Home affairs unlawfully accessed public's stored metadata, ombudsman reveals
The home affairs department ordered companies to preserve metadata and used warrants to access it “without proper authority” and twice unlawfully accessed stored communications, according to an ombudsman’s report.
In a sequel to the report revealing 116 illegal metadata searches by the ACT police, later admitted to number more than 3,000, the Commonwealth Ombudsman has declared that unlawful access by government agencies has “reduced significantly” since 2016-17.
But despite improved compliance, the ombudsman still found a litany of errors between 1 July 2017 and 30 June 2018 such as 31 instances of agencies receiving data outside the parameters of the authority, including 26 at the home affairs department.
In 2015 law enforcement agencies gained the power to access individuals’ metadata – information about a communication which does not include its content – when investigating certain offences, subject to oversight from the ombudsman.
In its latest report, tabled in parliament on Tuesday, the ombudsman concluded that agencies were “generally exercising their powers … appropriately” but highlighted lapses including:
In one instance Victorian police authorised metadata access that was “not for a permitted purpose” and in two instances authorised requests for information that included content – although “no information was received from the carrier” in those cases.
In 23 instances the Australian federal police used provisions authorising searches of information to find missing persons to gain information relating to criminal investigations.
In four instances the AFP authorising officers took “less than one minute” to assess requests, calling “into question whether the [legislative] requirements could have been met”.
In the case of home affairs, the ombudsman identified “instances where preservation notices were given and stored communications warrants were applied for by a person who was not nominated to do so”.
Despite acknowledging the breaches were caused by “a simple administrative error” the ombudsman warned of “complications … because stored communications had been obtained without the proper authority”.
“This presents a similar issue to that highlighted for the AFP, where the accuracy of authorisations and delegations can have significant flow-on effects.”
The ombudsman found home affairs officers did not have a proper delegation to authorise metadata access on 25 occasions, twice accessed data without proper authority and unlawfully accessed stored communications on two occasions.
Three of 17 agencies audited unlawfully accessed stored communications because telecommunications carriers provided information which did not comply with conditions on the warrant or the data was not sufficiently identified as belonging to the person on the warrant.
The ombudsman said that – despite carrier error – it is “the agency’s responsibility to ensure it is only dealing with lawfully accessed stored communications” and that information should be quarantined until they determine it is lawful to access it.
The home affairs department disclosed that it gave a series of 56 historic domestic preservation notices to the same carrier over consecutive periods relating to the same person – a practice the ombudsman found had in fact occurred 100 times.
While the practice is not “strictly in breach of any legislative provision”, the ombudsman noted home affairs “is not authorised to give ongoing notices because it is not an interception agency”.
Similarly, the AFP gave five consecutive foreign preservation notices in response to a foreign country’s request to keep information to enforce a foreign law, using consecutive notices to overcome lack of authority to give an ongoing notice.
The ombudsman also found that “a number of agencies … have accessed telecommunications data outside an authorisation made under the [Telecommunications Interception and Access Act]”, relying on an “alternative legislative basis” and putting them outside its oversight.
The ombudsman did not find any compliance issues in 2017-18 relating to access of journalists’ metadata, which requires a warrant. In 2017 the AFP admitted an officer unlawfully accessed a journalist’s call records without a warrant.
The breaches of metadata laws by WA and ACT police, first reported by Guardian Australia in July, did not result in any disciplinary consequences, with top cops in both jurisdictions blaming administrative oversight.
In the ACT, the director of public prosecutions concluded that illegally accessed metadata – although included in one brief of evidence for a prosecution – was not relied on to obtain the conviction.