Encryption and citizenship-stripping legislation: Are Australia’s latest security laws necessary and proportionate?

Today, I will say something about:

• the INSLM role and its origins;

• the counter-terrorism threat;

• my tentative views on my citizenship inquiry, namely that some laws pass

  muster and some don’t;

• my approach to my encryption inquiry;

• some key questions.

The INSLM role and its origins

In 2001, there were no federal anti-terrorism laws and thus no such prosecutions, ASIO had shrunk with the end of the Cold War, Al Qaeda was hardly a household name and ISIL didn't exist. The attacks of 9/11 changed many things, and they certainly began a process of legislative and government response to terrorism activities which has continued to this day and which has resulted in over 75 separate statutes being passed and a similar number of people– 10% of whom were children - being convicted of such offences so far, with many receiving lengthy sentences. And that is not all: there are:

• new or updated laws concerning espionage and sabotage;

• a variety of laws to deal with the still sizeable cohort of foreign fighters, their supporters and dependants; and new encryption laws to counter organised criminals and terrorists using technology to ‘go dark’ as far as surveillance of them by police and intelligence authorities is concerned, although in the UK the preferred terms are not ‘going dark’ but ‘going spotty’ or even ‘going different’.

The new laws (like the new threats) were and are often unsettling in their novelty and reach and raise legitimate questions:

• Do they go too far?

• Do they work?

• Do they properly deal with legitimate human rights concerns?

In a sceptical world, it is no longer enough for any government minister anywhere to say ‘just trust us’ or ‘if you knew what I know you would be satisfied’. As Sir Adrian Fulford, the UK Investigatory Powers Commissioner, has said of transparency:

in the post-Snowden world, the security and law enforcement agencies can no longer expect to work in the shadows, in the sense that material which can properly be made public should be widely available for scrutiny.ii

In 2010 Australia adapted the role of the United Kingdom’s Independent Reviewer of Terrorism Legislation, by enacting the Independent National Security Legislation Monitor Act which provides for the appointment of a part- time INSLM. With my appointment to that role in early 2017, I followed two eminent lawyers, namely the Honourable Roger Gyles AO QC and, before him, Bret Walker SC.

Fundamentally, to adopt the language of former Independent Reviewer Lord David Anderson QC, both Reviewer and INSLM share the following features:

• first, independence;

• second, an entitlement to see everything of relevance, even the most

  highly classified intelligence material: this is one answer to the person unconvinced by a Minister who says ‘if you could see what I see’ as both INSLM and Reviewer can and do see just that; and

• third, compulsory publication of the reports to government, in my case tabling of any declassified report must occur within 15 sitting days so that the Parliament and the public can read and consider for themselves.

As INSLM I don't investigate complaints or look at bills, rather, I independently:

• review the operation, effectiveness and implications of national security and counter-terrorism laws; and consider whether such laws

• contain appropriate protections for individual rights;

• remain proportionate to terrorism or national security threats; and

• remain necessary.

Many reviews can be conducted by me of my own motion, however, the Prime Minister and the Attorney-General can send me any topic related to counter- terrorism or national security - a much broader concept - and the increasingly important and highly respected Parliamentary Joint Committee on Intelligence and Security (PJCIS) can also send me certain matters, and they in fact have recently sent me their first reference, namely, the encryption review, which I will come to.

Threats

Because I must consider whether particular laws remain proportionate to threats of terrorism or to national security or both, I receive regular briefings from police, policy and intelligence agencies on all matters of relevance to my reviews. As has been the case for the past four years, the current threat of a terrorist act occurring in Australia remains at the ‘probable’ level. My views are that:

• The credible threat of one or more terrorist attacks in Australia will remain a significant factor in the Australian national security and counter- terrorism landscape for the reasonably foreseeable future;

• While more complex or extensive attacks cannot be ruled out and must be prepared for, attacks by lone actors using simple but deadly weapons, with little if any warning, are more likely;

• There can be no guarantee that the authorities will detect and prevent all attacks although most have been;

• There is also the risk of opportunistic if unconnected ‘follow-up’ attacks in the immediate aftermath of a completed attack at a time when police and intelligence agencies are fully occupied in obtaining evidence and returning the attacked locality to normality;

• The threats come mainly from radical and violent Islamist action – which is not to be confused with the great world religion of Islam which advocates peace;iii

• There are also increasing concerns about radical, violent, right wing activity;

• The implications of the recent atrocities in Christchurch and Sri Lanka, as with the likely future roles of the remnant foreign fighters of the so-called caliphate, are yet to be fully worked out.

