National Telecommunications Conference Brisbane - 14 August 2008
Introduction
I am very pleased to welcome you to this second National Telecommunications Conference.
I particularly extend a warm welcome to the representatives of the Metropolitan Police, the New Zealand Police, the European Technical Standards Institute and FaceBook USA.
Your attendance at this conference recognizes that we are all facing significant challenges in maintaining our capacity to intercept telecommunications for law enforcement and intelligence purposes.
It also recognizes that we can’t succeed by ourselves.
A concerted international effort offers, in my opinion, our only chance of keeping up with the extraordinary pace of technological development in the telecommunications industry.
Need for a concerted international effort
Three years ago, the then Australian Attorney-General and I visited Bell Laboratories in New Providence, just outside New York.
We were told that the speed of the development of new technology and the sophistication of retail off the shelf software and encryption products meant that our capacity to intercept was going to be greatly reduced unless we moved very quickly.
Nothing has occurred in the intervening three years to lessen this threat.
In fact, the recent introduction of the iPhone indicates how quickly things are going ahead.
As you know, 3G technology means that with one device you can: make mobile phone calls and receive and send SMS and video messages; send and receive web based email and browse the web including social networking sites; take photographs; play music and videos; display photos; and work out where you are while you are doing all of the above on the global positioning system.
However, on a more positive note, the former Attorney highlighted the warning sounded by Bell Laboratories in subsequent meetings with his counterparts in friendly countries, including the UK and the USA.
Each of them indicated their willingness to work together to find acceptable solutions to the extent they were politically achievable.
Importance of T I in Australia
We are very concerned about these problems in Australia because we have a very well developed and effective telecommunications interception regime which is founded on the requirement that every carrier must be able to provide authorities with the capacity to intercept.
This level of access is essential for our intelligence services but it is also makes an outstanding contribution to law enforcement, because we can use intercept evidence to support criminal investigations and as evidence in subsequent trials.
We have had two outstanding examples of the importance of TI in criminal investigations just last week.
The Australian Federal Police and the Australian Customs Service announced they had seized the world’s largest haul of ecstasy and dismantled a very significant organized crime syndicate operating here and in several other countries.
The drug bust netted almost four and half tones of ecstasy or 15 million tablets worth around $440 million on the street.
In a press conference held on Friday, the present Attorney-General, Robert McClelland, stated that the investigation had involved 10,000 hours of interceptions.
The second example is about our largest terrorism trial which is reaching its final stages this week in Melbourne. The Australian newspaper reported on Monday that the jury has listened to 482 secretly recorded conversations and telephone intercepts involving the 12 accused of terrorist offences, which make up the bulk of what the prosecution has described as a largely circumstantial case (page 16).
The most recent statistics illustrate the importance of TI in Australian law enforcement.
In the year to 30 June 2007, there were 3,280 applications for TI warrants, which was a 10% increase on the preceding period.
There were 1,743 arrests made and 2,671 prosecutions commenced based on intercepted information. In addition, 2,256 convictions were recorded in prosecutions where intercepted information had been given in evidence.
New crimes
Of course, our concerns with telecommunications aren’t limited to increasing threats to our interception capacity.
We are also concerned that new technology provides a new field in which crime can flourish.
The Australian Crime Commission recently published a report on Organised Crime in Australia. The report noted that:
An increasingly large range of offences is committed using computers….. The criminal exploitation of technology is diverse, flexible and opportunistic.
Crime may be carried out against users or providers of technology for financial profit such as phishing, fraud or malicious attack…
Alternatively, organized crime groups may use technology such as secure communication tools to facilitate criminal activity or protect themselves from law enforcement.
The Crime Commission also said:
Advances in technology are increasing the effectiveness of many of these criminal activities. The internet has had a dramatic effect on the operations of criminal groups, particularly those involved in financial crimes and pornography.
Where to from here?
I know you know most of these facts and issues.
But it is useful to set the scene for trying to work out where we go from here and how, in doing so, we balance the conflicting needs of intelligence and law enforcement agencies with individual rights in a liberal democracy.
With that in mind, during the course of this conference you will consider the laws regulating telecommunications interception; the implications of new technology; a range of operational issues; and regulatory developments.
