AFP Commissioner addresses media regarding a self-report submitted to the Commonwealth Ombudsman

AFP COMMISSIONER ANDREW COLVIN:              

Alright. Well, good afternoon everybody and thanks for coming down to AFP headquarters on a Friday afternoon. I thought it important that I disclose to you all that a little earlier this week the AFP self-reported to the Commonwealth Ombudsman that we had breached the Telecommunications Interception Act.

The breach occurred within our Professional Standards Regime; our Internal Investigations area, and related to an investigator who sought and was gained- and was provided access to the call records of a journalist without the prior authority of a Journalist Information Warrant. Now, as I'm sure you're very aware, 18 months ago the legislation changed and bought in a mandated requirement for us to get a Journalist Information Warrant if we wanted to access call records.

I do want to say at this point, because it's important there isn't confusion, that what was accessed was the records of calls, not the content of those calls, just the fact of the existence of the calls in the first place.

Now the actual investigation, the internal investigation that led to this breach, is still ongoing. It related to the unauthorised release of sensitive police information to a journalist. The breach, as a result of that investigation, was identified by the AFP as a result of our own practices, our own review, and once the breach was confirmed, we immediately moved to destroy all of the material that was provided to us as a result of that breach. I can also say that no investigational activity has occurred as a result of us being provided with that material.

Now, put simply, this was human error. It should not have occurred. The AFP takes it very seriously and we take full responsibility for breaching the Act. But I also want to say that there was no ill will or malice or bad intent by the officers involved who breached the Act. Quite simply, it was a mistake that should not have happened and it was a mistake that was not picked up and corrected before it occurred by our internal practices and procedures.

As you would expect, as a result of this matter and as a result of us identifying this breach, we have been reviewing our internal practices and our procedures to make sure they are as robust as possible and we've made significant changes. When this legislation came in 18 months ago the AFP, along with our police colleagues around the country, moved to put in place a number of procedures and practices to ensure compliance with the law within our organisations. However, on consideration and reflection on this matter, we have now enhanced those. We have raised the level of internal authorisation required for access to data of this type. We are limiting the number of authorised officers who can approve access of this type. And we are also re-rolling out and stepping up our mandatory training to all investigators and to authorised officers to make sure that they are fully aware of their obligations under the Act.

Now, I have been assured and I am confident that the changes we have made are robust and give me confidence that a breach of this nature should not occur again. As a result of this breach, we have also had cause to review other matters, other investigations underway in the AFP that also result to unauthorised release of information in these circumstances, to make sure we have not breached somewhere else and I'm satisfied, on the back of that review, that there have been no further breaches.

However, I must say, as a result of the AFP disclosing this breach to the Commonwealth Ombudsman this week, the Commonwealth Ombudsman has today informed me that commencing next Friday, she will launch her own audit of this breach and the circumstances that related to that breach. Now, of course we welcome this audit. We will work very closely with her office and we will be fully compliant and cooperative in relation to any material, as we always are, with the Ombudsman's inspections of our Telecommunications Interception Act requirements. Any recommends the Ombudsman makes about improvements to our systems processes, to our internal guidelines, we will obviously take very seriously.

Now, I'm going to take questions in a minute, but you'll understand I am going to be limited because the investigation is ongoing and, as I know many of you know yourselves, the Telecommunications Interception Act limits what I can say.

But there's three important points I want to make in closing: firstly, there should be no inference that the journalist involved has in any way committed an offence. This was an investigation into the release by a police officer of information to the journalist. So I don't want any inference the journalist has committed an offence. I also want to make it clear that it was important to me that we were open and honest about this breach. I'm sure the breach would have been revealed through our normal Ombudsman's review processes and reported to Parliament at some point but it was important to me that we were open and honest with you about the fact we had breached it and that we were taking measures to ensure it doesn't happen again.

The final point I'd like to make, and probably the most important, is notwithstanding this breach, I believe that the public should have full confidence in the police. I believe the public should have full confidence in this policy, which was a controversial policy that was debated very widely in Parliament and the public at the time. And I want to underscore how important access to metadata is to police as a fundamental building block of our investigations. The breach on this occasion occurred because of the very unique and specific circumstances relating to a journalist. I will leave it at that and take some questions.

QUESTION:        

Commissioner, has the journalist been informed that their metadata was illegally accessed? And has the leaker or alleged leaker been identified and has action been commenced against them?

AFP COMMISSIONER ANDREW COLVIN:              

Okay, so the investigation about the leak is still ongoing and that's why I'm not going to say too much about it. And for that reason, we haven't notified the journalist that we have breached and accessed that particular journalist's data without the warrant. Once the investigation takes its full course, we'll be able to consider what actions we need to take but at this stage, because of the sensitivities with the investigation, we haven't advised the journalist.

QUESTION:        

Doesn't the journalist have a right to know you breached their rights?

