Timely reminder:“Democracy dies behind closed doors.”

David Cole, the Honorable George J. Mitchell Professor in Law and Public Policy at Georgetown University Law Center writing in The New York Review of Books reflects on drone strikes and surveillance, and given the incredible extension in what technology can deliver, the importance of transparency. 

Professor Cole while acknowledging secrecy is sometimes necessary, ticks various boxes about the extent to which a degree of forced transparency has had a subsequent restraining influence on US policy and programs, but needs to go further:

We won’t have a chance to arrive at defensible policies on surveillance and targeted killing if the questions are not fully and fairly debated. When the balance between individual rights and security is struck in secret one-sided determination, as has been the case with both drone killing and electronic surveillance, as well as the CIA’s enhanced interrogation program, it will inevitably be skewed. Increasingly, our governments seem to be insisting that our lives be transparent to them, while their policies remain hidden from us. For the sake of democracy itself, we must do all we can to resist that impulse.

Australian readers might ponder the situation here in light of this Business Insider list in June 2014 of what the world learned in a year of Snowden leaks.

We had or are having something of a debate about the powers given to Australian security services, metadata and data retention. 

But as Martin Place and Paris are sure to raise questions about the need for ever more information about all of us in the search for the deranged, driven and malevolent, let's plug for Professor Cole's full and fair debate. 

Something we missed here following revelations for example about Australian involvement in those drone strikes and the PRISM and XKeyscore programs, spying on our friends and in this case their lawyers, the shared arrangements we have entered into to pool information about citizens, and who here in government let alone the rest of us knows what is going on.

More from Professor Cole here:

SA bridges safe-from disclosure that is.

Outback SA bridge- bluegumpictures.com.au

South Australian Ombudsman Richard Bingham, after investigating a complaint concerning a decision by the Department of Transport to refuse a Freedom of Information application for information about the state of SA bridges, said the claim that disclosure might assist terrorists and endanger lives showed an interpretation of the FOI law that was "irrational, absurd and ridiculous". The Sunday Mail report included this about the Ombudsman's letter to the Department:

"To date, the agency has raised what I considered to be a very generalised and highly speculative argument." He said most of the information was already in the public domain, and questioned why the information could not be released. Mr Bingham said many of the problems with bridges would be visible to the public and, "likewise, many of the photographs included in the documents could be taken by a member of the public". "I question why the disclosure of such information could reasonably be expected to endanger the life or physical safety of any persons, or the security of any structure," he wrote.

Shades of Tim Lester's three year battle to get access to reports about national preparedness to cope with emergencies, finally conceded in his favour about the time the issue of preparedness for bushfires emerged in Victoria following Black Saturday. And of a 2006 NSW Administrative Decisions Tribunal decision (Hutchinson and Roads and Traffic Authority, NSW [2006] NSWADT 147) that photographs showing structural details of the Sydney Harbour Bridge could reasonably be expected to facilitate a terrorist attack, although in that case a unique provision (Clause 4A of Schedule 1) of the NSW Freedom of Information Act was at issue rather than the more common exemptions of danger to life or physical safety or danger to the security of any structure. There was no evidence of anything to link the applicant to possible terrorist activity, and plenty of books and photographs about the structure of the bridge are in the public domain. It came down to a simple finding that it was "not irrational, absurd or ridiculous to expect that disclosure of the photographs could facilitate the commission of a terrorist act."

Being alert to, and sensible about, danger to important infrastructure is one thing. Blanket claims like the one in South Australia for everything contained in 696 bridge inspection reports and two earthquake-risk reports, much of which is in the public domain, is as the Ombudsman says "irrational, absurd and ridiculous." And hides inefficiency and information about performance (or not) to deliver safe infrastructure that should be readily available.

Brad Crouch in the Sunday Mail reported that the use of exemptions in SA has soared in recent years. As previously mentioned here, it's one of two state governments (the other WA) that to date have shown no interest in fundamental reform of access to information laws.Correction-should have also added Victoria to that list, where the Government seems to have retired hurt after a flawed reform effort failed to carry the Upper House 18 months ago.

There goes the neighbourhood.

http://farm1.static.flickr.com

The US Government mistakenly posted on the web (since removed) a 266-page report, marked “highly confidential,” that details hundreds of nuclear sites and programs, as reported in the New York Times. Makes Australian Foreign Minister Stephen Smith by comparison, a paragon in handling sensitive documents.

