George Brandis (Queensland, Liberal Party, Shadow Attorney-General) Share this | Hansard source

This is a bill to make the amendments necessary to facilitate Australia's accession to the Council of Europe Convention on Cybercrime, known as the Budapest Convention. Amendments require carriers and carriage service providers to preserve telecommunications data for specific persons when requested to do so by domestic agencies or by the Australian Federal Police on behalf of foreign countries. In addition to the Council of Europe members, the Budapest Convention has been acceded to by the United States, Canada, Japan and South Africa. The convention was tabled in this parliament on 1 May 2011 and it is the subject of a report by the Joint Standing Committee on Treaties.

The convention is the first international treaty on crimes committed either against or via computer networks. It deals particularly with online fraud, child pornography and the unauthorised access, use or modification of data stored on computers. The convention's main objective is to pursue a common criminal policy by adopting consistent legislation and fostering international cooperation.

The bill makes amendments to the Telecommunications Act 1987, the Telecommunications (Interception and Access) Act 1979, the Mutual Assistance in Criminal Matters Act 1987 and the Criminal Code Act 1995. The principal effects of the amendments are: to require carriers and carriage service providers to preserve the stored communications and telecommunications data of specific persons when required by certain domestic agencies or when requested by the Australian Federal Police on behalf of certain foreign countries to do so; to ensure Australian agencies are able to obtain and disclose telecommunications data and stored communications for the purposes of a foreign investigation; to provide for extraterritorial operation of certain offences in the Telecommunications (Interception and Access) Act; to amend the computer crime offences in the Criminal Code so that they have adequate scope; and, finally, to create confidentiality requirements in relation to authorisations to disclose telecommunications data.

The Joint Standing Committee on Treaties' report, while recommending accession to the convention, identified a number of concerns that would arise from any enabling legislation. In addition to the loss of autonomy in future domestic law reform on the issue, there are concerns about privacy and jurisdictions in particular, to which I will turn.

Dealing first with the issue of privacy, submissions to the Joint Standing Committee on Treaties complained that the convention does not contain sufficiently robust privacy and civil liberties protections to offset the increased surveillance and the information sharing powers that it implements. The powers governing the real-time collection and preservation of computer data were identified as being of particular concern. However, powers for mass surveillance activity, such as wire tapping or eavesdropping, are not enhanced by the legislation because the amendments are limited to telecommunications legislation, which requires the issue of a warrant, and do not extend to surveillance devices. Disclosure of real-time data is limited to investigations relating to a criminal offence punishable by at least three years' imprisonment. In addition, the acts to be amended by this bill contain their own fairly robust privacy safeguards and accountability mechanisms.

On the question of jurisdiction, the proposed legislation may have some effect on state and territory governments because some of those governments do not currently criminalise activity but they will be bound by amendments to the cybercrime offences in the Criminal Code. The government of Western Australia, for instance, submitted that:

It is important to note that accession to the convention should not create further bureaucracy, which could act to stifle established links between agencies, particularly those formed at a state level. WA police already have strong ties with a number of service providers in attempting to tackle cybercrime. It would be detrimental if accession to the convention were to erode those links.

I note, however, that there is a savings clause in the Criminal Code which provides that Commonwealth computer offences are not intended to limit or exclude the operation of any law of a state or territory. This clause will have continuing effect. Despite those concerns, the bill has been welcomed by the information technology sector. Given the nature of computer based offences, there is a need for a mechanism to detect and preserve evidence that is, by its nature, ephemeral and easily moved. International cooperation and mutual assistance is vital in respect of crimes that are not constrained by national borders.

