Australia Releases A Pair Of New Technology Laws

The Morrison government continues to take the lead in technology policy with new bill to expand surveillance powers.

With the introduction of last month’s “Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020” last month, the government in Canberra is once again pushing technology policy for the Five Eyes nations and others. However, in doing so, the Liberal–National Coalition is proposing a further incursion into protected and encrypted communications, apps, software, and hardware in the name of law enforcement. This new legislation follows a 2018 law that allows the Australian government to order technology companies to assist in decrypting and handing over communications. Under the new bill, some of Australia‘s law enforcement agencies would be able to use new “data disruption warrants” to stop and interfere with online crimes. Additionally, agencies could use “network activity warrants” to surveil online criminal activity and may obtain “account takeover warrants” to seize online accounts to acquire evidence in the course of an investigation.

Like the new bill, the “Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018” was enacted in December 2018. In mid-2020, Australia’s Independent National Security Legislation Monitor (INSLM) issued its report on “Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018” (TOLA). The Parliamentary  Joint  Committee on Intelligence and Security had requested that the INSLM review the statute, and so INSLM engaged in a lengthy review, including input from the public. As explained in the report’s preface, the “INSLM independently reviews the operation, effectiveness and implications of national  security  and  counter-terrorism  laws;  and  considers  whether  the  laws  contain  appropriate  protections  for  individual  rights,  remain  proportionate  to  terrorism or national security threats, and remain necessary.”

INSLM claimed

In this report I reject the notion that there is a binary choice that must be made between the effectiveness of agencies’ surveillance powers in the digital age on the one hand and the security of the internet on the other. Rather, I conclude that what is necessary is a law which allows agencies to meet technological challenges, such as those caused by encryption, but in a proportionate way and with proper rights protection. Essentially this can be done by updating traditional safeguards to meet those same technological challenges – notably, those who are trusted to authorise intrusive search and surveillance powers must be able to understand the technological context in which those powers operate, and their consequences. If, but only if, the key recommendations I set out in this report in this regard are adopted, TOLA will be such a law.

INSLM stated “[t]he essential effects of TOLA are as follows:

a. Schedule 1 gives police and intelligence agencies new powers to agree or require significant industry assistance from communications providers.

b. Schedules 2, 3 and 4 update existing powers and, in some cases, extended them to new agencies. c. Schedule 5 gives the Australian Security Intelligence Organisation (ASIO) significant new powers to seek and receive both voluntary and compulsory assistance.

INSLM found

• In relation to Schedule 1, for the reasons set out in greater detail in the report, Technical Assistance Notice (TANs) and Technical Capability Notice (TCNs) should be authorised by a body which is independent of the issuing agency or government. These are powers designed to compel a Designated Communications Provider (DCP) to reveal private information or data of its customers and therefore the usual practice of independent authorisation should apply.
• I am satisfied that the computer access warrant and associated powers conferred by Schedule 2 are both necessary and proportionate, subject to some amendments.
• I am generally satisfied that the powers conferred by Schedules 3 and 4 are both necessary and proportionate, but there are some matters that should be addressed and further monitored.
• I have concluded that Schedule 5 should be amended to limit its breadth and clarify its scope.

Moreover, as the Office of Australia’s Information Commissioner (OAIC) wrote of TOLA, “[t]he powers permitted under the Act have the potential to significantly weaken important privacy rights and protections under the Privacy Act…[and] [t]he encryption technology that can obscure criminal communications and pose a threat to national security is the same technology used by ordinary citizens to exercise their legitimate rights to privacy.”

The new “Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020” would “introduce new law enforcement powers to enhance the ability of the Australian Federal Police (AFP) and the Australian Criminal Intelligence Commission (ACIC) to combat online serious crime” according to the Explanatory Memorandum issued along with the legislation.

This policy justification is being offered for the legislation:

• Cyber-enabled serious and organised crime, often enabled by the dark web and other anonymising technologies, such as bespoke encrypted devices for criminal use, present a direct challenge to community safety and the rule of law. For example, on the dark web criminals carry out their activities with a lower risk of identification and apprehension. Many anonymising technologies and criminal methodologies can be combined for cumulative effect, meaning it is technically difficult, and time and resource intensive, for law enforcement to take effective action. Just as online criminals are constantly changing their operations and reacting to new environments, the law must adapt in order to give law enforcement agencies effective powers of response.
• Existing electronic surveillance powers, while useful for revealing many aspects of online criminality, are not suitably adapted to identifying and disrupting targets where those targets are actively seeking to obscure their identity and the scope of their activities. Without the critical first step of being able to identify potential offenders, investigations into serious and organised criminality can fall at the first hurdle. Being able to understand the networks that criminals are involved in and how they conduct their crimes is also a crucial step toward prosecution.