Obama standard sounds pretty good from here

President Obama's speech at the National Archives in Washington covered a wide range of issues concerning intelligence, values, and national security including this:

Now, let me touch on a second set of issues that relate to security and transparency. National security requires a delicate balance. One the one hand, our democracy depends on transparency. On the other hand, some information must be protected from public disclosure for the sake of our security -- for instance, the movement of our troops, our intelligence-gathering, or the information we have about a terrorist organization and its affiliates. In these and other cases, lives are at stake.

Now, several weeks ago, as part of an ongoing court case, I released memos issued by the previous administration's Office of Legal Counsel. I did not do this because I disagreed with the enhanced interrogation techniques that those memos authorized, and I didn't release the documents because I rejected their legal rationales -- although I do on both counts. I released the memos because the existence of that approach to interrogation was already widely known, the Bush administration had acknowledged its existence, and I had already banned those methods. The argument that somehow by releasing those memos we are providing terrorists with information about how they will be interrogated makes no sense. We will not be interrogating terrorists using that approach. That approach is now prohibited.

In short, I released these memos because there was no overriding reason to protect them. And the ensuing debate has helped the American people better understand how these interrogation methods came to be authorized and used.

On the other hand, I recently opposed the release of certain photographs that were taken of detainees by U.S. personnel between 2002 and 2004. Individuals who violated standards of behavior in these photos have been investigated and they have been held accountable. There was and is no debate as to whether what is reflected in those photos is wrong. Nothing has been concealed to absolve perpetrators of crimes. However, it was my judgment -- informed by my national security team -- that releasing these photos would inflame anti-American opinion and allow our enemies to paint U.S. troops with a broad, damning, and inaccurate brush, thereby endangering them in theaters of war.

In short, there is a clear and compelling reason to not release these particular photos. There are nearly 200,000 Americans who are serving in harm's way, and I have a solemn responsibility for their safety as Commander-in-Chief. Nothing would be gained by the release of these photos that matters more than the lives of our young men and women serving in harm's way.

Now, in the press's mind and in some of the public's mind, these two cases are contradictory. They are not to me. In each of these cases, I had to strike the right balance between transparency and national security. And this balance brings with it a precious responsibility. There's no doubt that the American people have seen this balance tested over the last several years. In the images from Abu Ghraib and the brutal interrogation techniques made public long before I was President, the American people learned of actions taken in their name that bear no resemblance to the ideals that generations of Americans have fought for. And whether it was the run-up to the Iraq war or the revelation of secret programs, Americans often felt like part of the story had been unnecessarily withheld from them. And that caused suspicion to build up. And that leads to a thirst for accountability.

I understand that. I ran for President promising transparency, and I meant what I said. And that's why, whenever possible, my administration will make all information available to the American people so that they can make informed judgments and hold us accountable. But I have never argued -- and I never will -- that our most sensitive national security matters should simply be an open book. I will never abandon -- and will vigorously defend -- the necessity of classification to defend our troops at war, to protect sources and methods, and to safeguard confidential actions that keep the American people safe. Here's the difference though: Whenever we cannot release certain information to the public for valid national security reasons, I will insist that there is oversight of my actions -- by Congress or by the courts.

We're currently launching a review of current policies by all those agencies responsible for the classification of documents to determine where reforms are possible, and to assure that the other branches of government will be in a position to review executive branch decisions on these matters. Because in our system of checks and balances, someone must always watch over the watchers -- especially when it comes to sensitive administration -- information.

Now, along these same lines, my administration is also confronting challenges to what is known as the "state secrets" privilege. This is a doctrine that allows the government to challenge legal cases involving secret programs. It's been used by many past Presidents -- Republican and Democrat -- for many decades. And while this principle is absolutely necessary in some circumstances to protect national security, I am concerned that it has been over-used. It is also currently the subject of a wide range of lawsuits. So let me lay out some principles here. We must not protect information merely because it reveals the violation of a law or embarrassment to the government. And that's why my administration is nearing completion of a thorough review of this practice.

And we plan to embrace several principles for reform. We will apply a stricter legal test to material that can be protected under the state secrets privilege. We will not assert the privilege in court without first following our own formal process, including review by a Justice Department committee and the personal approval of the Attorney General. And each year we will voluntarily report to Congress when we have invoked the privilege and why because, as I said before, there must be proper oversight over our actions.

