Press conference announcing the introduction of the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014 with Mr Duncan Lewis, Director-General of Security, and Mr Andrew Colvin, Commissioner of the Australian Federal Police

30 October 2014

Joint transcript

Attorney-General
Minister for the Arts
Senator the Hon George Brandis QC

Minister for Communications
The Hon Malcolm Turnbull MP

Subjects: Data Retention Bill, Mohammad Ali Baryalei, Coalition's Direct Action plan

E&OE

George Brandis: Well thank you very much indeed ladies and gentleman. On the 5th of August the Prime Minister and I announced an in principle decision of Cabinet to introduce a system of mandatory data retention in Australia. As the then Director-General of ASIO said at the time, access to metadata is an absolutely crucial tool for counter-terrorism. The need for a mandatory data retention regime arises from the fact that, due to changing commercial practises by telecommunications providers, metadata which has hitherto been kept and was therefore accessible will soon no longer be kept, in fact that is already happening. Unavailability of access to metadata will be a very significant degradation of Australia's counterterrorism and general crime fighting capabilities. Since that announcement, legislation has been in development in consultation with the national security law enforcement agencies, industry and other relevant stakeholders. As you know, a short while ago the Minister for Communications, Mr Turnbull introduced into the House of Representatives the Government's legislative response.

Metadata is information about the circumstances of a communication as opposed to the content of a communication. It is defined by the Bill by reference to certain types of information. The identity of the subscriber to a communications service, the source and destination of the communication, the date, time and duration of a communication, the type of the communication and the location of the equipment used in the communication. For the avoidance of doubt, the bill makes it explicit by Section 187 A4 that nothing in the bill requires a service provider to keep information about the content of a person's communications and specific provision is made to exempt from the scope of the bill a person's web browsing history. The obligation to retain metadata is for two years. The obligation applies to carriers, within the meaning of the Telecommunications Act and ISPs providing the services enabled by means of infrastructure located in Australia.

Mandatory retention of metadata is an international best practise standard for counter-terrorism and the investigation of serious crimes, for instance; paedophile networks. Data retention regimes currently operate in some 29 countries including most European countries and the United States. I want to stress, as Mr Turnbull stressed in his second reading speech, that this bill confers no new powers on ASIO, the AFP or on law enforcement agencies. They can already access metadata under the existing law; the purpose of the bill is to establish a common, industry wide standard for metadata retention and to ensure that metadata continues to be retained so that the investigative capabilities of the intelligence agencies and the police are not degraded.

The retention of metadata was considered by the Parliamentary Joint Committee on Intelligence and Security (PJCIS) as part of its comprehensive review of Australia's national security legislation during the last Parliament. The scheme adopted by the Government has ben guided by the recommendations of that committee in chapter five of its report. Those recommendations were of course, bi-partisan. The Government has today referred the bill back to the PJCIS for review.

Now before I ask Mr Turnbull, Commissioner Colvin and the Director-General to make some remarks, I want to touch on another matter. There has been a lot of public discussion about the effect of Section 35P which was passed recently as part of the first tranche of counter-terrorism legislation. Almost all of that public commentary was wrong. In particular the suggestion that Section 35P was directed to journalists or somehow constituted a constraint on the freedom of the press is simply wrong. That provision applies generally to all citizens. It was primarily, in fact, intended to deal with a 'Snowden' type situation. It was based on a pre-existing provision of the Crimes Act, Section 15HK which contains analogous protections for protected operations by the Australian Federal Police. An analogous provision again was introduced into the Crimes Act as part of the delayed notification search warrant regime which was considered and passed by the Senate yesterday as part of tranche two. I'm concerned that so much discussion about those provisions, that is Section 35P and the analogous provisions is misguided. There is no possibility, no practical or foreseeable possibility, that in our liberal democracy that a journalist would ever be prosecuted for doing their job.

