Attorney General's Department on data retention

estimates

Budget Estimates Wednesday 29 May - Legal and Constitutional Committee

CHAIR: Senator Ludlam, we will go to your questions.

Senator LUDLAM: Thanks, Chair. I will just seek some advice from the offices at the table, because I may be winding us back in the program. Maybe, Mr Wilkins, you can just give me some advice, because I think it is something that you know a bit about. I am interested in consultations that the department has been having with industry on data retention, which has been fed into the inquiry by the joint committee.

Mr Wilkins : I am just seeing if there have been some, Senator. We have not had any.

Senator LUDLAM: Since when? The department has been consulting with industry on this for months, if not years.

Mr Wilkins : Since about June or July last year, apparently.

Senator LUDLAM: Thanks.

Mr Wilkins : About the time it was actually referred to that committee.

Senator LUDLAM: Before or after?

Mr Wilkins : There have not been any since it was referred to the committee.

Senator LUDLAM: I see. I am with you. I understand there were consultations occurring in an earlier iteration of the data retention policy around 2009.

Mr Wilkins : I think there were some informal discussions. I think the consultation was done without, for example, my authority. So it was done on the initiative of officers thinking they would just have a chat about what this might involve-

Senator LUDLAM: Sorry, Mr Wilkins; are we talking about having a chat about the earlier iteration in 2009 or more recently?

Mr Wilkins : No, no-I am talking about that earlier one. That was an initiative by officers at a lower level. They were interested in getting details about what it might cost or how it might work. So I would not want to elevate this concept of 'consultation' to something that has been done with the blessing of ministers or the secretary or someone like that.

Senator LUDLAM: Okay. That is interesting. When you say it was lower-level officers doing this without your imprimatur, does that include the consultations that were occurring in June or July of last year? I am just going a bit off the reservation and flying some kites.

Mr Wilkins : I am not saying that I think these people need to be reprimanded, Senator. I am just saying they were-

Senator LUDLAM: No, neither am I-well, we could have an interesting discussion about that.

Mr Wilkins : They were doing what officers do when they take initiatives. I am just saying it was not instigated as a form of government consultation; that is all.

Senator LUDLAM: That is fascinating. How many meetings were there?

Mr Wilkins : I do not know.

Senator LUDLAM: Is that because these things did not have any formal standing as such?

Mr Wilkins : There were two, apparently.

Senator LUDLAM: Okay, there we go! We are making progress: there were two meetings. It sounds as though you might need to take on notice who actually initiated them. If you are not happy to-

Mrs Smith : I can answer that.

Mr Wilkins : Catherine did!

Senator LUDLAM: Wonderful. We are making progress.

Mrs Smith : Those meetings were initiated by me, as Mr Wilkins said. I went about seeking the advice of industry, which I do in my daily job in assisting the Attorney in administering the Telecommunications (Interception and Access) Act. It was brought to our attention by agencies that they were having issues with data no longer being collected or retained by industry, so they were essentially meetings to ascertain what kind of information they were keeping and no longer keeping so that we could advise government accordingly.

Senator LUDLAM: Thank you, that is helpful. And you chaired those meetings with internet service providers?

Mrs Smith : I did indeed, yes.

Senator LUDLAM: Are you able to provide us with the dates when those meetings occurred and any such records as exist of the meetings themselves?

Mrs Smith : I can certainly take that on notice. From memory, one was, I think, in March and one was in September, but I will definitely take those on notice-

Senator LUDLAM: Yes, if you could.

Mrs Smith : and as to who attended.

Senator LUDLAM: I suspect you will not be interested in providing me with names-that is fine-but any of the commercial participants who participated?

Mrs Smith : Yes, I do not have problems with providing that on notice.

Senator LUDLAM: That is much appreciated, thank you. I understand that at some stage there was an interdepartmental committee within the government that was set up to look into that issue. Is that the case?

Mrs Smith : Not to specifically look at data retention; that was just to generally look at the need to amend the Telecommunications (Interception and Access) Act in the light of new technologies being provided by industry which were doing what is considered to be 'going dark', which means that they would lose capabilities.

Senator LUDLAM: I understand that concept.

Mrs Smith : That is what the meetings were for.

Senator LUDLAM: Data retention would have been included amidst that set of issues?

Mrs Smith : Most certainly.

Senator LUDLAM: Can you just describe for us how I refer to this interdepartmental committee-what its name was, or what standing those sorts of entities have?

Mrs Smith : I think it was an interdepartmental committee. That is all I recall it being called, but I will certainly take that on notice.

Senator LUDLAM: That is great. Were you the chair of that?

Mrs Smith : No, I was not.

Senator LUDLAM: Who chaired that?

Mrs Smith : Mr McDonald, to my left.

