Tim Wilson (Goldstein, Liberal Party) Share this | Hansard source

It is a great pleasure to be able to speak on this important piece of legislation, the Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020, because sitting at the heart of it is the constant tension between freedom and security of the people of Australia, not just in the physical realm but of course online as well. We reviewed this legislation in the Parliamentary Joint Committee on Intelligence and Security, on which I am privileged to serve, because of the very nuanced parts in which it operates around Australia's electronic records and data and the implications it has.

The Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020 is quite an innovative, modern and worrying piece of legislation. I don't say that as any point of criticism of the legislation or its intent, but, in the end, it raises serious questions about the bounds of the state and the capacity of police forces and our agencies to investigate certain operations and the means by which they can do so.

I support the bill wholeheartedly, but I have reservations about it. I am glad that there are constant review mechanisms around how we look at this legislation, through the Independent National Security Legislation Monitor, the IGIS and, of course, the PJCIS, as well as this parliament—and we reviewed legislation around specific and extraordinary powers only in recent days—because we must always make sure that, when legislation of this sort is put before the parliament and imposed upon the people, it has proper accountability and scrutiny and continues to meet the need to keep Australians free and safe.

The legislation itself is quite complicated, but it goes to the heart of one of the emerging challenges that exists around disrupting, significantly, online activity which is done with malicious intent or to undermine Australians' health, welfare and security. The bill introduces, essentially, three new powers that will substantially boost the capacity of the Australian Federal Police and the Australian Criminal Intelligence Commission to fight cyber-enabled serious crime. Of course, in many cases, this work—or what is ordinarily completed by these agencies—is done with existing powers in a physical realm, but this is about updating the legislation to enable them to do similar work, recognising the complexity and the emerging challenges of the online world.

There are three essential new powers. One is for network activity warrants, which will enable the Australian Federal Police and the ACIC to collect intelligence on the most harmful criminal networks operating online, including on the dark web, and when using anonymising technologies. We need to realise how common these anonymising technologies are, particularly amongst criminal networks. We are all very familiar with using encryption with our own communications in the modern era—and, in many cases, we are very thankful for it—to maintain and preserve our privacy and security. However, we are seeing, increasingly, a large amount of activity being done through technology where it is almost impossible to identify the end user and without at least some capacity to utilise the technology to identify them, often having to go beyond the superficial nature of the technology and of course in the realm of the dark web where nefarious intent lies.

Now, the overwhelming majority of Australians have no real interest in the dark web—and I include myself; the only time I've been there is when somebody has demonstrated to me how it is that one gets there, and it's more complicated, frankly, than I'm probably interested in entertaining in an ordinary context. I know that there are many people who have used the dark web, and sometimes for legal or legitimate reasons. But the overwhelming majority of people who use the dark web are doing it because they're trying to conceal something and there's a reason why they're trying to conceal it—and I don't mean in terms of morality, though that can be a part of it, but simply because they know that what they're engaging in is a form of criminal conduct that, if it came to the attention of responsible agencies, would be justifiably suppressed because it would cause harm to others, either to their physical health or wellbeing or to protection of their property.

So the network activity warrants provide a pathway to investigate intelligence on criminal networks that operate online, particularly through the use of new technologies. One of the reasons we need this legislation is that technology—as it should; I just need to be clear—moves faster than the rate of legislation. It moves fast. We are always responding. That's what happens in a free society. In a free society, people are able to go out, to innovate, to push the boundaries, to see where we can take humanity and its progress, and we should be excited by that. But every good technology that comes along with a legitimate purpose can be used, abused and manipulated by those who wish to achieve ill in society or for their own personal gain, with nefarious intent. So we're always responding, and this bill provides for a pathway which is broad enough to enable us to continue to adapt with technology, but narrow enough that it has the safeguards, obligations and restrictions that operate on our agencies so they cannot abuse it and it needn't become a justification for people to be concerned about their lawful privacy or activity simply because they choose to go into the electronic or online realm.

The second significant power is for the data disruption warrants that enable the AFP and ACIC to disrupt serious criminality online, authorising the AFP and the ACIC to modify data belonging to individuals suspected of criminal activity, to frustrate the commission of serious offences such as the distribution of child exploitation material. If we had the capacity to fulfil this function, it would be very hard for most members to argue against the spirit and intent of what this power is designed to do. We all know that, tragically, information and content is shared online that is often sourced explicitly through the abuse of minors and children—normally not in this country, but we need to acknowledge that, tragically, sometimes it does occur in this country. But it doesn't stop there; the exploitation and the distribution of that material, either live or through some sort of stored mechanism online, goes to other parts of the world. If anybody thinks that this parliament would not take the hardest and firmest view against such conduct, not just because of its criminality but also because of its immorality and the abuse of children, they are deluding themselves. I would hope none of us would be prepared to tolerate such conduct when we know that we can take measures to stomp it out, even if it doesn't occur in our country. If Australians, sadly and tragically, are consumers of such behaviour or conduct, we should seek to hold the people engaged in it to account and stomp it out. The role of our agencies, as much as anything else, is to help do that, not just in the interests of Australians and their health and wellbeing but also for children overseas. We make no apologies in standing up against child exploitation, because it is the fundamentally moral position to take and the right one for all of us. I'm sure you would agree with that, Deputy Speaker Vasta.