Therefore I have today decided to take advantage of the powers available to me under Section 8 of the Commonwealth Director of Public Prosecutions Act to give a direction to the Commonwealth Director of Public Prosecutions (DPP) that in the event that the Director had a brief to consider the possibility of the prosecution of a journalist under Section 35P or under either of the two analogous provisions which I have mentioned, he is required to consult me and no such prosecution could occur without the consent of the Attorney-General of the day. That would mean that in the barely foreseeable, barely imaginable event that a journalist was subject of a prosecution brief to the Commonwealth DPP, the Attorney-General, as a political official, as a Minister, would assume immediate responsibility for allowing that prosecution to proceed. Let me stress that does not mean the Attorney-General could instruct the prosecution, the Attorney-General can never instruct a prosecution. The prosecution can only be brought by the Director of Public Prosecutions but this would add a very powerful safe guard by providing that the Attorney-General would be required to consent to and therefore accept personal and political responsibility for a prosecution in the barely imaginable event that such a prosecution were brought.

Malcolm Turnbull: Well thank you Attorney-General. The important thing to understand about this metadata bill, these amendments, is that it is not creating new classes of data to be retained. And what it is seeking to do, simply, is to ensure that the ability of our law enforcement agencies, security agencies and police are not diminished because changing technologies and changing business practises no longer require telcos to retain that type of data. It is routinely used, as I mentioned in the second reading speech the ability to resolve internet protocol addresses to customer accounts is a routine, fundamental, vitally important part of the work of our police and there is nothing new about it. The challenge is that these records are not being retained for either very long or indeed for barely any time at all. So what this is seeking to do is to create a standard.

As George has said, it is not giving the police any new powers, it expressly precludes any obligation to retain your destination IP addresses, what you're doing on the web and the typical example is where an IP address is identified, it may be identified as Commissioner Colvin can describe in more detail in the context of a ring of people that are sharing child exploitation material and an IP address is actually identified as an Australian one. The ability to go back to the ISP that dynamically allocated that IP address and say, who was the account holder at this time and date is critically important and again as I mentioned in the second reading speech, you can see examples where the unavailability of that IP address record, the inability to resolve it to a customer account actually prevents law enforcement from catching the criminals and preventing them from doing further harm. So that's what this is about, it's about preserving the status quo and ensuring that there is a consistency across the board and we are very satisfied that we have protected, we've taken account of privacy considerations. Again as George just mentioned, I said in the House a moment ago we've substantially reduced the range of agencies that have warrantless access to this type of telecommunications metadata and it is essentially now limited to what you might describe as traditional law enforcement agencies, police, crime commission, ASIO, customs and so forth.

Duncan Lewis: Attorney, thank you, ladies and gentlemen I just want to make a few remarks, firstly access to telecommunications metadata history is critical and central to ASIO's work as we go about protecting the security and the safety of we Australians, our families and our interests. We have used communications metadata for more than half a century in one way or another within the Australian Security Intelligence Organisation. This is not new, as has been pointed out, we are not receiving any new powers. What has changed, as the Attorney and the Communications Minister have made plain, is that the holding of metadata have been diminishing, that's a technologically and commercially driven reality. We seek to halt that and we seek to have access, continuing access to these metadata stores in order that we can fulfil our function.

In particular, for my organisation, this is important for counter terrorism operations that we have and continue to conduct. We've had four major mass casualty attack plans, executed or planned in this country in recent years. One of those you may remember; Operation Pendennis, in 2005 in Sydney and in Melbourne were particularly important. All four of those mass casualty plans, terrorist plans, were thwarted in large part because of access to metadata and if you have a look at the Operation Pendennis example, we had 18 convictions, we currently have eight of those individuals still in jail, five of them for terms of in excess of 20 years. So the seriousness of the crimes that are addressed by us, or resolved by us in a way through the access to metadata is critical. Now it's not only for counter terrorism but it also applies in ASIO's case for foreign espionage and foreign interference in this country. So for us to perform our function of protecting Australians, and Australian interests, we need this access. Thank you.

