New police powers: Karen Middleton on the law that will empower the AFP to spy on Australians
In direct contradiction to a recommendation of a national intelligence review, the government is giving the AFP sweeping new spying powers to combat cybercrime.
The Australian Federal Police (AFP) are being given extra cyber powers to spy on Australians and disrupt computer activity, despite a warning to government that it could turn police into “judge, jury and executioner” and undermine democratic rights.
The domestic spying and disruption powers reflect those that the Home Affairs Department had originally proposed to give to the Australian Signals Directorate (ASD), Australia’s only fully cyber-capable intelligence agency.
Home Affairs envisioned having
ASD effectively embedded in corporate computer networks to protect the nation’s banks, telecommunications and other critical infrastructure.
The original ASD proposal was the subject of a report in Sydney’s Sunday Telegraph in April 2018, which led to police raiding the home of News Corp journalist Annika Smethurst.
ASD’s current mandate is strictly for operations offshore. It has limited scope to spy on Australians abroad and only in support of operations by other agencies, primarily ASIO. The proposal to broaden that remit to include onshore surveillance of Australian citizens alarmed some security analysts.
The AFP’s new powers are designed to combat criminal activity online and especially on the dark web, where encryption makes detection extremely difficult. But the move directly contradicts a recommendation of the national intelligence review conducted by former director-general of security Dennis Richardson, made public last week.
Richardson acknowledges that in seeking to prevent crime, law enforcement agencies are increasingly trying to disrupt offences as they are occurring, especially when the consequences could be catastrophic.
He said the AFP should develop a highend capability to combat cybercrime, but it should rely on existing powers and not be given a specific “disruption” mandate.
Disruption, he warned, can be too loosely defined, leading to the potential destruction of computers or other property, without proper legal process to prove an offence was being committed.
Richardson expressed strong concern police could effectively take matters into their own hands. He took aim at unnamed “officials” who he suggested were too zealous in their desire to step in.
“We are particularly concerned about empowering police officers to pass conclusive judgement and act in accordance with that judgement to destroy property,” Richardson wrote.
He said the law allows property to be seized and destroyed, but only after judicial involvement. “Police may not simply seize and destroy property that they suspect of being a proceed or instrument of crime,” he wrote.
Richardson warned that if a new disruption power was granted that could involve destroying, damaging or forfeiting property, extra safeguards should be in place involving judicial approval.
Richardson said “there appears to be a tendency for some officials to consider that ‘zapping’ computers being used in child exploitation is a reasonable response” and warned this may exceed the police’s mandate.
“Police making conclusive assessments of criminality would raise serious questions about the separation of powers, given that the courts, not police, are responsible for adjudicating criminal guilt in Australia,” he wrote. “Such a move should not be taken lightly – it is the equivalent of making the police the judge, jury and executioner.”
Although the government said his recommendation against new powers was “agreed in principle” and not among the four it formally rejected, in practice it was opposed.
“The AFP and ACIC [Australian Criminal Intelligence Commission] should fully utilise existing powers to combat cyber-enabled crime,” the government wrote in a formal response to the review. “However, those agencies’ current powers are increasingly ineffective against mass campaigns of cyber-enabled crime, including those that use the cover of the dark web and anonymising technologies.”
On Tuesday last week, the government produced the new surveillance legislation that boosts the AFP’s powers – three days before making public the Richardson review, which was completed a year ago.
The Surveillance Legislation Amendment (Identify and Disrupt) Bill gives the AFP and ACIC a specific power to “collect intelligence, conduct investigations, disrupt and prosecute … the most serious of crimes” – defined as child abuse and exploitation, terrorism, human and drug trafficking, identity theft and fraud, assassinations and weapons distribution.
The Law Council of Australia’s president, Pauline Wright, is concerned Richardson’s recommendation has been ignored.
“The Law Council considers that the reasons advanced by the Richardson review are persuasive and should be accepted, unless compelling evidence is presented publicly about significant changes to the security outlook since that review delivered its report in December 2019, which necessitate revision of its conclusions,” Wright told The Saturday Paper.
“The government response does not engage in any meaningful way with the reasoning underlying the recommendation.”
The council held serious reservations about the need for the disruption power, its breadth and “inadequate safeguards”.
Wright was also concerned there is too little oversight of newly expanded questioning powers granted to ASIO in legislation that passed the parliament on Thursday – the last sitting day of the year.
That legislation finally abolishes a draconian and unused questioning-anddetention power held by Australia’s domestic spy agency, which watchdog bodies have repeatedly said should be repealed.
But it extends other ASIO questioning powers, allowing warrants to be issued by the attorney-general, not a judge, and people as young as 14 to be questioned.
In his review, Richardson said there was a need for specialist capability in combating cybercrime. But he said the AFP was the appropriate agency and rejected the Home Affairs proposal that ASD’s mandate be extended to the domestic domain.
Richardson argued that would dilute ASD’s surveillance and cyber operations work abroad, it being the only agency with that capability. He said it would also constitute “a profound break with the principles which have stood it in good stead”. The Saturday
Paper understands ASD did not endorse the original proposal.
Richardson said that while ASD’s work should support other agencies and it “could be given a greater role onshore in combatting cyber attacks”, the AFP should be responsible primarily.
Having headed ASIO as director-general of security and served as secretary of both the Defence and Foreign Affairs departments, Richardson was particularly well placed to undertake the root-and-branch review.
He found the basic 40-year-old structures of Australia’s intelligence apparatus remain sound and relevant to today’s challenges, notwithstanding the need to update some legislation in response to technological change. But he warned that the web of laws around telecommunications interception in particular was far too complex and confusing. The government has agreed they should be replaced by a single electronic surveillance act.
Richardson calls out those inside the system who he says see the law as a burden for trying to run clandestine and urgent operations.
“One member of the NIC [national intelligence community] saw ‘legal requirements’ as a hindrance to data and information sharing,” he wrote. “The ends do not always justify the means and the referenced legal requirements are important features designed, amongst other things, to protect individuals’ rights.”
Australian National University intelligence and security specialist Professor John
Blaxland says this is an important reminder. He notes Richardson’s first recommendation is that intelligence chiefs should ensure their officers are properly trained in the “history, background and principles” that underpin the legal framework in which they operate and understand the democratic values they are upholding.
“It’s inconvenient, it’s administratively inefficient,” Blaxland says of the need to do the paperwork and follow the law. “Well, in a liberal democracy, democracy itself is inefficient. In a democracy, you accept the inefficiency because that’s the way we ensure deliberate safeguards.”
Blaxland says in making the kinds of changes the new surveillance bill proposes, “you need to have really rock-solid safeguards in place”. “I haven’t seen the evidence of a rock-solid check on that extra power.”
He warns bestowing extra wide-ranging powers on law-enforcement and intelligence agencies might erode public trust.
“In this day and age, with fake news and with our democratic rights of governance under such challenge, extra effort is required to ensure these national security and intelligence institutes do not fall prey to the erosion of their public credibility that would see their important role undermined.”