The bill was referred, as well as to the Joint Standing Committee on Treaties, to the Joint Select Committee on Cyber-Safety, which reported on 18 August last year. The committee made 13 recommendations for amendments. Let me summarise them briefly: one, that the thresholds that apply to the issuing of a stored communication warrant under the Mutual Assistance in Criminal Matters Act for the Telecommunications (Interception and Access) Act for an investigation into a serious foreign offence be the same threshold as applies to domestic Australian offences; two, that the Attorney-General investigate whether the proposed part 3A of the mutual assistance act may prevent stored communications warrants being available to foreign countries for investigation into child sexual exploitation; three, that subsection 8(2) of the mutual assistance act be amended to include an additional discretionary ground to decline a request where the requesting country's arrangements for handling personal information do not offer privacy protection substantially similar to those applying in Australia; four, that the proposed section 180F of the Telecommunication (Interception and Access) Act be amended to elaborate more precisely the requirement that the authorising officer consider and weigh the proportionality of the intrusion into privacy against the value of the potential evidence and needs of the investigation; five, that proposed sections 180A(5) and 180C(2) of the Telecommunication (Interception and Access) Act be amended to ensure that, in determining whether a disclosure of telecommunications data to a foreign country is appropriate in all the circumstances, the authorising officer must give consideration to the mandatory and discretionary grounds for refusing a mutual assistance request under section 8 of the mutual assistance act; six, that the disclosure of telecommunications data to a foreign country in the context of police assistance at the investigative stage and in relation to criminal conduct that may attract the death penalty must only take place in exceptional circumstances and with the consent of the Attorney-General and the Minister for Home Affairs and Minister for Justice; seven, that the bill be amended to elaborate the conditions of disclosure of historical and existing telecommunications data to foreign countries, including in relation to retention and destruction of the information and express prohibition on any secondary use by the foreign country; eight, that the Attorney-General investigate the desirability and practicality of a legislative requirement that data subjects be advised that their communications have been subject to an intercept, stored communications warrant or a data disclosure if that advice could be given without prejudice to an investigation; nine, that the proposed new section 186(1)CA of the telecommunications interception act be amended to require that the Australian Federal Police report to the minister on the number of authorisations for disclosure of data to a foreign country, the identity of those countries and any evidence that disclosed data has been passed on to a third party; ten, that the Attorney-General consult with the telecommunications industry, statutory authorities and public interest groups to clarify and agree on the data handling and protection obligations of carriers and trade service providers; eleven, that the bill be amended to require carriers and trade service providers to destroy preserved and stored data when that information is no longer required for a purpose under the telecommunications interception act unless it is required for another legitimate business purpose; twelve, that the exemption of small internet service providers from the Privacy Act as small businesses be reviewed by the Attorney-General with a view to removing the exemption; and, finally, thirteen, that the Attorney-General's Department consult widely with carriers and carriage service providers to ensure that the bill when enacted can be implemented in a timely and efficient manner.

I will return to the last of those recommendations in a moment.

It is a matter of some concern to the opposition that the government would proceed to bring this bill before the Senate without making any formal response to the joint committee's report, which was tabled more than a year ago—that is, the report of the Joint Select Committee on Cyber-Safety, not the Joint Standing Committee on Treaties. The failure of the government to respond to that committee's report is characteristic of a government which trumpets its commitment to being open and consultative—in contrast to its admittedly chaotic, impulsive and paralysed processes—without even paying lip service to a joint select committee of this parliament on such important legislation as this. I am, however, pleased to note that the government has circulated amendments to give effect to most of the substantive recommendations of the joint parliamentary committee on cyber-safety to which I have referred. Those amendments all have the coalition's support.

However, as I foreshadowed, the joint committee's 13th recommendation—that is, that the Attorney-General's Department consult widely with carriers and carriage service providers to ensure that the bill, when enacted, can be implemented in a timely and efficient manner—is very important and must be given effect to. The Attorney-General's Department has advised that it is of the view that the legislation can be implemented within the time frame contemplated by its provisions and that, if carriers and carriage service providers are unable to comply, stopgap measures will be acceptable and the Attorney-General's Department will not insist on strict compliance.

The views expressed to the coalition by the carriers and carriage service providers is that this is a simplistic approach which provides cold comfort to them. It also fails to take into account the additional expense to which carriers and carriage service providers will be put to comply with what we are advised is a totally unrealistic time frame. We understand that these companies have in place cost-recovery arrangements with the Commonwealth and its agencies, but the government fails to acknowledge the expenses to be incurred by these companies, both in making fast-track alterations to their systems and in the assistance they provide to law enforcement agencies free of charge as good corporate citizens.

Ultimately, the coalition has been forced into a fairly unacceptable choice: to take the government at its word—always a risk with this government—or to support amendments that might further delay the implementation of important law enforcement legislation. On this occasion, and on balance, we have decided with some hesitation to take at face value the government's assurances that interim measures will be acceptable and that carriers and carriage service providers will not be put to unnecessary expense in an effort to comply with the legislation. With the lengthy passage of time it has taken the government to bring this bill before the Senate, some of those concerns have been slightly ameliorated. However, the government is on notice that the carriers and carriage service providers remain anxious about the implementation of the bill and will be bringing any departure from those assurances to the notice of the opposition and we, in turn, will be bringing them to the notice of the parliament. With those reservations, I indicate that the coalition will support the bill with the amendments that have been circulated.