Qld police get new powers to access cloud-based evidence

Queensland has passed new laws that subject cloud-based data to the same information access powers currently used by law enforcement agencies to access physical storage devices.

The Police Powers and Responsibilities and Other Legislation Amendment Bill 2019 passed into law on Thursday, amending the state’s Police Powers and Responsibilities Act 2000 (PPRA).

The bill clarifies existing “access information” powers afforded to police so that “any information accessible on, or via, a storage device” can be lawfully obtained under warrant.

Access information powers allow police to compel individuals to hand over passwords or encryption codes to gain access to and obtain data from electronic devices.

The powers can also be used to require individuals to provide assistance in the form of a swipe pattern or fingerprint so that police can gain access to an electronic device.

But up until now, police have been unclear on the extent of their powers when it comes to cloud services, which are increasingly used to manage and promote criminal activities.

“While the storage of incriminating information on traditional storage mediums, such as: computers; laptops; hard disk drives; and memory sticks is captured under existing laws, the use of cloud services is not clearly outlined within existing legislative definitions,” the bill states.

The government puts this down to ambiguity around the “term ‘stored’ as it relates to ‘information’ and uncertainty over the “scope of information accessible in cloud services”.

“Due to the lack of a definition it is unclear whether access information powers in the PPRA allow police to access password protected information through device applications such as Facebook and Instagram or email accounts such as outlook.com and gmail.com.”

“The Bill makes amendments to resolve this ambiguity and to make it clear that any information can be accessed (within the terms of the judicial order) on or through an electronic device.”

It does this by substituting terminology in existing laws that “refers to ‘stored information’ or ‘information stored’ with ‘device information’ to make it clear that any information, (albeit limited by the terms of the judicial order), can be accessed on or via a digital device”.

This includes information available on social media, instant messaging services and email, as well as “other information that may be accessible in the cloud/internet”.

The bill, which law Queensland enforcement agencies have been calling for for years, brings the state into line with the Commonwealth, NSW, Victoria and WA.

All four jurisdictions refer to the ‘access of data’ instead of ‘information stored’, giving offers access to data that is reachable from devices, even if it is not physically located there.

While largely supported by stakeholders, the Queensland Law Society is “strongly opposed” to the bill because of the “enormous implications for privacy and commercial confidentiality”.

“The bill grants police officers extraordinarily broad powers to pry into the private affairs of people who are not suspected of any offence, and into matters beyond the scope of any suspected offence under investigation,” its submission [pdf] states.

But introducing the bill last September, police minister Mark Ryan said the bill was intended to make the act’s provision “sufficiently broad to ensure that, no matter how incriminating evidence is contained on or through a device, it can be lawfully accessed”.

“Whether evidence of crimes is stored physically on a device, in the cloud, in email accounts or in social media applications, police and commission officers will have access to the evidence upon meeting existing criteria,” he said at the time. 

On Thursday, Ryan said the new powers would give police the tools to help investigate illegal activities such as child abuse, sexual assault, terrorism and cybercrime.

“The world has changed and we are changing the law to meet new challenges,” he said, adding that criminals were using platforms like Facebook and Instagram to hide evidence.

“I commend the Queensland Police Service for recognising and identifying the changes we have introduced.

“I am pleased that the government and the Parliament has taken the steps to give police the powers they need to target those who would do harm to the community.”