One of Australia’s key laws governing surveillance – the Telecommunications (Interception and Access) (TIA) Act of 1979 – is desperately in need of an overhaul. It’s a dinosaur from the days of the fixed line telephone and the fax machine.

It has been patched up numerous times in an attempt to keep pace with advancing technology, and has been subject to two comprehensive reviews – the Australian Law Reform Commission report in 2008, and the parliamentary joint committee report of 2013 – and now a senate inquiry headed by the Greens senator Scott Ludlam, which is due to report on 27 August.

Today, a phone is much more than simply a phone. It is a computer. Smartphones enable many means of communication and these interactions can be tracked, which makes it both a powerful tool for criminals and terrorists, but also a lightning rod for crime-fighting and intelligence agencies.

The Abbott government is taking its first steps since winning office last September to expand Australia’s surveillance footprint to keep pace with digital communications and emerging security threats. Legislation has been introduced to the Senate which will expand Asio’s powers of surveillance over computers and computer networks, and make it easier for Australia’s domestic spy agency to cooperate with other bodies.

But this is just a down payment. The government is waiting for the results of the Senate inquiry before proceeding with additional changes to the national security framework, including a highly contentious proposal under which phone companies and internet service providers would be forced to store the private communications data of anyone in Australia for two years or more – just in case the records are needed during investigations.

The attorney-general, George Brandis, while not yet locking the Coalition in, has sent a billboard-sized hint that the government is likely to implement mandatory data retention in the coming months. The Asio boss, David Irvine, who has recently made the case in public that agencies need more sweeping surveillance powers to keep the public safe, is more forthright than Brandis on this subject. Irvine contends mandatory data retention is essential to Asio’s operations.

With big changes contemplated to the legal and policy framework, it’s timely to take stock of the inquiry being held by the Senate’s legal and constitutional affairs committee and look ahead to what might be heading to parliament later this year.

What stakeholders are telling the inquiry

A review of the 42 submissions so far (two confidential) by final year journalism students at the University of Canberra, under the supervision of this article’s author and journalism professor Matthew Ricketson, highlighted an uncomfortable – and even contradictory – struggle to balance law enforcement and security agencies’ requirements with the agreed right to privacy entrenched in the TIA Act.

Simply put, how can privacy be protected while it is being invaded?

The difficulty is the temptation of the data honeypot, the digital footprint that makes it irresistibly cheap, easy and effective for a dystopian Big Brother to watch people without them knowing it, as became chillingly clear with the revelations by former National Security Agency contractor-turned-whistleblower Edward Snowden in Guardian Australia and elsewhere.



Currently, agencies can legally access some personal information without a warrant.



Those making submissions to the TIA Act inquiry are roughly split down the middle about the need for surveillance of our private lives in pursuit of law enforcement and national security, and concerns about the extent to which privacy is invaded, by whom and with what authority.

Law enforcement, security organisations, even the attorney-general’s office, are in favour of keeping available their warrant-free access to the data pool from personal communications; the legal fraternity, and privacy and human rights watchdogs, side with private industry against allowing easy access to the details of private lives that make such a big picture.

How can agencies get access to information about individuals?

Under the TIA Act there are three ways authorities can gain access to private information. The first is access to the content and substance of telecommunications in real time, for which they need a warrant. This provides access to the content of emails, text messages, phone calls and internet use. To obtain a warrant, they must suspect the person of a serious crime that would carry a minimum seven-year sentence.

Second, there is access to stored telecommunications and their contents, which also requires a warrant. For this, authorities must suspect the person of an offence that carries a minimum three-year sentence.

Both these warrants last for a maximum of 90 days, but can be extended.

Within these warrant regimes are further classifications, such as a named person warrant and the lesser known B-Party warrant, which grants access for a maximum of 45 days to the content of communications between people associated with a person under investigation. These associated people need not be suspects and could include doctors, lawyers or journalists, who might have no idea they were being investigated. The attorney-general’s annual report said 120 such warrants were issued in 2012-13.

Metadata – a treasure trove for police and intelligence agencies

Then there is access to metadata, the shell details of communications – calls and emails sent and received, the location of a phone, internet browsing activity. There is no access to the content of the communication, just how, to or from whom, when and where.

A warrant is not required for this, and under the current law organisations other than police or security agencies can get access to it – the RSPCA famously is one, as are local councils and foreign law enforcement agencies.

Warrantless access to metadata is a hot-button issue in submissions to the Senate Inquiry.

There were 319,874 authorisations granted in 2012-13, giving access to private information of roughly one in 67 Australians.

Privacy advocates argue this reflects an alarming ease of access, even though agencies should make every effort to ensure the invasion of privacy is justified by the importance to the public of solving a crime or recovering money.

The NSW Council for Civil Liberties says in its submission to the Senate inquiry: “The figures [for metadata access] are so great for some of the agencies (103,824 by the NSW police, 63,173 by the Victorian police, 22,900 by the Australian federal police – and that is just for existing data) it is a reasonable assumption that no such calculation is made.’

A 2014 poll by Essential Media showed that 80% of Australians disapproved of access to their metadata without a warrant, and submissions to the Senate inquiry show human rights and privacy bodies, private companies and the legal fraternity also strongly oppose a warrantless system.

They want it subject to stricter oversight and a warrant regime. Law enforcement and security agencies argue it is essential to their efficient and cost-effective operation.

Ludlam points out that security interests will always take precedence over privacy interests, but he has called for tightening privacy protection to include metadata.

Ludlam pushed for the Senate inquiry after Guardian Australia published two stories in 2013 about the activities of Australian intelligence agencies, drawing on source material leaked by Snowden.

