Scott's stand against mandatory data retention

I am here today on behalf of the Australian Greens to oppose this bill in the strongest possible terms. In the course of the debate over the next few days, we will spend a lot of time considering elements of the bill in detail: its impact on journalists, the unknown costs, the inevitable mass breaches of privacy that will follow and the technicalities of how the bill will actually work. But, before we disappear into the weeds and the technical detail, I want to state plainly why I believe that this bill is unamendable and why it should be rejected.

This legislation, the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014, betrays a mindset that inverts the power relationship between the state and the individual. It provides for the mass collection of private information of 23 million people who are neither suspected nor accused of having committed a crime. It entrenches the ability of dozens of government agencies to access these private records hundreds of thousands of times a year without a warrant and it normalises the fiction that this information is nothing more than billing records or the envelope that surrounds substantive communications.

Over a period of many decades, democracy has evolved, developing ways to protect citizens from the power of the state. These are some of the foundation principles of liberalism, from which the hollowed-out entity that proposed this bill takes its name. One of these points of balance is the judicial warrant: if the state wants to violate your privacy, there needs to be a good reason. These reasons include corruption; serious organised or violent crime; crimes against children; or genuine national security threats, including terrorism. In Australia, around 4,700 such warrants are issued every year, and, in a country of 23 million people, that does not seem like an undue amount. The police surveillance scandal in New South Wales has exposed the fact that even these judicial checks and balances sometimes fail, but it is a system which has worked tolerably well for the most part.

The act that we are amending today was written in 1979, under the prime ministership of the recently passed Malcolm Fraser. Mobile phones only existed in Star Trek. The internet was unthinkable for all but a handful of researchers and futurists. Fast-forward to 2015: there are more mobile phones than people in this country and the internet is busily infusing nearly every corner of our lives. Every one of these devices, seen and unseen, generates a cloud of information in the course of its ordinary operation. One single tweet 140 characters long is the tip of a small iceberg of code that runs to about a page and a half. Your phone handset is essentially a tracking device that allows you to make phone calls. Our relationships and our social lives are increasingly mediated by digital tools. Collectively, these devices and apps silently generate billions of records of place, time, contact, data type and volume, all of it aggregated under this loose concept of 'metadata'. Anyone who tells you that these are simple billing records or the innocent envelopes surrounding substantive communications is either technically illiterate or lying to your face.

In 2012-2013, agencies made around 340,000 demands for this information from Telstra, Optus and the rest of the telecommunications industry, without the trouble of having to apply for a single warrant. Now, I do not have more recent numbers than that because the Attorney-General's Department is refusing to publish the report for the last financial year. Telecommunications regulator the ACMA reports 748,000 warrantless authorisations were received by carriers in 2013-14. Why do agencies do this? Here is NSA contractor Edward Snowden:

… metadata is extraordinarily intrusive. As an analyst, I'd prefer to be looking at metadata rather than content because it's quicker and it's easier and it doesn't lie.

Former General Counsel of the NSA, Stewart Baker, said:

If you have enough metadata, you don't really need content.

And, just in case we were not completely clear, consider former CIA Director Michael Hayden's memorable boast of last May:

We kill people based on metadata …

This is a bill to entrench a system of passive mass surveillance. It is corrosive of the very freedoms that governments are elected to protect and it has no place in a democracy. Yet it is a democratically elected parliament that is probably about to enact it, and nothing I say in here this afternoon is likely to change the minds or the votes of the senators from the Liberal, National or Labor parties, who will file in here later this week and vote the way they have been told to vote. Many of them strongly disagree with the bill, and a small handful have spoken out; and a few—we will pay attention to who—will no doubt be absent when the vote is finally taken.

The Liberal Party: if you go to their website, under 'About' and then 'Our Beliefs'—I wonder when was the last time you checked this out, Senator Fifield—here is what it says:

We Believe:

In the inalienable rights and freedoms of all peoples; and we work towards a lean government that minimises interference in our daily lives; and maximises individual and private sector initiative

That is why you have imposed a $400 million surveillance tax on the whole country! Well done!