Andrew Colvin: Thank you, Attorney, thank you Malcolm, Good morning everybody. The Director General has already stated how important this is to law enforcement and security agencies and a lot has been said about this before so I don't wish to repeat what has already been said, except to underline I know I speak on behalf of all law enforcement in this country when I say how fundamentally important this is to us, not just in a national security context but so fundamental in most of the crimes, particularly serious and organised crimes, that we investigate on a daily basis.

As we said this is not about new powers for police, it's about seeking to retain that which is, at the current stage, retained in an inconsistent and unfortunately rapidly degrading manner. I'd like to put on the record a few matters that I think will help the public and people in the room understand how that we use this data.

We've already spoken, the Minister has mentioned child protection matters and child abuse matters, many of us in the room today are wearing a red badge which is to support the Daniel Morcombe Foundation and Day for Daniel events are taking place around Australia today and tomorrow. That is a classic case of an investigation which I have absolute confidence in saying would not have been as successful as it has been without the ability for the Queensland police to access metadata of the type that this bill is seeking to retain. Contrast that with a number of other matters where we know that metadata is rapidly degrading as new players come into the market and as businesses devise their systems in such a manner that metadata is no longer retained.

If I could just give you a couple of examples of some child protection matters. I'll be reasonably generic but you'll understand the gist of the matter. A recent EUROPOL matter that identified 371 potential suspects for child abuse material in the UK, of that 371 IP addresses if you like, because the UK have solid data retention laws UK authorities were able to identify 240 individual suspects in that matter of which they prosecuted 120. Contrast that with another major, leading European country, quite sophisticated and developed in the way that it does business, the same investigation, a very similar number of IP addresses were identified in that country; 350 odd. They were only able to identify seven and didn't prosecute anybody because there are no data retention laws in that country and the data wasn't able to be made available.

We have very similar cases in Australia as well, a recent investigation of 460 odd IP addresses that resolve back to Australian addresses of people who are actively going online, viewing, downloading, sharing, child abuse material and of course many of these people, it troubles us that while they may be offending online, there is also a high likely hood, potential, that they are offending offline as well. Of that 460, over 150 of those could not be identified, that was several months ago. My real concern is that as time passes we will probably have more than 150 of those that could not be identified today.

So this is a real, pressing issue for law enforcement around the country at the moment, it is a matter that we deal with each and every day, not just in child protection operations, in serious and organised crime investigations, in our national security work, our physical assault, sexual assault, murders metadata is that fundamental tool that we use. It's the tool that we use often to place people at the scene of a crime, or remove them from suspicion. It's the tool that we use to help us refine what further intrusive matters or powers we may need to use down the track. As I say I can't underscore enough how fundamental it is. I might leave it at that, a lot has already been said.

Journalist: First of all, Minister Turnbull, in your speech you said that the government expects to make a significant contribution to the costs that the providers will bear, is there any ball-park figure on that and Attorney you said that you would like to refer this on to the joint committee, what about the timing you'd be expecting…[inaudible] what are your expectations of trying to get this through Parliament?

Malcolm Turnbull: Well just dealing with the costs, yes, I said that we expected to make a substantial contribution both to the implementation and operational costs as indeed the commonwealth does presently. It makes a financial contribution when it asks telcos to provide access to metadata now. So we understand that we're asking these companies to do things that they don't have a business need to do and there is an expense. As to the ball-park figure, yes there are some ball-park figures being thrown around but they are at this stage not of sufficient accuracy for me to be citing at the moment, there's a wide range and we will obviously work through that with the Parliamentary Joint Committee on Intelligence and Security will not doubt take an interest in this and of course we have a working group consisting of the two gentlemen on the far left and far right and the Secretaries of the Attorney's department and my department.

Journalist: So you don't know? You don't know how much the two years storage will cost?

Malcolm Turnbull: We don't have a final figure Malcolm at this point, there are a number of estimates and the estimates are getting more accurate. It is something that will be refined in the course of the consultation.

