Chapter 2 - Overview of the Bill
2.1
The Bill seeks to amend the Telecommunications (Interception and
Access) Act 1979 (the TIA Act), the primary objective of which is to:
...protect the privacy of individuals who use the Australian
telecommunications system. The TIA Act makes it an offence to intercept
communications or to access stored communications, other than in accordance
with the provisions of the Act.[1]
2.2
The TIA Act also recognises that there are legitimate circumstances when
it may be necessary to intercept or access telecommunications, such as to
facilitate the investigation of serious criminal offences. The second purpose
of the Act therefore is to specify the circumstances in which it is lawful to
intercept or access telecommunications.
2.3
The amendments in the Bill have three key outcomes, which were the main
focus of this inquiry:
- extension of the sunset date for the network protection
provisions;
- clarification that a device-based named person warrant gives the
authority to intercept multiple telecommunications devices, and that additional
devices not identified when the warrant was issued may be added; and
- removal of mandatory requirements for state interception agencies
to provide copies of warrants and revocation instruments to state Ministers and
for the Ministers to forward these to the Attorney-General's Department.
2.4
The Bill also seeks to make some relatively minor technical amendments.
Extension of sunset clauses for network protection provisions
Introduction
2.5
Sections 7 and 108 of the TIA Act prohibit interception of telecommunications
that are 'passing over'[2]
a telecommunications system, and access to stored communications, except in
accordance with a telecommunications interception warrant.
2.6
However, an exemption is provided under subsection 5F to the employees
of a number of Commonwealth and state law enforcement and security agencies, if
they are responsible for operating, protecting or maintaining a network or if
they are responsible for enforcement of the professional standards (however
described) of the agency or authority.
2.7
Similarly, subsection 5G(2) provides an exemption to a number of law
enforcement and security agency employees in regard to the intended recipient
of a communication. These exemptions authorise these employees, who are the network
administrators of the agencies concerned, to access telecommunications passing
over the agencies' networks, without warrant, for the purposes of network
security and enforcement of professional integrity.
2.8
These exemptions have become known as the 'network protection
provisions'[3],
and are the subject of the sunset clauses that Items 1 and 2 of Schedule 1 of
the Bill seek to amend.
Background on the network
protection provisions
2.9
In 2005, the Howard Government appointed Mr Anthony Blunn AO to
undertake a review of the regulation of access to communications under the TIA Act.
In relation to access for network protection purposes, Mr Blunn found that:
...from a privacy point of view uncontrolled access is simply not
satisfactory. An access regime should be established which provides appropriate
protections and prevents back-door use and access to obtain content.[4]
2.10
Notwithstanding this, he considered there is a need for the effective
protection of agency or enterprise systems from accidental or deliberate damage,
such as against unauthorised entry (hacking) and viruses; and for developing
and testing new technologies.[5]
2.11
Consequently, Mr Blunn recommended that:
...subject to appropriate controls, access to communications
without warrant be permitted where it is necessarily incidental to the
protection of data systems or the authorised development or testing of new
technologies or interception capabilities.[6]
2.12
The network protection provisions were introduced in a government
amendment to the Telecommunications (Interception) Amendment Bill 2006 (the
2006 amendment bill). In their original form, the provisions applied only to
the Australian Federal Police (AFP). While the committee conducted an inquiry
into the provisions of the 2006 amendment bill, the government amendments were
introduced after the committee had concluded its inquiry.[7]
2.13
The passage of the Telecommunications (Interception and Access)
Amendment Bill 2007 (the 2007 amendment bill)[8]
extended the network protection provisions to cover a broader range of Commonwealth
agencies. These included the Australian Commission for Law Enforcement
Integrity and the Australian Crime Commission; Commonwealth organisations
undertaking roles in relation to security, intelligence, foreign affairs and
defence; and eligible state authorities including state police and state
integrity and corruption investigation commissions. The
sunset clauses were not amended in the 2007 amendment bill.[9]
Summary of provisions
2.14
Items 1 and 2 of Schedule 1 of the Bill will extend the existing sunset
provisions in subsections 5F(3) and 5G(3) of the TIA Act until 12 December 2009.
2.15
The Explanatory Memorandum (EM) gives the following explanation for extending
the network protection sunset provisions:
...to enable the development of a full legislative solution that
clarifies the basis on which network administrators may access communications
within their network for the purposes of network security and the enforcement
of professional integrity.[10]
Device-based named person warrants
Introduction
2.16
A device-based named person warrant is a form of 'named person warrant'.
