Federal police admit to accessing journalist's metadata without a warrant

Australian federal police have admitted an officer unlawfully accessed a journalist’s call records held under the government’s controversial metadata retention regime.

But police have still not told the journalist about the breach owing to the sensitivity of an ongoing investigation.

The AFP commissioner, Andrew Colvin, fronted media in Canberra to admit the breach on Friday afternoon, saying it involved the unlawful accessing of a journalist’s metadata.

Police were investigating the leaking of confidential police information at the time, and accessed the journalist’s call records within a specified timeframe.

“Put simply, this was human error,” Colvin said.

“It should not have occurred, the AFP takes it very seriously … and we take full responsibility for breaching the act,” he said.

“It was a mistake that was not picked up and corrected before it occurred by our internal practices and procedures.”

Police are required to obtain a warrant when accessing the metadata of journalists. That special warrant was not obtained in this instance.

The officer had not been disciplined or suspended, Colvin said. “I don’t believe there was ill will or bad intent here,” he said.

“Clearly we will do some more work to understand exactly what occurred. I don’t want to foreshadow where that might end, but I think the system’s failed the investigator as much as the investigator failed in their obligations to know the law.”

He said the accessed metadata had been destroyed but conceded the investigator could not “unsee it”.

The breach has raised further questions about the ability of the AFP to safely handle metadata.

The Human Rights Law Centre legal advocacy director, Emily Howie, told Guardian Australia the breach showed that the metadata powers were putting “press freedom at risk”.

“The fact that police can so easily access a honey pot of personal information at any time surely has a chilling effect on free speech,” Howie said. “Let’s not forget that it is not only journalists whose metadata might be accessed.

“Australia’s metadata regime is the most oppressive in the western world. It effectively allows law enforcement bodies to watch everybody, all of the time, without them knowing.”

The chairman of Digital Rights Watch, Tim Singleton Norton, criticised the decision not to tell the journalist involved. “The entire journalism community is now wondering are they at risk, are their sources at risk?” he told Guardian Australia.

Singleton Norton said the breach raised broader questions about the government’s ability to manage sensitive data.

“I don’t think it’s just the AFP,” he said. “I don’t think the government can be trusted, they’ve shown that on multiple occasions, they’ve shown that with Centrelink data.”

But Colvin said the breach should not shake the public’s confidence in the metadata retention laws. He said the powers were crucial to law enforcement.

“I have been on the record many times saying that it is extremely rare that we are interested in a journalist’s metadata but it’s not rare that we use metadata on nearly all of our investigations,” he said. “It is a very common tool we use.”

The commonwealth ombudsman will now audit the breach.

The federal police pointed out that it had publicly admitted to the breach, and been open and transparent. It reported itself to the ombudsman two days before Friday’s press conference.

Colvin also said the breach was likely to have been picked up by regular ombudsman’s reviews and parliamentary reporting requirements.

He said the AFP had bolstered measures to improve its handling of similarly sensitive metadata.“We have raised the level of internal authorisation required for access to data of this type,” Colvin said.

“We are limiting the number of authorised officers who can approve access of this type. We are also re-rolling out and stepping up mandatory training to all investigators and authorised officers to make sure they are fully aware of their obligations under the act.”

He said he was confident that a “breach of this nature should not occur again”.

The journalists’ union, the Media, Entertainment and Arts Alliance, said it was “appalled” at the unlawful access.

Its chief executive officer, Paul Murphy, said the breach constituted an attack on press freedom and showed an “over-zealous and cavalier approach” to accessing metadata.

“It demonstrates that there is very little understanding of the press freedom concerns that we have been raising with politicians and law enforcement officials for several years now,” Murphy said.

“The use of journalist’s metadata to identify confidential sources is an attempt to go after whistleblowers and others who reveal government stuff-ups.”