How many agencies can access your metadata without a warrant? Look, AGD would tell us, but it's just so much damn work and they'd rather not.
The Attorney-General's Department doesn't want you to know which agencies have requested access to metadata without a warrant since the data retention regime came into effect in October.
As part of the tranche of national security legislation that forced all telecommunications companies in Australia to retain call records, assigned IP addresses, email information, call locations, SMS records and other data for two years for warrantless access by law enforcement, the government dramatically shortened the list of agencies that could access telecommunications metadata.
Under the previous regime, where agencies could ask for the data but telcos weren't required to keep it, just about any federal or state government or local government agency could access metadata without a warrant, and they did. The RSPCA, a taxi regulator, local councils
and other agencies accessed call records and other stored customer data.
After the legislation came into effect in October this year -- although most Australian telecommunications companies, including Telstra, will not be fully compliant until April 2017
-- the number of agencies that could access the data decreased to just 22 agencies. Those that missed out need to apply to the Attorney-General in order to be added to the list of agencies.
Since the passage of the legislation in April, Australian Border Force has been added to the list of agencies, and the Australian Taxation Office, and the Victorian Racing Integrity Commissioner are lining up at Brandis' door to be added to the list.
The Attorney-General's Department would not confirm to media how many agencies had asked to be added, but a freedom of information request
filed by privacy advocate Geordie Guy sought to force the government to reveal exactly who had asked to be added under the legislation.
In a response received yesterday, the Attorney-General's Department informed Guy it intended to refuse the request on practical grounds. The FOI Act
empowers government agencies to refuse requests that would "substantially and unreasonably divert resources".
According to the response, there were 288 documents found, with up to 2661 pages in total for the agency to go through, for up to 450 hours of decision-making time. The response does give a hint as to how many agencies might have requested to be added, however. The department suggests it would need to consult with 45 third parties, i.e. people outside of the department, who are mentioned or included in the documentation. This suggests that up to 45 agencies could have asked for access to metadata.
Guy is narrowing his request to simply ask for just a list of agencies that have requested access. We will know more, soon enough.