Australia and the US have begun negotiating a deal to speed up information sharing about criminal suspects between law enforcement agencies and tech giants such as Google and Facebook.
But questions remain about the practical effects of such a deal, given the drive towards encryption of information that keeps data at arm’s length from the tech companies themselves.
The announcement capped a visit to the US by the Australian home affairs minister, Peter Dutton, at the invitation of the US attorney general, William Barr, to attend the Lawless Spaces Summit on warrant-proof encryption and its impact on child exploitation cases.
The trip started with Australia joining the US and UK in warning Facebook against going ahead with plans to implement end-to-end encryption in all its messaging unless it creates a backdoor to allow governments to access the content of private communications.
Dutton’s trip also included an appearance at a government-industry roundtable alongside the home affairs department secretary, Mike Pezzullo, at which Dutton warned that “existing policy settings are not keeping pace with … technological change”.
Facebook rebuffs Dutton on backdoors to encryption
Law enforcement agencies worldwide are struggling to formulate a response to the increasing use of end-to-end encryption, which protects communications with a code so strong that only the users can read the messages, thwarting the investigation and prosecution of criminal offences.
Facebook already employs end-to-end encryption on WhatsApp, and plans to integrate Facebook Messenger and Instagram with WhatsApp have sparked concern from the US, Australia and UK. Those countries warned it not to proceed with the plan “without including a means for lawful access to the content of communications to protect our citizens”.
Dutton told Guardian Australia encryption was “important for banking and other uses, but paedophiles are using it to order children and send images of children being raped”.
“All companies, including Facebook, must have zero tolerance when it comes to child exploitation and not allow their platforms to facilitate these sick crimes,” he said. “At the moment even with a court-ordered warrant police can’t access the messages to use as evidence to prosecute these evil criminals.
“You’re either on the side of vulnerable children or not. It is time for Facebook to pick a side.”
Facebook responded by saying it “strongly opposes government attempts to build backdoors because they would undermine the privacy and security of people everywhere”.
“We believe people have the right to have a private conversation online, wherever they are in the world.
“As the US and UK governments acknowledge, the [Clarifying Lawful Overseas Use of Data – Cloud] Act allows for companies to provide available information when they receive valid legal requests and does not require companies to build backdoors.”
UK strikes Cloud Act deal but Australia still at square one
The Cloud Act, passed in 2018, compels US tech companies to hand over data when presented with a warrant by law enforcement agencies. It also allows the US to strike deals with partner countries to provide that data in return for reciprocal cooperation from their agencies and tech companies.
On Thursday the UK struck the first Cloud Act deal, which mandated that each country would gain permission before using the data for death penalty prosecutions in the US, or cases implicating freedom of speech in the UK.
Australia is still at the first stage of the process to negotiate a deal. Dutton said Australia was very pleased to have entered negotiations but “we have some way to go before the agreement is finalised”.
“Once in place it will mean service providers based in the United States can respond directly to electronic data requests issued by our enforcement agencies under Australian law for data critical for the prevention, detection, investigation and prosecution of serious crime,” he said.
“Current processes for obtaining electronic information held by service providers in other countries risk loss of evidence and unacceptable delays to criminal justice outcomes.”
The innovation and entrepreneurship director at the US Studies Centre, Claire McFarland, said it was unclear what conditions Australia would need to meet to reach a deal.
“The mechanism for cooperation that our laws are working on is not keeping pace with the speed of technological change,” she said. “A government-to-government avenue is time consuming, so having an alternative framework between Australia and the US will result in expedited outcomes.”
In a statement the US justice department noted the deal would be “underpinned by Australian legislation yet to be introduced”.
Encryption legislation puts US deal at risk, Labor suggests
Labor’s shadow home affairs minister, Kristina Keneally, welcomed the proposed deal but questioned whether it would require the Coalition to amend encryption legislation rushed into law in December.
The legislation attempts to overcome the problem of encrypted messaging by coopting technology companies, device manufacturers and service providers into building the functionality needed for police to do their spying.
The Law Council and tech firms have warned that it could prevent Australia qualifying for a Cloud Act agreement because it may breach the US requirement that foreign countries have robust data privacy protections to receive data from US firms.
The council also submitted to a parliamentary inquiry that Australian laws were “insufficient on their own to compel a service provider in the US to do anything not authorised by US law”.
Jerry Nadler, the chairman of the US House of Representatives judiciary committee, wrote to Dutton on 4 October warning the legislation “may undermine [Australia’s] ability to qualify for an executive agreement under the Cloud Act”.
Nadler noted the concerns about the “profound impact” of the laws, lack of judicial oversight and requested information on the risk of encryption being weakened. The Cloud Act prohibits an agreement from creating “any obligation that providers be capable of decrypting data or limitation that prevents providers from decrypting data”.
Keneally told Radio National there were “open and serious questions” about whether “the Australian law which was passed by the parliament in a significant rush less than 12 months ago … can conform to the Cloud Act in the United States and allow this type of ability to access encrypted material to become possible”.
The Centre Alliance senator Rex Patrick said a Cloud Act deal would “need to be subject to very close scrutiny by the Australian parliament”.
“Given their track record, it is not easy to have confidence that a negotiation undertaken by [Dutton and Pezzullo] will properly protect the data rights and privacy of Australians, including protection of data generated by journalists and media organisations,” he said.
Patrick noted that the Cloud Act had been supported by the information giants Microsoft, Apple and Google but had been heavily criticised by civil rights and privacy groups, including the Electronic Frontier Foundation, the American Civil Liberties Union, Amnesty International and Human Rights Watch.
Patrick said the bilateral deal “should properly protect the rights and privacy of Australian citizens”, including “strong protections for journalists and media organisations that may be targeted in the US government’s politically driven crackdown on information leaks, whistleblowers, journalists and media organisations”.