The Battle for Privacy Intensifies in Australia
By Rebecca Bowe | EFF | August 31, 2012
Australians are fending off threats to their right to privacy from all directions. First, there was Australian Attorney General Nicola Roxon’s push to expand government online surveillance powers, submitted to Parliament in a package of reforms sought in a National Security Inquiry.
Then, on Aug. 22, the Australian Senate approved the Cybercrime Legislation Amendment Bill 2011, granting authorities the power to require phone and Internet providers to store up to 180 days worth of personal communications data. The purpose is to aid in investigations by both foreign and domestic law enforcement agencies, making it especially controversial since it can result in granting foreign governments access to Australian citizens’ communications data. The legislation only allows for data retention in the cases of specifically targeted individuals.
The bill is based on the Council of Europe Convention on Cybercrime – which we’ve flagged in the past as one of the world’s worst Internet law treaties – and the passage of the bill opens the door for Australia to join the Convention.
At least we can welcome the news that one of the most controversial aspects of Roxon’s National Security Inquiry proposal, a vague mandatory data retention provision that would have required service providers to retain all users’ communications data for up to two full years, seems to have been placed on hold – for now, anyway.
Yet at the same time, the newly approved Cybercrime Legislation Amendment Bill 2011 is viewed by some in Australia as a kind of “data retention lite,” and a precursor to the mass, untargeted surveillance that the more extreme proposal may yet usher in. An outcome of the approval of this bill, after all, is that providers will now have to install systems enabling data retention for up to 180 days – and pay for it themselves.
Public Fights Back
Despite the steady march toward expanded online snooping powers for law enforcement in the name of “national security,” a hefty pile of submissions landed in Parliamentary chambers last week, reflecting strong public opposition to the proposed reforms. A total of 177 submissions, representing thousands of individuals and organizations, flowed in to the Joint Parliamentary Committee on Intelligence and Security even though the government allowed only a brief time frame for comment.
Below, we collected some reactions of various Australian stakeholders who drafted lengthy submissions to convey their serious concerns. Civil liberties advocates aren’t the only ones worried about where this is going. The Australian Mobile Telecommunications Association and Communications Alliance, a telecom industry group, also chimed in to express concerns about costly new requirements for telecoms that would come attached to these surveillance measures. Since data retention disproportionately burdens smaller ISPs affected by requiring expensive equipment upgrades, the measure has the potential to hamper innovation by discouraging new startups from entering the market.
Re: Making it a Crime to Refuse to Aid in Decryption
One of the worst ideas contained in the National Security Inquiry package is the creation of a new crime under the Telecommunications (Interception and Access) Act of 1979: Refusing to aid law enforcement in the decryption of communications. That interception law granted law enforcement agencies, such as the Australian Federal Police (AFP) and the Australian Crime Commission (ACC), the ability to legally intercept communications for the first time. Reactions to the proposal hinged on the threat it poses to Australians’ right to silence.
Senator Scott Ludlam, speaking on behalf of the Australian Green Party, had this to say:
While the integrity of Australianʹs right to silence has been damaged by the anti‐terrorism laws, with regard to other criminal offences it remains intact. This proposal further degrades the right to silence, presumably to pre‐trial investigations and undermines the privilege against self incrimination. … The Committee should oppose this proposal as a serious erosion of the legal and human rights of Australians.
Electronic Frontiers Australia, a digital civil liberties organization (which is not formally affiliated with EFF), pointed out a number of problems with this idea:
EFA is concerned about the possible creation of an offence for failing to assist in the decryption of communications for the following reasons:
- it undermines the right of individuals to not cooperate with an investigation
- it poses a threat to the independence of journalists and their sources, particularly in circumstances involving whistle-blowing activity related to cases of official corruption
- it could undermine the principles of doctor-patient and lawyer-client confidentiality and other trusted relationships
- there are foreseeable and entirely legitimate circumstances in which decryption of data is not possible, such as where a password has been forgotten and is unrecoverable.
EFA therefore believes that the Committee should reject this proposal.
Re: Extending the Regulatory Regime to “Ancillary Service Providers”
A discussion paper submitted as part of the National Security Inquiry proposal makes it clear that the Australian government is “considering the need for a new interception regime that better reflects the contemporary communications environment,” i.e. a total overhaul of existing legislation to allow law enforcement to pry into communications taking place over platforms like Facebook or Twitter. The discussion paper defines “ancillary service providers” as “Telecommunications industry participants who are not carriers or carriage service providers.” Ultimately, this suggests the government is angling to bring all forms of online communications into the reach of interception laws.
The Australian Privacy Foundation cited the privacy concerns inherent in this proposal.
