FOI 27 2016 Document 12 for release.pdf

[released under the Freedom of Information Act 1982; FOI 27_2016]

Contents
Standard operating procedure ................................................................................. 1
Access to telecommunication data under the Telecommunications (Interception
and Access) Act 1979 .............................................................................................. 1
Contents .................................................................................................................. 2
Introduction .............................................................................................................. 3
Definitions ............................................................................................................ 4
Scope ................................................................................................................... 5
Responsibilities .................................................................................................... 6
Standard operating procedure ................................................................................. 6
Overview .............................................................................................................. 6
Lawful access to telecommunications data: ..................................................... 7
1.
Lawful access to telecommunications data ................................................ 8
1.1.
Requesting the disclosure of telecommunications data ....................... 8
1.2.
Authorising the disclosure of telecommunications data ..................... 11
1.3.
Notifying a carrier or carriage service provider of an authorisation .... 12
1.4.
Receiving telecommunications data ................................................... 14
2.
Use of telecommunications data............................................................... 15
2.1.
Use of telecommunications data ........................................................ 15
3.
Recordkeeping and Reporting .................................................................. 15
3.1.
Recordkeeping ................................................................................... 15
3.2.
Reporting ........................................................................................... 16
Legislative framework ........................................................................................ 17
Related policies and references ......................................................................... 17
Chief Executive Instructions ........................................................................... 17
Policies ........................................................................................................... 17
Other references............................................................................................. 17
Consultation ........................................................................................................... 18
Endorsement ......................................................................................................... 18
Approval ................................................................................................................ 18
Version control ....................................................................................................... 18
Appendix A: Enforcement agency – Authorisation and notification for access to
existing information or documents ......................................................................... 20
Appendix B: List of authorized officers .................................................................... 3

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception
and Access) Act

2 | P a g e

Requesting officer
An officer within the Investigations and Enforcement
Branch or the Intelligence and Analytics Section of the
CER that seeks to initiate a lawful request for the
disclosure of telecommunications data under the TIA Act.
Telecommunications  includes information about a telecommunication that does
data
not reveal the content or substance of a
telecommunication. Telecommunications data is available
in relation to all forms of communications, including both
fixed and mobile telephony services and for internet-based
applications including internet browsing and voice over
internet telephony. For telephone-based communications,
telecommunications data includes:
  Subscriber information
  The telephone numbers of the parties involved
  The time of the call and its duration.
In relation to internet-based applications,
telecommunications data includes the Internet Protocol
(IP) address used for the session and the start and finish
time of each session.
TIA Act
Telecommunications (Interceptions and Access) Act 1979
Scope
This Standard Operating Procedure applies to requests for the disclosure of
telecommunication information from carriers in particular circumstances.  As an
enforcement agency under the TIA Act, the CER is able to request
telecommunications information where it is reasonably necessary for:
-  The enforcement of the criminal law (section 178 of the TIA Act);
-  The enforcement of a law imposing a pecuniary penalty or for the protection of
the public revenue (section 179 of the TIA Act).
This Standard Operating Procedure sets out the mandatory procedures for:
-  authorising the disclosure of telecommunications data by authorised officers
within the CER
-  recordkeeping in relation to authorisations under the TIA Act.
-  reporting requirements under the TIA Act.
This Standard Operating Procedure also operates as a direction to officers for the
purposes of the APS Code of Conduct and the Public Service Act 1999.  Unless
specifically authorised otherwise by the Chief Executive Officer or an authorised
officer within the meaning of section 5 of the Telecommunications (Interception &
Access) Act 1979, staff must comply with this Standard Operating Procedure.

