Another chapter has opened on the internet filtering debate in Australia. You might recall a scrappy and quite effective campaign that raged from 2007 to 2010 against a Government proposal to force ISPs to block the somewhat arbitrary ‘Refused Classification’ list in Australia. On the eve of the last election, the campaign had become strong enough that Communications Minister Stephen Conroy dodged sideways and announced the issue would instead be studied by the Australian Law Reform Commission (ALRC), effectively taking it off the table for the 2010 election.
Roll forward to June 2011; while the ALRC was busy confirming that blocking against the RC list wouldn’t solve anything, the Government had hammered out a closed-door agreement with some of the country’s major ISPs to voluntarily block a small set of websites contained on the Interpol ‘Worst-of’ list.
By November 2012, the Government was able to announce that it had 90% of the market effectively blocked against the Interpol list; not by voluntary agreement, but with mandatory notices under s313 of the Telecommunications Act. Setting aside the almost trivial ease with which such blocks can be circumvented by the moderately tech-literate, most – not all – of the #nocleanfeed campaigners of previous years greeted the announcement with cautious approval, as it was announced simultaneously with the belated repeal of the ALP’s former policy to screen the whole RC blocklist. What had started out as an unhinged attempt to censor anything unclassifiable, had shrunk to a contained list of vile child abuse material administered by an international policing agency.
Since then, the Australian Federal Police have administered the scheme – the mechanics and review and oversight mechanisms were described in answers to a question we submitted to the department (transcript here).
Justifiable disquiet had been expressed at the unorthodox use of s313 to issue notices to block particular web content (this piece on Delimiter sets the tone).
Here’s what the key section of the Act says, in part:
(1) A carrier or carriage service provider must, in connection with:
(a) the operation by the carrier or provider of telecommunications networks or facilities; or
(b) the supply by the carrier or provider of carriage services;
do the carrier’s best or the provider’s best to prevent telecommunications networks and facilities from being used in, or in relation to, the commission of offences against the laws of the Commonwealth or of the States and Territories…
As far as I know, this section of the Act had never been used to block content until Minister Conroy hit on it as a way to put some teeth into the ‘voluntary’ blocking of the Interpol list. A section that had probably only been used to combat malicious attacks from specific servers was now being read to include blocking servers hosting illegal content.
The open question has been, if the Federal Police can invent such notices to implement an announced Government policy, what’s stopping other agencies using their own notices to block all kinds of other content?
Hypothetically, what would happen if another agency, without any announcement, decided to start issuing these notices to ISPs to block other material, with no review mechanisms or transparency, with the general public having no idea it was occurring? There would be no need to notify people, no blocklists, no criteria, no way to contest the decision, your website would just disappear from the net and you’d have no idea why. What if, inadvertently, more than a thousand other sites ended up as collateral damage in a poorly targeted hit on a phishing site somewhere, remaining offline for eight days while people tried to figure out why they’d all gone dark?
Welcome to the filter, reloaded. We now know that Australia’s corporate regulator ASIC was responsible for accidentally shutting down Melbourne Free University and 1200 other sites that happened to reside at the same IP address as a collection of investment scam sites. The detective work is documented here, and it’s worth a read.
Who gets to issue these 313 notices then? The section says ‘officers and authorities’ which is undefined and unexplained comprehensively in either the Bill or the Explanatory Memorandum.
It is not at all explicit that ASIC is such an entity; it is not a Commonwealth law enforcement agency in the same way as the federal police in this Part. It is defined as a law enforcement agency under section 5(n)(i) under the Telecommunications (Interception and Access) Act 1979 but this does not seem applicable to the Telecommunications Act which does not cross reference the definition. The agencies listed here, and here and here do appear to be arguably within their rights to be issuing these notices against any content they believe falls within the expanded interpretation of s313.
The definition of ‘Commonwealth Enforcement Agency’ which includes bodies like the Australian Federal Police and the Australian Crime Commission also includes this helpfully open-ended catch-all:
(n) any body whose functions include:
(i) administering a law imposing a pecuniary penalty; or
(ii) administering a law relating to the protection of the public revenue
That is going to net a very, very wide range of agencies. It may be the section ASIC relied on to issue the notice that accidentally bowled over twelve hundred bystanders: either way, we’re now in uncharted territory.
What’s needed most immediately is some clarity as to how many other agencies are using these notices to quietly drop the shutters on websites they deem to be “committing offences against the laws of the Commonwealth or of the States and Territories”.
ASIC’s thousandfold overblocking has done us all an inadvertent favour in exposing the fact that the Australian Government’s limited filter has already been subject to staggering scope-creep. The question is, who else has decided to avail themselves of this shortcut to unaccountable internet filtering?
That’s a question for the forthcoming budget #estimates round (tune in from May 27), unless, for a change, the agencies involved would like to come forward unprompted, just for once, and tell us what the hell is going on.