Border Protection plans to expand telco surveillance

Australian Customs and Border Protection Service has said that it would increase its surveillance of Australians' telecommunications should the mandatory data-retention legislation pass.
Written by Josh Taylor, Contributor

Australian Customs and Border Protection Service (ACBPS) is enthusiastic about the prospect of mandatory data-retention legislation passing in Australia, stating that it would likely use intercept powers and powers to access stored data more frequently should the legislation pass.

Since the last election, the powers held by Customs and Border Protection have increased significantly as the government implemented its policy of attempting to stop the flow of asylum seekers coming to Australia by boat. The department operates in a high level of secrecy in Operation Sovereign Borders, with many incidents going unreported due to the government declining to reveal so-called "on-water matters".

As a result, many of the reports about boat arrivals and incidents on offshore detention centres have been provided to journalists from sources close to the incidents, including from asylum-seeker advocates with contacts on the ground in places such as Papua New Guinea.

It was revealed on Thursday that the government referred journalists who have written up the reports of incidents involving asylum seekers to the Australian Federal Police (AFP) for investigation into where they obtained their information.

A routine part of the investigation would be for the AFP to then seek access to the call records of the journalist to see who they have been in contact with, in order to link the journalist back to the source providing the information.

These call records are exactly what the government is seeking to force telecommunications providers to retain for two years under mandatory data-retention legislation currently before parliament. In its submission to the parliamentary inquiry into the legislation, Border Protection revealed that it would use the powers to access this data more frequently should the legislation pass.

"Access and use of stored data is of particular importance to ACBPS to identify previously unknown persons of concern, to disrupt criminal or national security threats, and to support investigations into breaches of Australian border laws," the department's CEO Roman Quaedvlieg said.

"The changing nature of the work of ACBPS and the future Australian Border Force to target criminal networks, and focus on counter-terrorism, and the government's expectation that the ABF will significantly enhance the Commonwealth's investigative and enforcement capability, will likely increase our use or reliance on telecommunication interception powers and telecommunications data."

This comes despite the Attorney-General's Department dismissing concerns that journalists' sources would come under threat by the new legislation. The department claimed in its own submission that "legitimate whistleblowers" would be protected by existing whistleblower legislation.

Telcos want costs covered

Australia's two largest telecommunications companies, Telstra and Optus, both called on the government to assure that the cost for them to implement mandatory data-retention schemes would be covered.

Telstra said the upfront capital costs for complying with the legislation would be "significant", because the company would need to build a centralised platform to extract, store, retrieve, and process the data.

The government has yet to specify the exact set of data telecommunications that companies would be required to retain, and it would be set by regulation from the attorney-general, rather than in legislation. Telstra said that there should be long-term certainty on the data set to minimise the compliance burden and costs.

Optus said it was unable to provide an estimate of the costs of the scheme due to the ongoing uncertainty over the government's requirements for the data to be held.

Once that is set, Optus said it will need to "urgently initiate" a commercial project to scope out and review the requirements to build the systems required for mandatory data retention, and it could take three to six months. Optus said that despite assurances from the government that it will meet the costs of implementing the service, it is not explicitly outlined in the legislation.

Communications Minister Malcolm Turnbull has gone to great lengths to deny that mandatory data retention will be used to chase down Australians illicitly downloading TV shows and films online, but admitted late last year to ZDNet that the data could be obtained by rights holders through a civil court process.

Telstra said public awareness that telcos hold the data for two years will lead to more court orders for Telstra to hand over the data.

"We expect to receive an increase in the number of court orders we receive to make customer data available to the courts as part of civil litigation proceedings that otherwise do not involve Telstra. These court orders can be already quite resource intensive to comply with today, as they often require the telecommunications company to interpret the data for the courts," Telstra said.

"Also, industry does not have the option of cost recovery on court orders. Telstra recommends that industry be given the ability to recover the costs arising in providing information in response to court orders."

Editorial standards