Offshore storage to be allowed for Australian data retention

Telcos and internet service providers will be able to store the metadata of Australian citizens required under the Government's proposed two-year retention scheme outside of Australia.

The House of Representatives today debated the Government's mandatory data retention bill, and voted it through to the Senate with only three votes - MPs Adam Bandt, Andrew Wilkie and Cathy McGowan - against its passage.

During debate, Communications Minister Malcolm Turnbull admitted the internet and telco industry could store the mandated data set in offshore facilities.

Amendments tabled today to the data retention bill - in line with recommendations from the parliamentary joint committee on security and intelligence (PCJIS), as well as a push by Labor for protection for journalists - fail to deal with the issue of offshore storage.

Turnbull confirmed to the House that the amendments contained no requirement for the physical server hosting the data to be located in Australia.

Shadow Attorney-General Mark Dreyfus argued the issue was being addressed in the Government's telecommunications sector security reform.

"The [reform] is going to deal not only with the question of where retained data should be kept, but a whole range of other requests relating to telecommunications sector security," Dreyfus said.

He argued that the Coalition's amendments "faithfully" implemented the recommendations of the PJCIS, which he said did not stipulate where the data could be stored.

"It did discuss the issues raised - and those issues are a real concern expressed by members and publicly by Labor, that data should be stored in Australia - but certainly the committee accepted that there is the ongoing [telco security] reform," Dreyfus said.

Former iiNet chief regulatory officer Steve Dalby last year said the ISP would try to find the lowest cost option for storing the required data, which "at the moment .. is in China". 

Dreyfus also defended arguments by Greens MP Adam Bandt that the Government's amendments similarly failed to address the issue of the destruction of data at the end of the two-year retention period.

He said the Privacy Act requires private companies keeping sensitive customer data to retain it for no longer than is needed for their business purposes.

"And at the end of that period, it has to be destroyed or personal identifiers removed from it," Dreyfus said.

In its February report on the legislation [pdf], the PJCIS said the bill was "silent" on data security, despite the issue being raised by a number of respondents to bill's inquiry.

Optus and Australia’s intelligence watchdog, the Inspector General of Intelligence and Security, have both voiced concerns around the lack of provision for data destruction;.

The PCJIS also pointed out in its report that while privacy law requires entities covered under the Act to protect information from misuse and disclosure, among other things, smaller ISPs were not bound to such requirements.

However, it said it had been promised the issues of data destruction and storage would be dealt with through the telecommunication sector security reform.

Communications Minister Malcolm Turnbull today reiterated that the reform was expected to be finalised "well before the end of the data retention implementation period", without providing a date.

Public interest advocate to be created for journalist protection

The Government's new amendments seek to create an independent public interest advocate with powers to argue against police access to a journalist's metadata.

Labor and the Government have agreed that the bill will require agencies to obtain a warrant in order to access journalist metadata for the purpose of identifying a source.

It states that a judge can only issue a warrant if he/she is satisfied that "public interest in issuing the warrant outweighs the public interest in protecting [the source]".

The judge will also need to consider whether the matter law enforcement is seeking to investigate is "serious or trivial". 

The public interest advocate position has been created to assure the Labor party that the warrant process will not be a "tick and flick" one.

ASIO not bound to warrant scheme

Australian spy agency ASIO has been excluded from the arrangement, however - it will be able to apply directly to the Attorney-General for a warrant to access a journalist's metadata.

"All that will happen is this new public interest advocate would have the right to make a submission to the Attorney-General, but it'll never come in front of a judge," Bandt said.

"If you're a journalist who is getting information that might well relate to a future Attorney-General ... all the public interest advocate gets to do is go and talk to the person you might be investigating."

Revealing that a journalist warrant has either been sought or granted is punishable by two years jail.