The memorandum contains the following high-level summary of the legislation:

• This Bill addresses gaps in the legislative framework to better enable the AFP and the ACIC to collect intelligence, conduct investigations, disrupt and prosecute the most serious of crimes, including child abuse and exploitation, terrorism, the sale of illicit drugs, human trafficking, identity theft and fraud, assassinations, and the distribution of weapons.
• The Bill contains the necessary safeguards, including oversight mechanisms and controls on the use of information, to ensure that the AFP and the ACIC use these powers in a targeted and proportionate manner to minimise the potential impact on legitimate users of online platforms.
• The Bill introduces three new powers for the AFP and the ACIC. They are:
  • Data disruption warrants to enable the AFP and the ACIC to disrupt data by modifying, adding, copying or deleting in order to frustrate the commission of serious offences online
  • Network activity warrants to allow agencies to collect intelligence on serious criminal activity being conducted by criminal networks, and
  • Account takeover warrants to provide the AFP and the ACIC with the ability to take control of a person’s online account for the purposes of gathering evidence to further a criminal investigation.

However, in using the “data disruption warrant,” the activities of the AFP and ACIC would be “covert” and these agencies could conceal their activities. And while these powers would not be used solely for the purpose of collecting evidence, the agencies may collect evidence in the course of altering, disrupting, adding, or deleting information. It seems probable that as with agencies in other nations, there will be a blurring of this line and this sort of warrant will at some point be used predominantly for collecting evidence perhaps with a fig leaf of intending to change some of the information.

In the Explanatory Memorandum, the Coalition uses the hammer of online child sexual material to justify the expansion of the government’s powers:

The purpose of the data disruption warrant is to offer an alternative action to the AFP and the ACIC, where the usual circumstances of investigation leading to prosecution are not necessarily the option guaranteeing the most effective outcome. For example, removing content or altering access to content (such as child exploitation material), could prevent the continuation of criminal activity by participants, and be the safest and most expedient option where those participants are in unknown locations or acting under anonymous or false identities.

Of course, these materials are plaguing the victims, relatives, and investigators of these crimes, but it bears note the data disruption warrant appears not to be limited to those instances. For example, cyber-crime is a massive problem, and so would this warrant be issued for those collecting, amassing, and selling credit card numbers? How about advocacy organizations that may have information on covert Australian government activities Canberra does not want exposed?

Only “eligible” judges or a “nominated Administrative Appeals Tribunal (AAT) member” may issue a data disruption warrant on the basis of an officer’s reasonable grounds that:

• one or more relevant offences are being, are about to be, or are likely to be, committed, and
• those offences involve, or are likely to involve, data held in a computer, and
• disruption of data held in the target computer is likely to substantially assist in frustrating the commission of one or more of the relevant offences previously specified that involve, or are likely to involve, data held in the target computer.

Likewise, for network activity warrants, the specter of online child sexual exploitation material is used to justify the establishment of a new criminal investigation power:

These warrants will be used to target criminal networks about which very little is known, for example where the AFP or the ACIC know that there is a group of persons using a particular online service or other electronic platform to carry out criminal activity but the details of that activity are unknown. Network activity warrants will allow agencies to target the activities of criminal networks to discover the scope of criminal offending and the identities of the people involved. For example, a group of people accessing a website hosting child exploitation material and making that material available for downloading or streaming, will be able to be targeted under a network activity warrant.

Consequently, this warrant is intended to defeat “anonymising technologies” used to mask the commission of crimes:

Network activity warrants will allow the AFP and the ACIC to access data in computers used, or likely to be used, by a criminal network over the life of the warrant. This means that data does not have to be stored on the devices, but can be temporarily linked, stored, or transited through them. This will ensure data that is unknown or unknowable at the time the warrant is issued can be discovered, including data held on devices that have disconnected from the network once the criminal activity has been carried out (for example, a person who disconnected from a website after downloading child exploitation material).

This seems to suggest this type of warrant would allow the AFP and ACIC to chase network activity, or really the data wherever it may go. Hence, if Microsoft is shuttling the data around the world data center to data center, and the AFP is holding such a warrant, it could follow these data legally from Sydney to Singapore to San Francisco.

The Coalition’s initial overview elided an aspect of this warrant that implicates encryption. Deeper in the Explanatory Memorandum, we learn:

The AFP and the ACIC will be authorised to add, copy, delete or alter data if necessary to access the relevant data to overcome security features like encryption. Data that is subject to some form of electronic protection may need to be copied and analysed before its relevancy or irrelevancy can be determined.

As a practical matter, this is how intelligence and law enforcement agencies around the world are taking on, and in most cases, circumventing encryption. But, this pushes the debate over encryption into new territory, for if even more agencies in Australia are working to disable or defeat encryption, it may be foreseeable that commercial, widely used encryption methods will be further weakened. And, as seen with the hack of the Central Intelligence Agency’s hacking tools and exploits, it is often just a matter of time before methods to defeat security in online communications are exposed.

As with data disruption warrants, network activity warrants can only be issued by “eligible” judges or nominated AAT member:

• a group of individuals are engaging in or facilitating criminal activity constituting the commission of one or more relevant offences, and
• access to data held in computers will substantially assist in the collection of intelligence about those criminal networks of individuals in respect of a matter that is relevant to the prevention, detection or frustration of one or more kinds of relevant offences.