On all these matters related to the disclosure of sensitive information, I wish I could say that there was some simple formula out there to be had. There is not. These often involve tough calls, involve competing concerns, and they require a surgical approach. But the common thread that runs through all of my decisions is simple: We will safeguard what we must to protect the American people, but we will also ensure the accountability and oversight that is the hallmark of our constitutional system. I will never hide the truth because it's uncomfortable. I will deal with Congress and the courts as co-equal branches of government. I will tell the American people what I know and don't know, and when I release something publicly or keep something secret, I will tell you why. (Applause.)

As our debate here on another matter- the budget and the economic outlook- continues amid concern about the Government's information management and control, and "obsession with spin" , that last sentence sounds like a pretty good commitment to me.

Minister saves media from Keelty's size 12s

Australian Federal Police Commissioner, Mick Keelty, has been left standing quite alone on the deck with his call for a media blackout on terrorism cases until they get to court. Attorney General McClelland in a statement yesterday said "Commissioner Keelty's comments represent his views not those of the Rudd Government".

Here's a McClelland quote to keep handy: "Access to government information and decision making are keys to a healthy and vibrant democracy".

Richard Ackland has a typically breezy comment on the issue.

Those affected should be informed about major data security breaches

Yes, the Federal Privacy Commissioner is right in calling for compulsory notification of major data security breaches. It's clear that we are pretty much in the dark here concerning possible breaches that may have significant identity fraud implications.

One intriguing result of this case note published by the Commissioner in January is that she apparently isn't fussed by the fact that some EFTPOS terminals issued by the major banks continue print a receipt that includes the full details of the credit card used in the transaction including name, full credit card number, type of card and expiry date.

The Commissioner found the merchant in this case had not breached privacy principles, but there isn't a word about what is a very unsatisfactory practice, still widespread in this country and full of identity fraud potential.

Have a look at your receipt next time - in my experience it mainly occurs with smaller retailers but in the case above it was an events ticketing company - and think twice about chucking the receipt in the bin.

Freedom of Information and Brian Burke meet up again

The Crime and Conduct Commission in Western Australia released a report (see under publications) last Friday on alleged misconduct by the Director General of the Department of Health, Dr. Fong (who resigned when the report was released) arising from his claims that he had no relationship with former Premier Brian Burke. The Commission recommended consideration be given to disciplinary action against Fong for misleading the minister about the relationship.

One of the main issues was that in response to an FOI application Fong’s initial advice to the FOI staff was that he had received no emails from Burke. As the report reveals the Department IT people subsequently found 9 but only with headers and no text. The CCC having seized Burke's computer identified 33 emails between him and Fong, most initiated by Burke. Some sought Fong's assistance in matters on behalf of Burke clients. Others included an email from Fong asking assistance from Burke to pay for a dinner, and advice from Burke regarding Fong’s employment at Health, and how to handle the media.

The report includes detail about record keeping in the Department of Health and major shortcomings in relation to the retention of emails. The TRIM system (also used widely in the public sector elsewhere in Australia) "is primarily a communication system and is not designed as an electronic records keeping system". Responsibility for ensuring that emails are kept rests with the officer dealing with the matter, with important emails to be downloaded and copied on the file.

"Retention of each individual employee’s emails is limited by the storage limit allocated. Full backups of the exchange information databases, system software and system transactions are run every evening and a three month tape rotation cycle is currently employed by DOH. These tapes are overwritten on a three monthly cycle. Therefore the only records in existence of email content beyond a three month period would be contained in the individual employee’s inbox, sent items folder or copied to a personal folder or stored on disc or on their personal
drive".

One of the Commission's recommendations is that the Department of Premier and Cabinet and the State Records Commission consider a whole of government standard in relation to agencies' archival processes and retention of email communications.

The retention of digital records is a major issue in record keeping circles and overseas - the White House was reported recently to have not been able to locate 5 million emails, and only started back up tapes in 2003.

All this has important implications of course if accountability mechanisms, particularly Freedom of Information laws are to work as intended.

Interesting times as they say.

Data loss one of the big privacy issues of 2007

The latest unhappy UK experience of data loss involved the theft of a laptop containing details of 600,000 people who have expressed an interest in or have joined the navy, marines and air force. For those who had submitted written applications, "extensive personal data" was involved including the bank details of 3,500 people.

This revelation came too late for inclusion in this long (but severely limited) list of 2007 celebrated instances of personal information disappearing into the stratosphere (or somewhere more sinister).

You would be forgiven for thinking all this is a northern hemisphere phenomenon. Something tells me it just isn't so.

