George Brandis, Asio and the battle to control Australia's telecommunications

Over the past two years, a battle has been quietly waging that will have profound consequences for the future of the internet in Australia.

If the battle is won by the government, it would see the attorney general, George Brandis, and the head of the Australian Security Intelligence Organisation have a vice-like grip over Australia’s telecommunications industry. Their powers would extend to being able to shut down services that are deemed prejudicial to security and potentially have an impact on on services such as Facebook or Twitter.

The Telecommunications and Other Legislation Bill 2016, which follows on from the data retention requirements introduced in 2015 is now before the parliamentary intelligence committee, which will hold what are likely to be the final hearings on Thursday.

The government has argued it is a way to enhance Australia’s telecommunications cybersecurity. But Australia’s peak telecommunications bodies and individual telcos have raised objections, among them:

• Internet providers would be required to reveal details about their business decisions, internal operations and IT infrastructure;
  

• There are few, if any, limits on new powers that would allow the attorney general to shut down telecommunications services in circumstances where they are “prejudicial to security”;
  

• Providers would struggle under the cumulative weight of data retention, mandatory breach notification, copyright laws and now the latest security measures.

The new legislation has largely slid by public scrutiny – with only eight submissions received by the parliamentary intelligence committee.

The chief executive of the Communications Alliance, John Stanton, said: “We remain concerned that in fact it will not work to achieve its stated objective and indeed may well act counter to the desire to ensure that critical infrastructure is protected against cyber-risks.”

‘Balanced and risk-based’

Telecommunications companies take measures to protect the security of personal data they hold but standards vary.

Security services and law enforcement agencies rely on them to provide the data they need for intelligence and law enforcement work. The vast surveillance architecture that operates as part of the Five Eyes network that Australia is part of is only possible with the collaboration of telecommunications companies.

This makes them as much a target as government institutions because of the data they would possess about surveillance operations.

Australia’s is now trying to introduce a legislative response to these concerns. The bill is designed to require companies to “do their best” to protect telecommunications networks and facilities, reveal potential security risks and share company information.

A submission to the inquiry by the attorney general’s department says: “The bill proposes a balanced and risk-based approach to take into account the needs of the Australian telecommunications sector to remain competitive and innovative in the market, having regard to minimising regulatory impacts.”

But critics say the bill is forcing telecommunications companies to disclose potentially almost everything about their infrastructure and key business decisions. One of the key parts of the bill is a series of notification requirements that will force telecommunication companies to disclose changes in their processes and infrastructure to government.

The power to do this is broad and, according to industry, would require them to notify the government – and potentially seek approval – for every minor decision it has to make about contracting arrangements.

While industry has to report to the government, there is no corresponding obligation of the government or security services to disclose potential vulnerabilities to the companies.

The vice-president of Optus, David Epstein, said there remained fears that there would be an “asynchronous flow of information”.

“Our fear is that a broad brush approach might be taken – which may pay less attention to the nuances than we feel needs to be taken, or might be overly prescriptive, because it is broad brush, or may be based on a lesser understanding than we would expect with some of our technical dialogue with operational agencies,” he said.

Angela Daly, a research fellow at the Queensland University of Technology, said: “It seems to have a very broad and vague scope ostensibly around cybersecurity. But it seems to give a lot of powers to the attorney general’s department to request information and to also ask the telecommunication companies to do or not do something. The implications for that could be very serious from an individual privacy perspective.”

‘No limits, no guidance’

One of the most concerning parts of the new laws is an expansion of the attorney general’s powers to direct telecommunication services to be shut down in circumstances where they are “prejudicial to security”.

While there is already an existing power to suspend the operation of telecommunications services in certain circumstances, the new bill enlarges the power of the attorney general. The attorney general’s submission acknowledged that no limit has been put on what actions these can constitute “to enable flexibility in the engagement between government and industry”.

Patrick Fair, a partner at the Baker McKenzie law firm, said: “That power has been moved right into the context of this obligation to protect security and it’s an extremely broad power. The concern is that there are no limits on that power and no guidance as to what would be considered a serious threat.”

Asked whether this could hit Facebook or Twitter, Fair said that was “one possible outcome” if parts of the network were shut down.

All of these powers relate to Asio. The attorney general can delegate his decision-making to the director general of security, Duncan Lewis, under these powers. Asio furnishes the security assessments on what telecommunications companies are permitted to do.

The agency has driven the push for greater access to telecommunications infrastructure, in the same way it drove the push for mandatory data retention.

And yet the agency’s submission to the inquiry is secret. Asio gave a confidential briefing to the committee members, which senator David Bushby alluded to in the public hearing. But the public and those seeking to challenge the laws have had no opportunity to test any of the claims put forward by the security services.

Guardian Australia sought comments from the attorney general, George Brandis, and the shadow attorney general, Mark Dreyfus. The committee is due to report on the bill in April 2017.

Many industry players are concerned about their ongoing negotiations with governments and opposition and are reluctant to speak on the record about their concerns. The intelligence committee also usually forms a bipartisan report on national security laws, which would likely guarantee Labor’s backing once the report is complete.

But Stanton’s critique in his evidence to the intelligence committee was echoed by many in private. He warned the cumulative weight of data retention, mandatory breach notification, copyright laws and now the latest security measures were posing an extraordinary burden on these companies. “They are really struggling under the cumulative weight of the impositions that have come from government in recent years,” he said. “All of them, potentially, are quite worthy but making it very hard operationally.”