AFP COMMISSIONER ANDREW COLVIN:              

Look, I think that's a fair question. As I said, once the investigation's finished, we'll have to consider that. What I'm doing today is trying to be as open and transparent about it as I can. I don't think there can be any question that we're not trying to be held to be account for it. But while the investigation's ongoing, it is a serious matter, we're just not- we're not in a position to do that.

QUESTION:        

Has another application for the same metadata now been made through the proper processes?

AFP COMMISSIONER ANDREW COLVIN:              

No, it has not.

QUESTION:        

Do you intend to that?

AFP COMMISSIONER ANDREW COLVIN:              

I'll leave it at that. I mean, as I said, once we realised that we'd made the breach, we stopped all investigations relating to that particular line of inquiry and I think I'll just leave it at that.

QUESTION:        

Can you explain Commissioner, if there was no ill will or malice against- involved, can you explain just in layman's terms how this breach occurred? [Inaudible]

AFP COMMISSIONER ANDREW COLVIN:              

So basically the legislation, as amended 18 months ago, which was about the retention of data but also included specific provisions that if, in the course of an investigation, a police officer was looking to find a source of a journalist, then they would be required to go an extra measure and get a Journalist's Information Warrant. It was all predicated and the vulnerability is the fact that the journalist- sorry, the investigator needs to understand that that's their requirement and on this occasion, the journalist- the investigator didn't, I'm sorry.

QUESTION:        

So he didn't get the warrant and that's the process …

AFP COMMISSIONER ANDREW COLVIN:              

Correct, yes.

QUESTION:        

Has the investigator been suspended or has any disciplinary action taken?

AFP COMMISSIONER ANDREW COLVIN:              

No. No, as I said, I don't believe that there's been any ill will or bad intent here. Clearly we will do some more work to understand exactly what occurred and I won't- I don't want to foreshadow where that might end but I think the system's failed the investigator as much as the investigator failed in their obligations to know the law.

QUESTION:        

Can you quantify the metadata? Was it over a particular period of time? I mean, not dates but perhaps how many months?

AFP COMMISSIONER ANDREW COLVIN:              

Well, what I'll say is that any metadata request is time-limited. We- it's not an open fishing exercise; we have to be very specific about the period of time. So yes, it would have been but, again, it's about the investigation, I'm not going to talk too much about that.

QUESTION:        

The investigators obviously- although the material has been destroyed, they've seen it, they can't unsee it, it's clearly to influence the investigation, isn't it? Can you reflect on that?

AFP COMMISSIONER ANDREW COLVIN:              

Yeah, look, clearly they can't unsee it and they'll need to consider in terms of next steps of the investigation what weight they put on what they saw, but that material was accessed illegally so it can bear no- it can have no bearing on the conduct of the investigation. If, in the judgement of the investigators, that information may afford evidence at some point later, then there's a different process that we're going to have to go through.

QUESTION:        

And just in terms of what the metadata constitutes, is it phone numbers, times of calls or durations for a specific period, or …?

AFP COMMISSIONER ANDREW COLVIN:              

Yeah, so metadata is a very broad term that gets interpreted many different ways. Effectively what this was is the record of one phone number calling another phone number and the time, date and duration of that phone.

QUESTION:        

So it wouldn't have been [inaudible]?

AFP COMMISSIONER ANDREW COLVIN:              

No, it would have been all of the calls in a particular period. So a, you know, a one-week period.

QUESTION:        

So only to that phone number or to all of the calls that were made?

AFP COMMISSIONER ANDREW COLVIN:              

The data that was accessed inappropriately, unlawfully, related to the calls made by that phone number.

QUESTION:        

And it was just calls? It wasn't emails or …?

AFP COMMISSIONER ANDREW COLVIN:              

No, it's just phone- it was basic- sorry, I shouldn't say that. It was records in relation to one phone number calling another phone number.

QUESTION:

And if the investigator had gone through the proper process and had a warrant, this is all information they would have been able to obtain legally?

AFP COMMISSIONER ANDREW COLVIN:              

Absolutely. There is no impropriety in the fact that this information was relevant to the investigation. What was improper was that the right steps weren't taken to gain access to it.

QUESTION:        

Commissioner, can I just ask you on another topic, just quickly-

AFP COMMISSIONER ANDREW COLVIN:              

[Interrupts] Well, have you finished on that one?

QUESTION:        

Quick, one more from me. Does this not confirm or vindicate some of the concerns that have been raised over the past two years about mandatory retention of metadata? Can you just address that?

AFP COMMISSIONER ANDREW COLVIN:              

Look, I don't think it does. In reality, the changes that were brought in by the Government 18 months ago, which I was certainly- took a very keen interest in, tightened the laws around police access to metadata. It put in place processes and practices like this. It limited the number of agencies that could access metadata from what was a much broader set of agencies before. So I think, if anything, the public should have confidence that we have found this breach, I'm being very open and honest about the breach. As I said before, it's not about the propriety of whether that information was relevant to a serious investigation, it was that a step wasn't taken that should have been.

