The federal government has reassured the public that Covidsafe data held by Amazon will not be able to be accessed by US law enforcement, but a parliamentary committee is currently investigating separate legislation that would pave the way for US law enforcement to access data held in Australia.
Federal parliament this week debated and passed Covidsafe legislation designed to protect the privacy and security of users of the government’s contact-tracing app.
A major concern held by those critical of the app is that the data is being hosted in Australia by US tech giant Amazon Web Services, and any data held by the company in Australia would be subject to the US Cloud Act – a law which can force US companies to hand over data to US law enforcement regardless of where that data is held.
The defence minister, Marise Payne, argued that because the Covidsafe legislation makes “any transfer of data to any country outside Australia … a criminal offence under the provisions of the bill”, US law enforcement would not be able to get the Covidsafe data.
However, the telecommunications legislation amendment (international production orders) bill 2020 would, if passed, make it possible for Australia to facilitate agreements with other nations so that Australian law enforcement agencies could access data held in those countries and vice versa. It has been developed with the US Cloud Act in mind.
The Law Council of Australia told a committee reviewing the IPO legislation that there weren’t enough safeguards built into it to “quash” any request from the US for Covidsafe data under the Cloud Act.
“The Law Council has significant concerns about the adequacy of safeguards affecting nearly all aspects of the proposed international production orders scheme. These issues in our view may impede Australia’s ability to make an agreement with the US,” the Law Council of Australia president Pauline Wright told the committee on Tuesday.
If there was no agreement made under the Cloud Act, then it would be possible for law enforcement to force, either by US warrant or court order, the handing over of the data.
“Entering into an executive agreement with the US would ensure among other things that the protections of Cloud Act would be enlivened enabling an order for the production to US authorities of data held by an Australian arm of a US company, for example by AWS that holds the Covidsafe app data, to be quashed.”
Business Software Alliance APAC policy director Brian Fletcher told the committee there was not adequate redress to prevent companies facing legal action in situations where Australian law was in conflict with overseas law.
“The only reason that a provider could challenge an IPO that has been issued to them, would be in writing to the Australian designated authority on the basis that the IPO does not meet the designated international agreement,” he said on Wednesday.
“We would like to see the ability for technology providers to challenge on a wide range of considerations including that the data no longer exists.”
If the IPO legislation passes, Australia will still need to negotiate an international agreement with the US under the Cloud Act in order to get reciprocal arrangements for data sharing between law enforcement agencies in the US and Australia.
It is in this agreement, that home affairs minister Peter Dutton is currently negotiating with his US counterpart, that Covidsafe data could be excluded, shadow home affairs spokeswoman Kristina Keneally told the Senate on Wednesday.
“The foreign minister could seek diplomatic assurances from the United States, and the minister for home affairs could ensure that access to Covidsafe app data is excluded from any security or intelligence-sharing arrangement with the United States,” she said.
“I urge [Dutton] to pursue this option as it will provide further assurances to the Australian public and hopefully will result in more downloads of the app. If the government wants this app to be embraced by millions more Australians – something that could continue to keep Covid-19 at bay – they would be taking these steps.”
When asked on Thursday whether the draft agreement between the US and Australia would be made public, Department of Home Affairs officials said it would not, but ultimately the final text of the agreement would go to the joint standing committee on treaties.
Labor MP Ed Husic has called for AWS’s $709,000 contract, which runs until late October, to be cancelled and handed to an Australian cloud provider instead, which would move the data further from US law enforcement grasp.
“My firm view is that the AWS contract should be taken away from AWS and provided to one of the providers that is on that protected list and is Australian based to build stronger confidence in the way that this app is managed and not just have five million Australians downloading this app, but many more,” he said.
Australian law enforcement are keen to facilitate this agreement because they stand to benefit from it much more than their US counterparts due to the vast amount of online information being held in the US. They say getting data out of US-based companies like Facebook, Google and Apple can take a long time under existing mutual agreement frameworks.
NSW police assistant commissioner Michael Fitzgerald told the committee of one case in which a person was threatening to kill another person and created fake Facebook profile accounts of the victim’s dead relatives, with offensive edited photos of those family members. He said it took Facebook four years, from 2015 to 2019, to comply with the request for information on who was behind those accounts.
“We have had murder investigations where we’ve had offenders charged and we’ve had to wait up to a year to two years to get information from those providers so we use the [existing treaty] as a source to build up the brief of evidence but it’s generally not used as an investigative tool because of the time delay.”