Senator LUDLAM: So we have the experts at the table. That is good. When did the department begin the process of drafting data retention legislation?

Mrs Smith : We are not drafting data retention legislation. We had in the past consulted, and now we are awaiting an outcome of the Parliamentary Joint Committee on Intelligence and Security.

Senator LUDLAM: So at no stage were parliamentary counsel engaged to draft a bill?

Mrs Smith : Not on data retention, no.

Mr Wilkins : There have been discussions with parliamentary counsel.

Mrs Smith : Yes, but not-

Senator LUDLAM: Okay, discussions were had. Just talk me through what sorts of discussions were had.

Mrs Smith : This is on the broader reform or the broader need to reform telecommunications interception legislation, of which data retention is an aspect-well, that is not a reform; that is a new aspect. We have certainly engaged with the OPC to discuss the ways in which we could potentially modernise the legislation, but there have certainly been no decisions made on any of that.

Senator LUDLAM: I think the T(IA) Act has been amended since I have been here, which is not that long relative to some others, 45 times, so-

Mr Wilkins : Yes, exactly right, Senator. I actually talked to the parliamentary counsel himself and said that I had never seen such a Gothic piece of legislation with gargoyles and flying buttresses. It is not technology neutral, so I have been asking him if we could almost think about how we would go back to square one on this and start with a clean base.

Senator LUDLAM: That might be a rare point of concurrence between us, Mr Wilkins!

Mr Wilkins : So, if and when the opportunity arises to do something about the legislation, I hope the parliamentary counsel has done some thinking about what that might look like. That is really the type of discussion that has occurred. It is at that sort of level.

Senator LUDLAM: Was a regulatory impact statement-

Mr Wilkins : No.

Senator LUDLAM: initiated for not the broader T(IA) reforms but-

Mrs Smith : No, because we have not gone to cabinet, so it is not required at this stage.

Mr Wilkins : No, we haven't got anything like that detail.

Senator LUDLAM: So discussions were had with the OPC, but nothing was initiated as such?

Mr Wilkins : I discussed things with the parliamentary counsel, with the secretary to parliamentary counsel, effectively.

Senator LUDLAM: But there was no such thing as a draft of a bill that included data retention provisions?

Mr Wilkins : I do not know-nothing that I have got.

Mrs Smith : No, there were some very vague draft provisions, not to do with data retention though.

Senator LUDLAM: Okay. That sounds fairly unequivocal. We will take you on that. How often did the department brief your A-G-how many Attorneys-General have you been through since this process started? We will take two as my first guess. On how many occasions did the department brief your A-G on the legislation? Actually, there have been three.

Mr Wilkins : What legislation, Senator?

Mrs Smith : There is not-

Senator LUDLAM: I beg your pardon. I will say 'on the proposal for data retention'.

Mr Wilkins : We briefed Attorney-General McClelland on the need for reform. We briefed Attorney-General Roxon on the need for reform, and she, you might recollect, is the person who referred it to the parliamentary committee.

Senator LUDLAM: She did, and I saw her talking about it on YouTube.

Mr Wilkins : And we have-I do not know-

Mrs Smith : No, we have not briefed, because we-

Mr Wilkins : We have not properly briefed the current Attorney-General, but we will be briefing him. He has obviously been busy and it has been before the committee during his time in the role. But I think he is aware of a number of issues because he was Cabinet Secretary at the time it was referred to-

Senator LUDLAM: Yes, I expect that's true. So you would just say that on a number of occasions you have briefed all of the A-Gs, apart from the present one, during this phase of the proposal while the material has been with the joint committee?

Mr Wilkins : In slightly different forms and in slightly different contexts, but yes.

Senator LUDLAM: Did the department discuss a regulatory impact statement with the Office of Best Practice Regulation?

Mr Wilkins : I didn't.

Mrs Smith : We have not prepared a regulatory impact statement.

Senator LUDLAM: No, I did not say 'prepared'. Was the creation or promulgation of a RIS discussed?

Mrs Smith : My understanding is that we have to prepare that when we are going to cabinet, and we are not anywhere near that stage because we are still seeking views from the PJCIS.

Senator LUDLAM: Mrs Smith, you chaired a consultative group around industry. What was the general tenor of industry's response to the data retention proposal?

Mrs Smith : I would need to go back to the minutes of the meeting. I understand that a lot of industry give their comments on an in-confidence basis. I would have to go back to those comments before I could disclose. Generally industry are always very keen to work with us on how we can appropriately modernise the legislation to the best benefit of law enforcement and their own interests.

Senator LUDLAM: Could I ask you to table those minutes for us.

Mr Wilkins : Can we take that on notice?

Senator LUDLAM: Sure; I will play along. So you are not able to tell us the tenor of industry's response without naming names or breaching confidentiality?