QUESTION:        

And how, by its nature, can the public not have an eroded confidence in the system if these sort of unlawful breaches are going to happen?

AFP COMMISSIONER ANDREW COLVIN:              

Well, look, I think the com- the public will make their own judgements on the fact that this is a very thin, narrow wedge of metadata law relating to journalists. Now, I've been on the record many times saying that it is extremely rare that we are interested in a journalist's metadata but it's not rare that we use metadata on nearly all of our investigations. It is a very common tool that we use and the Ombudsman regularly inspects the Australian Federal Police's compliance with that and we regularly come up very well in those compliance inspections.

QUESTION:        

Just in terms of how the information is obtained, do the police go to the telecommunications company and say, we want details, or trace this number?

AFP COMMISSIONER ANDREW COLVIN:              

Yeah, so the Act prescribes how we do it but there's many hundred of providers of phone services now in Australia and once we identify which provider, we make a request under the Act to that provider.

QUESTION:        

The fact, Commissioner, that you said that you will go back and look at the other- some other instances, I think …

AFP COMMISSIONER ANDREW COLVIN:              

[Interrupts] Yeah, we have looked at them, yes.

QUESTION:        

Oh, you have. Is that indicating you have accessed journalists' metadata before?

AFP COMMISSIONER ANDREW COLVIN:              

No, we looked at- what I said is we looked at other investigations that were of a similar nature that involved unauthorised release and we have not breached. And I think I've been on the record as saying we have also not had any Journalist Information Warrants sought.

QUESTION:        

So just- when did you disclose it to the Commonwealth Ombudsman, sorry?

AFP COMMISSIONER ANDREW COLVIN:

The 25th- 26th April. Two days ago.

QUESTION:        

Do you think, though, people's confidence in the system is shattered, effectively you've broken the law investigating one of your own for a leak?

AFP COMMISSIONER ANDREW COLVIN:              

Well, I hope their confidence isn't shattered because, as I've said, I mean, we- this is routine that we use metadata as a common part of police investigations across the country and I think we have been found to be very compliant. We have breached in respect of a journalist's particular circumstances on this occasion. I don't think that gives cause to say the public should have their confidence shattered in the system.

QUESTION:        

When did the first investigation start into the journalist?

AFP COMMISSIONER ANDREW COLVIN:              

I don't know when it started. It goes back several months. The actual breach occurred earlier this year, though.

QUESTION:        

Commissioner, just on the other …

AFP COMMISSIONER ANDREW COLVIN:              

Okay, yes.

QUESTION:        

Can you explain how your De-radicalisation Unit didn't have full access to a car in Sydney?

AFP COMMISSIONER ANDREW COLVIN:              

I can, actually. That report, which I read with interest this morning, was very much out of context. That report related to material released in an FOI about the setting up of our team in the very early stages when the team was being set up. And I think anyone would expect that with the establishment of any new area, members are going to ask for certain resources and those resources were provided. I have sought assurances again today to make sure that team has all the resources inclu- it needs, including a car, and has had since it was established.

QUESTION:        

So how long did that go on for then, that there was no access to the car in Sydney?

AFP COMMISSIONER ANDREW COLVIN:              

Oh, I don't know. But it would have been simply in the process of setting up. And can I also say, too, we have a lot of cars in the AFP. I don't think any team or officer doesn't have access to a vehicle.

QUESTION:        

So are you adequately resourced, then? Do you need more resources for those teams?

AFP COMMISSIONER ANDREW COLVIN:              

Well look, that's a discussion that I have with government all the time. Counter-terrorism matters and all matters relating to counter-terrorism are a priority and we move resources to the priorities and counter-terrorism is a priority so I'm satisfied that we are applying the right resources to counter-terrorism.

QUESTION:        

So you have enough resources for those teams?

AFP COMMISSIONER ANDREW COLVIN:              

Yes.

UNIDENTIFIED SPEAKER:             

One more question.

QUESTION:        

Commissioner, on the topic of counter-terrorism, three Australians arrested in Beirut [indistinct]

AFP COMMISSIONER ANDREW COLVIN:              

Look, I saw those reports this morning. We have good relationships with the Lebanese authorities. It should be no surprise to anybody, the Government and ourselves have said on a number of occasions that we are concerned about Australians in the conflict zone and it should also be no surprise they will occasionally, potentially, turn up in neighbouring countries. I'm not going to confirm or deny anything about the three that were reported this morning, though.  Thank you.

National Security Hotline

Visit the AFP Futures Centre

The Australian Centre to Counter Child Exploitation

Platypus Online: Read. Discover. Enjoy.