Home affairs says agencies are pushing for data to be held for more than two years for complex investigations

Government agencies are pushing for telecommunications companies to be forced to retain customer data for law enforcement agencies for longer than the current two-year requirement.

Under the mandatory data retention legislation that passed in 2015, companies such as Telstra, Optus and Vodafone are required to store customer metadata, like number dialled, time of call and call location for two years.

The vast majority of data used by police and other agencies in investigating crime is less than three months old but, according to the Department of Home Affairs, agencies are pushing for the data to be held for more than two years for complex investigations, and when cases reach courts.

Australian federal police accessed journalists' metadata 58 times in a year Read more

In a submission to the joint standing committee on intelligence and security’s review of the law, the department said older data “plays a more critical role in investigations where agencies cannot rely on other forms of evidence easily”.

The Australian Competition and Consumer Commission, for example, made requests for data older than two years 30% of the time between October 2015 and February 2019.

Without naming the case, home affairs pointed to a prominent catfishing case, where a person falsely claimed to be actor Lincoln Lewis, and said Victoria police were unable to get a hold of telecommunications data dating back to 2011 as part of the investigation because Optus no longer held the data.

Lydia Abdelmalek was ultimately convicted on six counts of stalking, home affairs claimed the lack of older data contributed to a seventh charge of stalking not being proven beyond reasonable doubt.

Despite the push, home affairs said that any expansion of the retention period would require consideration of the privacy implications.

The department also said that forcing companies to retain more types of data, including media access control (Mac) addresses for devices, would be of greater assistance to law enforcement. Mac addresses for devices, for example, would tell law enforcement which device was being used at the time of the crime being investigated.

The review has also drawn into attention how the telecommunications companies are storing the data.

In its submission to the review, Optus revealed that the new law in 2015 required the company to store some data in older systems in an unencrypted state but the company received an exemption from the legal requirement to encrypt the data and stated no security breaches occurred.

The companies charge government agencies for access to the data, and home affairs noted there wasn’t any consistency between the companies on how much is charged. Vodafone, for example, only charges a maximum of $224 to access data two months old, while Optus charges $756.

The cost goes up for even older data and home affairs said some requests for data “may not be pursued due to the associated costs”.

The Australian federal police last week revealed that it had received two journalist information warrants to access a journalist’s metadata in order to track down a source, and had accessed the journalists’ metadata 58 times.

New encryption powers used at least five times by federal and NSW police Read more

The commonwealth ombudsman said the major loophole in this warrant regime designed to protect sources is that it does not require the police to obtain a warrant to access the alleged source’s metadata to see if the alleged source has been in contact with a journalist.

“If the first limb of this test is not satisfied – i.e. the person whose telecommunications data the agency is seeking to access is not working in a professional capacity as a journalist and is not the employer of such a person – the agency will not be required to obtain a warrant before issuing an authorisation and there will be no oversight by an external issuing authority or a public interest advocate, despite the possibility that agencies have sought access to that telecommunications data for the purposes of confirming whether the person disclosed information to a journalist, and therefore whether they are a journalist’s source.”