File #2812: "2020_Book_AdvanceMetadataFair.pdf"

2020_Book_AdvanceMetadataFair.pdf

Text

1|Preface|7
1|Acknowledgements|8
1|Contents|9
1|Chapter 1: Generating 4G, 5G and Social Media Location Information|14
2|1.1 Introduction: The Balance of Power Is Off-kilter|14
2|1.2 Faster and Integrated 4G and 5G Mobile Communications|17
2|1.3 The Popularity of Mobile Devices and Mobile Communications|18
2|1.4 4G and 5G Location Information|19
2|1.5 Inferring the Location from the Mobile Phone´s Battery|20
2|1.6 Busting the Myth of Coarse Versus Precise Location Information|20
3|1.6.1 Location Precision Powered by Small Cells|23
2|1.7 Conclusion|25
2|References|25
1|Chapter 2: The Legal Scheme for Mobile Telecommunications Companies and Social Media Platforms to Retain Location Information|28
2|2.1 Legally Defining Location Information|28
2|2.2 Location Information As Metadata|29
2|2.3 The General Legal Requirement to Retain Location Information|29
3|2.3.1 The 2-Year Minimum Retention Period|30
3|2.3.2 The Exclusions Not to Retain Certain Categories of Location Information|31
4|2.3.2.1 The Obligation NOT to Retain Location Information That Is NOT Used to Provide the Communication Service|31
4|2.3.2.2 Retain the Location Information at the Start and at the End of a Communication|33
2|2.4 Voluntary Retention and Use of Location Information|35
3|2.4.1 The Use of Location Information by the Telco|36
3|2.4.2 The Use of Location Information by the Social Media Platforms|38
2|2.5 Surveillance Policies|38
2|2.6 Unfair Limits to Civil and Property Rights|38
2|2.7 Conclusion|39
2|References|39
1|Chapter 3: The Legal Framework for Mobile Telecommunications Companies and Social Media Platforms to Disclose Location Informa...|42
2|3.1 The Compelled Disclosure of Location Information|42
3|3.1.1 The AFP|43
3|3.1.2 ASIO|44
3|3.1.3 Power to Collect `Technical Information´ From Social Media Tech Giants|44
4|3.1.3.1 The List of Things to Assist with: Disclosing Technical Information|45
3|3.1.4 The Self-Certification Process Under the TIA Act 1979|46
3|3.1.5 The Self-Certification Process Under Section 280 of the TA 1997|47
3|3.1.6 Pre-authorisation Checks|49
3|3.1.7 Disclosure Under Journalist Information Warrants to ASIO and the Concentration of Power|52
3|3.1.8 Disclosure Under Journalist Information Warrants to the AFP|53
4|3.1.8.1 The Ambiguity of the JIW Process in Relation to Whistle-Blowers|54
4|3.1.8.2 The Public Interest Advocate|55
2|3.2 Voluntary Disclosure of Location Information|56
3|3.2.1 Privacy Protections Are Subject to the Discretion of the Agencies and the Telco|57
2|3.3 Conclusion|58
2|References|59
1|Chapter 4: The Powers of the Agencies to Collect and Use Location Information|61
2|4.1 The Powers of the AFP to Use Location Information|61
3|4.1.1 Statistics About the Use of Metadata|63
3|4.1.2 Access to Location Information in Respect of Non-serious Offences and the Low Threshold|63
2|4.2 The Powers of ASIO|65
3|4.2.1 Investigatory Powers and the Powers Performed in Connection with the Functions|65
3|4.2.2 Defining the Term `Security´|67
4|4.2.2.1 The Courts Accept the Broad Definition of `Security´|67
3|4.2.3 ASIO Still Yields Tremendous Power, Despite the Privacy Safeguards|69
3|4.2.4 Confidentiality|69
2|4.3 The Likely Impact of `Security´ on Young People Protesting Inaction on Climate Change|71
3|4.3.1 The Greens Political Party Activities Are Described As a National Security and Economic Threat to Australia|73
3|4.3.2 Tech-Savvy and Politically Active Young People As Potential Targets of the Data Retention and Disclosure Scheme|74
2|4.4 Conclusion|76
2|References|76
1|Chapter 5: Limits to the Powers of the Agencies to Collect and Use Location Information|80
2|5.1 Privacy as a Limit to the Powers of the AFP|80
3|5.1.1 Increased Privacy Protections|80
3|5.1.2 The Privacy Tests|81
4|5.1.2.1 The Justifiable and Proportionate Privacy Test|82
4|5.1.2.2 The Reasonable and Proportionate Privacy Tests|82
5|Considering the Legitimate Expectations Relating to Privacy and Cybersecurity|82
5|Considering the Legitimate Expectations Relating to Privacy and Cybersecurity|83
5|Partially Entrusting National Security to Polling Data|87
6|Opinion Poll on Cybersecurity|90
5|Indirectly Legitimising Opinion Polls|90
6|The Department of Home Affairs and ASIO Endorse the Use of Opinion Polls|93