Be aware of ID fraud risks

The Federal Attorney General also yesterday launched National Identity Fraud Awareness Week to increase awareness of identity theft.

The release says nothing about the Government's views regarding the introduction of a requirement to notify personal data security breaches which is seen to be an important element in seeking to limit identity fraud. The Federal Privacy Commissioner favours such a move, and Senator Stott Despoja has a Bill on this issue before the Senate.

Canadian Privacy Commissioner on notification of privacy breaches

Short posts, on holidays.

Like Senator Stott Despoja (see post below), the Canadian Privacy Commissioner is pressing for statutory changes that would mandate notification to those effected by a breach of data security principles, but in the meantime the Commissioner has issued voluntary guidelines on the subject, including criteria for notification and a checklist of issues to be considered.

The Australian Federal Privacy Commissioner favours a notification requirement, but this issue is probably not going anywhere before the Australian Law Reform Commission reports next year.

Dark memories of black lists

The news that a secret black list of "excludable persons" will be maintained by the NSW Police during the APEC meeting in September, produced justifiable criticism from civil liberties and other groups.

Another loud voice, heard from retirement, was that of the executive member of the NSW Privacy Committee through the seventies, the highly respected Bill Orme.

His letter in yesterday's Sydney Morning Herald reminded readers of the investigation of the unfair consequences flowing from secret black lists maintained at that time, including names of doctors and nurses who had been the subject of complaints. It turned out there were 7000 names on the list but 6000 were quickly removed when the list came to light. A whole range of other public and private black lists were revealed during the Committee's investigation.

This experience shows secret lists of this kind are capable of abuse, particularly where there is no oversight, or need to tell people their names are included.

The secret APEC list to be maintained by the NSW Police, is another reminder that NSW privacy law does not apply to the Police except in respect of their administrative and educative functions, an exclusion not seen as appropriate in other Australian privacy laws.

Canada clears SWIFT of privacy breaches

The Canadian Information and Privacy Commissioner has published her report on the investigation of the handling of personal information concerning Canadians by the Belgian based SWIFT interbank messaging cooperative, particularly the revelation last year that such information is routinely passed to US intelligence agencies.

It turns out that the SWIFT database is located in Belgium and the US, and the information provided was in response to "subpoenas" issued by the US Department of Treasury. The Commissioner found that SWIFT was required by US law to provide requested information in connection with anti-terrorism investigations. She found no breach of Canada's privacy law, but notes that other regulators have concluded that SWIFT breached relevant laws concerning the handling of information about their nationals.

The Commissioner commented that SWIFT is subject to Canadian privacy legislation in the communication of personal information to and from banks in that country, and that to facilitate greater transparency about the handling of such information, requests of this kind should be sought direct from Canadian authorities.

When this issue was raised last year, the Australian Privacy Foundation (Australians' banking records get a SWIFT kick - straight to the USA) asked the Federal Privacy Commissioner to investigate whether Australian banks complied with their obligations under the Privacy Act in participating in SWIFT. The Foundation gave a 2006 Big Brother Award for "Greatest Corporate Invader" of privacy to the Australian banks collectively.

The Federal Privacy Commissioner's website contains no reference to the issue.

As the Canadian Commissioner found, Canadian laws regarding tracking financial transactions permit provision of information to US authorities. Australian laws do likewise.

Privacy concerns regarding information sharing with US

Summer blog

I notice that The Australian has reported that Qantas routinely passes passenger information to the US authorities for those traveling from Australia to the US. This won't surprise anyone who has read the fine print on their e-ticket, although its news that, according to The Australian the shared information includes meal preference - you need to keep a watch out for those vegetarians and vegans!

There has been quite a fuss in the UK however, as reports indicate that information provided about passengers arriving in the US from there includes not just names but credit card and other details including email addresses. This report suggests that the US may be in a position to examine the history of credit card purchases. I don't imagine this, if true, is a unique requirement for the UK.

No one has clarified to date what happens with all this information, including what US agencies have access, and what security safeguards apply. There is certainly no evident privacy notice or pamphlet when you line up for the customs service on arrival at a US airport.

A new issue has arisen this week in the light of US plans to require 10 finger prints for arriving passengers, so that data can be matched against an FBI data base. At present arriving passengers in the US provide a one finger print and a retina scan.

This UK report says that the new requirements will apply also to passengers arriving from Australia.

One thing that isn't clear from what I have seen is what information Australian authorities share with the US - for example does the FBI already hold the complete database of finger prints now consolidated in Australia in the Federal Government's Crimtrack system?

