New Surveillance Law Makes Criminals Out Of Civilians
Tech|Nov 8, 2021

New Surveillance Law Makes Criminals Out Of Civilians

New Surveillance Powers Granted To Australia’s Law Enforcement Are An Affront To Civil Liberties.
Dara Macdonald

New surveillance powers granted to Australia’s law enforcement are an affront to civil liberties. Unless laws are amended, they could lead to the violation of ordinary law-abiding Australians’ privacy as their information is collected for evidence, without their knowledge or permission. 

There has been a lot of reporting of the new surveillance powers that were introduced into law in September. Much commentary has focused on the ability to hack and manipulate data, which is no doubt a concern, but the relatively higher threshold for the use of this power - namely that it can only be used to prevent a crime from being committed - makes it the least scary. The powers that everyone should be more concerned about are the ones that allow police to take over people's internet accounts. The accounts they can gain access to include email accounts, social media accounts, online banking accounts and any other account of a person suspected of either present or future crimes.

The Surveillance Legislation Amendment (Identify and Disrupt) Act 2021 (“Identify and Disrupt Law”) creates three new warrants to allow police and other law enforcement bodies to engage in covert activities to find and disrupt the commission of crimes online. 

The new warrants allow Officers of the Australian Federal Police (AFP) and the Australian Criminal Intelligence Commission (ACIC) to disrupt, manipulate, add or remove any data required to prevent the commission of a crime, such as manipulating cryptocurrency payments (“Data Disruption Warrant”); to access the network activity of suspected crime organisations (“Network Access Warrant”); and finally, to take over accounts (e.g. social media or email accounts) to gather evidence of criminal activity (“Account Take Over Warrant”). 

All these warrants have inherent risks in their use, as was clearly recognised by the Parliamentary Joint Committee on Intelligence and Security when they conducted their review of the bill. As such, the committee recommended that these new warrants be subject to an oversight function, a report about how these powers have been used due in three years time, and a sunset date of 5 years.

These safeguards are an admission that these powers could be dangerous. 

Whereas both the Data Disruption Warrant and the Network Access Warrant are intended to prevent the actual commission of crimes, the Account Take Over Warrant can be used to gather evidence. That makes it the most open to misuse.

In effect, that means that anyone in communication with someone whose account has been taken over can have their information gathered as evidence. 

The powers that everyone should be more concerned about are the ones that allow police to take over people's internet accounts

Back in 2014, when I was studying evidence law, the great controversy was whether confessions obtained through a Mr Big Sting operation, where an undercover police officer poses as a mob boss promising money and power in exchange for information on past indiscretions, were admissible.

This type of operation led to the arrest of Daniel Morcombe’s killer. That horrible crime captured the attention of the entire nation (like the William Tyrrell case does today). Few would argue that these tactics are not completely justified if it means catching a person that rapes and murders children. 

The same logic guides those ushering in the Identify and Disrupt Law. These powers simply allow the police to conduct the undercover operations they already perform in person online, so the argument goes. And as the commission of crimes has changed drastically over the last decade, and now more than ever is reliant on technological means, this allowance is crucial. 

But the interconnected nature of the internet means that undercover operations online could have far broader impacts than the physical operations. In order to be caught up in a sting in the past you would have to be a part of the plot or actively participate in the commission of a crime. With these new warrants, however, one only needs to have emailed the suspect for their data to become subject to investigation.

Another difference between the world of real life sting operations and covert online investigations is that the internet is predominantly a world of the written word, not of conversations between people. 

Gathering evidence in the spoken word has age-old inbuilt protections for people to prevent false confessions. False confessions are not just a matter of duress by physical force. People may confess to crimes they haven’t committed if they think it will earn them a tough guy reputation. 

Mr Big Stings were controversial because they violated the most well known rule of evidence - the rule against hearsay - which is designed to protect against false confessions of exactly this kind.

Age-old protections that ensure a person confessing to a crime is telling the truth melt away when the evidence gathering is in the written word, in which case pretty much everything can be used against the person to whom it relates.

The Identify and Disrupt Law may grant the powers police have previously used but the nature of the internet means that protections for innocent parties that were previously in place for in-person operations are sorely lacking. 

Australians need to be incredibly vigilant to make sure the Account Take Over Warrant doesn't sweep everyone into criminal investigations. 

* Dara Macdonald is a contributor for Young Voices, an admitted Australian lawyer, and founder of a new organisation that aims to create a culture of freedom, All Minus One.