<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:13.5pt;
font-family:"Times New Roman",serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri Light",sans-serif;
color:#1F4D78;
mso-fareast-language:EN-AU;}
span.m3499457503986880609hoenzb
{mso-style-name:m_3499457503986880609hoenzb;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><i><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Quote: The difficulty is that while they're required to advise the CAC, there's no right for you to withhold information pending CAC clarification.<o:p></o:p></span></i></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>I would not be releasing any information until I was 100% satisfied it was made by an authorised party in the correct format.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>CAC should have already produced a simple flowchart of the process, who to contact if there are any questions, and sent it to ISPs. It really isn’t hard to do. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'>Rod<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri",sans-serif'> AusNOG [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Paul Wilkins<br><b>Sent:</b> Wednesday, 16 November 2016 4:46 PM<br><b>To:</b> ausnog@lists.ausnog.net<br><b>Subject:</b> Re: [AusNOG] Data Retention - are you kidding me??<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><div><div><div><p class=MsoNormal style='margin-bottom:12.0pt'>I think the point is that the feds require an authorised senior executive.<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>State police I'd assume will also be requesting authorisation, but does show tremendous chutzpah on the part of a senior constable to be asking for DR metadata.<o:p></o:p></p></div><div><p class=MsoNormal>The difficulty is that while they're required to advise the CAC, there's no right for you to withhold information pending CAC clarification. So the onus is on operators to know whose authority they're required to recognise before they step in the door. Nor does it help the CAC don't publish this, which perhaps they should.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>I am not a lawyer. This is not legal expert opinion.<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>Kind regards<o:p></o:p></p></div><p class=MsoNormal>Paul Wilkins<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On 16 November 2016 at 16:22, Robert Hudson <<a href="mailto:hudrob@gmail.com" target="_blank">hudrob@gmail.com</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><p class=MsoNormal>My understanding of the term "officer" in this context comes from "office bearer" (ie an individual granted authority to act on behalf of an organisation) rather than the the rank which is held by said individual.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>When someone comes along and claims to be authorised, I suspect you'd want to be asking for the letter from the commissioner authorising them to act on behalf of the AFP in that particular matter.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>IANAL, nor do I play one on television. This not legal advice.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>:)<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Regards,<o:p></o:p></p></div><div><p class=MsoNormal><br>Robert<o:p></o:p></p></div></div><div><div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On 16 November 2016 at 16:00, Paul Wilkins <<a href="mailto:paulwilkins369@gmail.com" target="_blank">paulwilkins369@gmail.com</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><p class=MsoNormal>There is no precedent. The access to data is governed under the <o:p></o:p></p><h3><span style='font-weight:normal'>TELECOMMUNICATIONS (INTERCEPTION AND ACCESS) ACT 1979</span><o:p></o:p></h3><p><o:p> </o:p></p><p>S 5AB provides that:<o:p></o:p></p><p>(1A) The Commissioner of Police may authorise, in writing, a senior executive AFP employee who is a member of the Australian Federal Police to be an authorised officer.<o:p></o:p></p><p><o:p> </o:p></p><p>Firstly, a senior constable is not an officer. They're an NCO. Secondly, ask the CAC for a copy of their authorisation, as provided under:<o:p></o:p></p><p><o:p> </o:p></p><p>(2) A copy of an authorisation must be given to the Communications Access Coordinator: <o:p></o:p></p><p><o:p> </o:p></p><p>I am not a lawyer. This is not expert opinion.<o:p></o:p></p><p><o:p> </o:p></p><p>Kind regards<o:p></o:p></p><p><span style='color:#888888'><o:p> </o:p></span></p><p><span style='color:#888888'>Paul Wilkins<o:p></o:p></span></p></div><div><div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On 16 November 2016 at 15:13, Ross Wheeler <<a href="mailto:ausnog@rossw.net" target="_blank">ausnog@rossw.net</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal><br>Had a call a short while back... I think I've got the details right, but I sure hope I've got something wrong....<br><br><br>ISP had a senior constable come in with a request for data.<br>Request had been signed by said senior constable.<br><br>As I understand the (meta)data retention legislation, a request has to be signed by a senior officer (commissioner or thereabouts), or a minister etc.<br><br>I suggested to the ISP that I thought the request was not valid but to check it with the CAC. Had a call back a while later that basically the ACMA said to honour the request, and that if there was a problem "it would be caught in the audit later".<br><br>This scares the pants off me.... if we're being told to just give the data out to low-level shitkickers with no senior level oversight or control, there's going to be no end of vexatious queries, fishing expeditions and trivial requests. Who's going to get banged up if we disclose private information that turns out (later) to have been given incorrectly? How will the damage to affected person(s) be undone?<br><br>A highly, HIGHLY dangerous precedent. (This was a smaller non-metro ISP in a fairly out-of-the-way part of the world, perhaps for the very reason that if it blows up in their face they can hide it more effectively than if it was a large, highly visible isp).<br><br>R.<br>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>