Online account takeover powers sent to PJCIS for review

Proposed laws that would hand federal authorities new online account takeover powers have been referred to the parliamentary joint committee on intelligence and security.

The committee kicked off its review of the Surveillance Legislation Amendment (Identity and Disrupt) Bill 2020 on Tuesday following referral from Home Affairs Minister Peter Dutton.

It follows calls from the Law Council of Australia last week for a “close inspection” of the proposed laws by both parliament and key stakeholders to avoid a repeat of the much-maligned encryption-busting laws.

The bill, which was introduced to parliament last Thursday, contains three new powers to bolster the investigative abilities of the Australian Federal Police (AFP) and Australian Criminal Intelligence Commission (ACIC).

One power that has gained notoriety is the account takeover warrant, which would allow the agencies to gain exclusive control of a person’s online account to gather evidence about serious offences.

According to the bill’s explanatory memorandum, this would be “covert” and “forced” – a significant departure from the current framework, where the agencies are required to gain consent.

Another power gives the AFP and ACIC the ability to add, copy, delete or alter data in an online account during the course of an investigation using a data disruption warrant.

While the powers are targeted at serious criminal activity that use anonymising technology, the bill does not make a distinction between that and all crimes that carry three or more years jail time.

This means the powers could extend to the investigation of a range of other serious offenses under the Crimes Act.

Last week, the long-awaited review of the country’s intelligence laws recommended that the AFP’s “existing power to disrupt online offending” continue in its current form.

The government disagreed with the position, however, pointing to the difficulties that authorities are now having with anonymising technologies such as virtual private networks and the dark web.

“The AFP and the ACIC should fully utilise existing powers to combat cyber-enabled crime,” the government said in its response.

“However those agencies’ current powers are increasingly ineffective against mass campaigns of cyber-enabled crime, including those that use the cover of the dark web and anonymising technologies on the surface web (such as virtual private networks).

“The increasingly large-scale use of the dark web, and other technologies that allow users to remain anonymous, to enable serious crime and terrorism is inhibiting agencies’ ability to protect the community.

“New powers should enable agencies to identify and collect intelligence on dark web targets, and to take action against those targets, whether that be through traditional investigation and prosecution, or through further disruption of criminal activities.”

Submissions to the PJCIS inquiry will close on February 12.