Commonwealth Ombudsman’s report into law enforcement agencies’ use of industry assistance powers
Media Release
Commonwealth Ombudsman’s report into law enforcement agencies’ use of industry assistance powers.
Today, the Attorney-General tabled Commonwealth Ombudsman Iain Anderson’s 2021-22 report on oversight of law enforcement agencies’ use of industry assistance powers under Part 15 of the Telecommunications Act 1997 (the Act).
The industry assistance framework under Part 15 allows law enforcement interception and intelligence agencies to request or compel a designated communications provider (DCP) to provide certain types of technical assistance for a specified purpose under the Act. Agencies can seek industry assistance through:
- Technical Assistance Requests: TAR - industry provides assistance voluntarily
- Technical Assistance Notices: TAN - (compulsory) industry must provide assistance
- Technical Capability Notices: TCN - (compulsory) industry must provide assistance.
These requests and notices do not replace existing warrants and authorisations, for example for the use of surveillance devices or to intercept a person’s communications. However, these mechanisms can be used to seek technical assistance from industry to help give effect to a warrant or authorisation that the agency sought separately.
This report covers agencies’ use of the powers from 1 July 2020 to 30 June 2021. Only 4 of the 9 law enforcement interception agencies used the powers during this reporting period, with the Office conducting inspections on these 4 agencies between 1 July 2021 and 30 June 2022. This is consistent with our general practice of inspecting records retrospectively to manage live operational sensitivities.
“I am pleased that all 4 agencies we inspected in 2021-22 had taken steps to implement my Office’s previous findings, and that we observed agency progress to improve the frameworks, governance, policy, procedures and training to use the powers,” said Mr Anderson.
In 2021-22 the Commonwealth Ombudsman made no recommendations, 7 suggestions and 16 better practice suggestions. This is a decrease in the number of findings we made compared to 2020-21, however there was also a decrease in the number of inspections we conducted since only 4 agencies used the powers in the records period. All 4 agencies accepted the suggestions or better practice suggestions we made.
The key matters we identified through inspections in 2021-22 include:
- a mature culture of compliance and good governance and administration was an enabler for using the powers to seek a broad range of assistance from industry
- an isolated instance of an agency attempting to use a TAR where it appeared a related telecommunications data authorisation was not in place
- limited instances where a designated communications provider began preparatory work or provided assistance to an agency outside of the ‘in-force’ period for a TAR
- internal agency instruments delegating powers requiring updates or closer management
- enhancements required to training material and delivery to target audiences using the powers
- limitations on our ability to verify the lawfulness or currency of warrants or authorisation used in conjunction with an industry assistance mechanism – notably when these warrants or authorisations are issued under state or territory laws. This is not an issue caused by agencies; it arises when industry assistance mechanisms are used alongside other agency powers for which we are not the oversight body.
“We observed agencies using the powers to seek assistance from industry with more complex and technical investigative solutions,” said Mr Anderson. “While we are encouraged by agencies’ progress demonstrated at our inspections in 2021-22, we are conscious that the changing technical environment in which these powers may be applied will present new and unanticipated compliance risks.”
“As agencies broaden the assistance they are seeking from industry with these powers, we will be closely monitoring this to assure Parliament and the public that powers are used in compliance with the legislation and its safeguards.”
The report can be found on the Commonwealth Ombudsman website.