Australian communications data retention legislation

Submission to the Australian Parliamentary Joint Committee on the Telecommunications (Interception and Access) Amendment (Data Retention) Bill

1. Introduction

Over the past several years Australian parliaments have considered how legislation should enable law enforcement and security agencies to do their work in a rapidly changing communications environment. At a time when there is a heightened awareness of threats from terrorism, it is important that legislators carefully consider any new laws intended to make us safer and not pass laws that threaten freedoms that up to now we have taken for granted.

In 2012 the previous administration sought views from the PJCIS regarding data retention, with proposals relying heavily on the EU Data Retention Directive as an exemplar. Since that time, the Court of Justice of the EU has found data retention undermines the right to privacy and therefore attempting to base Australian legislation using EU law as a template no longer presents such a convincing case.

In the 2012 enquiry many respondents had serious concerns regarding data retention. These concerns have not diminished; indeed with the better understanding today of the pervasiveness of metadata, these concerns are heightened.

In 2015 we are again considering mandating metadata retention with a Bill that I believe in its current form is essentially flawed.

• Blanket mandatory data retention will fundamentally change the relationship between the government and the citizen.
  
  
• The vulnerabilities introduced by data retention will damage the state of our national security and will make Australians MORE vulnerable and LESS secure.
  
  
• In adopting data retention, Australia will be ignoring the fundamental rights to privacy and data protection as exemplified by the recent ruling of the Court of Justice of the EU.
• The Bill does not adequately test the notion of proportionality in sacrificing the privacy of citizens in order to better detect criminality.
• It will be expensive and ineffective.

I am concerned because this Bill will mandate Carriage Service Providers to retain customer metadata for a period of 2 years. This will require them to create, collect and store metadata on all customers and make it available in near real-time to Law Enforcement Agencies (LEAs) and other bodies nominated by the A-G. This metadata is in excess of what communications providers currently store for commercial purposes.

Targeted communications surveillance, undertaken by LEAs via warrant, is a necessary and effective weapon in fighting serious crime including terrorism. However unwarranted blanket data retention is fraught with dangers and represents a step change in powers that citizens would be required cede to government.

The proposals outlined in the Bill lack proportionality and if enacted will sacrifice the privacy of all Australians for no commensurate and demonstrable improvement in the capacity to detect serious offences. The capture of metadata would in theory enable automated profiling of each citizen with a chilling effect on democracy and perceived freedom of expression. Parallels with Jeremy Bentham's Panopticon are all too real. We risk sleepwalking into a surveillance society.

There is a lack of clarity in the oversight and management of the retained data and indeed the metadata itself is not even defined but left to be prescribed by regulation.

Far from making us safer, data retention will make us more vulnerable. The Bill as currently drafted will give rise to many unintended consequences.

2. It's only metadata, it's not content

The average person will generate a significant amount of metadata each day which reveals a lot about their private lives. A bit like the front of an envelope analogy?

To give you an idea of how fatuous this distinction is, the embarrassing contents of your medical records are “content” and require a warrant, but the fact that you placed a call to a GP clinic on Monday, were emailed by a pathology lab on Wednesday, Googled for pharmacies near work, and then spent the next three days trying to Skype ex-girlfriends, is metadata – and doesn’t need a warrant.

With the proposed retention period of 2 years, the metadata will become a honeypot for civil litigants who may seek court orders. This could include family law and commercial disputes.

It has even been suggested (PwC questionnaire to Communications Alliance 24 Dec 2014) that CSPs could make commercial use of the metadata they collect.

The UN General Assembly 2014 report 'Promotion and protection of human rights and fundamental freedoms while countering terrorism' makes this observation (s8.53):

By combining and aggregating information derived from communications data, it is possible to identify an individual’s location, associations and activities (see A/HRC/23/40, para. 15). In the absence of special safeguards, there is virtually no secret dimension of a person’s private life that would withstand close metadata analysis. Automated data-mining thus has a particularly corrosive effect on privacy.

3. Citizens not suspects

Mandatory blanket data retention is massive invasion of privacy and if enacted will fundamentally change the relationship between government and the citizen. It will have a chilling effect on democracy. We will all become suspects not citizens.

The idea that the government is entitled to watch all of us is fundamentally wrong. It is neither necessary nor proportionate in handling the challenges posed by terrorism and serious crime and I believe constitutes an unacceptable incursion into the civil liberties of each and every Australian.

The Bill makes no provision for the exception of professional privilege so that metadata associated with:

• lawyers and their clients
• doctors and their patients
• journalists and their contacts
• Members of Parliament and their correspondents

will be able to be collected, accessed and analyzed along with everything else.

The use of the UK's RIPA law by police to intercept journalists' phone records illustrates the problems of overreach that poorly drafted law can produce.