George Brandis: In relation to the PJCIS that is a matter that is being discussed today between the Government and the opposition. I spoke a little earlier on to Mr Tehan, the Chair of the PJCIS, and he is engaging the Deputy Chair, Mr Byrne, in order to resolve the timing issue. Whatever inquiry there will be will be a thorough inquiry. But can I just make this point to you? Most of the work that the PJCIS needs to do about this has already been done. It was done in the last Parliament as a result of a very— and you're familiar with a very large report that was produced and tabled in June of last year which dealt among a range of topics with the question of data retention. So the policy issues, the questions of the safeguards regime, all of those issues have already been addressed. So the function of the PJCIS inquiry is essentially to go through the Bill, it is not a particularly long Bill, it's some 47 pages, to satisfy themselves that it is fit for purpose, that it meets the policy and safeguards objectives that were established by the earlier report.

Journalist: On 35P you announced that extra safeguard. Is that your alternative to what Bill Shorten is asking for—the appointment of the National Security Legislation Monitor? Are you still going to do that?

George Brandis: We have made it clear that we will be appointing a National Security Legislation Monitor. The selection of the appropriate person will be announced very soon. It is not an alternative to that, we will be doing both. The reason that I have given the direction to the Commonwealth DPP today is to put to rest, what as I said in my initial remarks, is really an entirely false story. That provision is not about journalists, it was never directed to journalists. Journalists have taken umbrage at it and rather than let this false story continue to run I have installed what I'm sure you will see is a very powerful safeguard by having the Attorney-General take personal and therefore political responsibility for any prosecution were any ever to be considered. But as I also said it is barely imaginable in this country that that would occur.

Journalist: And you will refer the legislation to the Monitor when he or she is appointed as Shorten has asked?

George Brandis: I haven't seen Mr Shorten's remarks earlier today. I haven't seen those remarks.

Journalist: The legislation was rather unexpectedly introduced this morning, it didn't go to the joint party room on Tuesday, is there a particular urgent matter that either ASIO or police are looking at that demanded that demanded that this legislation come in and that they needed these powers rather quickly?

George Brandis: Well the parliament has been very busy with national security legislation all week as you know and the Government took the view that it was appropriate to sequence the introduction and announcement of these measures. Michelle—

Journalist: Was there a reason it didn't go to the party room? 

George Brandis: It did go to the party room this morning and it was approved unanimously.

Journalist: You have to get it through by the end of the year?  Is that correct?

George Brandis: That's not what I said. I said that there are discussions going on today between the Government and the Opposition in relation to the manner in which this bill will be dealt with, both by the PJCIS and by parliament.

Journalist: Sorry Attorney, just on 35p, you seem to be offering some protection for reporters there. What about their sources?  And are you now saying that it is specifically about Snowdon-like cases?

George Brandis: No, no, no. I'm not saying it's specifically about Snowdon-like cases; in fact, I'm saying the opposite. I'm saying it's a law of general application. The event that inspired our concerns about this was the Snowdon event and Snowdon-like cases. But if you simply read it, as I'm sure you have, you'll see it's a law of general application. It will continue to be a law of general application but the Government has -- we don't need legislation to do this, I have made a direction to provide a very powerful safeguard to journalists.

Journalist: Mr Turnbull, what safeguards will be put in place in terms of data retention with the telecommunications companies and just as a matter of principle, we're moving from something that is their commercial requirement to store what they want to store, to something that the Government is obligating them to do. So does the Government then take some responsibility if there is some sort of data breach in the future?  If there is a security breach?  So basically there is specific question there about what measures will be put in place for safety and the principle.

Malcolm Turnbull: Okay well the first point there is the securing of data safely is the responsibility of the telcos. And of course, they are very alert to data security already and they are very sophisticated in that regard. We will, we are, preparing new legislation which will strengthen—as I said in the second reading speech —the security of Australia's telecommunications structure or system and that would add to that security. And we expect those new laws, new amendments, to be in place before the 18 month period is complete. But the responsibility for securing data is clearly in the hands of the telcos, as it is at present. I mean, just so everyone understands, most of the categories that we're talking about in terms of data, for example telephone metadata, are being kept by telcos for very long periods, for seven years for example, so this is really anticipating a change in that. There are some ISPs that have been storing data that they have hitherto kept for very long periods, for years, down to very short periods or barely at all. And because there isn't in, an IP world as the Commissioner said earlier, there isn't actually a business need for them to do so. So we're asking them to do something which they are either doing or are supremely capable of doing but which they may not in the future, if not at the present, have a business need to do so. And so this is why we talk about protecting the degradation of this resource which has been so important for law enforcement. So there's nothing new in these gentleman and their agencies accessing metadata. So this, is in effect, a measure designed, in large measure, to preserve the status quo.

