Telcos decry lack of consultation on new snoop powers

Australia’s telcos and tech industry lobby groups say they are unpleasantly surprised by a new government plan to allow US authorities to access data held by Australian IT services companies.

News of the plan arrived yesterday, Monday, 7 October a day more than half of Australia took as a public holiday^*. But that didn’t stop the Federal Government from using the day to issue a joint announcement revealing that Australia is in talks with the US on a bilateral agreement that “would enable Australian law enforcement to serve domestic orders for communications data needed to combat serious crime directly on US-based companies, and vice versa.”

That idea is not seen as outrageous, because the USA has already legislated to let other countries access data held by US companies. The US Department of Justice explains (pdf) that the relevant law – the “CLOUD Act” – is necessary because requests for access to data stored by US companies were growing and legal action was getting fierce.

Such requests were often to investigate crime or terrorism, but US-based companies could legitimately deny access on privacy and security grounds.

So the USA legislated to make life easier for all concerned. Investigators get access, tech giants got certainty and nobody has to go to court to establish legal principles about why cross-border data access should be allowed.

Many Australian technology businesses would have been aware of the CLOUD Act.

But it appears none were told we were in talks with the USA about bringing it here.

Which is why Australian Information Industry Association CEO Ron Gauci told CRN his organisation is “Still working with our members to ascertain what position we should have.”

“We have been consistent in supporting efforts to combat terrorism and major crimes,” Gauci said. “We have also been consistent that there should be better consultation with industry.”

Communications Alliance CEO John Stanton offered us similar sentiments.

“We have no information from the Government on this, including as to what it means for the privacy rights of Australians,” he said. “Industry supports unreservedly the objective to combat serious crime in all its forms, but Government should consult, so it can understand the implications of what it is contemplating committing to.”

CRN also sought comment from Australian telcos and cloud operators from the largest operators to niche providers. None had a position. A tier one telco told us “We’re aware of this story and the possible scenario you outline, but we do not have a public comment to make at this early stage.”

A junior telco told us it “can’t comment on this one”. Others would not comment because they were unaware of the talks (see comments about Public Holidays above).

The AIIA’s Gauci also felt the announcement was a little premature, on grounds that Australia’s Telecommunications and Other Legislation Amendment (TOLA) bill infamously permits authorities to compel access to encrypted material, but the USA does not have comparable requirements.

“Those inconsistencies would make it hard to get agreement,” he told CRN. For that reason the AIIA felt that any CLOUD Act action was far from imminent.

And that may be the case: minister Dutton’s statement hedges on the agreement by using language like “if finalized and approved” and offers no details on a time-frame for making a deal.

But coming on top of the scanty consultation on the TOLA bill, and the rapid implementation of 2019’s Abhorrent Materials bill that can see web hosts required to take down certain material, Australia’s technology industry is again feeling unloved.

And CRN expects the channel feels threatened too: the CLOUD Act means those who host servers or storage can receive offers they dare not refuse. But those offers can be very hard to handle – how would you deliver data a client encrypts, on a server for which you don’t have the passwords?

^*Labour Day in NSW (pop 8.0m), South Australia (1.7m) the ACT (425k), and Queen’s Birthday in Queensland (5.1m) and the Northern Territory (245k) for a total of 15.47 million out of a total population of 25,287.400 according to the Bureau of Statistics.