After Communications Minister Malcolm Turnbull’s appearance on AM this morning, there’s now a fifth definition of metadata in just four days from the government. But, at last, we might actually have one that is comprehensible.
The Prime Minister and the Attorney-General have both stumbled badly over what data they want a data retention scheme to keep. Having kept Turnbull out of the decision and the initial explanation of the proposal, the Communications Minister was allowed in yesterday. His initial foray wasn’t promising: talking with Bloomberg, he spoke nebulously of how the government was on a “journey” to define metadata in consultation with telcos. But this morning, the Zen self-enlightenment stuff was dropped, after a meeting with intelligence agencies and the Australian Federal Police last night. Suddenly we had a much clearer definition:
“It does not relate to the content of traffic. It doesn’t relate to which websites you visit. It is simply in the internet world, the internet protocol world: it simply means that you go on to your ISP, you’re connected to your ISP to connect to the internet. It allocates you a number which is called an IP address, which is essentially your internet address for a period. That may be for a short time or a long time. And that is in the ISP’s records connected to your account.”
So, no browsing history — contradicting both the PM and the Attorney-General and even, apparently, officials who briefed journalists.
How do we know Turnbull has the right end of the stick? Well, we don’t, given how inept this government appears to be, but Turnbull’s explanation was reiterated at a joint media conference by David Irvine of ASIO and Andrew Colvin of the AFP late this morning. And the definition provided by Turnbull closely matches the direction that agencies wanted to go in 2012.
In response to similar — but nowhere near as extensive — confusion over metadata in 2012, then attorney-general Nicola Roxon approved the release of a working definition. The head of her department (and longtime Crikey favourite) Roger Wilkins released it in response to questioning at Estimates by Greens senator Scott Ludlam. Ludlam then discussed the meaning of the document with the AFP’s Neil Gaughan. That discussion can be found here, but this is the crucial exchange (edited):
Ludlam: Part I says “relates to communications for item 2, internet,” and then it says, “Information that allows a communication to occur,” and the first dot point there says, “the internet identifier”. I presume you mean an IP address there.
Ludlam: It says “The internet identifier assigned to the user by the provider,” but you are telling us that that would not allow you to identify web traffic.
[AFP Commissioner] Negus: That is right.
Gaughan: What it does, Senator, is it allows us to identify who has used a particular IP address when they have undertaken a certain activity — for example, downloading child abuse material … For instance, how it works in child protection investigations is a very good example. We receive from our international law information agencies what has been accessed — that is, child abuse material — and an IP address. That is all we get. We do not get any other information. We then ask the telcos to identify who has accessed that IP address to enable us to commence the investigation.
Ludlam: So who held the IP address for a period of time in which content was accessed?
Gaughan: Correct, but it is in undertaking our specific investigation … We do not obtain IP addresses and then go seek the internet of what they have looked at
When Ludlam pressed them on the issue of whether the AFP could go looking for web history, it produced an angry retort from Wilkins that he would “spell it out in words of one syllable” that it didn’t include that. IT specialists can debate issues about, for example, the use of dynamic addresses that may change with individual ISP customers, or the extent to which IP addresses can facilitate identifying browsing history. But there’s at least some solid footing to the definition offered by Turnbull. And the fact that Brandis, in his car crash interview on Wednesday, seemed fixated on the word “address”, seems to suggest agencies had explained the definition to him, but he had failed to grasp it.
None of this fixes the problem that data retention poses to whistleblowers, journalists, activists and politicians. But the lack of browsing history is likely to partially allay the privacy concerns of many.