David Shoebridge (NSW, Australian Greens) Share this | Hansard source

I rise on behalf of the Greens to speak to the Telecommunications (Interception and Access) Amendment Bill 2023. This bill's purpose is to amend sections 65 and 137 of the Telecommunications (Interception and Access) Act to provide that information obtained under any of sections 11A, 11B or 11C—which are about warrants for foreign intelligence information—can be communicated, used and recorded in accordance with ASIO's wishes. Schedule 1 of the bill provides a capacity for agencies to communicate so-called foreign intelligence information—information obtained under those warrants—that contains threats to Australia or otherwise. It enables agencies, most specifically ASIO, to communicate that information however they see fit in accordance with the performance of their functions. What it does is remove the existing constraints on the use of foreign intelligence information.

This legislation has been brought in an unseemly hurry to the parliament—and I put on the record that we appreciated the urgent briefing that we got from the government, seeking to establish the urgent need for this legislation. We were not persuaded by that briefing as to the desperate urgency of the bill. The bill, of course, seeks to make changes to telecommunication laws, especially around ASIO's practice of sharing foreign intelligence information. I note at the outset that the rush to put this legislation through raises a very real question about what has been the practice inside ASIO up to this point. Has it been compliant with the existing provisions of the law? In short, has Australia's premier security agency been complying with Australia's law? Under the current law, ASIO can only share foreign intelligence information with persons who are named in the warrants issued by the Attorney-General. When you read the act and read the relevant provisions, that much is abundantly clear. That's what the law says—that, having obtained the information under a warrant, ASIO and other security agencies can only share that information with persons named by the Attorney-General. The question is: has that law has been complied with to date?

The bill seeks to change that law by, instead of having a defined list of persons with whom that information can be shared—and 'persons' means both natural and non-natural persons—creating what is described as a 'purpose test' for sharing information, instead of a person test. It also seeks to, in the course of making those changes, permit the Attorney-General to impose conditions. What that means is that the Attorney-General—instead of specifying who intercept material such as phone taps and the like can be provided to—has the capacity to provide a limited purpose for which the information can be shared. I will pause here to note that whilst we are talking about foreign intelligence information involving at least one party who is not an Australian citizen, almost inevitably this warrant material involves conversations with Australian citizens and Australian residents; that is the nature of this intercepted material. So it is wrong to suggest that we can just park Australia's privacy and rights based framework to one side and say this will only impact foreigners. That is not the case. Nor should we discard privacy and rights based analysis for third parties. But to suggest that this only applies to non-Australian citizens is to misunderstand how this law works. The information gathered will inevitably include many, many private conversations and private exchanges amongst and involving Australian citizens.

The explanatory memorandum says that, instead of information being shareable with named persons approved by the Attorney-General, 'The amendments will allow the Attorney-General to limit the communication and use of such information by specifying purposes or imposing conditions.' At first blush that may seem reasonable enough. It is not identified clearly in explanatory memorandum, nor is it explained in any detail on the second reading speech, but, on a close reading of the bill, it is quite clear that the Attorney-General does not have to put in any limiting purposes and is not required to put in any conditions for the sharing of the information. The bill, in fact, refers to the Attorney-General including a purpose, if any, which means that almost certainly the law will provide going forward that the Attorney-General can agree to a warrant, not put a purpose in, not put conditions in, and that literally allows the information to be shared with anyone, for any purpose that ASIO sees fit. Is this parliament comfortable in passing such a law, in giving such information-sharing power to ASIO? Having obtained this information inevitably involving private, otherwise privileged, communications amongst Australian citizens, ASIO, once having got the information, can literally share it with anyone for any purpose that ASIO sees fit.

We should move aside the wash about it being a purpose based reform; that is all spin. That is all to pretend that there are constraints and privacy constraints; they are pretend constraints. In reality, this bill lets ASIO share it with anyone for any purpose, and that could be with US, UK, other foreign intelligence agencies, literally with anyone. The only constraint is what ASIO wants to do with it.

There is also a fundamental flaw with the conditions clause, since the conditions imposed by the Attorney General, if they are imposed—and there is no obligation for the Attorney-General to put conditions on—only restrict ASIO. So the Attorney-General may have turned his or her mind to important privacy and public interest concerns about the nature of the information that is the subject of the warrant and may have put quite detailed conditions down, limiting what ASIO can do with it, limiting the circumstances in which ASIO can exercise the warrant, potentially limiting the classes or types of people whom ASIO can share it with, and maybe for good policy reasons. But once ASIO shares it with any third party, anyone at all, none of those conditions apply. None of them apply to that third party. That third party can share it with another third party and on and on and on, and the information is then at large. Are we comfortable with that, too, without any proper scrutiny of this legislation? It hasn't gone to committee and it hasn't benefited from consideration by the legal community or anybody with any of the privacy stakeholders. Are we really comfortable with rushing this legislation through without any consideration? There are two notional constraints that are meant to satisfy this parliament about the privacy and other constraints in this legislation, but when you look at both of them they both fall away. The Attorney-General doesn't have to limit it by purpose. Even if the Attorney-General gets very exercised and they put in conditions, those conditions don't run with the information. Once it's gone to any third party, those conditions effectively just fall away.

The rationale for supporting the bill is that ASIO says it needs the ability to rapidly share time sensitive information about credible risks from foreign targets in Australia to protect from risks such as cyberattacks. If that information is available and it's needed to be shared on an urgent basis, the law should permit it—and the law does. It would require putting that information in front of the Attorney and expanding the list of persons; that's what it would require under the current law. It is hardly an unreasonable burden and hardly an inappropriate protection for Australia's privacy and the right to privacy of millions of Australians.

On balance we don't believe the bill should be supported without significant amendment, but we think it is fixable. We're not here simply to say, 'no, never', but we've looked at the bill and we think it's fixable. We are proposing to move two amendments to address the accountability gaps in the scheme and to implement some reasonable checks and balances. The first of the amendments will require the Attorney-General to put in specific purposes for the use of any information obtained by the warrant—so, rather than it being a feel-good notation in the explanatory memorandum and an element of the government's press release, it will actually require it to be in the law. We cannot see a rational basis to not put that limitation in. This goes through that process with the Attorney anyhow; it's just saying the Attorney must do their job and turn their mind to the purposes and specify the purposes.

The second amendment we'll be moving is in recognition of just how rushed this is, of the drafting concerns we've identified in less than 24 hours and of the fact that this legislation is only being moved now to patch up something that was rushed through the parliament two decades ago. It is to recognise and look at that history, and say, 'Actually, rushing the previous legislation through created a mess which we are apparently cleaning up today.' In recognition of that we have an amendment proposing a three-month sunset clause in the bill to effectively require the government, potentially through PJCIS, to do a rapid review of the bill, to consider if it does provide the right balance, and, if necessary, to come to the parliament with a fully considered regime—not something that was dreamt up on Monday, drafted on Tuesday, whacked on the photocopier on Wednesday and passed by midday. I'll speak to both those amendments in committee.