5|The Lack of the Personal Privacy and Free Speech Rights Versus Parliamentary Sovereignty and the Proportionality Principle|94
6|Relevance to the Civil Disobedience|98
4|5.1.2.3 The `Reasonably Necessary or Directly Related Tests´|99
5|The APP 3.1 Reasonably Necessary or Directly Related Personal Information Test|100
6|The Term `Reasonably Necessary´ Versus the Term `Directly Related´|101
5|The APP 3.5 Lawful and Fair Means Test|102
5|The Reasonably Necessary to Enforce the Criminal Law Test|102
5|The Reasonably Necessary to Investigate an Offence Test|102
6|The `Reasonably Necessary´ Threshold as Lacking the Requisite Degree of Precision|103
5|Suspicion of an Offence, Based on Reasonable Grounds, as a Limit to the Powers of the AFP|103
6|Caratti v Commissioner of the Australian Federal Police|104
6|Day v Commissioner, Australian Federal Police|105
6|George v Rockett|106
6|The Wording of the CAC Determination 2018|107
6|Voluntary Disclosure and Requests for Historical Location Information and Suspicion Based on Reasonable Grounds|109
6|The Impact of the Absence of the Need for Suspicion of an Offence, on a Reasonable Grounds Standard, on Privacy|109
5|Warrants to Access Content Require Suspicion But Authorisations to Collect Location Information for Non-Serious Offences Do Not|111
6|The Various Templates to Request Telecommunications Data|112
2|5.2 Privacy as a Limit to the Powers of ASIO|115
3|5.2.1 ASIO Has the Special Duty to Prevent Undue Influence Over the Exercise of Its Powers|115
4|5.2.1.1 Prevent Undue Influence From the Insider|117
3|5.2.2 The Reasonable and Proportionate Privacy Test|118
3|5.2.3 The Connection Test|118
4|5.2.3.1 Cases Interpreting the Phrase `in Connection with´|118
5|Gant v Commissioner Australian Federal Police|119
5|Samsonidis v Commissioner, Australian Federal Police|120
4|5.2.3.2 The Disclosure of Location Information Under the CAC Determination 2018 and the Suspicion on Reasonable Grounds|121
5|Suspicion on Reasonable Grounds IS NOT a Limit to the Powers of ASIO|121
4|5.2.3.3 Balancing the Competing Interest of Privacy and the Public Interest of an Effective Criminal Justice System|124
2|5.3 Conclusion|125
2|References|125
1|Chapter 6: Location Information as Personal Information, to Better Protect Privacy|130
2|6.1 The Right to Privacy Under Australian and International Law|130
2|6.2 Privacy in Relation to Personal Information|132
3|6.2.1 The Personal Nature of the Location Information That Is Required to Be Retained|134
4|6.2.1.1 The Potential Impact on Tech-Savvy Young Australians|134
4|6.2.1.2 The Potential Impact on Journalists|135
4|6.2.1.3 The Mapbox Platform|136
2|6.3 The Debate About Certain Types of Location Information as Personal Information|136
3|6.3.1 Finding the Meaning of the Words: `About an Individual´|137
3|6.3.2 Categorising the Types of Location Information as Personal Information|139
3|6.3.3 Metadata That Is Mandatory to Retain: Location Information Retained at the Start and End of the Voice or SMS Communicati...|140
4|6.3.3.1 Most Location Information That Is Required to Be Retained Is Deemed to Be Personal Information|141
5|Not All Retained Location Information Is Personal Information|141
3|6.3.4 Metadata That Is Retained Voluntarily: Location Information Retained Prior to, During and After the Voice or SMS Communi...|142
4|6.3.4.1 Metadata That Is Retained Voluntarily: The Location Information Retained During the Voice or SMS Communication|144
4|6.3.4.2 Metadata That Is Retained Voluntarily: Location Information Retained Prior to a Voice or SMS Communication, and Locati...|145
2|6.4 The Use of Big Data Analytics Software|147
3|6.4.1 The Definition of Big Location Data|148
3|6.4.2 The Australian Criminal Intelligence Model and Associated Management Strategy|149
3|6.4.3 The Secondary Use of Location Information in Other Investigations, Inquiries and Activities to Enforce the Law|150
4|6.4.3.1 Transferring Evidence from One Investigation to the Next Without Fully Applying the Privacy Tests|150
4|6.4.3.2 The Location Information May Be Shared for Secondary Investigations, Inquiries and Activities to Enforce the Law|151
4|6.4.3.3 The `Connection Test´ and the `Reasonably Necessary Tests´ and Big Location Data Analytics|151