Are our privacy regulators keeping an eye on all this?

Thanks to PogoWasRight for some links.

White flour keeps rising

The great "white flour" mystery continues.

Foreign Minister Downer, in a letter published earlier this week, indignantly dismissed the Sydney Morning Herald allegation that he and the Prime Minister had deliberately exaggerated the claim that white powder - that turned out to be flour - sent to the Indonesian Embassy last year, at the height of the Schapelle Corby drama, was a "biological agent".

Today, Matthew Moore Sydney Morning Herald FOI Editor, gives a full account of his attempts to access documents that provided the basis for public statements - including the Prime Minister's labelling the act as "murderous criminality". The post on his blogsite includes the text of emails between him and ministerial press officers during his inquiries about the matter over the last few weeks.

All could be resolved if the Government let the documents speak for themselves - so far it's the only one to see the crucial Protective Services Coordinating Committee briefing note.

Federal Parliament passes batch of laws with privacy implications

In the final weeks of sittings, the Federal Parliament passed several Bills with significant privacy implications. To access details of the legislation and the debate in Parliament go to this site, then "Current Bills by Title" and then to the relevant bill title for the legislation mentioned below.

The Privacy Legislation Amendment (Emergencies and Disasters) Bill creates a new Part of the Privacy Act that will apply to the handling of personal information during a declared emergency or disaster situation. The amendments follow evidence that was confusion and uncertainty about exchange of information, and disclosure during the 2004 Asian tsunami and other recent crises among government agencies and private sector bodies.

Some speakers during debate noted that the Federal Privacy Commissioner and the Australian Privacy Foundation both thought the issue was adequately covered by existing powers for the Commissioner to issue a public interest directive that would override the privacy principles. The Government claimed that new legislation was required to remove doubt and uncertainty.

The new legislation will apply to Federal Government agencies and private sector organisations covered by the Federal Privacy Act, but not to state government agencies in NSW, Victoria and Tasmania where separate state legislation applies. The original idea was to remove confusion and uncertainty, so this leg of the exercise might also require some attention if the objective is to be achieved.

The Anti Money Laundering and Counter-Terrorism Financing Bill (see earlier blog 30 November) also passed both Houses, the Government choosing to not act on recommendations from the Senate Legal and Constitutional Affairs Committee, or to pick up on many recommendations contained in the independent Privacy Impact Statement. The legislation extends existing reporting requirements and requires banks and other financial service providers, gambling organisations and others to take a "risk based approach" to identify and report to Austrac suspicious financial transactions. Some speakers highlighted concerns about the scope of the law, the extension of Austrac powers, privacy intrusions, and the possibility of discriminatory profiling of customers on race or ethnic grounds.

The Telecommunications Amendment (Integrated Public Number Database) Amendment Bill amends the Telecommunications Act following concern for some years about the potential misuse of data stored on the database by directory producers and directory assistance service providers. The database, maintained by Telstra includes unlisted and listed residential and business telephone numbers, and was established to act as a resource for emergency service and law enforcement use and for the provision of directory services. The Bill provides for access for the purposes of research in limited circumstances.

There wasn't much debate due to end of session timetabling, but the Bill was criticised for not going far enough and leaving directory service providers out of the loop.

FSU ups ante on bank outsourcing overseas

The Financial Services Union is conducting a campaign about bank outsourcing overseas. In addition to raising issues about employment, the campaign highlights the fact that sensitive personal information about bank customers is being sent overseas, to countries such as India that do not have privacy laws.

We have mentioned this issue in previous posts but the Union has some interesting material concerning the practices of the major banks.

Key issues include whether the banks refer to the transfer of personal information in their privacy statements, and what recourse, if any, Australian customers have in the event of a failure in any overseas country to comply with generally accepted privacy standards.

White washing white powder?

Did the Prime Minister and Foreign Minister Downer exaggerate test results to claim white powder sent to the Indonesian Embassy in Canberra last year, later shown to be flour, was a biological agent?

That's the claim by Sydney Morning Herald FOI Editor Matthew Moore, based on documents obtained under FOI from ACT Pathology and the Australian Federal Police. The Prime Minister in Parliament yesterday denied any wrongdoing and read a sentence from a briefing note which he claimed justified the description.

As Moore says in a follow up article today, the Prime Minister has refused to release the full advice he and other ministers relied on.

There is an easy way to clear this up - simply release all the documents.