Telecommunications legislation already goes much further than regulation in most other sectors in mandating a role for private sector businesses as agents of the state in surveillance and law enforcement (banking and finance is the other main area where this has happened). These proposals would see a further significant extension of this role. Online intermediaries in particular host our communications with our friends, relatives, co-workers etc. They host a vast amount of information, the volume and scope of which is growing exponentially as we move to the cloud, use social networks, etc. Using online intermediaries as an agent of the State dramatically impacts on the state’s surveillance capabilities. Even minor changes in what they are required to do on behalf of government agencies can have very broad implications for people’s privacy.
Ludlam, of the Australian Greens, also blasted the idea.
The Attorney Generalʹs paper does not explain how covering ʹancillary service providersʹ – the many and ever increasing forms of social media – in legislation will address ʹcurrent potential vulnerabilities in the interception regime that are capable of being manipulated by criminalsʹ. The Greens believe it is excessive to extend the reach of surveillance into the retention of all social media exchanges. Does this include all business exchanges on video conferencing platforms?
And EFA pointed out that this proposal could expose anyone to law enforcement scrutiny, not just people suspected of wrongdoing.
Central to many of the services that Australians deliberately sign-up for— e.g. Facebook, Twitter, Pinterest, Apple iCloud, etc.—is the concept of sharing across networks. In surveilling a target’s activities in such services, shared friends or media objects connect target and non-target individuals such that following one surveillance target inescapably involves collateral surveillance necessarily breaching the privacy of non-targets. …. Indeed, “cloud computing” itself underlies “social networking”. As such, the information flows pertaining to individuals cross and recross such services to the point where, again, separating surveillance of a particular target is almost inevitably going to encounter that of other individuals, but in this case in ways that cannot be anticipated and very deeply undermine Australians’ reasonable expectation of privacy.
Related articles
- Roxon edges towards keeping online data for two years (smh.com.au)
- Roxon backs new online data powers (theage.com.au)
- Australian Government Moves to Expand Surveillance Powers (alethonews.wordpress.com)
- Australian customers could pay for govt spying (zdnet.com)
Australian Government Moves to Expand Surveillance Powers
By Rebecca Bowe | EFF | July 17, 2012
Australia is the latest democratic nation to introduce new national security measures that would vastly expand governmental surveillance powers, following an alarming legislative pattern that’s also unfolded in the United Kingdom and Canada in recent months.
Just as EFF sounded the alarm about the UK’s attempt to move forward with a mass surveillance bill and kept the pressure on before Canada’s online surveillance bill was temporarily shelved in the face of an outcry from privacy advocates, we’re ready to join Australians in pushing back against this latest bid for greater online spying powers Down Under.
Last week, Australian Attorney General Nicola Roxon submitted to Parliament a package of proposals intended to advance a National Security Inquiry in an effort to expand governmental surveillance powers. In a 60-page discussion paper, Roxon calls for making it easier for law enforcement and intelligence agencies to spy on Twitter and Facebook users, which would likely be achieved by compelling companies to create backdoors to enable surveillance. The proposals also revive a controversial data retention regime. And an especially problematic proposal would go so far as to establish a new crime: failure to assist law enforcement in the decryption of communications.
The bulleted list of proposed reforms, which Roxon submitted to Parliament’s Joint Committee on Intelligence and Security committee, reflects a wish list of Australia’s intelligence agencies. The discussion paper proposes to revise four laws relating to the surveillance activities of Australia’s six intelligence bodies, at great cost to Australians’ civil liberties. The proposed changes are divided into three categories: those that the government “wishes to progress,” those it’s considering, and those it’s seeking advice on.
On a broad level, the discussion paper makes it clear that intelligence agencies are seeking nothing less than a radical overhaul of Australia’s wiretapping laws.[1] “The magnitude of change to the telecommunications environment suggests that further piecemeal amendments to the existing Act will not be sufficient,” the paper states, in reference to the Telecommunications Interception and Access (TIA) Act of 1979. “Rather, holistic reform that reassesses the current assumptions is needed in order to establish a new foundation for the interception regime that reflects contemporary practice.”
If approved, the revisions would amount to what the Sydney Morning Herald characterized as “the most significant expansion of the Australian intelligence community’s powers since … reforms following the terrorist attacks of 2001.” A readers’ poll that accompanied the article showed that 96 percent of respondents were opposed to any plan that would force telcos to store telephone and Internet data.
“These proposals are one of the biggest threats to the privacy of all Australians for many years,” said Nigel Waters, of the Australian Privacy Foundation and Privacy International. “Governments seem to have an insatiable appetite for more and more information about us all that is none of their business, and when history shows that they can’t make effective use of the intelligence they already collect.”
Concerned citizens have only until August 6 to weigh in on Roxon’s initial package of reforms. To have your say, go here.