Legislative framework
Given my Department’s responsibility for the Telecommunications Interception and Access Act, I have a direct interest in ensuring our legislative frameworks are up to the task.
We know our laws need to be brought into the 21 st century. That is obvious when you realize that the TI Act was first drafted nearly 30 years ago.
Fortunately it was written in technologically neutral language so it could accommodate telephones, telegrams and telexes although I imagine there are some people in this industry today who don’t know what a telex is or what a telex machine looked like.
So it’s not hard to mount an argument that the legislation needs to be reconsidered in the light of modern technology – the internet, Voice over Internet Protocol, mobile phones, SMS messaging, BlackBerrys and iPhones.
It’s instructive to reflect for a moment on how fast this industry is growing.
Less than 30 years ago, telecommunications were delivered by one company – Telecom – as a single service – voice calls.
Now Australia has over 170 licensed carriers with around 1,600 internet service providers, some 2,000 companies providing Voice over Internet Protocol services and thousands of cafes, hotels and universities providing WiFi hot spots.
The global nature of telecommunications also means that Australian companies face unlimited overseas competition and law enforcement has to deal with borderless crimes.
Attorney-General McClelland recognizes the importance of this challenge and has authorized the Department to scope out possible legislative initiatives dealing with network protection, data retention and the Technical Assistance Centre.
However, there is no doubt any legislation in this area will be politically sensitive and the Government will insist that any new laws or regulation balance the rights of public authorities, telecommunications carriers and individuals.
Five balancing factors
I can think of five factors we will need to take into account in achieving that balance.
The first is privacy.
Privacy
The Telecommunications Interception and Access Act has always placed a great deal of importance on the privacy of individuals.
Section 7 of the Act prohibits the interception of communications except in specific circumstances, most notably under an interception warrant.
A warrant can only be obtained for the offences listed in section 5 of the Act.
In addition, sections 46 and 46 A require authorities issuing a warrant to take into account the privacy of any person using or calling a service and whether other investigative techniques are available before issuing a warrant.
Given that telecommunications now pervade most areas of daily life, we can expect this emphasis on privacy to be maintained and even strengthened in future.
But this will be a difficult task because technology is now so pervasive in every aspect of daily life and public attitudes to privacy can be confusing.
On the one hand, in addition to their longstanding worries about misuse of personal details and identity, some people are also concerned about new products like Google’s Street View that shows 360 degree pictures of streets and homes.
On the other hand, subscribers put huge amounts of personal information on social networking sites like MySpace, FaceBook and Beebo including birth dates, phone numbers, personal photos and random thoughts recorded in their online diaries.
I understand that FaceBook claims more than 90 million active users with over 6 million active user groups. It is the fourth most trafficked site in the United States with more than 65 billion page views per month and more than 24 million photos uploaded daily.
It’s not surprising that one commentator recently summarized this issue this way. Writing in The Age newspaper on 15 July this year, Graeme Philipson said if you want instant movies, music and phone calls, you have no privacy. Get over it.
Our Attorney-General is well aware of both the need to protect privacy but also to have laws that meet the demands of the times.
In a speech in Sydney on Monday, Mr McClelland said:
..as we face the challenges of the 21 st century, as a progressive nation, Australia must develop the attitudes and protections that suit out modern environment.
And, at the same time, we must balance this with important rights including the right to privacy.
Secure communications
At the same time as working its way through this privacy maze, the Government is committed to ensuring that Australians have access to secure communications for their personal and business dealings and to protect their children from pornography and worse.
This commitment can be seen in the work of the Australian Federal Police’s High Tech Crime Operations and Online Child Protection Operations and the Government’s current E-security review.
A media item on 6 August this year reported the Commissioner of the AFP, Mick Keelty, saying that incidents of online fraud in Australia had jumped 60% in the past 12 months, while 3.6 million Americans lost money last year after having their identities stolen.
While members of the community may not have these statistics at their fingertips, they are certainly alert to the risks involved in identity fraud and expect the Government to do something about it.
The Unisys Security Survey and Index published in June 2006, which is based on a Newspoll Survey, supports this observation about community awareness.
The Survey recorded that 53% of Australians or 8.3 million people are very or extremely concerned about other people obtaining their credit or debit card details.