Journalist: With regard to 35P, with that you say you've instructed the Commonwealth DPP to take this new course. How durable then is that defence? For example do you expect it to survive beyond your time as Attorney-General and beyond the life of the current Commonwealth DPP? Will it become an excepted approach to dealing with journalists in these cases?

George Brandis: Well that's a matter for future Attorneys-General. Direction under Section 8 of the Commonwealth DPP Act are revocable, having given this direction it stands until if it were ever to be revoked by a future Attorney-General.

Journalist: Is it a safeguard that can be revoked at any time?

Journalist: Is that really a true safeguard?

George Brandis: I think it's a very powerful safeguard. It's a very powerful, practical safeguard because what it means is that the Attorney-General has a double capacity, he's the first law officer and he's also a Minister and therefore a politician. It is a very powerful, practical safeguard for a Minister who is a practising politician to assume some personal responsibility for authorising the prosecution of a journalist. You can well understand I'm sure from a practical point of view how powerful a safeguard that is.

Journalist: Commissioner Colvin you gave a couple of broad examples on data retention for child exploitation, can you explain how it might have been relevant to say Operation Appleby, or if you don't want to go into that operational detail perhaps a hypothetical similar example for national security.

Andrew Colvin: Thank you. Again, fundamentally it's a part of everything we do. In terms of an operation like Appleby very similar to what the Director General has spoken about in relation to Operation Pendennis or Operation Neath - the big investigations you've seen. At a basic level it helps us establish networks. It helps us bring together who are the groups, who are the communications between. In this regime what we're asking to be retained is not the content, that is a warranted regime, which is very different to legislation before the Parliament today. But it helps us establish those networks, it helps us work out who may be talking to who. And in the case of Appleby, as with Pendennis and Neath, we need to do that so we can narrow in our investigation to where we think we need to focus our resources.  

Journalist: Once the legislation is through, could it be used, for example, to target illegal downloads? Those responsible for that?

Andrew Colvin: I haven't even touched on some of the other range of crimes. Absolutely, I mean any interface, any connection somebody has over the internet, we need to be able to identify the parties to that connection. Again, not the content, not what may be passing down the internet. So illegal downloads, piracy… sorry, cyber-crimes, cyber-security, all these matters and our ability to investigate them is absolutely pinned to our ability to retrieve and use metadata.  

Malcolm Turnbull: If I could just flesh it out in terms of copyright. A lot of internet piracy, downloading and sharing copyrighted material unlawfully, is done by way of file sharing. I'm sure no one here has any experience of it! But the that works is that a torrent stream typically is created in which there are a whole number of computers all with their own IP addresses which are sharing this pirated content. What the right's owners do is use different programs, Detectee is a very common one, the participate in the swarm, they therefore identify the IP addresses computers that are infringing copyright, and then they seek from the ISPs—and they are able to do this with a subpoena of course—the account details of the holder. Now generally they do this pretty much in real time so the two year, holding that data for two years, probably doesn't make a big difference in terms of copyright infringement because they are dealing much more with the here and now. Whereas the Police Commissioner's interests often tend to be much longer-term. But that process of resolving an IP address to an account name is relevant and it happens all the time.

Journalist: You've mentioned that there's a lot of national security legislation going through this week and I was just wondering, Senator Faulkner has put out a very long paper talking about the [inaudible] accompanying greater oversight with all these new powers going to the intelligence agencies. I was wondering whether you've thought about that and whether you have any particular proposals about the powers of the joint intelligence and security committee and also when we'll see more details about more resources given to the IGIS.

