Aust MPs seek URL ban in data-retention proposal

The controversial data-retention proposal could be altered to specifically exclude web-browsing history in a move to allay public outrage, according to Attorney-General's Department secretary Roger Wilkins.

Department officials appeared today before the Joint Committee on Intelligence and Security to discuss wide-ranging proposed changes to telecommunications-interception legislation, but the entire two-hour hearing was devoted to a subject that only got just over two lines in the discussion paper for the proposal: data retention.

The proposal would see telecommunications customer "non-content data" retained for up to two years, so it could be obtained by law-enforcement and government agencies without a warrant. There has been some contention over the definition of what "non-content data" is and whether that includes destination IP address, particularly after a document (PDF) released by law-enforcement agencies last month suggested that an "internet identifier" could potentially include a destination IP address. This would essentially contain the address of the site being visited.

When questioned about whether URLs are included, Wilkins said today that URL is an "unhelpful expression," and that URLs would be classified as content data and would require a warrant in order to be obtained by law enforcement. He said that the metadata definition could be altered to state that explicitly.

"In characterising what [telecommunications companies] are obliged to do, we could say, 'This does not include web-browsing material.' They are not obliged to do that, and certainly the more critical thing is that law-enforcement agencies basically cannot authorise access to that," he said.

"So I would suggest we do, just as bluntly as that, put in: 'doesn't include web browsing.' If you want metadata that divulges content, you will need a warrant."

Labor Senator John Faulkner said that part of the reason why the public has become so concerned about data retention is because not enough detail has been provided.

"There has been concern that from the kick-off of this process, there has not been any flesh on the bones about the data-retention scheme proposal. A very controversial issue manages about two and a quarter lines in a dot point on page 13 [of the discussion paper]," he said.

Shadow Attorney-General George Brandis agreed.

"I find it almost incredible that the one issue that we have identified as being of concern to us has been left obscure in the document," he said.

"What this committee wants is a clear statement that reassures us that insofar as internet metadata is sought to be retained, there is no way either directly or incidentally that the retention of that internet metadata will enable content to be retained."

Faulkner also probed the department on how long it has been testing the waters for a data-retention proposal. Wilkins said that he was not aware that the department was consulting the telecommunications industry back in 2010, but Catherine Smith, assistant secretary in the telecommunications and surveillance law branch of the department, said that industry was consulted as early as March 2010. She denied that they had been shown a policy proposal, but said that they were given a "working document."

Will Facebook and Google be affected?

On the question of how the proposals for data retention would apply to foreign companies that have users in Australia, such as Facebook, Google, and Twitter, Smith said that the legislation would seek to "make it a requirement of anyone who wants to carry telecommunications business in Australia, to keep people's information secure, and they deliver it when required to by law."

She said that in the US, there are already strong data-preservation laws that Australia has been able to take advantage of in investigating crime, and many of the companies like Google and Facebook are cooperative with Australian law enforcement.

"They are happy to retain information so long as they're satisfied that a lawful order will come along at some point," she said. "[And] we would not be seeking information from a US provider that would not be lawful under Australian law."

Wilkins said that companies' reputations will suffer if they do not work with law enforcement.