Civil rights groups, legal bodies and information security experts have expressed renewed concern about the government’s push to store greater amounts of phone and web users’ personal information following revelations that the federal police mistakenly published sensitive information and metadata about ongoing criminal investigations.
Guardian Australia reported on Thursday that the AFP provided documents to the Senate that were published online for several years, accidentally disclosing information about the subjects and focus of criminal investigations and telecommunications interception activities.
The revelations have sparked concerns from Labor and the Greens about the AFP’s handling of sensitive telecommunications data, while the Australian Lawyers Alliance has warned that criminal investigations and trials may have been jeopardised as a result of the disclosure.
The federal government has ramped up its push for a mandatory data retention scheme, which could see a greater amount of phone and web information stored for two years that would then be subject to access by the AFP and other enforcement agencies.
The Australian Lawyers Alliance spokesman Greg Barns told Guardian Australia the error could have serious implications for criminal investigations and trials if juries became aware that information was accessible online about an investigation that could prejudice a trial.
“It can impact on a person’s rights if there’s information that is adverse to them which has been published and which ordinarily wouldn’t be published because it would be highly prejudicial to any criminal investigations that might result,” he said.
He said the mistaken disclosure showed why the government’s proposals were a grave risk for personal privacy.
“This is a very good reason why the metadata proposal is so dangerous. We’ve seen twice this year sensitive personal information placed within reach of the general community,” he said.
“The first time was in relation to the asylum seeker data breach by the department of immigration. Now second we’ve got the AFP disclosing information about individuals in criminal investigations.”
“That ought to be telling the government one thing and that is that government agencies do slip up, they do compromise the Privacy Act, and the storage of large volumes of metadata without judicial scrutiny or independent oversight does mean you get these sorts of breaches and they go unchecked.”
The president of the New South Wales Council for Civil Liberties, Stephen Blanks, said: “One would expect that an AFP database of this nature would have a very high level of security. This would appear to be not only a deeply embarrassing breach for the AFP but likely a seriously damaging one in terms of their criminal investigative work.”
“And yet the community is being told that there is nothing to worry about in the government’s determination to legislate for the retention of everyone’s telecommunications metadata for two years and to make it available to intelligence and other agencies without warrant.”
The shadow attorney-general, Mark Dreyfus, also said the mistaken disclosure was concerning, and called for support on Labor’s bill for mandatory data breach notifications that would compel organisations to notify interested parties when a data breach occurred.
“Labor currently has a Privacy Alerts bill in the Senate, which would require the government and businesses to notify Australians when their privacy has been breached.”
“Of course we would expect government agencies to self-report a breach, but our bill would mean that private companies would have the same obligation to let Australians know when there has been a breach of their privacy.”
Greens senator Scott Ludlam, who received the documents from the AFP and also published them but took them down when he was informed of the breach, said the failure to protect the data was “a sharp lesson in metadata security”.
“This is the very agency that is requesting warrantless access to every Australian citizen’s metadata,” he said.
Stephen Wilson, a privacy and security consultant with the Lockstep group, said he was “flabbergasted” by the latest in a series of failures by government agencies to protect personal data.
“This just seems to be the third case in a fortnight of senior government people not having an understanding of how government information systems work,” he said.
“We’ve had several ministers misspeaking about metadata. We’ve had Asic not understand how IP addresses work and now we’ve got somebody in the AFP not understanding how documents get saved.”
A spokeswoman for the minister for justice, Michael Keenan, said in a statement about the breach: “A serious breach occurred in 2012 during AFP efforts to be open and accountable to the parliament.”
“The AFP has advised it has taken immediate and appropriate action to rectify the matter. The government expects all agencies to manage sensitive information with utmost security.”
The privacy commissioner, Timothy Pilgrim, said he was “awaiting further information” from the AFP about the circumstances of the breach, and said the office of the Australian information commissioner (OAIC) would be assessing its circumstances.
Pilgrim said: “The OAIC strongly suggests all government agencies and organisations covered by the Privacy Act 1988 carefully consider the importance of data security and the risk of data breach.”