George Brandis: Well, thank you Laura. I've read Senator Faulkner's paper. I read firstly in your paper, an extract from it, and then Senator Faulkner was good enough to give me advance notice of the fact that he was publishing this paper. I think it's a very good paper. Broadly speaking, the approach that Senator Faulkner takes—which is that the agencies in this day and age need strong powers but that those strong powers should be balanced by strong oversight mechanisms and strong safeguards—is my approach. It is a view that I've expressed very often long before I read Senator Faulkner's paper so he and I are largely of one mind in relation to the approach to be taken here. We don't want weak agencies. We want strong agencies with sufficient powers but we want to have a rigorous oversight regime and rigorous safeguards to ensure that they conduct themselves—as of course they do—in accordance with the law. Now, there is already a very considerable architecture. The fact is that we have an IGIS—a unique officer specifically dedicated to this area of policy. One of the proposals that the Government has adopted as part of the recommendations of the PJCIS in its report on tranche two of the national security legislation was to give the PJCIS oversight, as well, of the counter-terrorism functions—the Part 5.3 functions of the Australian Federal Police. And that has been done. So the approach you have recommended to me is my own approach, and the safeguard and oversight mechanisms are already strong—and are being enhanced.

Journalist: [inaudible]

Andrew Colvin: Can I just quickly answer that as well. The bill that has been introduced this morning doesn't make it explicit that the Ombudsman, if he doesn't already in his own motion provisions, has oversight of the AFP. But this makes it clear that the Ombudsman will have oversight of the Australian Federal Police in relation to our access and our use of the metadata. And that we will need to bring forward a report to Parliament, much like we do with other Acts—surveillance devices Acts—so there is additional safeguards for the community in this.

Journalist: Under what circumstances did our agencies require a warrant to investigate metadata and has that changed with the legislation today?

Andrew Colvin: If you want me to answer, nothing in this Bill changes our access provisions, our access requirements. If we wish to access content, then we currently—and nothing will change—need to get a warrant to do that. That could be a telecommunications interception device warrant; it could be a stored communications device warrant. Those are different regimes. The warrant requires us to go before a judicial officer and establish the grounds and the means of which we believe we need to access that content. Nothing in this bill today changes any of that. As it stands at the moment, an authorised officer, a senior police officer, on the reasonable grounds to suspect that a crime was being committed, can authorise metadata to be released to the AFP.

Journalist: Is there a case to issue a similar direction to the DPP in relation to the provisions that are affecting the AFP rather than other agencies?

George Brandis: I mentioned that Section 15HK of the Crimes Act is the equivalent analogous provision for the AFP to Section 35P of the ASIO—yes it does—and in fact Section 35P of the ASIO Act was modelled on Section 15HK of the Crimes Act. I discussed the matter with both the Commissioner and the Director-General because this is a fanciful notion that anyone would be prosecuting journalists. They've both told me they're perfectly comfortable with that direction being given. I've also discussed it with the Commonwealth Director of Public Prosecutions who's also comfortable with it.

Journalist: Is there scope to build into the TIA Act a provision that prevents agencies going after the sources of journalists?

George Brandis: Well we're not dealing with that at the moment.

Journalist: It's a possibility is it not? It's a possibility is it not?

Journalist: A question for you or the Director-General or the Commissioner, is there any further clarity on reports that Mohammad Ali Baryalei has been killed?

Senator Brandis: Do you want to say something about that Duncan?

Duncan Lewis: Yes, I've seen those reports. We've been checking those reports very carefully over the last 48 hours and at this stage I am still unable to confirm whether he is alive or dead.

Journalist: Can I ask a non-question—a non-terrorist question? [laughter] To Mr Turnbull?

Malcolm Turnbull: I've never been asked a non-question before.

George Brandis: [inaudible] a non-question?

Malcolm Turnbull: I'll give you a non-answer.

George Brandis: He's given a few non-answers!

Journalist: Minister what's your view on the Direct Action Bill that was signed yesterday with Clive Palmer?

Malcolm Turnbull: I think it's a triumph of negotiating skill on behalf of the Environment Minister. Thank you very much.