The Survey also reported that 35% of Australians or 5.5 million are very or extremely concerned about computer security in relation to viruses and unsolicited emails.
Thirty-five percent of Australians or 5.4 million are very or extremely concerned about the security of shopping and banking online.
Fifty-six percent or more than 8.7 million Australians are very or extremely concerned about unauthorized access to or misuse of their personal information.
I haven’t seen a more recent survey, but I am confident these figures illustrate a level of concern that is unlikely to have gone down in the last two years.
Preventing crime
The third factor we have to bear in mind is the need to prevent, detect and prosecute crime. I have already mentioned the Crime Commission’s report on criminality in Australia.
The ACC has found that identity crime is one of the most critical and widely used activities that enables or assists other crimes.
Instances of identity crime have been growing for some years and it is now fundamental to many organized crime activities.
The ACC has also observed that crime groups are moving into the telecommunications and insurance industries.
Sectors with strong growth, complexity and the ability to make transactions at arm’s length are attractive to organized crime. Sectors with potential for cross border trade are also appealing.
I think it follows that law enforcement agencies have to have the technology-enabled tools to protect the community from these technology-enabled crimes.
It is not surprising that other countries are as worried about these issues as we are.
The head of the US Department of Homeland Security, Michael Chertoff, was recently quoted on this topic in the Sydney Morning Herald (19 April 2008, page 29).
In that article, Tom Allard asked what would happen if crime syndicates or terrorists could disable the computer networks that sustain the critical infrastructure of modern societies in what was alarmingly dubbed a cybergeddon or digital mushroom cloud.
Mr Chertoff said: The leverage that even a singly, skilled individual has to cause mass havoc is enormous. In that sense, cyber threats have enabled terrorists and criminals to do a kind of damage that they would never really be able to contemplate doing in the real world.
Cost sharing
Next we come to the issue of cost sharing arrangements.
The TI Act provides that carriers are entitled to recover costs for certain types of assistance to government agencies, including administration costs in executing warrants or providing data.
This arrangement was supported by the 2005 Review of the Regulation of Access to Communications and I would expect it to continue.
New capabilities
The fifth factor is an equitable basis of sharing the cost of developing and implementing new capabilities.
At present, carriers bear the cost of developing and installing interception capability and the government agencies bear the cost of developing delivery capabilities.
Once again, I would expect that arrangement to continue.
Legal problem areas
Now I want to touch on two legal problem areas that call for detailed attention.
The first is the question of jurisdiction.
Jurisdiction
Because the TI Act applies to communications that occur in Australia, a problem arises as a result of the increased availability of web-based email services with servers based outside Australia.
While communications through these services would have all the applicable protections under Australian law, they will also be protected under the laws of the country where the server is situated.
Identifying information and obtaining content from these overseas services can be very difficult.
A further issue is to determine which law should regulate access.
Evidence
The second legal problem deals with evidence.
Historically in Australia, interception has been accepted into evidence and recordings of conversations played in court without being challenged.
However, there has been an increase in the number of challenges over the last 18 months. They have questioned all aspects of the interception process including who can obtain a warrant for what purposes; questioning the technical collection process; questioning the accuracy of the intercepted information and the manner it may be submitted in court.
These sorts of objections can give rise to difficulties protecting capabilities from public disclosure under a claim of public interest immunity.
Conclusion
So, in conclusion, this conference is very timely and you have a lot of urgent and important work ahead of you.
I can summarise my remarks by saying that our telecommunications interception policy and operational environment are being subjected to wholesale changes.
In responding to them, I think there are three major implications which require careful consideration.
The first is that the number of participants in this industry is much greater now than before and will continue to grow. This growth will put pressure on our ability to develop and implement a consistent and reliable telecommunications interception capacity.
The second is that the ability of law enforcement, security and intelligence agencies to effectively intercept telecommunications – both legally and operationally – has to match the sophistication of devices like the iPhone and whatever comes next.
And third, the people who understand these issues – that is, the people at this conference and the organizations you represent – have to take part in the public debate that will inevitably take place as we endeavour to update our laws and practices to ensure Australia has a competitive and innovative telecommunications industry.
I wish you well in your deliberations.
Robert Cornall AO
Secretary