The NSW Labor government is set to introduce a bill to give NSW Police the power to require people to provide access to their digital devices during more routine arrests.
The October 2022-enacted digital evidence access order (DEAO) regime allows police to obtain such an order when executing search and crime scene warrants. If the subject of the order refuses, it becomes a criminal offence, carrying up to five years in prison. This measure overrides the common law right against self-incrimination.
However, once police have obtained access to a suspect’s phone, they can use software, developed by Israeli digital forensics company Cellebrite, that can download a person’s content, including all deleted messages and images.
NSW Greens MLC Sue Higginson, the party’s justice spokesperson, told parliament in early June that this capability allows police to access any message the subject has ever sent, as well as “any photo they have ever taken, their location at any moment, everything they have ever searched and biometric data about who they are”.
For several years, NSW police has been able to use this invasive technology during policing operations serious enough to require a warrant. Now, Labor wants to provide DEAO use to cops on the beat.
The Chris Minns government is modernising organised crime laws to bring them into line with emerging technologies. It announced on June 18, as part of this, that it plans to expand the DEAO regime, allowing police to apply for an order, while in the field, when a device has been seized.
The language being used to discuss this new policing power focused on organised crime and gang-related matters. But shifting this capability into routine policing suggests that it will become available beyond matters relating to organised crime.
Labor said the new law will enable police to compel a suspect to provide access information, like a PIN or a face scan, and that a failure to comply or if the person provides false information they would face serious prison time. It foresees this measure being applied “in fast-moving organised crime investigations where delays can risk loss, encryption or remote wiping of data”.
Any police officer or NSW Crime Commission executive officer can apply to either a judge or an authorised police officer for a DEAO, depending on the sort of warrant it will accompany. The government said that the power to execute search warrants actually presupposed a search of devices and the issue had been that they needed to get around passwords.
The seriousness of this power to scan civilian mobile devices has meant that a summary offence was inserted into section 76AG of the Law Enforcement (Powers and Responsibilities) Act 2002, in which police officers who provide false information to obtain a DEAO can face up to two years in prison and/or a fine of $11,000.
“Most people in NSW would be alarmed to know that the NSW police, using data from an Israeli corporation … can access any message they have ever sent, any photo they have ever taken, their location at any moment, everything they have ever searched and biometric data about who they are,” Higginson said.
Higginson added that this is precisely what happens on a DEAO scan and that this capability is being sought as another tool for routine policing. She explained that when police apply for a DEAO, they can then use Cellebrite universal forensics extraction devices (UFED) to facilitate the content download. This includes messages from encrypted apps, like WhatsApp, Signal and Telegram, along with the search history, health data, call logs, contacts. The UFED also extracts metadata.
Higginson said that Cellebrite is involved in Israel’s “genocidal military operations” right across the Gaza Strip and the West Bank. She said that apart from NSW Police multiple federal and state government agencies have contact with it.
Criminal defence lawyer Nick Hanna has suggested that police have the attitude that whatever mobile device they can gain access to warrants a Cellebrite scan.
Higginson noted that Hanna had reported that a police officer had provided testimony during a cross-examination on how she downloads about 20 mobile devices a week. She said in light of this it “can be assumed that police across the 400 police stations in NSW are using Israeli surveillance technology to download tens of thousands of phones every single year”.
She warned that it is likely that not only suspects whose phones are being scoured by police, but that devices belonging to victims are probably as well. She said the data obtained by police is stored indefinitely and can be used again, pointing to the Brittany Higgins sexual assault case when downloaded data was “later used in defamation proceedings brought against her by her perpetrator”.
As the Minns government seeks to make this an every day policing tool, Higginson reminded parliament that there are “no reporting requirements for any government agency on Cellebrite use” and neither are there any “known policies or guidelines governing how downloaded data is stored, used or shared” or any requirement to destroy data after matters have been finalised.
[Paul Gregoire writes for Sydney Criminal Lawyers, where this article was first published.]