review and supervision of secret surveillance measures may come into play at three stages: when the surveillance is first ordered, while it is being carried out, or after it has been terminated. As regards the first two stages, the very nature and logic of secret surveillance dictate that not only the surveillance itself but also the accompanying review should be effected without the individual's knowledge. Consequently, since the individual will necessarily be prevented from seeking an effective remedy of his or her own accord or from taking a direct part in any review proceedings, it is essential that the procedures established should themselves provide adequate and equivalent guarantees safeguarding his or her rights. In a field where abuse is potentially so easy in individual cases and could have such harmful consequences for democratic society as a whole, it is in principle desirable to entrust supervisory control to a judge, judicial control offering the best guarantees of independence, impartiality and a proper procedure.

I emphasise that quote for the committee.

Senator McALLISTER: I'll try to keep it very brief, because we're running against the clock. Thanks very much for your submission. I note your remarks about having limited resources. It is very important that civil society participates, and we're grateful to all of your organisations for making submissions. Dr Dreyfus, you spoke about law enforcement in the digital age, and that is a nice way of encapsulating the dilemmas the chair referred to. I want to test an idea that you've put to us: that this changes the fundamental balance of power between the state and citizens. Interestingly enough that's probably the opposite proposition to that which was put to the committee in the written submission from the Department of Home Affairs. We should test these things. In their written submission the department would tell us is that in recent times that balance has changed in favour of those who would, through the use of encryption, avoid surveillance. Their argument would be that, through this bill, they seek simply to restore the balance that previously existed. I wonder if you'd like to respond to that.

Dr Dreyfus : Yes. There are a couple of things. In the academic literature on the philosophical side of this debate there is reference to the right to whisper: do you have the right, if you go to the parish pump, to pump water and whisper to one of your neighbours without someone listening to you? I think you could say that in older times you didn't have the police surveillance capability to do that. The problem is that we live our lives increasingly in a digital world, so our whole existence in fact is on that world. Therefore data collection is much easier for the state than it would have been previously. As we have moved into that space, it's not just about data collection; it's now also about analysis—so big data, data analytics and, increasingly, AI analysis of that. You can see these things coming together in a Venn diagram, and if the state is in the middle of that, combined with their powers, the potential for abuse is very severe indeed. I would argue that if you don't want to end up in a world of Tom Cruise's Minority Reportand you don't want to have a world of predictive policing in a way that puts people in jail for thought crimes—and I don't say that's what happens now, but you could see a future that looks like that—you have to have both adequate transparency and adequate oversight, and that includes judicial oversight.

In that swinging balance it is not that there is no capability for law enforcement to investigate a target. There is. As my colleague has highlighted, there are capabilities out there that allow you to do it. I suspect there is a gap in knowledge and a gap in resources. I'm not arguing for more law enforcement, but I am saying that it is a restrictive thing in the nature of how many targets you can actually surveil. How many old-fashioned video cameras can you place in someone's house, with a due warrant, over their keyboard to know what their passwords are that they're typing in, or whatever it may be? That in itself is not necessarily a bad thing, because it is in a sense a layer of protection against mass surveillance. That's a key concern we have. It's mass surveillance, but it's also about mass security impinging by doing things like knowing that there is a fatal flaw in Microsoft Word and not releasing that to the company, and therefore to the public, to actually fix it and then exposing 23 million other people via copies of their software, because they don't have the upgraded version.

I understand where law enforcement is coming from. I don't agree that traditionally they had all-listening, all-seeing capability—that wasn't the case—but I can see that they would be very tempted by this environment where they could get the data. I'm struck by a senior former NSA official, an engineer, who went to the former head of the legal department at the NSA concerned about the pervasive technologies that were being used to, we now see, do large-scale population information monitoring—population surveillance. He said, 'You don't understand'—this is what the counsel said—'We just want the data, all the data'. It was a shock moment. I don't think for a moment that his intentions or the intentions of those of the NSA that were driving that were evil in any way, but it's like there's a loss of understanding of the rest of society, who are saying, 'Wait a minute, this is my life.' While there may be five terrorists, there are 23 million other Australian who are not and who should be afforded some independence and privacy. I guess what the committee and the parliament need to decide is where in this shifting landscape are our individual rights to reside? That's really an important question.

Mr DREYFUS: Can I say, first of all, that the committee's indebted to all of you for the very quick manner in which you've been able to put together very detailed submissions. We're also indebted to you for your oral evidence given to the committee here today. We're up against a time constraint. The committee has already announced on our website that this was to be, and has been, the first hearing in this inquiry and that there will be further hearings of the committee on dates yet to be fixed, likely to be in late October or November. Because of the time constraint, I don't wish to advance any questions to you today, but I would leave open the possibility that at a future hearing we may invite all of you to return on behalf of the groups that you represent. I just wanted to check that, subject of course to date and availability, you're all prepared to return?

Justin Clacherty : Yes.

Dr Dreyfus : Yes, very happy.

Mr Murray : Entirely, and might I also put on the record the rushed process of this is exactly the issue. Might I just emphasise that this is the issue that we're saying: this is being rushed. I wholeheartedly embrace significantly public consultation on the comments you've just made.

Mr DREYFUS: Heard and understood.

Dr Dreyfus : Thank you all for listening to us today. It makes a big difference.

CHAIR: Thank you for taking the time to come and speak with us. I don't think there are any questions on notice, but if you would be prepared to come back to us and perhaps more of the detail of the bill itself. So, thank you once again for appearing today.

Mr Murray : We appreciate it. Thank you Mr Chair.

Justin Clacherty : Thank you.

Dr Dreyfus : Thank you.

Committee adjourned at 15:58