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception
and Access) Act

5 | P a g e

1. Lawful access to telecommunications data
1.1. Requesting the disclosure of telecommunications data
1.1.1.  A request for the disclosure of telecommunications data under the
TIA Act can be initiated by any staff member of the Investigations
and Enforcement Branch or the Intelligence and Analytics Section.
This staff member is referred to as the “requesting officer”.
1.1.2.  A request for the disclosure of telecommunications data must be in
support of an existing CER case or investigation, and must be
reasonably necessary for the enforcement of the criminal law or the
enforcement of a law imposing a pecuniary penalty or for the
protection of the public revenue.
1.1.3.  To maintain integrity and protect evidence, a requesting officer cannot
be the same person as the authorised officer authorising the request.
An authorised officer that seeks to request telecommunications data for
investigative purposes should submit their request to another
authorised officer within the agency to get an authorisation for the
disclosure of that information, being a person who is separate from the
investigation itself.
1.1.4.  Requesting officers can seek to request the disclosure of specified
information or specified documents that are in existence at the time
of the request the request is made.  Specified information or
specified documents may take many forms, and will vary depending
on the carrier or carriage service provider, but will generally take the
form of one or more of the following:
  Subscriber details
  Integrated Public Number Database (IPND) Enquiry
  Call Record Information, including:
»  Fixed Service Call Records (ongoing calls)
»  Fixed Call Records (incoming calls)
»  Fixed Call Records (both incoming and outgoing calls)
»  Mobile Service Call Records (ongoing calls)
»  Mobile Call Records (incoming calls)
»  Mobile Call Records (both incoming and outgoing calls)
  International Mobile Equipment Identifier (IMEI)
  Email address registration details
  Mobile location Search

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception
and Access) Act

8 | P a g e

1.2. Authorising the disclosure of telecommunications data
1.2.1.  Authorised officers in the CER are responsible for ensuring the
authorisations for the disclosure of telecommunication data meet the
legislative requirements of the TIA Act.  A list of officers authorised
by the Chair and Chief Executive Officer of the CER under s5AB of the
TIA Act is provided in Appendix B.
1.2.2.  Upon receipt of an “Enforcement Agencies - Authorisation and
notification for access to existing information or documents” request,
the authorised officer must:
  Ensure that the proposed authorisation form is complete;
  Ensure that:
»  For proposed authorisations under section 178 of the
TIA Act, the disclosure is reasonably necessary for the
enforcement of the criminal law, and is accompanied by
supporting case notes or briefing material to satisfy this
requirement, including the particular offence under CER
legislation for which the disclosure is sought.
»  For proposed authorisation under section 179 of the TIA
Act, the requesting officer must have regard as to
whether the disclosure is reasonably necessary for the
enforcement of a law imposing a pecuniary penalty or
for the protection of the public revenue, and is
accompanied by supporting case notes or briefing
material to satisfy this requirement, and must cite the
particular breaches or legislative references under CER
legislation for which the disclosure is sought.
  Have regard to whether any interference with the privacy of
any person or persons that may result from the disclosure
or use of telecommunications data under request is
justifiable, having regard to:
»  the likely relevance and usefulness of the information or
documents;
»  the reason why the disclosure or use concerned is
proposed to be authorised.
  Have regard to whether the requests are specific to a
particular person or investigation.
  Providing financial approval for lawful requests for the
disclosure of telecommunication data in accordance with
the Financial Management and Accountability Act 1997,
FMA Regulations and FMA Orders.
1.2.3.  Once the authorised officer is satisfied that the information provided
on the “Enforcement Agencies - Authorisation and notification for

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception
and Access) Act

11 | P a g e

2. Use of telecommunications data
2.1. Use of telecommunications data
2.1.1.  The use of telecommunications data as evidence is limited to the
investigation for which it was first sought.
2.1.2.  Telecommunication data can be added to CER intelligence holdings
for future reference and to identify issues across investigations.
2.1.3.  If telecommunication data obtained through an authorisation
processes is relevant to another investigation or a separate matter,
this information must be obtained again through an independent
authorisation process.
2.1.4.  Telecommunication information obtain under the TIA is considered
to be “protected information” under the CER Act and will be
managed in accordance with “Protected” security classified
information under the Protective Security Policy Framework.
3. Recordkeeping and Reporting
3.1. Recordkeeping
3.1.1.  Section 185 of the TIA Act stipulates that all authorisations are to be
retained for a period of no less than 3 years.  However, the CER will
retrain records of authorisations for longer periods in accordance
with the CER’s records management authority.
3.1.2.  The CER’s Intelligence Database, maintained by the Intelligence
and Analytics Section, is the primary system for recording and
reporting authorisations made under the TIA Act.  For this reason,
all authorisations must be provided to the Intelligence and Analytics
Section.
3.1.3.  Authorisations should also be recorded in other relevant systems
(including the Jade Case Management System and relevant case
folders in shared drive (G: drive)).  However, these systems will not
serve to facilitate reporting.
3.1.4.  The hard copy record of the authorisation must be retained in an
appropriate file cover pertaining to the case.  This will in general be
maintained by the Investigations and Enforcement Branch.  This is
the official record for recordkeeping purposes.  This file cover record
number should also be recorded in the CER’s intelligence and/or
investigative systems.

