Statement regarding unauthorised telecommunications data access in 2015

AFP badge

On Monday 22 July, the Commonwealth Ombudsman tabled a report in Federal Parliament presenting results of inspections of access to stored communications and telecommunications data during the 2015-16 financial year. Given the significant volume of records, the Ombudsman’s Inspectors examined records from 13 October 2015 to 30 June 2016.

In providing the information to the Commonwealth Ombudsman, ACT Policing self-disclosed that its authorised position holder did not have the appropriate delegation to approve 116 requests for telecommunications data during a two week period between 13-26 October 2015.

This was the result of an administrative oversight in March 2015, when the relevant ACT Policing position was inadvertently omitted from the list of authorised positions. This delegation is provided for under the Telecommunications (Interception and Access) Act 1979. The omission occurred when the AFP instrument of delegation was updated. In October 2015, ACT Policing identified the omission and made a request for it to be corrected.

The ACT Policing position holder, who previously held the appropriate delegation, had continued issuing authorities in good faith unaware that the delegation had been omitted.

During 2018, while re-examining the 116 requests for telecommunications data, ACT Policing identified a further 3249 telecommunications data requests which had been made from 11 March to 13 October 2015 as a result of the same authorisation issue. ACT Policing self-disclosed this information to the Ombudsman at this time.

The type of telecommunications data requested included identifying the registered holder of a particular telephone number (mobile or fixed line) for the purpose of the enforcement of criminal law or to assist in finding a missing person. This information supported a range of community policing investigations from organised crime matters to assaults and property offences. None of the data in question was obtained in order to identify a journalist’s source.

It is important to note that while the delegation was not in place, all authorisations and requests were managed in accordance with the relevant policies and procedures, including security, storage and disclosure.

Once the issue was discovered, ACT Policing notified the Ombudsman’s Office to seek advice on how to remedy this administrative oversight. 

ACT Policing subsequently examined all relevant records to determine the use of the data that had resulted from these requests. It was established that the majority of the results had not been used in evidence or provided to third parties. Action was also taken to develop a quarantine process to eliminate any future use of the data. 

Of the total telecommunications data requests, 240 generated information that was of value in progressing ongoing investigations and inquiries. Noting one investigation may require multiple telecommunications data requests, the 240 telecommunications data results were referred to individual Case Officers to conduct further examination and confirm its use and dissemination. During this process, steps were taken to commence quarantining the relevant material.

ACT Policing has sought legal advice regarding the management of two matters relating to a missing persons case and a criminal matter where the data in question may have been used in a prosecution. The Ombudsman’s Office has been kept informed throughout the examination and quarantining process. It is not appropriate to identify particular cases.

ACT Policing has implemented measures to maintain enduring authorisation to prevent this issue reoccurring and is committed to ensuring access to telecommunications data is conducted appropriately and transparently.

ACT Policing has made the changes to its processes recommended by the Ombudsman and also initiated its own additional changes to provide greater assurance.

Refresher training has been provided on legislation, delegations and assurance procedures to ensure authorisations are conducted in accordance with the legislation.

ACT Policing is committed to working with the Ombudsman to investigate, monitor and ensure compliance with the legislation and to improve its practices where any breaches are detected.

Following the 2016-17 inspections the Ombudsman’s report noted positive levels of transparency and accountability and a willingness to self-report any potential compliance issues as identified.

The Ombudsman continues to monitor these issues at future inspections.

Note - dates have been amended in the first and second paragraphs of this statement at 5.45pm Friday 26 July 2019.

Media enquiries

Police Media — (02) 5126 9070, act-police-media@afp.gov.au