Holes in metadata bill make it unacceptable
Metadata regulation is needed, but the legislation before the Australian Parliament contains major flaw, writes George Williams.
Metadata regulation is needed, but the legislation before the Australian Parliament contains major flaw, writes George Williams.
OPINION: The Abbott government has succeeded in having Parliament enact an array of controversial new anti-terrorism laws. However, its greatest battle is yet to come. Its last measure for the year is a bill that compels telecommunications companies to retain metadata for two years. As yet, no one, including the government, knows what metadata is, except that it includes such things as the time and place of a communication, rather than its content.
Realising it has a difficult fight on its hands, the government has not tried to rush this measure through Parliament. Instead, the metadata bill is the subject of a lengthy parliamentary inquiry and will be a focus of debate in the New Year. The government hopes this will give it time to build a case for change.
Many people have expressed grave concerns about forcing telecommunications companies to retain metadata. The scheme has been criticised for its excessive cost, and because it enables blanket surveillance of the community. The measure is also inspiring a fear campaign based on the idea that the government could pry into the private lives of ordinary Australians and prosecute them for illegally downloading television programs and other copyright infringements.
Despite these concerns, a strong case can be mounted for a national metadata scheme. The data has proven its worth time and time again in solving crimes and in enabling prosecutions. It is without doubt an essential tool for the police and other agencies in combating serious criminal activity including terrorism and child pornography.
It also needs to be recognised that companies already retain metadata. They do this on an ad hoc basis with wide variations across industries, and authorities are accessing the data with few checks and balances. A national law is needed to provide a consistent approach to retaining metadata, and for ensuring appropriate safeguards in its use.
The problem with the government's bill is not that it mandates data retention, but that it contains major flaws. First, and most remarkably, the bill does not define what metadata is and, therefore, what information a company must retain for two years. It states, in an unhelpful and cryptic fashion, that service providers must retain "information of a kind prescribed by the regulations" or "documents containing information of that kind".
This leaves the real work of defining metadata to the government at a later date. Its efforts so far do not instil confidence. When the government does lay down a definition, the bill directs that metadata not include the content or substance of a communication. Instead, it must relate to things such as subscribers to a telecommunications service, their account or device, and the destination, date, time and duration of a communication. Concerns remain that the definition of metadata might include information that enables the authorities to reconstruct a person's web-browsing history.
Second, the bill fails to set out the full list of agencies that can access metadata. Attorney-General George Brandis has said the regime will apply "only to the most serious crime, to terrorism to international and transnational crime, to paedophilia". He has also claimed that agencies will not be able to access metadata to investigate copyright infringements and online piracy.
These statements are not correct. In addition to granting access to law enforcement agencies, the bill permits the Attorney-General to grant access to a wide range of other bodies. Indeed, he would be granted a wide discretion to do so. The Attorney-General could take into account not only whether the body enforces the criminal law, imposes penalties or protects the public revenue, but "any other matter" that he considers relevant.
Access to metadata could be granted to local councils, gambling authorities, universities, private security firms, toll road operators and organisations responsible for enforcing copyright infringement. Even if Brandis has no wish to extend the regime in this way, the bill enables a future government to do so.
Third, agencies will be able to access metadata at their own discretion. Despite the private nature of the information, no warrant will be required. This is out of step with the requirement that agencies seek a warrant for sensitive, personal information in other contexts, either from a judge or minister. At the very least, agencies should be required to gain the consent of a minister to provide a level of political accountability.
The government's metadata bill pursues a worthwhile purpose. However, in its current form, it is deeply flawed in providing no more than the shell of such a scheme. Parliament is being asked to pass a bill that compels telecommunications providers to retain unspecified information that relates to the private lives of ordinary Australians. This information could be accessed by an unknown range of organisations at their own discretion. This is not the metadata law that Australia needs.
George Williams is the Anthony Mason Professor of law at UNSW.
This article first appeared in The Sydney Morning Herald.