australian federal police data breach Andrew Colvin

An Australian Federal Police Officer who snooped on the call records of a journalist to chase a leak did not even know he or she was supposed to secure a warrant.

In late April, AFP Commissioner Andrew Colvin revealed that an officer had accessed a journalist’s call records for a week as part of an investigation by the AFP into a leak of operational information to that particular, as yet unnamed, journalist. This was in breach of the law around mandatory data retention passed in 2015, which specifically requires Commonwealth officers to first obtain a so-called journalist information warrant when accessing the metadata of a journalist for the purpose of chasing a leak to that journalist. At the time, Colvin said it was “human error” and no ill will was involved. He didn’t go into much detail — constrained by the mandatory data retention legislation about what he could say about the case.

The matter was referred to the Commonwealth Ombudsman just days before the public was informed, and the Ombusdman’s office has launched its own investigation into the breach.

In letters about the breach recently published on the Commonwealth Ombudsman’s freedom of information disclosure log, AFP deputy commissioner for capability Ramzi Jabbour told the then-acting ombudsman, Doris Gibb that the investigator was “unfamiliar with the full suite of data retention amendments that came into effect in October 2015, specifically the requirement to obtain a journalist information warrant for the purpose of accessing telecommunications data to identify a journalist’s source.”

Jabbour also said that as a result of the breach, the AFP would be updating its forms that officers need to fill out in order to request metadata of any kind:

“Is this request being made to identify a possible source of a journalist?” is the question that officers will now be asked every time they fill out a form for metadata.

If they check yes, then they are referred to the procedures on how to obtain a journalist information warrant.

Gibb responded stating she would conduct an investigation, speaking to all officers involved, not just the one who didn’t know about the metadata warrant, but also the authorising officer, the supervising officer and anyone who had oversight of the request.

Gibb indicated that the investigation would be included in the Commonwealth Ombudsman’s annual report, due to be released to the government after June this year. Once it is made available to the government, it will be tabled in Parliament. The journalist involved has not been informed that their metadata was accessed illegally as the investigation into the leak to that journalist is still ongoing. Colvin at the time dismissed suggestions that the illegal access of call records would prejudice the investigation, but admitted there was no way for the officer to “unsee” the call records that were subsequently destroyed.