The third power is an account takeover warrant enabling the AFP and the ACIC to take control of a person's online account for the purpose of gathering evidence about criminal activity, to be used in conjunction with other investigatory powers. This power is actually extraordinary, and I think we need to acknowledge that. It would enable agencies to take over people's accounts and, for want of a better phrase, present themselves as somebody else, in pursuit of investigation and establishment. This raises serious questions about entrapment, whether there's justification for police doing so, and the consequences that then flow. I don't think we should hide away from that.

There were recommendations from the Parliamentary Joint Committee on Intelligence and Security about the threshold tests that apply around warrants that have not been fully adopted. I'll be frank—and I acknowledge the minister in the room—and say that my preference would be more consistent with that of the committee. That's why we made those recommendations. I will not die in a ditch over them, because the purpose of the legislation is more important than the threshold, but I think the threshold test around warrants and their application, particularly with the new powers, is something that we as a parliament need to review. This is an ongoing piece of work that we as a parliament will need to address some time in the future—maybe the next parliament, depending on who is here, of course—to decide on the warrant powers that would exist against new types of online platforms.

The principle remains the same: we need to make sure there is independent oversight and approval associated with the exercise of these powers, because they are serious and they're a departure, particularly when we're introducing world-leading legislation. This is world-leading legislation that seeks to push the boundaries of what can be done online. For a number of reasons, we need to make sure that there are proper accountability mechanisms and safeguards, but firstly because it's about public confidence. One of the things we always face in the space of national security and the tension with civil liberties is making sure that governments don't overstep the mark and aren't given a free hand. Public confidence comes not just from members in this place, although they're a critical part of the conversation. It also comes from the public when they don't feel that these powers will be abused, even by well-meaning agencies, in most circumstances, against otherwise law-abiding citizens going about their normal life.

One of the most significant and dramatic trends that have occurred within my lifetime—and there are a number of them—concerns the privacy people have in an online setting. Some people are completely indifferent and share everything; others take it very seriously. But we should always start from the basic proposition that we respect citizens' rights and their freedom to keep things private. If they don't seek to put something in the public domain, then ultimately their intention is to keep it private, and we don't want agencies or the police to somehow have powers that needlessly compromise not just that principle but the confidence that underpins so much of our national security legislation and framework. We need to be clear: the Australian community does hold a very high degree of confidence in it for that exact reason. So we want to maintain public confidence, but also, as members of parliament, we shouldn't want the abuse of state power, even when we're seeking to achieve something for legitimate purposes, because in the end we all operate in a free society that's based on the idea that we restrain government power, democratise it to the people, and respect their right to live their lives without constant fear of an egregious Canberra monopoly overseeing their daily lives.

I think we have, broadly, the legislation we need. It has gone through the PJCIS process, which, as I have said previously, is a very collegiate one. I know as a committee member that for every piece of legislation we go through, including this one, we get substantial briefings from agencies as well as feedback and public hearings that reflect questioning to challenge and test the assumptions behind the legislation and the justification and need for it. With this particular legislation we were taken through some aspects of the application of it. Some of those briefings were, as always, done confidentially, but they provided committee members with insights into how the agencies work successfully to do the job they need to do on behalf of us.

When you get a report from the PJCIS making a recommendation to pass legislation, it's a reflection of the House's confidence not just in the position the committee had adopted but in the degree of rigour that we apply. It is very rigorous, often with members—including me, I'm proud to say—having quite diverse views and sometimes with a member taking a bent that directly challenges not just the assumptions behind the power of the agencies but the position of government. That includes government members, as well. That should breed confidence. As somebody once remarked, we have the full philosophical spectrum of our parliament represented on that committee, and that is one of the reasons it does good work. And it's one of the reasons it should continue to do good work so this House can make decisions with confidence.

This legislation is important. It gives a very good basis for the updating of appropriate surveillance of online behaviour when people engage in criminal or nefarious activity. The three new powers included in it provide a clear basis on which we can ensure that our agencies have the powers they need to do the job that we the people, as well as this parliament, want them to do. None of them are in contexts where people are engaged in behaviour that would normally pass the test of social acceptability. These powers and the thresholds and safeguards that operate around them are designed so that each time they are used they are cracking down on criminal behaviour, whether it's the drug trade or types of exploitation. I refer in particular to the data disruption warrants around child exploitation material. Technology, though it can be used to empower the individual for good purposes, needs to be constrained when it is used for nefarious ones, and we will need to continue to review and update legislation—not just this bill but many other bills—to follow and respond to the evolution of technology. It is one of the most critical challenges we face in this parliament and one we must take up and master.

See this speech in context