Mrs Smith : I cannot recollect any of them in particular, but I note that most of them made submissions to the Parliamentary Joint Committee on Intelligence and Security which would clearly give their views.

Senator LUDLAM: Yes, which are pretty strident in some cases. Some members of the joint committee have expressed at public hearings their concerns about the poor quality and rather vague nature of the proposals put forward by the then Attorney-General McClelland in the discussion paper in which the data retention proposal is canvassed so sketchily as to not really be canvassed at all. Does the department accept those comments as fair criticism?

Mr Wilkins : Yes.

Senator LUDLAM: Have you reviewed the preparation of that paper to determine how it could provide better material for committees considering issues like that?

Mr Wilkins : We have not reviewed that paper.

Senator LUDLAM: Let me put that another way. Is there another copy of the proposal, or is there other material that has been put to the committee?

Mr Wilkins : No.

Mrs Smith : The department has made a number of public submissions and former Attorney-General Roxon wrote letters which were also on the public record.

Senator LUDLAM: Is there a reason why the department refused to provide a copy of the proposal to the committee and did not discuss the existence of it until pressed to do so by Senator Faulkner at a public hearing? It took quite some time for that information to be forthcoming.

Mrs Smith : My understanding is that data retention was given attention in the discussion paper. As I mentioned earlier, it is only one part of a greater reform of interception legislation. We answered questions when we appeared. Both Mr Wilkins and I appeared.

Senator LUDLAM: Mr Wilkins, going back to your earlier comment about a root and branch review of the TI Act, that is something we have been calling for for quite a period of time. So perhaps it is something that we will be able to do down the track. Mr Wilkins, at a public hearing of the JPCIS in November on the national security reforms, in response to a question about whether data retention would be effective when internet users use an encrypted writing system like TOR you said, 'The department or the relevant law enforcement agency could require the key to the encryption to be provided as well.' You probably do not have that transcript in front of you, but is that-

Mr Wilkins : I cannot really recall. I do vaguely recall a conversation about encryption. What is the question, Senator?

Senator LUDLAM: I am just trying to tease out how this would work. If data retention was enforced in Australia for a period of however long, and an internet user is using an encrypted router service like TOR, it would effectively bypass the whole purpose of data retention. So, firstly, because I had a surprising response from the PM's cyber security people the other night, is the department aware of the existence of the TOR encryption service?

Ms Smith : Yes. The use of those sorts of technologies is normally to protect the content of communications. Data retention is about industry only collecting the information for which they are collecting for their own business purposes. I am sorry if there was some confusion with an earlier answer I gave before the committee.

Senator LUDLAM: No, that is right.

Ms Smith : Essentially an encryption key would only be used where there is an interception warrant in place which allows an agency to access the content of a communication, and the encryption key would be used under the force of that warrant so as the information could be provided and clear to be used as evidence or intelligence, as the case may be. Data retention, if the information is not available to a carrier, then they cannot retain that information-it is of no use to them either.

Senator LUDLAM: Yes. Can I just be clear: TOR is not an encryption service per se; it is an anonymiser?

Ms Smith : That is right.

Senator LUDLAM: You are familiar with that?

Ms Smith : I am familiar with that. We were talking about encryption keys and I was just explaining the purpose-

Senator LUDLAM: Yes, understood. TOR does not have permanent encryption keys.

Ms Smith : No, that is right.

Senator LUDLAM: And temporary keys are not available to assist admins anyway.

Ms Smith : Yes.

Senator LUDLAM: You are basically acknowledging that it simply would not apply-data retention would not apply in the case of somebody using that service?

Ms Smith : That is correct, unless the industry participant was able to have that information in the clear and they retained it for their business purposes-and it is very unlikely-

Senator LUDLAM: We have agreed that that is very unlikely that they would do so.

Ms Smith : Correct.

Senator LUDLAM: How would you respond to the argument, then, that even a freely available encryption and anonymisation tools like TOR, let alone the commercial ones, would utterly defeat the purposes of data retention? If somebody wanted to avoid their material being held it is trivially easy for them to do so?

Ms Smith : My understanding from working with the agencies is that is the reason they want to see major reform to the legislation to give them better tools to deal with these new technologies. I cannot give you the answer as to what that response would be.

Senator LUDLAM: Presumably those tools would need to include breaking those sorts of encryption services so they could not be used-

Ms Smith : Possibly.

Senator LUDLAM: Is that where this is heading? I think I will leave it there. That has been extremely instructive. Thank you.

CHAIR: That concludes all the questions we have for group 3.

[20:37]

CHAIR: We will now move to group 2. Could those officers come forward, please. Mr Wilkins, are you group 2 all by yourself?

Mr Wilkins : Yes. I have the minister.

CHAIR: That is hugely impressive.

Senator LUDLAM: He's got an answer for everything!