The Law Council of Australia does not support mandatory data retention.

4. Security

At present there are around 600 Carriage Service Providers (including ISPs and telcos) operating in Australia. The regime of data retention proposed by the Bill, with CSPs creating and maintaining their own individual databases, with the consequent lack of uniform security and vetting procedures, will inevitably result in the data being compromised at some point. It has been suggested that for cost reasons some CSPs may be compelled store the captured metadata on cloud services hosted overseas thus compounding the problem.

As evidenced by many recent well publicised examples, security breaches of this kind can have disastrous and unforeseen consequences.

Any Australian with a digital footprint (that's just about all of us) will potentially be at risk of attack from hostile groups or foreign nations. This Bill will create multiple targets for criminals to exploit stored metadata to undertake identity fraud, blackmail or just create chaos.

The vulnerabilities introduced by data retention will damage the state of our national security and will make Australians MORE vulnerable and LESS secure.

5. Effectiveness

Those who wish to circumvent the proposed law have the means to evade detection and will do so in increasing numbers if the Bill becomes law. This will inevitably result in reduced efficacy for targeted surveillance. As the Communications Alliance submission to the committee states:

“A recent search of the Apple Store, for example, revealed no fewer than 267 secure messaging applications on offer – each of which is readily obtainable and potentially able to remove the user from the reach of the proposed data retention regime.”

I understand that it is proposed that public WiFi hotspots will be exempted from the regulations thus further emasculating this ill-conceived legislation.

The US’s Privacy and Civil Liberties Oversight Board found that there is little evidence that the metadata program has made the US safer.

The Bill assumes that all CSPs will be able to undertake the complex task of designing dynamic systems to retain a changing set of communications metadata, the details of which can be modified at any time by regulatory order. I believe most CSPs will be of the view that this will entail considerable ongoing effort (not being part of their core business) and come at a significant cost. Those drafting the Bill have given insufficient weight to this issue.

6. Data retention in the EU

In April 2014, the EU’s Court of Justice (CJEU) threw out a scheme equivalent to that proposed here, noting that metadata;

“...may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environment.”

Most EU countries with the exception of the UK have or are in the process of changing national laws to reflect this judgement. European policy makers will need to think twice before proposing any data retention or mass surveillance program in the future. (Laws recently passed in the UK expanding the use of data retention run the real risk of failing to comply with the 2002 EU privacy directive and have yet to be tested).

Australia is travelling in the opposite direction.

7. Surveillance tax

The government has indicated that they are prepared to recompense CSPs for a proportion of costs incurred in meeting the requirements of the Bill. Taxpayers will pick up the tab for this. Remaining costs will be borne by ISPs and telcos who will pass this on to consumers. In the popular mind this will be dubbed the Surveillance Tax when added to their monthly bill.

8. PJCIS Hearings

As I understand it the Joint Committee on Intelligence and Security have been given until 27 February 2015 to report on the Bill. At its first public session on 17 December 2014, the A-G's department who is responsible for the passage of the Bill was still unable to provide a meaningful definition of the metadata to be captured by ISPs and telcos, without which no substantive estimates can be made regarding cost.

It is not clear whether either definitions or costing will be forthcoming before the JCIS is due to report at the end of February. How then will parliament be able to make an informed decision?

During evidence to the committee most of Australia’s law enforcement agencies were unable to say how many times phone and web data has been used to prevent serious crimes or terrorist attacks, or how many convictions resulted from requests.

The Bill proposes that the definition of metadata would be by regulatory instrument. This is vague and dangerous, with mission creep embedded in its mission statement. It is not good law.

9. Responsibility of parliament

When considering introducing laws which restrict freedoms in the name of national security, it is important that politicians do not pass knee-jerk legislation which they mistakenly believe will help the nation defend itself against terrorism and serious crime.

There are many laws already on the statue book which give LEAs the power to undertake targeted surveillance in pursuit of wrongdoers; there is little evidence to suggest that increasing the size of the haystack will result in the discovery of more needles.

Parliament needs to better test the question of proportionality before Australia embarks on a regime that will greatly erode the privacy of all Australians, introduce security vulnerabilities and impose significant costs.

The UN General Assembly 2014 report 'Promotion and protection of human rights and fundamental freedoms while countering terrorism' makes this observation (s7.51):

The related principle of proportionality involves balancing the extent of the intrusion into Internet privacy rights against the specific benefit accruing to investigations undertaken by a public authority in the public interest.

I do not see that a convincing case has been made to show that this balance has been struck.

Recent surveys have shown that 80% of respondents ‘disapprove of the Australian Government being able to access their phone and internet records without a warrant’. I do not believe that, once acquainted with the facts, the great proportion of the Australian electorate will accept the unwarranted mass surveillance implicit in this Bill.

Brian Ridgway