A 'named person warrant' is 'an interception warrant issued or to be issued
under sections 9A, 11B or 46A' of the TIA Act.[11]
As explained in the EM to the Bill, named person warrants can relate to either
telecommunications services being used by a particular person, or 'a particular
telecommunications device' used or likely to be used by the person.[12]
2.17
A 'telecommunication device' is a 'terminal device that is capable of
being used for transmitting or receiving a communication over a
telecommunications system'[13],
such as a computer terminal, personal digital assistant or mobile telephone
handset. Telecommunications devices can be used to access more than one
telecommunications service. For example, it is a simple matter to change the
SIM card in a mobile telephone, allowing the phone’s user to access more than
one telephone service.
2.18
A device-based named person warrant enables an interception agency to
lawfully intercept multiple telecommunications services accessed with a
telecommunications device by a named person. However, the TIA Act currently
does not permit agencies to intercept more than one device-based warrant.
Background
2.19
Named person warrants were introduced in 2000.[14]
According to the Attorney-General's Department, these warrants were introduced
'to reflect the advances in technology which targets had taken advantage of
with the express purpose of avoiding law enforcement detection, such as the use
of multiple telecommunications services.'[15]
2.20
Device-based named person warrants were
introduced in the 2006 Amendment Bill, with its EM providing the
following explanation of their purpose:
These amendments are designed to assist interception agencies to
counter measures undertaken by persons of interest to evade telecommunications interception
such as adopting multiple telecommunications services.
The amendments will enable interception agencies to apply to an
issuing authority for a named person warrant to intercept communications from
identified telecommunications devices.[16]
2.21
Device-based named person warrants were intended to be used only when
other possibilities have been exhausted, as reflected in the conditions imposed
on their use. The EM for the 2006 Bill explained:
An issuing authority must not authorise interception on the
basis of the telecommunications device unless satisfied that the applicant
agency has no practicable methods of identifying the telecommunications
services used or likely to be used by the person of interest, or that interception
of those services would not be possible.[17]
Summary of Provisions
Items 3 to 7 of Schedule 1 of the Bill
– security provisions
2.22
Item 3 of Schedule 1 seeks to amend subparagraph 9A(1)(b)(ii) of the TIA
Act to clarify that a device-based named person warrant issued under section 9A
gives the authority to intercept 'multiple telecommunications devices.' The EM states
that this amendment is 'consistent with service-based named person warrants'.
The item will replace the words 'a particular telecommunication device' with
the words 'telecommunications devices'.[18]
2.23
Items 4, 5, 6 and 7 are described in the EM for the Bill as making 'consequential
amendments' to section 9A as a result of Item 3. These items are nonetheless
significant.
2.24
Items 4, 5 and 7 will replace the words 'a telecommunications device,
identified in the warrant' with the words 'any telecommunications device'. This
wording change means that any devices used by the person, including those not identified
on the warrant at the time of issue, may be intercepted.
2.25
Item 6 of the Bill will repeal paragraph 9A(2)(ba) of the TIA Act and
insert a new paragraph. This paragraph specifies the level of detail that must
be included in a device-based warrant sought by the Director-General of
Security.
2.26
The existing requirement in the TIA Act is that the warrant 'must
include details sufficient to identify the telecommunications device...'. Item 6
will replace these words with the words 'must include details (to the extent
that these are known to the Director-General of Security) sufficient to
identify the telecommunications devices...', a less stringent identification
requirement.
2.27
The amendments proposed in Item 6 are similar to those proposed in Items
11 and 20. They also incorporate the following features which are consistent
with the other changes in the Bill in relation to device-based named person
warrants:
- multiple devices on a single warrant;
- a less stringent requirement to identify the device or devices;
and
- devices do not necessarily have to be identified at the time the
warrant is sought, and can be added subsequently.
Items 8 to 12 of Schedule 1 of the Bill–
foreign intelligence
2.28
Items 8, 9, 10, 11 and 12 seek to amend section 11B of the TIA Act. The
changes proposed in these items are consistent with the overall intent in the Bill
of enabling device-based named person warrants to authorise the interception of
multiple telecommunications devices. The EM again notes that the changes will
make the provisions for device-based named person warrants consistent with
those that apply to service-based named person warrants[19].