Turning to the dual citizenship issue: a key focus of the current operation of counter-terrorism laws concerns Foreign Fighters, which brings me to say something about ISIL members and supporters.

The rise of ISIL, which led to the so-called caliphate, took almost everyone by surprise. I expect its capacity to surprise will continue. ISIL has produced a large, now widely dispersed, radicalised, highly trained diaspora of actual or potential terrorists, many of whom remain with their supporters and dependants (including children), and most of whom remain outside of their countries of citizenship. Foreign Fighters abroad or at ‘home’ pose a durable threat, directly by pursuing violence, indirectly by inspiring others.iv The formation of Al- Qaeda is said to be a good example of this, where Foreign Fighters involved in the 1970’s/1980’s Afghan–Soviet conflict later formed the core of Al-Qaeda.^v And the ISIL threat is wider than the Foreign Fighter group, large though it is, because of the effectiveness of its message, particularly over the internet, to inspire other attacks. As the UK Home Secretary, Sajid Javid, said in a speech on 20 May this year:

In fact, of all the terrorist plots thwarted by the UK and our Western allies last year, 80% were planned by people inspired by the ideology of [ISIL]/Daesh, but who had never actually been in contact with the so- called Caliphate.^vi

We still have much in common with the United Kingdom, for example:

• legal history and institutions;
• membership of Five Eyes;
• close collaboration in intelligence and law reform, and, unfortunately;
• dual citizens who are either ISIL terrorists, their supporters or their child dependants.

There has been much reporting about the plight of such children or those who travelled as children. Let me say something about children in this context, although I will be careful to say nothing which could interfere with Australia’s current diplomatic and aid efforts.

The position of children and young people is not straightforward. Of course, as a matter of humanity, reflecting the terms of the Convention on the Rights of the Child, the plight of very young children is distressing and there is general hope for their safe return. Beyond the very young, the position becomes more complex.

As I said in my recent report to the Prime Minister concerning the Prosecution And Sentencing Of Children For Terrorism Offences,

There are ... parallels between child soldiers and Australian children in territory controlled by ISIL: the fact that each are certainly victims does not mean they cannot also become perpetrators, and thus they remain a cohort of interest.^vii

That remains true even though ISIL no longer controls territory as it once did. As a matter of law, the cohort of children need to be divided, between:

• those under the age of criminal responsibility, which is 10;
• those under 14 where there the presumption against criminal intent applies;
• and those between 14 and 18 who are to be tried and punished as juveniles.

It is very possible that there were young Australians over 14 years of age who have committed one or more terrorist offences or breached the declared area provisions which made it a crime to be in Mosul or Raqqua without reasonable excuse. Finally, within these groups no doubt the level of criminal culpability will vary.

The current Citizenship review

While revoking citizenship due to terrorist conduct is a recent development the concept of stripping citizenship for criminal conduct is not new.^viii There are two types of provisions of relevance in the Australian Citizenship Act. First, there are what I might call the conventional provisions in s 35A.ix The requirements that must be met to empower the Minister to revoke a person’s citizenship under s 35Ax are:

• the person has been convicted of a specified offence related to terrorism;

• the person has been sentenced to at least six years imprisonment for such

  offences;

• the person is a national or citizen of a country other than Australia;

• the Minister is satisfied that the person’s conduct demonstrates that they

  have repudiated their allegiance to Australia; and

• the Minister is satisfied that it is in the public interest for the person to no longer be an Australian citizen, having regard to certain factors.

My preliminary view is that such provisions pass muster under the INSLM Act, at least for the following reasons.

First, there is a conviction by a jury – so the terrorist conduct is established.

Second, there is a substantial sentence imposed by a judge, which shows the level of seriousness of the conduct.

Third, the person will not be rendered stateless, thus we continue to comply with the Convention on Statelessness.

Fourth, it seems to me too absolute to say that citizenship revocation for terrorists is either always or is never justified or is either always or is never an effective way to protect the Australian community. Rather, sometimes it is both justified and effective.

The argument in favour of such revocation might go like this:

• Citizenship still has at its core the notion of allegiance to a nation state;

• Just as it can be expressly disavowed by renunciation, it can be impliedly disavowed by inconsistent conduct: take the historical case of spying or fighting for the enemy during World War 2;

• Although there are no longer declared wars between nation states, is it not so very different where an Australian citizen fights for ISIL against the Australian Defence Force or its allies?