The Labor Party: how apt that this week we are debating the return of the Australian Building and Construction Commission. Presumably you are aware that this entity, which treated the blues as though they were something worse than terrorists, was doing warrantless metadata surveillance of trade union organisers in its previous incarnation—somewhere between a dozen and 30 warrantless requests per year until we closed it down. I am sure that those union members had nothing to hide and they therefore had nothing to fear from the ABCC.

And so it falls to the Greens and the crossbench to stand up and provide the opposition that this reckless and vicious government so desperately deserves. In this, we represent views that are entirely mainstream. Guess who described metadata retention as a 'sweeping and intrusive new power' when the Labor Party was toying with the idea in 2012?

 Photo of MPSenator DI NATALE: Was it Malcolm?

 Photo of MPSenator LUDLAM: Senator Di Natale has it in one. Who said the following?

Leaving aside the central issue of the right to privacy, there are formidable practical objections. The carriers, including Telstra, have argued that the cost of complying with the new data retention regime would be very considerable with the consequence of higher charges for their customers.

Yes, that was the Liberal member for Wentworth, Mr Turnbull, basically demolishing the case for this proposal—probably more eloquently than I am today. Who said: 'I think that this proposal is akin to tactics that we would have seen utilised by the Gestapo'? Well, that was the Liberal member for Moncrieff, Mr Steve Ciobo. When Labor does it, it reminds him of the Nazi secret state police; when Prime Minister Abbott and Senator George Brandis pick it up, it is just to keep us all safe and there is nothing to see here. The President of the Law Council of Australia, Mr Duncan McConnell, was a little less strident but still believed the following:

They propose that the bill be withdrawn, amended and released as exposure draft legislation for public consultation.

He goes on to explain why: because of 'concerns about the proportionality of the data retention regime, security of the retained data and the impact on privacy and confidential communications.' That is the Law Council. The CEO of the Media, Entertainment & Arts Alliance, Paul Murphy, put it this way:

Any system with the capacity to go after confidential sources has a chilling effect on journalism because it targets whistleblowers who seek to expose wrongdoing, illegality, dishonesty, fraud, waste and corruption. If you are going after sources, then you are going after journalism.

This government appears to be enjoying something of a habit of going after journalists to find out who they are talking to when they print unpopular stories about things like the horrors of the prison camps that we maintain on Pacific islands. Nobody on that side of the chamber appears willing to make eye contact at the moment.

Do not say you were not warned: industry has been raising the flag, and so has the former Director-General of ASIO, Mr David Irvine. Telstra's chief information security officer, Mike Burgess, put it this way:

If [you were] that way inclined as a hacker, you would go for that system because it would give you the pot of gold, as opposed to working your way through our multitude of systems today to try and extract some data.

Of course, this $300 million or $400 million surveillance tax is going to build new data centres to store all this excess material that industry has not had to store before. But it is not just that, and I am not sure that it is well understood. It is about the systems that would allow the telcos on demand to very rapidly withdraw the material from their servers and provide it to these agencies on the basis of the rubber-stamped request, which means matching names and address types across all the various systems. It creates a huge new pool that will be entirely attractive for people with malicious intent. Do not say that you were not warned.

In the end it will be the Greens and the independent crossbenchers who provide the opposition—just as it was in the House of Representatives when this was committed to a vote last week—but anyone who can count understands that there will not be enough of us. We have seen this before—most vividly last year when the Australian government criminalised national security reporting. When Prime Minister Abbott wraps himself in the flag—no matter how much an object of desperate ridicule he has become—that is the signal for the Australian Labor Party to say something earnest about finding the balance and then to cave in. Those two words, 'national security', are all it takes for the Australian Labor Party to flop into defeated bipartisanship because they are terrified the Daily Telegraph will say mean things about them.