2.29
Item 8 replaces the words 'a particular' with 'any', reflecting the less
stringent requirement to identify the device (as discussed in paragraphs 2.27-2.28
above).
2.30
Items 9 to 12 are described by the EM as making 'consequential
amendments...'. Items 9 and 12 replace the words 'a telecommunications device,
identified in the warrant' with the words 'any telecommunications device'.
2.31
Item 10 replaces 'a telecommunications device identified in the warrant'
with 'any telecommunications device that the person is using, or is likely to
use'.
2.32
Item 11 is a similar provision to that described in paragraphs 2.26 -
2.28 above in relation to Item 6. The item replaces the requirement to include 'details
sufficient to identify the telecommunications device' with 'details (to the
extent that these are known to the Director-General of Security) sufficient to
identify the telecommunications devices...'. As is the case for item 6, the item
reflects the changes that will authorise multiple devices on a warrant; the
less stringent identification requirement; and the addition of devices after
the warrant has been issued.
Items 20 to 25 of Schedule 1 of the
Bill – law enforcement
2.33
Items 20 to 25 seek to amend Division 3 of Part 2-5 of the TIA Act,
specifically sections 42 and 46. Division 3 of the TIA Act allows an agency (for
example, the AFP) to apply to an eligible Judge or nominated AAT member for a
warrant in respect of a telecommunications service or a person. Warrants authorised
under Division 3 are generally for law enforcement purposes.
2.34
Item 20 is similar to those described above in relation to Items 6 and
11. The EM explains that Item 20 amends paragraph 42(4A)(ba) of the TIA Act to
allow for multiple telecommunications devices to be included in the affidavit
accompanying an interception warrant application[20].
Item 20 will replace the words 'a telecommunications device' with the words 'any
telecommunications device'. The item will also replace the words 'details
sufficient to identify the telecommunications device...' with the words 'details
(to the extent these are known to the chief officer) sufficient to identify the
telecommunications devices...'.
2.35
Item 21 replaces the words 'a particular' with 'any'. The EM explains
that the amendment will allow for multiple telecommunications devices to be
included on an application for a device-based named person warrant[21].
2.36
Items 22 to 25 are described in the EM as amendments consequential to
the amendments in Item 21.
Items 13 and 14 of Schedule 1 of
the Bill – notification of telecommunications carriers
2.37
Items 13 and 14 of the Bill seek to amend section 16 of the TIA Act.
This section requires a 'certifying person' to notify the Managing Director of
a carrier when a device is to be added to a device-based named person warrant
issued under sections 9A or 11B. These items substitute the words 'a
telecommunications device, identified in the warrant' with the words 'any
telecommunications device'. The items are described in the EM as amendments
consequential to Items 3 and 8.
Item 31 of Schedule 1 of the Bill –
Notifications to the Secretary of the Attorney-General's Department
2.38
Item 31 consolidates the requirements for an agency to notify the
Secretary of the Attorney-General's Department in relation to lawfully issued
telecommunications interception warrants. Significant features of this
notification requirement are that the Chief Officer of the intercepting agency
must provide to the Secretary of the Attorney-General's Department:
- a copy of every warrant issued to the agency;
- where it is proposed to intercept additional services not
identified in a service-based named person warrant, a description in writing
sufficient to identify the services to be added to a warrant; and
- where it is proposed to intercept additional devices not
identified in a device-based named person warrant, a description in writing
sufficient to identify the devices to be added to a warrant.
Item 37 of Schedule 1 of the Bill–
notification of Managing Directors of carriers
2.39
Item 37 is important as it is one of the key amendments that will, if
passed, resolve current inconsistencies in the TIA Act, as discussed below.
Correction of inconsistencies in
the TIA Act
2.40
Several of the items in this Bill will, if passed, overcome drafting
errors which have prevented subsections 16(1A) and 60(4A) of the TIA Act from
operating.
2.41
Both sections of the TIA Act relate to the requirement to provide
carriers with descriptions of devices added to a warrant. The sections are
internally inconsistent in that they require the warrants to be in relation to
a single identified device, but also indicate that additional devices, not
identified in the warrant, can be added to the warrant.
