New encryption powers to seek assistance from tech companies to spy on users have been used at least five times by federal and New South Wales police.
The Commonwealth Ombudsman has revealed to an inquiry into the encryption act that agencies are already using the powers and called for the home affairs minister Peter Dutton’s ability to censor its reports on the process to be revoked.
Under the encryption legislation agencies are required to notify the ombudsman if they issue a technical assistance request or exercise powers to compel assistance or build a new capability to spy on users.
In response to a Guardian Australia freedom of information request the ombudsman revealed it had received two notices from the NSW Police, on 25 March and 9 April, and three from the federal police, on 9 and 12 April and 3 May.
The Telecommunications Assistance and Access Act, rushed into law with Labor support in December, is being reviewed by the parliamentary joint committee on intelligence and security.
Submissions to the inquiry are the first confirmation that powers, which agencies said were urgently needed to prevent suspects hiding behind encrypted communications, have been used, although the police have previously said the threat of longer prison sentences has helped coerce suspects to unlock their own devices, such as mobile phones and computers.
The home affairs department submission confirms the powers are being used for “investigation of transnational, serious and organised crime, cybercrime and serious crimes against the person” as well as “national security matters”.
It suggests agencies are “beginning with technical assistance requests to engender support and cooperation”, with all uses by the AFP relying on the voluntary powers rather than compelling assistance from tech companies.
The AFP has also used the new “computer access warrant” powers, which allow law enforcement agencies to covertly obtain evidence directly from a device, if approved by a judge or member of the administrative appeals tribunal.
The department confirmed the Australian Security Intelligence Organisation had also used the encryption act powers.
The ombudsman complained that the home affairs minister’s power to delete information from its reports to parliament about the operation of encryption legislation was “inconsistent with the ombudsman’s role as an independent and impartial office”.
It said the law already required it not to publish information that “could reasonably be expected to prejudice an investigation or prosecution, or compromise an interception agency’s operational activities” – the same criterion the minister applied when deciding whether to redact a report.
The ombudsman suggested the power be removed or – if not – it be shifted to the attorney general, to prevent the home affairs minister judging a report into his or her own department.
Amazon warned the encryption legislation allowed agencies to order tech companies to build a “security vulnerability”, arguing the “underlying assumption of the Act, that a security vulnerability can be created for a targeted technology without creating a systemic weakness or vulnerability, is technically flawed”.
Amazon complained that notices compelling assistance:
“are issued based on the judgment of decision-makers at agencies or the attorney-general, without prior judicial authorisation”;
can require technology providers to do acts in Australia that violate the laws of other countries in which they operate; and
could expand the range of companies required to retain user data, beyond the existing metadata scheme which applies only to carriers or carriage service providers.
The Australian Information Industry Association urged the Australian government to study whether the legislation was harming IT exports or forcing them out of the Australian market.
In March, Microsoft’s president and chief legal officer, Brad Smith, warned companies were “no longer comfortable” about storing their data in Australia as a result of the legislation.
Labor promised to amend the legislation to improve judicial oversight, if elected, but its shock loss in May likely meant it would continue in its current form at least for this term of parliament.