If the bill passes, we know this will be just the beginning. It has scope creep written into its DNA. The Attorney-General can add new categories of data and new agencies to the list of people who can look through your stuff any time he likes. They propose that parliament should to ratify the Attorney-General's decision within 40 sitting days. Depending on the time of year, 40 days could be anything up to six months; and parliament will be expected to rubber-stamp the decision that the Attorney-General makes. The Victorian police wanted five years. There is no secret among some of the agencies pushing for this proposal that two years was the minimum, even though that is the maximum that has been applied anywhere else in the world. They will be pushing for five years, next time something awful happens somewhere in the world; then they will be pushing for it not to be deleted at all, because it has proven to be so valuable. Then they will be pushing for web traffic and session logs. Scope creep only operates one way: once you legislate this kind of system, it is immensely difficult to claw it back.

The saddest thing about this policy debacle is that nobody can provide any evidence that it will reduce crime or make people safer. There are any number of anecdotes about the importance of metadata for investigations—I understand that it is used in slightly less than 100 per cent of investigations. I understand that it is valuable and I have no reason to believe that the anecdotes that are flipped out by people pursuing this policy are untrue. But where is the evidence that blanket surveillance of millions of innocent people helps reduce crime? In Europe, where a data retention regime was briefly implemented before being thrown out by the European Court of Justice as an abuse of human rights, the evidence is crystal clear in its absence—data retention had no impact whatsoever. President Obama's high-level panel on the NSA's surveillance abuses came to the same conclusion: targeted surveillance of criminal suspects and networks helps prevent and solve crime; mass surveillance of millions of innocent people does not. What an immense surprise that must be to all of us.

When I asked Senator Brandis last week in question time to provide evidence of how indiscriminate collection of the private phone and internet records of millions of innocent people helps make the country safer, instead of evidence, he referred me to an ASIO press conference—simply because ASIO says so, because they want it. Chair of the Parliamentary Joint Committee on Intelligence and Security, Mr Tehan, has done much the same thing on many occasions. Of course, clandestine agencies and police authorities want more power. It is the job of the Attorney-General to keep them in check. If the Attorney-General ends up being too compliant to uphold this responsibility, then it falls to parliament. The Abbott-Shorten mass surveillance unity ticket sets this parliament up to fail. Instead we fall back on the dismal logic of 'nothing to hide, nothing to fear'. That is the logic of the police state: if you have done nothing wrong, then the police have no need to go through your stuff. Can anyone in here recall a bill passing where the government and opposition did not know to within the nearest $100 million how much it would cost? Last week an extraordinary letter was signed by the CEOs of the nation's major telecommunications providers, and I seek leave to table that letter now. It was circulated earlier with the consent of the whips.

Leave granted.

 Photo of MPSenator LUDLAM: This is a letter that has been signed by the nation's telecommunications providers—from Telstra, Optus, Vodafone Hutchison, the M2 group, iiNet, Macquarie Telecom and a whole page of others—demanding to know who is going to pick up the tab for the 300 to 400 million dollars surveillance tax that the Liberal Party and the Labor Party are introducing today. They say in part:

We note that the Government has variously indicated it will make a "reasonable" or "substantial" contribution to these costs—

that is, out of taxpayers' money—

which might exceed $300 million—

but they do not know; they are guessing; they are as much in the dark as the rest of us—

according to estimates provided by the consultants commissioned by the Government.

They have seen that document; this parliament has not, and neither has anybody in the public, because the government refuses to table it. The letter continues:

Our request to you is, we believe, relatively simple and reasonable.

It is that the Government provide to industry, the Parliament and the wider community a degree of certainty as to the size of the Government's planned contribution—

and how they plan on cutting up these funds. This is going to drive some of the smaller telecommunications carriers in this country to the wall. Telstra is not wild about this proposal, but it will be able to adapt and upgrade its systems—and it has said as much—which are very large and complex. But, of course, Telstra has pretty deep pockets and it is going to be able to accommodate a proposal such as this. What about the smaller providers, who are suddenly being forced to participate in the building of new data centres to help host this stuff or to farm it offshore to cloud providers who knows where?—maybe China. Best of luck hanging on to that material once it has left this country.