• The High Court has said ‘Australian citizenship is a common bond, involving reciprocal rights and obligations’^xi and that ‘a federal offence is, in effect, an offence against the whole Australian community’^xii - and a serious terrorism offence is a clear case of an offence against the Australian community and one which may break the common bond;

• If all of that is accepted, then there is a logical argument that it may, I emphasise, may, be in the public interest in an individual case to revoke citizenship.^xiii In the language of the INSLM Act the law may be ‘necessary’. But because there may be many competing factors a decision must be made considering the facts and surrounding circumstances in each particular case.

In contrast there are two ‘operation of law provisions’ (ss 33AA^xiv and 35^xv) which in effect provide that if:

• a person is a dual citizen of Australia and another country;

• is 14 years of age or more;

• is outside Australia; and

• engages in fact in specified forms of acts related to terrorism - such as committing a terrorist act, or fighting for ISIL; then

• by operation of law, without any further event such as conviction by jury or decision by a minister, official, judge or Tribunal member, the person then and there loses their citizenship.

These provisions operate to cease a person’s Australian citizenship automatically on the occurrence of certain ‘conduct’ (s 33AA) or where the person fights for, or is in the service of a Declared Terrorist Organization (s 35). Upon the relevant Minister^xvi becoming aware of citizenship so ending under s 33AA, 35, or 35A, he must give (or make reasonable attempts to give) notice to the person of that event as soon as practicable unless there is a decision made on the grounds of security, international relations etc not to notify in which case the former citizen will not be aware of their loss of citizenship.

In contrast to my preliminary views on s 35A, my preliminary view of ss 33AA and 35 is that each are problematic under the INSLM Act for at least the following reasons.

First, the law operates in an uncontrolled and uncertain manner. The Australian government has publicly announced that the provisions of the law have operated to deprive 12 persons of Australian citizenship although, mainly because of Ministerial decisions not to notify the affected persons, the names of the persons are not known publicly except for Neil Prakash, where there is a disagreement between Australia and Fiji as to which country he remains a citizen of.

It is very likely that there are more, perhaps many more, persons who have in this way lost their citizenship, but who are not known to the authorities. The most obvious group of such persons are those who fought for or supported ISIL without the knowledge of Australia, but the same could be said of as yet unknown terrorist recruiters or financiers anywhere in the world. Any government should be able to say at any particular time who is and is not a citizen but this law prevents it from definitively doing so.

I note that the Minister may reverse the revocation, but is under no compulsion even to consider such action. If, however, he does so, Parliament must be advised of the fact and the reasons for doing so. The provisions make citizenship comparatively easy to lose but hard to regain even if many years pass before the government or the person become aware of the citizenship loss.

Second, the law lacks the traditional and desirable accountability which comes from a person taking responsibility for a decision whether that is a Minister, an official, a judge or a tribunal member.

Third, there will inevitably be cases where it is not in the public interest to cancel a particular person’s citizenship for terrorist conduct, support or affiliation: examples of relevant factors can readily be imagined: actually, they don't need to be imagined because they are already listed as reasons to be taken into account in a Ministerial exemption decision under s 33AA (17), namely:

• the severity of the conduct engaged in;

• the degree of threat posed by the person to the Australian community;

• the age of the person;

• if the person is aged under 18--the best interests of the child as a primary consideration – that reflects Australia’s obligations under the Convention on the rights of the child;

• whether the person is being or is likely to be prosecuted in relation to the conduct engaged in, and, I would add, the extent to which they might be prepared to be a Crown witness against co-accused or others;

• the person's connection to the other country of which the person is a national or citizen and the availability of the rights of citizenship of that country to the person;

• Australia's international relations;

• any other matters of public interest.

None of those matters is considered when the law first operates: to that extent the operation of the law is likely to be disproportionate to the threat posed by some persons and, in any event their rights in relation to the loss of the valuable right of Australian citizenship seem insufficiently safeguarded.

Fourth, the problems are compounded by the capacity of the Minister not to give notice of the loss of citizenship: the revokee may well order their life on the basis that they remain a citizen when they do not. Take the possibility of an Australian woman who decided to have another child wrongly thinking the child will be Australian: there is then no technical breach of either the Convention on the Rights of the Child nor the Convention on Statelessness, but it is highly problematic for both mother and child.

Fifth, there are real problems with review and scrutiny. Although the courts can make a declaration that at the relevant time the person was not in fact a dual citizen and thus cannot have lost their (sole) Australian citizenship, the conclusion by an inter-departmental committee that the disqualifying conduct has occurred cannot easily be challenged, if it can at all.