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception
and Access) Act

15 | P a g e

3.2. Reporting
3.2.1.  Under s186 of the TIA Act, the CER is required to report annually
(no later than within 3 months of the end of the financial year) to the
Attorney-General regarding its access to telecommunications data.
The CER's report must include statistics on the number of
authorisations made during the previous financial year for:
  The disclosure under s. 178 of existing telecommunications
data for the enforcement of the criminal law
  The disclosure under s. 179 of existing telecommunications
data for the purpose of enforcing a law imposing a
pecuniary penalty or the protection of the public revenue
  Any other matter requested by the Minister in relation to
those authorisations.
3.2.2.  The Attorney-General will then compile the reports of all
enforcement agencies into an annual report for Parliament.
3.2.3.  The Manager, Intelligence and Analytics Section, is responsible for
preparing reports to the Attorney-General’s Department under s186
of the TIA Act.
3.2.4.  The Chief Investigations Officer is responsible for the approval and
delivery of these reports to the Attorney-General’s Department.

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception
and Access) Act

16 | P a g e

0.3
19/07/2013
– Legal

Services comments
0.4
19/07/2013
–

Acceptance of legal
services comments
0.5
30/07/2013
–

Review following CEO
comments
0.6
02/09/2013
–

Changes to CER
authorised officers
1.0
16/09/2013
–
Approved.
1.1
11/08/2014
–

Update following
nomination of
authorised officers
and passage of Public
Governance,
Performance and
Accountability Act
2013
2.0

– Approved.

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception
and Access) Act

19 | P a g e

Appendix A: Enforcement agency –
Authorisation and notification for
access to existing information or
documents
Telecommunications (Interception and Access) Act 1979 (Cth)
1              Authorised officer
(1)  The  Clean  Energy  Regulator  is  an  enforcement  agency  within  the  definition  of
‘enforcement  agency’  in  subsection 5(1)  of  the Telecommunications  (Interception  and
Access) Act 1979 (the Act).
(2)  I, [NAME], [^POSITION/POSITION NUMBER/RANK], am an authorised officer of Clean
Energy Regulator within the definition of ‘authorised officer’ in subsection 5(1) of the Act
as I am

☐   the head of the Clean Energy Regulator or a person acting as that head
☐   the deputy head of the Clean Energy Regulator or a person acting as that deputy head
☐   a person who holds, or is acting in, an office or position in the Clean Energy Regulator covered
by an authorisation of the head of Clean Energy Regulator under subsection 5AB(1) of the Act.
2              Authorisation
(1)  Acting  under  subsection 179(2)  of  the  Act,  I  authorise  the  disclosure  of  the  following  specified
information or documents, being information or documents that came into existence before the
time  the  person  from  whom  the  disclosure  is  sought,  being  [person/company  from  whom  the
disclosure is sought], receives notification of the authorisation:

[short particulars of the information and/or documents sought to be disclosed]
(2)  I
am
satisfied
that
the
disclosure
is
reasonably
necessary
for
the
enforcement of a law imposing a pecuniary penalty.
3              Notification and disclosure

Acting under subsection 184(3) of the Act, I notify the person listed above of this authorisation.

The information or documents authorised to be disclosed by this authorisation should be delivered
to Error! Reference source not found. by the following means:

[particulars  of  the  facsimile  number,  electronic  address  or  other  electronic  means  by  which  the
information should be provided to the agency]

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception
and Access) Act

20 | P a g e

Dated
…………………………………..
Authorised officer
* Omit if not applicable
^ Use same descriptor as used in instrument approving person as an authorised officer

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception and Access)
Act

2 | P a g e

Appendix B: List of authorized officers
The following list of management positions in the CER have been authorised by the Chair
and Chief Executive Officer as “authorised officers” under the Telecommunications
(Interception and Access) Act 1979 (Cth).
Only these officers are able to authorise the disclosure of telecommunications data in
accordance with these Standard Operating Procedures.
Schedule

Chair and Chief Executive Officer, Clean Energy Regulator
Executive General Manager, Reporting and Carbon Market Division
General Manager, Investigation and Enforcement Branch

V1.0—16/09/2013
Access to telecommunication data under the Telecommunications (Interception and Access)
Act

3 | P a g e