Having tabled that letter, I would also like to move my second reading amendment. The amendment adjourns the debate until after the matters raised in the letter by the CEOs have been resolved. I move:

At the end of the motion, add :

and, noting concerns about a lack of clarification from the Government about costs associated with this bill as strongly addressed in a letter to the Government signed by the chief executives of Telstra, Optus, Vodafone, iiNet and a number of other major telecommunications companies, further consideration of the bill should be made an order of the day for the day after the Government tables its response to the industry's concerns on cost.

On the understanding that the Abbott-Shorten surveillance unity ticket will override the better judgement of individual senators, who I know hold their own private misgivings about this bill, what happens next?

My words today are essentially for those outside the building, because, as it happens, there is plenty we can do: when the parliament fails in its fundamental job of constraining executive power, we can take our power back as citizens, as Australians, in many other ways. I want to thank everyone who called their Labour senators or who melted opposition leader Bill Shorten's phone over the last couple of weeks and everyone who hit up the Labor Party on social media. The injured tone of Senator Collins in introducing her remarks was readily apparent—I almost felt sorry for her. Forgive us for not expressing our gratitude to the Labor Party for caving in to Prime Minister Tony Abbott. It was very apparent from Senator Collins's tone that it has only just sunk in that the very medium that you are compromising with mandatory data retention is the same medium that you need to sell the rest of your agenda—and you wonder why people are not listening to you and why they are so angry.

It is entirely lawful—in fact, it is built into the bill—to circumvent mandatory data retention just by using overseas providers. If you do not want your email records kept under mandatory data retention, go with an overseas provider like Gmail or Yahoo! or Hotmail, if that is still around. Use Facebook Messenger. Use Twitter direct mail. I am not advocating that, of course, because that is extremely bad news for Australian telecommunications providers—that effectively the government is incentivising people to use offshore services. Well played; very, very smart; nicely supportive of Australian industry there! The government have had to do that, because of course there is no way of compelling overseas providers to hand over their records to an Australian data retention scheme. So, if you do not want your email records kept by this scheme, use Gmail or Hushmail or an overseas email provider. That is entirely legal. Any over-the-top service provider circumvents this bill: bravo, and well played!

Encryption is not illegal. The United States went through a very damaging variant of this debate in the 1990s during the so-called crypto wars, which fundamentally established that everything from the global financial system to global diplomacy, business and global civil society actually depends on strong encryption, depends on privacy. That was a lesson that was only learned at some cost. Encryption is not illegal. Private-key cryptography—including the very phone apps that Mr Turnbull is using to orchestrate his takeover of the Prime Minister's office—keeps no metadata. These systems keep no metadata; they leave no trace. They will be completely beyond the reach of this data retention scheme—as Mr Turnbull, who introduced this bill, so helpfully explained a couple of weeks ago. Free services like TOR, the onion router, which allow you to use the internet anonymously, completely defeat the purpose of a mandatory data retention scheme—and everybody knows this. Virtual private networks, available at a very reasonable subscription rate, make it impossible to tell where in the world who are when you are using the internet—also not illegal. Anonymity is not illegal, circumvention is not illegal and cryptography is not illegal.

So what I am proposing now is that we take our power back from a government that quite clearly has drunk the surveillance Kool-Aid, even though there is abundant evidence that it will do nothing at all to keep people safe or to reduce crime. If you are unhappy, perhaps most of all, with the dismal arithmetic of this place, then change the balance of numbers in your parliament in 2016, and replace major party politicians with people who have the capacity to think and vote independently on issues like this, rather than just sucking it up from the leader's office. If you have a few moments to spare, call opposition leader Bill Shorten. His number is (02)62774022. Maybe just make that call now—you will feel better; I can guarantee it.

We will not forget what the major parties have done this week and we will not forgive them when the inevitable privacy breaches occur down the track. This measure will be repealed at some stage in the future, either repealed or rendered obsolete as technology marches forward. If you are listening to this debate and you wish it were to end differently, change the way parliament operates and help break the two-party system once and for all.