However, my preliminary view is that there is a solution to these problems which might work, and that is to adopt the existing procedures for challenges to passport cancellations, where, as here, there is often much sensitive intelligence material which cannot be disclosed to the revokee, but where the Security Appeals Division of the Administrative Appeals Tribunal adopts a more inquisitorial model and tests the intelligence material in private in the absence of the revokee. This is essentially the model used in the UK in the Special Immigrations Appeals Commission. Noting that the Commonwealth is about to appoint special advocates to deal with Control Order cases, I would favour the UK model of using Special Advocates to represent the interests of the revokee in the closed session. The Tribunal could be required to apply all the factors the Minister may currently apply in deciding whether to reverse the revocation.

As you can appreciate, these are complex and difficult issues and the main reason for my appearance today at the Lowy Institute is to encourage wide participation in this and indeed all of my inquiries including the public hearings on citizenship due to be held 27 June 2019.

Encryption

The Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (TOLA) commenced in early December last year having been introduced as a bill some 6 weeks before. The PJCIS urgently considered its terms - however, having received advice from the government that there was an immediate need to provide agencies with additional powers and to pass the Bill in the last sitting week of 2018, it cut short its consideration and recommended enactment with some amendments, with the proviso that there be further review by both the Committee and my Office. This year it referred review of the Act to me.

The key features of the Act that have received attention are the new ability of federal intelligence and Australian police to get technical assistance from a designated communications provider either by agreement or ultimately by compulsion to require that provider to take certain steps to help the authorities perhaps by giving access to an app, or a service offered by an ISP, or an encrypted communication, but with a view to ‘better deal with the challenges posed by ubiquitous encryption’.^xvii Today is not the day to go into any detail on how this complex Act works: the 2019 report^xviii on the Act by the PJCIS is a good summary of the many controversies which attend the Act.

Today I advise all those interested in this important law to become engaged in my review. I would like to set up consultative groups so please let me know if you would like to take part. May I suggest a few principles, some derived from the report by David Anderson, called ‘A Question of Trust’.^xix

• First, just as in the physical world we do not accept lawless ghettos where the law does not apply, so also it should be in the virtual world: in this context it means intrusive surveillance powers – conferred by law and with clear thresholds and safeguards – which already apply in the physical world should in principle apply in the analogous virtual world unless there are good reasons otherwise, an example of such a good reason would be if, I emphasise if, the operation of the law would unduly undermine, say, the integrity of the financial and banking system.

• Second, what the law permits and forbids must be clear.

• Third, oversight and safeguards are vital and there are comparative models of interest: so, in the UK, industry is involved through a technical advisory panel and also in adjudicating on some requests through membership of a technical advisory board. It may also be appropriate to have a ‘double lock’ for decisions with the relevant Minister’s most intrusive powers subject to routine review by a panel of retired judges who have access to all the underlying material.

This is a very complex review and I welcome wide participation.

Key Questions

May I finish by noting some key questions.

• First, how can the role of Parliament and key committees such as the PJCIS in scrutinising counter terrorism and national security laws be enhanced?^xx

• Second, how best to achieve the desirable aim ‘that material which can properly be made public should be widely available for scrutiny’: one way to start, as I suggested in my latest report to the Prime Minister is following the UK practice of regularly making accessible figures on numbers of arrests and convictions.^xxi

• Third, how best to enhance the vital role of the guardians whether that is the judiciary; or the bodies like the Inspector-General of Intelligence and Security to whom whistleblowers may legitimately turn with any concerns they may have about illegality or maladministration?^xxii

• Fourth, how to ensure proper safeguards against misuse of internet technology?^xxiii

I suggest that one way to start to answer all of those questions is to measure them against the critical issue of trust in a democratic society. As David Anderson has written:

Public consent to intrusive laws depends on people trusting the authorities, both to keep them safe and not to spy needlessly on them...

Trust in powerful institutions depends not only on those institutions behaving themselves (though that is an essential prerequisite), but on there being mechanisms to verify that they have done so. Such mechanisms are particularly challenging to achieve in the national security field, where potential conflicts between state power and civil liberties are acute, suspicion rife and yet information tightly rationed...

Respected independent regulators continue to play a vital and distinguished role. But in an age where trust depends on verification rather than reputation, trust by proxy is not enough. Hence the importance of clear law, fair procedures, rights compliance and transparency.^xxiv

I look forward as INSLM to continuing to play my part on the issue of trust. It is a privilege to do so.

For full notes, download the full transcript here.