[Crikey needs ongoing support, if only to keep Bernard Keane doing what
he does.]
Data retention scheme is being abused exactly as critics predicted
A review of the Abbott government's data retention scheme has shown it
is being widely abused by scores of bodies around the country.
BERNARD KEANE
Crikey
FEB 25, 2020
https://www.crikey.com.au/2020/02/25/data-retention-scheme-abuse/
A review of the mass surveillance scheme established by the Abbott
government six years ago has revealed how it is being widely abused in
ways voters were assured would never happen.
The government’s data retention regime, which compels communications
providers to retain personal information on service use by customers for
two years, is currently the subject of a statutory review by the
Parliamentary Joint Committee on Intelligence and Security.
When the Abbott government introduced the scheme in 2014, it assured
Australians that the unprecedented level of surveillance of their
communications metadata — which can be used to construct a detailed
portrait of an individual’s life beyond that provided by any content
they may use — would be subject to strict controls.
Its use would be limited to serious offences and a small number of
security agencies — just 22 across the state and federal governments.
Those commitments have turned out to be false.
Telecommunications companies and the Communications Alliance, the body
representing most telecommunications providers in Australia, made
submissions to the committee last year that scores of bodies other than
the 22 security agencies specified in the data retention legislation
were routinely seeking retained data.
According to the Communications Alliance, bodies such as local councils,
the Victorian racing integrity regulator, taxi bodies, a vet body and
anti-dumping agencies have used a loophole under which they are able to
request retained data from telecommunications providers, via s.280 of
the Telecommunications Act.
In evidence to the committee earlier this month, the Communications
Alliance went further, explaining “when agencies outside the 22 CLEAs
make data requests … those requests can be imprecise. Sometimes these
agencies don’t know exactly what they’re looking for or what they’re
trying to find. Often they also have difficulty interpreting the data
that they receive, come back to the service provider and try to work
their way through it.”
This has also led to the content of communications such as the URLs
users are accessing being disclosed by providers, in direct defiance of
the intended limitation of data retention to metadata only.
Then-attorney-general George Brandis notoriously made a fool of himself
trying to explain that the scheme would be strictly confined to metadata
rather than content such as URLs, but according to Christiane
Gillespie-Jones of the Communications Alliance, URLs are “sometimes, but
not always by far, being provided by providers because of the difficulty
of separating out specific data points. I suspect that the same might be
the case with location data.”
Gillespie-Jones also told the committee retained data was being obtained
for civil court proceedings, yet again in defiance of the purported
limitation of data retention for serious criminal offences.
Data that would otherwise be deleted, but which is now being retained at
the request of security agencies, is being caught by other provisions of
telecommunications legislation, and processes such as court subpoenas,
and dragged into activities voters were assured it would never be used in.
At a previous hearing, staff of the Commonwealth Ombudsman told the
committee they were also aware of over 100 instances of information
being incorrectly provided to security agencies in 2017-18, including
over 40 cases of information for the wrong period being provided and 13
cases of data not asked for.
The Ombudsman’s office also argued that it was straightforward for
security agencies to evade the requirements of the “journalist
information warrant” process, intended to provide an extra hurdle when
agencies want to obtain metadata to identify a journalist’s sources:
If an agency has a sense of who the source might be, they can get an
internal authorisation to access the potential source’s data and, in so
doing, identify those phone numbers and so forth that the potential
source was communicating with, and it may turn out that one of those is
the journalist. And so there is a way in which the journalist’s source
is identified but without accessing a journalist information warrant.
Security agencies are also routinely keeping data indefinitely
(something not prohibited by the data retention laws) enabling them to
connect data from different requests and thus assemble a richly detailed
portrait of individuals.
Each new request potentially adds further layers and connections to
existing data on targets such as whistleblowers, journalists, lawyers —
some of the recent targets of the Australian Federal Police and ASIO.
Data retention critics repeatedly warned that each of these outcomes
would inevitably result from such a scheme: that retaining user data
would prove an irresistible honeypot for non-security agencies, that
mission creep would mean the scheme would stop being about “the most
serious criminal offences” and start being about parking fines and
rubbish bins.
They warned that metadata and content could not be cleanly separated,
that journalists and whistleblowers would be the target of the scheme
and that agencies would compile data in order to construct ongoing
profiles of large numbers of people.
Those critics were ignored at the time, particularly by the media, which
only woke up to the threat posed by data retention at the last minute
and were placated with an exception that, as the Ombudsman
representatives noted, is trivially easy to evade.
It’s now up to the government-controlled intelligence and security
committee to push for fixes to a scheme that was fundamentally flawed
from the outset.
--
Roger Clarke mailto:roger.cla...@xamax.com.au
T: +61 2 6288 6916 http://www.xamax.com.au http://www.rogerclarke.com
Xamax Consultancy Pty Ltd 78 Sidaway St, Chapman ACT 2611 AUSTRALIA
Visiting Professor in the Faculty of Law University of N.S.W.
Visiting Professor in Computer Science Australian National University
_______________________________________________
Link mailing list
Link@mailman.anu.edu.au
http://mailman.anu.edu.au/mailman/listinfo/link
