Greenleaf, Graham --- "Crypto report suppressed" [1997] PrivLawPRpr 8; (1997) 3(10) Privacy Law & Policy Reporter 181

---

Crypto report suppressed

Graham Greenleaf

The most significant report to date on options for development of an Australian cryptography policy, Review of policy relating to encryption technologies, was completed in December 1996 by Gerard Walsh, a consultant to the Security, Law and Justice Branch of the Commonwealth Attorney-General's Department, and former deputy director of the Australian Securities Intelligence Organisation (ASIO), after a six-month study (see < 3 PLPR 54> for background).

The disappearing report

The Walsh report was listed by the Australian Government Publishing Service (AGPS) as a purchasable document, a bargain, in fact, at $11.95. Brief details including contents and terms of reference were on the AGPS web site at http://www.agps.gov.au/cis/52454.htm from 21 January 1997.

On 7 February, Electronic Frontiers Australia (EFA) contacted the Attorney-General's Department Security Division to order a copy, but a spokesman said that the Walsh report's release had been delayed and he could not comment on when it would be released. He said that Australian Government policy was `likely to be overtaken by the OECD guidelines anyway' (the OECD guidelines are due for release in the near future -- see < 3 PLPR 126>). He noted that if the Walsh report is released there will be about three months allowed for comment, despite a mid-February date being shown on the AGPS listing.

Later that morning, the report summary on AGPS suddenly disappeared (both the /cis/52454.htm page and the /cis/ directory), with no explanation left on the site. However, PLPR has obtained copies of the web page, and its contents are reprinted on p 183.

Who's worried about Walsh?

The table of contents of the Walsh Report does not give many clues as to why the bulk of the report should not be available to the public (it is possible that deletion of some national security operational details might be necessary). Perhaps the review's approach described in `Creative tension or competition' took a little too seriously approaches which are at odds with A-G's security orthodoxy? Perhaps the comments about `The statistical vacuum' undercuts the certainties espoused by some others in Government? Perhaps the sections on `Striking a balance' and `A matter of proportion' didn't tip the balances and proportions far enough in the direction of surveillance agencies? Perhaps the extracts from `Australia online' are an unwelcome reminder that the Coalition Government actually had an election policy strongly opposing restrictions on encryption (see < 3 PLPR 1> at 3)? Perhaps the report's approach is not on-all-fours with the Australian-chaired OECD Cryptography Policy Guidelines which are supposed to `overtake' Australian policy. All idle and ill-informed speculation, of course, until we get to read the report.

As one of the many people interviewed by Mr Walsh last year when he was preparing the report, it would not surprise me if his report was a very thoughtful response which did not readily accept overstatements of either the dangers of encryption or the capacity of interception as the best means to deal with real dangers, or too easily accept the `solutions' being peddled by Australia's allies, particularly the US. If so, its suppression is easy to understand.

Who is responsible for encouraging public debate on these issues? The Privacy Commissioner's office (which says it is aware of the report), when asked whether the Commissioner had recommended that the report be made public, said that it could not comment at that stage. Has the Commissioner made any recommendation?

Barrett revisited

The Australian Government has a history of not wanting the Australian population to know the extent to which it is subjected to telecommunications surveillance. The last major official report on this topic, Pat Barrett's Review of the Long-Term Cost Effectiveness of Telecommunications Interception (1994), was suppressed by the Labor Government after a brief period of availability, as it revealed far more than was previously known about Australian surveillance policy, and included many recommendations to protect personal privacy (only some of which have subsequently been adopted in legislation). Fortunately, PLPR was able to obtain a copy during its brief availability, and to provide a lengthy summary (see < 1 PLPR 161>).

You can now obtain Barrett, but not yet Walsh.

Graham Greenleaf, General Editor.