Govt, agencies struggle to contain scope creep fears around surveillance powers

Australian authorities that would benefit from new powers aimed at curbing online crime were largely unable to assuage concerns that use of the powers could ultimately extend beyond what is intended.

The surveillance legislation amendment aims to create three new types of warrants for network intelligence gathering, data “disruption” (including the ability to “add, copy, delete or alter data”), and online account takeover.

At a hearing on Wednesday afternoon, representatives from Home Affairs, the Australian Federal Police (AFP) and the Australian Criminal Intelligence Commission (ACIC) faced repeated questions over the potential for scope creep.

The committee's concern is for a repeat of the scope creep seen under telecommunications metadata collection laws, where over 100 agencies used the powers to enforce all manner of state and local laws, well outside the intended use of those powers.

Parliamentary joint committee on intelligence and security (PCJIS) chair Senator James Paterson and member Senator Kristina Keneally were among those pushing the government and authorities for limits to be enshrined in the proposed surveillance law update.

“The intention of the metadata regime was to be only reserved for the most serious offending as well and we know it has been used by the proverbial dog catcher and local council parking inspector,” Paterson said.

“The committee might want to assure itself that there are really robust measures, not just in your assurances as a professional public servant but in the legislation itself that this wouldn’t end up being used for more trivial examples.

“Given these are extraordinary powers, I think it’s possible that the public would be more comfortable if they knew that it was reserved for the most extraordinary offences.”

Keneally also repeatedly pressed for more than verbal assurances and what the government argued were adequate “safeguards”.

AFP deputy commissioner Ian McCartney argued that some of those safeguards included that police “have finite resources so obviously our resources are focused on the higher end” of the criminal spectrum; and that issuing officers needed to be satisfied that a warrant was “justified and proportionate with regard to the offences being targeted”.

Both the AFP and Home Affairs also said the new warrants in the surveillance legislation amendment were unlikely to be used in isolation, and would most likely need to be combined with other types of warrants, secured separately.

“It’s very hard to imagine a situation where [for example] you will have an account takeover warrant but not some other type of warrant or [AFP] controlled operation that is happening to actually then do the activity once you’ve got control of that account,” Home Affairs national security policy branch assistant secretary Andrew Warnes said.

Keneally was unconvinced that these mostly verbal assurances went far enough.

“What safeguards beyond just pointing to capacity constraints or the good intentions of government can you point to that would assure this committee that these three warrants would not be used for other categories of crime or what would be considered by the community to be lower level offences, in terms of seriousness of the crime?” she said.

“Why is the government not willing? If you are upfront in saying, ‘We’re not going to use these powers to investigate subjectively low level offending’, why can't that be prescribed in legislation to give the community that assurance?

“That’s an issue this committee has to grapple with.”

The AFP’s McCartney said there was a “range of criminality” occurring online and that authorities wanted “operational flexibility”.

“Obviously we’re focused on serious criminality and in general those offences will be at the higher end in terms of penalties, but we do need operational flexibility in terms of the work that we do,” he said.

Both the government and authorities also argued that the powers were “narrow” in the sense that other warrants needed to be secured and operated in conjunction with the newly-proposed ones.

Warnes said that, in particular, the proposed account takeover warrant was more limited to the way it was represented by critics.

“They are quite a confined warrant in that they only allow the AFP or ACIC to take over that account to enable the collection of evidence, not to actually do the collection of evidence,” he said.

“That has to be authorised under separate powers, whether that be the AFP’s controlled operations regime or a surveillance device warrant or a computer access warrant. 

“It’s not the same as those more covert, intrusive collection powers.”