While this warrant “will not be permitted to be used in evidence in criminal proceedings, other than for a breach of the secrecy provisions of the SD Act,” it “may, however, be the subject of derivative use, allowing it to be cited in an affidavit on application for another investigatory power, such as a computer access warrant or telecommunications interception warrant.” And so, information gathered pursuant to this type of warrant could be used for surveillance by Australia’s security services. And for this reason, the “Inspector-General of Intelligence and Security (IGIS) will have oversight responsibility for network activity warrants given their nature as an intelligence collection tool.”

The third warrant, the account takeover warrant, would “enable the AFP and the ACIC to take control of a person’s online account for the purposes of gathering evidence about serious offences.” Under current law, an account takeover may occur only with a person’s consent, and the unsaid implication is that a significant number of people and suspects are not willing to hand over control of their accounts. The threshold for obtaining this type of warrant seems lower as a “magistrate will need to be satisfied that there are reasonable grounds for suspicion that an account takeover is necessary for the purpose of enabling evidence to be obtained of a serious Commonwealth offence or a serious State offence that has a federal aspect.” What’s more, “[t]his power enables the action of taking control of the person’s account and locking the person out of the account.”

In a related development, the Department of Infrastructure, Transport, Regional Development, and Communications (Department) has published a draft “Online Safety Bill” for consultation and is accepting input until 14 February 2021. The bill would modify four existing statutes that aim to protect people online and introduce a new regulatory scheme.

The Department claimed in its press statement the legislation:

• The provisions in the Enhancing Online Safety Act 2015 (EOSA) that are working well to protect Australians from online harms, such as the image-based abuse scheme;
• A set of core basic online safety expectations for social media services, relevant electronic services and designated internet services, clearly stating community expectations, with mandatory reporting requirements;
• An enhanced cyberbullying scheme for Australian children to capture a range of online services, not just social media platforms;
• A new cyber abuse scheme for Australian adults, to facilitate the removal of serious online abuse and harassment;
• A modernised online content scheme, to replace the schemes in Schedules 5 and 7 of the Broadcasting Services Act 1992 (BSA). The Bill will create new classes of harmful online content and will reinvigorate out of date industry codes to address such content;
• New abhorrent violent material blocking arrangements that allow the eSafety Commissioner to respond rapidly to an online crisis event such as the Christchurch terrorist attacks, by requesting internet service providers block access to sites hosting seriously harmful content; and
• Consistent take-down requirements for image-based abuse, cyber abuse, cyberbullying and harmful online content, requiring online service providers to remove such material within 24 hours of receiving a notice from the eSafety Commissioner.

In a Reading Guide, the Department asserted “[t]he Bill proposes five schemes to deal with different types of harmful online material. Four already exist in law (but are being appropriately updated)…[and] [o]ne is new – the adult cyber abuse scheme:

• Cyber-bullying Scheme – Provides for the removal of material that is harmful to Australian children. This scheme reflects the current regime in the Enhancing Online Safety Act (EOSA), however reduces the take-down time for such material from 48 hours to 24 hours and extends the scheme to more services.
• Adult Cyber-abuse Scheme – Provides for the removal of material that seriously harms Australian adults. This scheme is new. It extends similar protections in the cyber-bullying scheme to adults, however with a higher threshold of ‘harm’ to reflect adults’ higher levels of resilience.
• Image-based Abuse Scheme – Provides for the removal of intimate images shared without the depicted person’s consent. This scheme reflects the current regime in the EOSA, however reduces the take-down time for such material from 48 hours to 24 hours.
• Online Content Scheme – Provides for the removal of harmful material in certain circumstances. This scheme reflects and simplifies the current regime in Schedules 5 and 7 of the BSA, with some clarifications of material and providers of services captured by the scheme, and extending the eSafety Commissioner’s take-down powers for some material to international services in some circumstances.
• Abhorrent Violent Material Blocking Scheme – Provides for the blocking of abhorrent violent material, such as images or video of terrorist attacks. This scheme is new, but mirrors existing legislation in the Criminal Code Act 1995 (the Criminal Code).

Not surprisingly, under the bill, providers of online services and materials will have increased obligations. The Department stated “[t]he Basic Online Safety Expectations (BOSE) framework is an enhancement of the basic online safety requirements, coupled with new powers for the eSafety Commissioner to require service providers to report on compliance with the BOSE.” The Department explained that BOSE “will include, in legislation, core expectations that:

• End-users are able to access services in a safe manner;
• The extent of harmful material is minimized;
• Technological or other measures are in effect to prevent access by children to class 2 materials; and
• There are clear and readily identifiable mechanisms that enable end-users to report and make complaints about harmful material.

© Michael Kans, Michael Kans Blog and michaelkans.blog, 2019-2021. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Michael Kans, Michael Kans Blog, and michaelkans.blog with appropriate and specific direction to the original content.

Image by RobertDychto from Pixabay