Exclusive: Serious breach of security will embarrass AFP and government as they push for greater access to metadata and mandatory retention laws

This article is more than 6 years old

This article is more than 6 years old

The Australian federal police mistakenly published highly sensitive information – including metadata – connected to criminal investigations, in a serious breach of operational security.



Guardian Australia can reveal that the AFP provided documents to the Senate, which were then made publicly available online on parliamentary sites and other sources for several years, and which accidentally disclosed information about the subjects and focus of criminal investigations and telecommunications interception activities.

The revelations are an embarrassment for the law enforcement agency and the federal government, which are pushing for a mandatory data retention scheme to force telecommunications companies to retain personal data from phone and web users.

The information that police disclosed included the address of a target subject to surveillance, the types of criminal investigations and offences being investigated, the names of several AFP officers that are not publicly available and other identifying information including the phone number of an individual connected to an investigation.

The failure to secure the data correctly may have jeopardised criminal investigations, and could have exposed that individuals were subject to police surveillance.

A spokesman for the AFP said it had self-reported the breach to the Australian Privacy Commissioner and apologised to “relevant stakeholders associated with this matter”.

It was taking the breach very seriously and had “immediately taken the appropriate steps to rectify the matter”.

The spokesman said the information was “hidden behind electronic redactions within the document” and “one phone number and an address could, under certain circumstances, be accessed”.

The information had been taken down at the request of the AFP, he said.

The government continues to argue that the retention of telecommunications data is necessary for law enforcement and intelligence agencies to effectively conduct investigations.



But the proposal has alarmed civil liberties groups and some liberal backbenchers, while the government has struggled to clearly articulate how the proposal will work and what information will be retained.

Guardian Australia has chosen not to identify the location of the mistakenly published information. Publishers of the data were notified of the breach before publication and given time to remove the information.

The AFP treats the disclosure of telecommunications interception data seriously, and it is an offence under the Telecommunications (Interception and Access) Act to disclose information relating to interception activities.

Greens senator Scott Ludlam, who also inadvertently published the documents and was notified by Guardian Australia of the breach, said: “We’ve withdrawn those documents from our website as soon as we became aware that they might compromise the integrity of an investigation.”



He added: “It doesn’t do much for your confidence that this is an agency that is arguing strenuously for a mandatory data retention regime that they let this document go without realising it.

“We’ll be seeking their advice about whether they’ll be providing us with clean copy of the documents.”

Senior AFP and Australian Security Intelligence Organisation (Asio) officials have been repeatedly put forward by the government to attempt to quell uncertainty around the new data retention proposals, and gave a joint briefing to journalists in August.

During the briefing, the Asio chief, David Irvine, made assurances that the manner of accessing telecommunications data was rigorously monitored.

“The way in which we access it is very closely monitored and oversighted, in our case by the inspector general of intelligence and security,” Irvine said.

Australia’s privacy watchdog recently warned that an expanded data retention scheme would increase the risk of privacy breaches.

The privacy commissioner, Timothy Pilgrim, said: “The retention of large amounts of personal information for an extended period of time increases the risk of a data breach.

“Organisations holding this information need to comply with all their obligations under the Privacy Act, including the requirements to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure.”