One revealed that the Defence Signals Directorate (DSD - now the Australian Signals Directorate), indicated to its intelligence partners in 2008 that it could share “bulk, unselected, unminimized metadata” without some of the privacy restraints imposed by other countries, such as Canada. It is unclear what, if any, specific actions followed that 2008 meeting between the “5-Eyes” intelligence-sharing partners – the US, Britain, Canada, New Zealand and Australia – but the human rights lawyer Geoffrey Robertson and Ludlam raised concerns that Australian agencies might be operating outside their legal mandate.

Ludlam insists that metadata is just as important as content in police and intelligence investigations.

“People tend to misunderstand what can be done with metadata if you have enough of it, and government perpetuates the myth – they’re saying it’s the envelope, not the contents, but if you have enough envelopes you get a very powerful picture.’’

Mandatory data retention – the next big issue

Data storage is another contentious issue, with a proposal before the inquiry that private telecommunications companies be required under law to store metadata for two years, and to make this information available to police and security agencies. It is also proposed that companies should provide decryption information to police and security agencies.

As already noted, Irvine says data retention is essential to national security operations. Brandis has indicated Australia is likely to implement a mandatory data retention regime on the basis that “this is the way the western world is moving”. In fact some jurisdictions are moving away from such systems because of privacy concerns. In April 2014, the European Court of Justice declared data retention invalid on the basis of "wide-ranging and particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data."

Labor has yet to state its position on mandatory data retention, but based on statements in recent weeks from the opposition leader, Bill Shorten, the deputy leader, Tanya Plibersek, and Labor’s highest ranking representative on parliament’s joint committee on intelligence and security, Anthony Byrne, it seems Labor is likely to support such a regime provided there is sufficient oversight.

Ludlam begs to differ.

A mandatory data retention regime violates the first principles of privacy, he says. Private businesses should not be forced to retain information beyond what they require for billing purposes. He contends that individuals should be encouraged to encrypt their own information.

Some private industry also strongly resist the principle of mandatory data retention, including the telecommunications umbrella body, the Australian Mobile Telecommunications Association (AMTA) and the Communications Alliance.

The internet service provider iiNet says it is uncomfortable that “commercial businesses may be forced into a role as unwilling agents of the state to collect, store and safeguard very large databases for which the companies themselves have no use – a role very different from that [for] which those companies were originally established’’.

It estimates the cost of setting up the proposed system to store and safeguard the databases for the first two years of its operation at about $60m.

Additional security risks of prolonged data storage are also a significant concern, according to one of the most powerful supervisory bodies, the Inspector-General of Intelligence and Security (IGIS).

The IGIS – which oversees Asio, Asis and the ASD – has also stressed privacy concerns.

“The IGIS has a particular interest in whether proposed changes place sufficient weight on maintaining the privacy of individuals, and whether proposals reflect the concept of proportionality – that is, that the means for obtaining information must be proportionate to the gravity of the threat posed and the likelihood of its occurrence,’’ its submission said.

Oversight: who watches the watchers?

One of the Abbott government’s early moves was to axe the Independent National Security Monitor. This decision was badged as a red tape reduction measure. But the departing monitor, Bret Walker, disputed that reasoning because his agency performed a singular and highly specific function – the INSLM reviews counter-terrorism and national security legislation. That review function also includes ensuring that safeguards work.

Brandis has now reversed that decision as part of securing Labor’s in-principle support for the first tranche of national security reforms.

The Senate inquiry has also heard calls that a new Public Interest Monitor be appointed at Commonwealth level to further oversee the administration of surveillance – particularly if the surveillance footprint is widened.

But law enforcement and security agencies have rejected those calls, arguing that they are subject to enough oversight.

The warrants regime – should it be simplified?

There is consensus that as it stands the law is unwieldy and fragmented, and can hamper investigations due to the type of information agencies can legally share. But a proposal for a single-warrant regime, to encompass rapidly-evolving technology, has met with mixed reactions during the course of the Senate inquiry.

Law enforcement and security agencies welcome the potential to streamline their operations and cut down administrative burdens, but privacy and human rights organisations and lawyers were cautious due to the potential for misuse.

Again, the IGIS warned that moves to standardise warrant tests and thresholds must take into account the nature of the warrants and the level of intrusiveness.

“A single test could allow the use of more intrusive powers where less intrusive ones are appropriate,” it said.’

But no one denies we rely more and more on digital communication.

The Acma communications report for 2012-13 said 31m mobile services were in operation in Australia, with 11.19 million people owning a smartphone at the end of June 2013.

Some 14.24 million people had access to the internet at home and there was a 59% increase in internet downloads during the June quarter of 2013 compared with the June quarter of 2012.

A lot of money is spent on online too. Revenue from the sale of goods or services online by businesses operating in Australia reached $237bn during 2011–12.

Law enforcement agencies argue that criminals such as drug traffickers and money launderers increasingly use sophisticated technologies; security agencies argue likewise. The Australian Crime Commission estimates that organised crime costs Australia $15bn a year, and the attorney general’s submission to the Senate inquiry notes that in 2012-13 more than half of all interception warrants issued to law enforcement agencies were for organised crime, drug trafficking and serious drug or money laundering offences.

And they are all on the internet, leaving traceable trails, just like everyone else.

It’s a data honeypot like never before.

The law needs changing, and must keep pace with ever-evolving technology. But the right to privacy remains inalienable, and the risk of crime and intelligence agencies overreaching while operating in secret is real.

It’s a delicate course to steer, Big Brother.

* This article is a collaboration between journalism students at the University of Canberra and Guardian Australia. The project has been supervised at the University of Canberra by Matthew Ricketson and Gillian Lord. It has been coordinated at Guardian Australia by deputy political editor, Katharine Murphy, who contributed additional reporting and who has been appointed an adjunct associate professor at the university.