The Return of Mandatory Data Retention
The proposed “OzLog” mandatory data retention policy, which Parliament rebuffed in May, sought to require Australian Internet service providers to store information about each and every individual’s web usage history for two years. EFF has been mounting resistance to mandatory data retention policies since before the European Union’s 2006 adoption of the highly controversial Data Retention Directive, and we continue to sound the alarm when similar proposals arise.
The attorney general’s paper references a “tailored” data retention scheme, which would nevertheless require providers to store data for a full two years.[2] As a point of comparison, the European Union Data Retention Directive — which has not been universally adopted and Courts in in Germany and the Czech Republic have declared unconstitutional — requires data storage lasting just six months, with the possibility of an increase to two years in certain cases.
Data retention was included under the category of proposals the attorney general is “seeking advice” on, suggesting that it might not be politically tenable to charge ahead with the controversial measure with the same zeal as before. It was the inclusion of this agenda item that drew the strongest initial responses to the proposal.
“This inquiry will likely be used to again expand the powers of spy agencies when Australians are already under a phenomenal amount of government surveillance,” said Senator for Western Australia Scott Ludlam, Australian Greens communications spokesperson. “This extreme proposal is based on the notion that all our personal data should be stored by service providers so that every move we make can be surveilled or recalled for later data mining. It comes from a mindset that imagines all Australians as potential criminal suspects, or mindless consumer drones whose every transaction should be recorded and mapped.”
Sounding a similar note, Rodney Serkowski of the Australian Pirate Party also seized on data retention as one of the most odious proposals. “It is not possible for the government to adequately ensure that the vast databases of highly personal data would not be at risk or subject to abuse of third parties,” he wrote in an email. “Indiscriminate data retention, as opposed to judicially sanctioned, targeted surveillance of a specific person for specific reason, is incompatible with human rights, and should never be considered legal or legitimate.”
New Rules for ISPs and Telecoms
The proposal would broaden online surveillance powers for Australia’s intelligence and law enforcement agencies by compelling Internet companies to make it easier for authorities to conduct digital eavesdropping efforts.[3] “The exclusion of providers such as social networking providers and cloud computing providers creates potential vulnerabilities in the interception regime that are capable of being manipulated by criminals,” the discussion paper states. “Consideration should be given to extending the interception regime to such providers to remove uncertainty.”
Yet another proposal would sacrifice the privacy of law-abiding citizens for the sake of zeroing in on criminal suspects. It calls for allowing intelligence officials to tamper with a computer belonging to an uninvolved third party who is not under investigation in order to access a targeted computer.[4]
To justify the dramatic expansion of surveillance powers, the discussion paper attempts to portray the intelligence agencies as helpless, claiming that a revolution in communications technology has rendered existing wiretapping laws outmoded and inadequate.[5] “Substantial and rapid changes in communications technology and the business environment are rapidly eroding agencies’ ability to intercept,” the paper states. “Adapting the regime governing the lawful access to communications is a fundamental first step in arresting the serious decline in agencies’ capabilities.”
No New Surveillance Powers Needed
A radical expansion of police surveillance powers is not the answer. This proposal poses a serious threat to online privacy and it’s important to keep the pressure on, just as Canadian privacy advocates pushed back against a similar bill. The revisions floated in Australia’s National Security Inquiry should be met with stiff resistance from Internet users everywhere.
“These proposed changes, if implemented in their entirety, would appear to amount to a massive expansion of surveillance activity across the entire community, accompanied by a corresponding reduction in accountability for that surveillance activity, and are therefore a potentially significant threat to the civil liberties and privacy of all Australians,” Jon Lawrence of Electronic Frontiers Australia wrote in a recent blog post.
Bill Rowlings, CEO of Civil Liberties Australia, said the Australian Government seems to have found the straw that might break the back of the growing trend towards excessive surveillance in Australia. “People – your average Joe – are at last waking up that free speech and privacy matter, and are worth fighting for,” Rowlings said. “The ‘Arab Spring’ in the West might well be fought over such freedoms, rather than freedom of association, as in the Middle East.”
Stay tuned as EFF continues monitoring this proposal.
[1] “Equipping Government Against Emerging and Evolving Threats: A Discussion Paper to Accompany Consideration by the Joint Committee on Intelligence and Security of a package of National Security Ideas Comprising Proposals for Telecommunications Interception Reform, Telecommunications Sector Security Reform and Australian Intelligence Community Legislation Reform,” Australian Government Attorney General’s Department, pp. 17
[2] ibid., pp. 10
[3] ibid., pp. 27
[4] ibid., pp. 11
[5] ibid., pp. 23
Related articles
- Every click you make, they’ll be watching (theage.com.au)
- Spies want our net data (theage.com.au)
- Government unveils huge wishlist of new surveillance powers (crikey.com.au)
- Down Under-surveillance: Australian govt seeks confidential online data (rt.com)