4|6.4.3.4 The Secondary Use of Historical and Prospective Location Information Versus Serious and Minor Offences|153
4|6.4.3.5 Secondary Use of Location Information and Big Location Data Analytics|154
4|6.4.3.6 Analysing the Location Information to See Connections|155
3|6.4.4 Law Enforcement Activities Are Not Specifically Required to Be Based on the Reasonably Necessary or Directly Related Sta...|156
4|6.4.4.1 Poor Governance Under the Attorney-General´s Guidelines, the CAC Determination 2018 and the Ministerial Guidelines|159
4|6.4.4.2 Functions of ASIO Are Wide and Broad, and the Attorney-General´s Guidelines Are Permissive Rather Than Limiting|161
4|6.4.4.3 Trawling Through the Location Information|162
4|6.4.4.4 No Legal Requirement for ASIO to Delete Information That Is No Longer Required for National Security|163
2|6.5 Conclusion|164
2|References|165
1|Chapter 7: Oversight Exercised Over the Powers of the Agencies|171
2|7.1 A Schematic Outline of the Metadata Retention and Disclosure Framework|171
2|7.2 What Oversight Means|171
2|7.3 The Inspector-General of Intelligence and Security and ASIO|172
3|7.3.1 Oversight Over TARs, TANs and TCNs: Notification Obligations|173
3|7.3.2 Inspection Outcomes|173
3|7.3.3 Issues Raised by the Inspections and Reviews|174
4|7.3.3.1 Oversight and Big Location Data|175
2|7.4 The Commonwealth Ombudsman and the AFP|175
3|7.4.1 Oversight Over TARs, TANs and TCNs: Notification Obligations|176
3|7.4.2 Inspection Outcomes|176
2|7.5 The Extent of Compliance Standard|178
2|7.6 Oversight Exercised Is Based on Complaints Submitted|178
2|7.7 The Right to be Forgotten|179
2|7.8 The Conflict of Interest Between Privacy and Law Enforcement|179
2|7.9 Oversight Occurs After the Fact|182
2|7.10 Oversight Concentrated in the Executive Branch of Government|183
2|7.11 The Telco Is Not Inspected Like the Agencies Are, to Verify If They Disclose Only Information That Is Reasonably Necessary|184
2|7.12 Confidentiality and the Difficulty to Challenge the Activities of the Agencies|185
2|7.13 Pre-Warrant Checks Are Not Inspected, and Undermine Privacy|186
2|7.14 No Oversight Conducted Over Location Information Used Against Secondary Individuals|187
2|7.15 ASIO Has a Low Threshold to Meet to Access Telecommunications Data|187
2|7.16 The Use of Less Intrusive Methods to Access Telecommunications Data|189
3|7.16.1 Equally Personal or Less Intrusive?|190
2|7.17 Conclusion|191
2|References|192
1|Chapter 8: Proposing the Judicial Location Information Warrant, to Better Protect Privacy|194
2|8.1 A Location Information Warrant Is Generally Required in the USA|194
2|8.2 Bulk Metadata Collection Violates Privacy in the EU|195
2|8.3 Metadata Retention for Minor Offences Violates Fundamental Rights in the EU|198
2|8.4 Analysis: Judicial Oversight Preferred as a Check on Executive Power|199
3|8.4.1 The `Necessary and Proportionate´ Standard Did Not Adequately Protect Privacy in the UK|200
3|8.4.2 Improving Human Rights in Australia|201
3|8.4.3 Diagnosing the Australian Metadata Retention and Disclosure Framework|203
2|8.5 The Judicial Location Information Warrant Process|205
3|8.5.1 The Types of Location Information That Are Legally Personal Information|206
3|8.5.2 The LIW Issuing Authority|206
3|8.5.3 Exceptions to Making the LIW Application|207
3|8.5.4 The Role of the Issuing Authority|207
3|8.5.5 The Procedure to Request Location Information|208
3|8.5.6 The Types of Location Information Requested to Be Disclosed|209
3|8.5.7 The Standards to Safeguard Privacy|210
4|8.5.7.1 Transferring Privacy Protections to the LIW|210
4|8.5.7.2 Transferring the Privacy Standards from Section 180F of the TIA Act 1979 to the LIW|210
4|8.5.7.3 Guidelines for Methods Considered Intrusive and Methods Considered Less Intrusive|210
4|8.5.7.4 Guidelines for Activities That May Be of Interest to National Security|211
4|8.5.7.5 Review of the LIW|211
4|8.5.7.6 The Oversight Roles of IGIS and the Commonwealth Ombudsman|211
4|8.5.7.7 Creating a Positive Feedback Loop|212
4|8.5.7.8 The Journalist Information Warrant|212
4|8.5.7.9 Reporting Statistics|212
4|8.5.7.10 Amendments to the TIA Act 1979 and the TA 1997|212
2|8.6 Conclusion|213
2|References|214
1|Chapter 9: Conclusion: Restoring the Balance of Power|217
2|9.1 Restoring the Balance of Power|217
2|References|225
1|Index|227