Mass metadata retention: Australia as an early adopter

"Nobody is listening to your telephone calls," US President Barack Obama said on Friday about the National Security Agency's (NSA) surveillance program that was revealed by whistleblower Edward Snowden.

"That's not what this program is about. What the intelligence community is doing is looking at phone numbers and durations of calls. They're not looking at people's names and they're not looking at content, but by sifting through this so-called metadata, they may identify potential leads with respect to folks who might engage in terrorism."

Australians tend to be proud to be known as early adopters, and we've hit the jackpot here. The controversy in the US over this so-called metadata is something that Australians are only too familiar with. It was only nine months ago that then-Attorney-General Nicola Roxon was saying very similar things to Obama about Australian government agencies looking to require telecommunications companies to keep customer data for up to two years.

"It's not to keep a record of every website that's visited. It's not to keep the content of every email. It's not to force people to give their passwords to police. It's actually keeping what's called metadata; so, a record potentially of the time that a phone call is made, the time or fact of an email being sent. Something that our law-enforcement agencies can already do, where they suspect crime."

Metadata on telephone calls can be accessed by government agencies without a warrant today, while, similar to the US system, if the agencies want the content of the communication, they will need to obtain a warrant.

Australian Federal Police (AFP) deputy commissioner Mike Phelan said in a Budget Estimates hearing two weeks ago that there is an "internal authorisation" required for agencies to get metadata from the telecommunications providers.

"That internal authorisation is done at the superintendent level, and under those three particular sections that you called out. The first one, which is the majority of our requests, has to be to enforce the criminal law. The second category is in relation to missing persons, and the third one is in relation to enforcing a pecuniary penalty order," he said.

It's a power that government agencies are not shy about using. In 2011-12, over 40 government agencies received 293,501 authorisations to access metadata. This ranges from the AFP to state police, the Australian Taxation Office (ATO), even the RSPCA, and, strangely, the Victorian Taxi Directorate. This excludes the Australian Security Intelligence Organisation (ASIO), which is exempt from reporting its activity.

AFP commissioner Tony Negus even admitted that the AFP would use this data to assess government leaks, though he said that only five out of 20,000 authorisations in the last two years related to leaks.

"It would be rare, when investigating a leak matter, that we would not use this capability," he said. "This capability is a standard investigative capability, which helps us get to the essence of whether or not something has taken place."

When questioned as to whether journalists reporting leaks would know if their call data had been accessed, Negus said that journalists are "astute" enough to get around that problem.

"No, they would not. But, in my experience, most journalists are astute enough not use their own telephones when they are doing this sort of stuff."

While the Australian regime is much more public than the US version has been, it largely went under the radar until the government made the proposal to significantly expand the supposed non-content that carriers would be required to keep, and the length of time that carriers would be required to keep it for. The storage of IP addresses and email addresses has led to concern that the non-content data can include content.

Greens communications spokesperson Scott Ludlam has said that he will introduce a Bill into parliament to require agencies to obtain a warrant before the metadata can be accessed. This will likely be resisted by law enforcement agencies. Negus told the committee investigating the proposed legislative changes around data retention last year that it would bring criminal investigations to a halt.

"If you were wanting to grind the AFP to a halt, then you should implement a warrant scheme to actually do non-content data application — because 23,000 of these would require 23,000 judges to consider affidavits for those to be prepared and for those to be granted. It is an unrealistic expectation."

It's unclear whether the AFP and other law enforcement agencies will be granted their extra powers. The committee is due to report back in the final two weeks of parliament this month. In the wake of the NSA controversy and the looming September election, it is unlikely that legislation to retain more Australian telecommunications customer data would even be considered until well after election day.