2.42
For example, in relation to section 16, the internal inconsistency
arises in that section 16(1A) provides that a certifying person must cause the
Managing Director of the carrier to be given a description in writing of a
device not identified in a warrant as soon as practicable. However, the warrant
concerned is required to be a warrant that authorises the interception of a
telecommunications device identified in the warrant. The requirement that the
warrant has to be for an identified device means that the other conditions can
never be satisfied, and the section is of no effect. It also has the effect
that, under the TIA Act as it currently stands, it is not possible for a
device-based named person warrant to include multiple telecommunications
devices, or for devices to be added subsequent to the issuing of the warrant.
However, there are some provisions in the Act that indicate this may have been
the intention.
2.43
Item 14 (paragraph 2.37 above) will, if passed, substitute the words 'a
telecommunications device, identified in the warrant' with the words 'any
telecommunications device'. This would resolve the inconsistency. Item 37 will
resolve the inconsistency in paragraph 60(4A)(b) of the TIA Act in a similar
way.
Notifications of warrants to and by state ministers
Summary of provisions
2.44
Item 15 of Schedule 1 of the Bill will repeal paragraph 35(1)(b) of the TIA
Act to remove a current mandatory requirement for a state interception agency
to provide a copy of each warrant and instrument of revocation to the
responsible state minister.[22]
2.45
Item 17 will amend paragraph 35(1)(e) of the TIA Act, removing the subsequent
reporting requirements for the responsible state minister to provide a copy of
the warrant or instrument of revocation to the commonwealth minister (ie: the
Attorney-General).
2.46
The EM states that while the requirement for the state minister to
provide copies of warrants and revocation instruments to the commonwealth minister
was originally required as an accountability mechanism, this is now an unnecessary
duplication. The EM explains the process for ensuring that the Attorney-General
is notified of warrant issue and evocation[23]:
Originally required as an accountability mechanism, the practice
of the responsible State Minister providing copies of warrants to the
Commonwealth Minister is now an unnecessary duplication. Following the passage
of the Telecommunications (Interception) Amendment Act 2006 interception
agencies are required to provide copies of warrants and revocations to the
Secretary of the Commonwealth Attorney-General’s Department, who in turn
provides them to the Commonwealth Minister on a quarterly basis.[24]
The EM does not provide any further rationale for the removal
of the mandatory requirement for the state minister to receive copies of all
warrants and revocations.
2.47
Item 19 will insert a new subsection 36(1) that will allow state
legislation to make provision for the relevant responsible state minister to
receive a copy of each warrant and instrument of revocation, should the
responsible state minister wish to do so. However, individual states must enact
state law if the ministers concerned wish to exercise this option. Item 19 also
provides that where a state enacts such legislation, disclosure of a copy of a
lawfully issued telecommunications interception warrant to a responsible state minister
is a lawful disclosure of such information.
Background
2.48
The items referred to in this section of the report have their origins
in conclusions and recommendations made in the Report of the Review of the
Regulation of Access to Communications by Mr Tony Blunn.[25]
2.49
In that report, Mr Blunn made a number of recommendations, including
that the Agency Co-ordinator (Attorney-General's Department), rather than the AFP,
be given responsibility for maintaining the register of warrants, their issue
and revocation. This change was primarily implemented in the Telecommunications
(Interception) Amendment Act 2006.
2.50
In the process of arriving at this recommendation, Mr Blunn noted that
the NSW Attorney-General had questioned the need for state ministers to be
provided with copies of warrants, instruments and reports, as required by
section 35 of the TIA Act. Mr Blunn noted that the implications of the NSW
Attorney-General's comments were that the minister does not examine the
warrants and instruments of revocation, but relies instead on compliance reports
from the NSW Ombudsman.
2.51
While expressing apparent concern about whether the Minister was
meeting the intention of the legislation by relying on such reports, Mr Blunn observed
that 'it is difficult to see any useful purpose being served by requiring the
State Minister to act merely as a conduit' and that 'it makes even less
sense...that under the existing arrangements the Commonwealth....has already
received and actioned copies'.[26]
2.52
Mr Blunn considered that the requirements imposed by section 35 would
make sense if the intention of the state minister in forwarding the material to
the Commonwealth was to endorse it and thereby accept responsibility for the
actions of the state officers involved. He said, however, that whether or not this
was the intention of the legislation is not apparent, and that the NSW Minister
clearly did not think this was the case. Mr Blunn concluded that:
In my view if that is the intention it should be made explicit
and if not, and in the absence of some other explicit and agreed objective, the
obligation on the State Minister should be removed.[27]
Navigation: Previous Page | Contents | Next Page