Add Category
Posted
More government agencies are accessing people's phone and internet records than originally envisaged, in what critics are describing as "authority creep".
Key points:
- Access to metadata was initially restricted to 22 government agencies, but state-based agencies have blown that figure out
- Because they are accessing metadata and not content of communications, no warrant is required
- It is not known how many agencies are now able to request metadata
Controversial laws which came into force last year compel telecommunications companies to retain metadata on their customers, including information on who you call or text, where you make calls from, and who you send emails to.
To allay privacy concerns, access to the metadata was limited to 22 specific police and intelligence agencies, such as the Australian Federal Police, ASIO and state police forces.
But a parliamentary hearing has been told that number has blown out.
"There are many more than 22 agencies," John Stanton from Communications Alliance, the industry peak body, said.
"Many state-based agencies have come forward and started using their own state-based powers to request metadata.
"Authority creep, I guess you might call it."
The Communications Alliance told the parliamentary hearing telcos are getting around 1,000 requests for metadata each day.
It is not clear exactly how many agencies are now able to request access to stored metadata.
Because they are accessing the metadata and not the content of communications, the agencies are not required to get a warrant.
Shadow Attorney-General Mark Dreyfus expressed concern, noting access to stored metadata was supposed to be tightly restricted.
"It's a specified group of 22, reduced at the time of the mandatory data retention legislation going through from the previous very wide group of around 80."
What constitutes a 'systemic weakness'?
The concerns were raised in hearings held by the powerful Parliamentary Joint Committee on Intelligence and Security.
The Committee is examining proposed laws about how agencies can access password-protected devices and the content of communications, including encrypted data.
Critics have described the 'Assistance and Access' bill as forcing companies to give the Government "back-door" access to their customers' devices and data — something the Federal Government and national security agencies refute.
The legislation explicitly prohibits companies from being compelled to build "systemic weaknesses" into their technology for the benefit of police and intelligence agencies.
But what that means has not been defined.
"A systemic weakness means different things to different companies, and different things in different circumstances," Mr Dreyfus said.
"Who is going to decide what the systemic weakness is? Is it going to be the agency or is it going to be the tech company?"
Home Affairs Department secretary Michael Pezzullo told the committee hearing that authorities and companies will work together to determine what constitutes a "systemic weakness".
He said police and intelligence agencies don't want "back doors" to be built into systems any more than the telcos or the public.
"A systemic weakness would be something which would be universal, and therefore subject to the technical capacity of someone wishing to attack that weakness, [it] would be available to all attackers.
"That is the last thing we want."
Duncan Lewis, the director-general of spy agency ASIO, also sought to reassure critics, telling the parliamentary committee his agency is only interested in a small amount of data relevant to their investigations.
"I'll describe it as similar to using a pair of precision tweezers to extract a needle from a communication haystack," he said.
"We're looking to communication providers to help us pick that needle out of the haystack."
The ABC has contacted the Minister for Home Affairs for comment but has not yet had a response.
Topics: government-and-politics, federal-government, internet-technology, computers-and-technology, science-and-technology, australia