Yesterday Australia’s technology and media communities reacted Yesterday Australia’s technology and media communities reacted with shock at the news that theQueensland Police had arrestedFairfax journalist Ben Grubb in response to material he had obtained while reporting a story on how a security researcher managed to bypass Facebook’s privacy settings to access someone’s private photos.This incident raises questions relating to the scope of Australia’s cybercrime legislation, the questionable judgment of the Queensland Police in deciding to pursue the journalist who reported the story (and not as yet the researcher who managed to obtain access to the private photos), and whether Australia’s laws provide proper safeguards for journalists.
However, before considering the broader policy implications of this situation, it is worth outlining what I understand to be the legal basis for the actions of the Queensland Police.
On Sunday, security expert Christian Heinrich gave a presentation at a BSides Australia event at the Gold Coast, titled "For God Your Soul... For Me Your Flesh". In that presentation Heinrich demonstrated how he had gained access to the privacy-protected Facebook photos of the wife of HackLabs director Chris Gatford.
Although the journalist Ben Grubb was not at that presentation, he was given an hour-long presentation by Heinrich shortly after he presented. On Tuesday Grubb published a story on the Sydney Morning Herald website that outlined the outlining the Facebook privacy vulnerability that Heinrich maintained could allow for privacy-protected photos to be accessed without being the user's "friend". Crucially that story, when first posted online, included a blurred image of the photo that Heinrich had obtained.
The Queensland Police presumably saw that story, with the photo, and believed that Grubb therefore may have had evidence relating to a criminal offence. To reach this conclusion, the Queensland Police must be of the view that Heinrich may have committed a criminal offence when he obtained access to a privacy-protected Facebook photo.
Section 408E of the Queensland Criminal Code Act 1889 deals with computer hacking and misuse. However, as Heinrich did not use “a restricted computer without the consent of the computer’s controller” to obtain access the privacy-protected photo, that provision would not apply.
As such, we can only assume that the Queensland Police believed Heinrich may have committed one of the computer offences that were inserted into the CommonwealthCriminal Code Act 1995 by the Cybercrime Act 2001 (Cth). One possibility is section 477.1, “Unauthorised access, modification or impairment with intent to commit a serious offence”, as Heinrich arguably caused unauthorised access to data held on a computer by means of a telecommunication service, knowing that the access was unauthorised. However, for it to be an offence under section 477.1, Heinrich would also need to intend to “commit, or facilitate the commission of, a serious offence against a law of the Commonwealth, a State or a Territory” by that access. To date there is nothing to suggest Heinrich had such an intent (in fact, quite the opposite; he was simply seeking to highlight a security vulnerability of Facebook).
However, the element that Heinrich had intended to commit a serious offence, is not required under section 478.1 of the Commonwealth Criminal Code Act, “Unauthorised access to, or modification of, restricted data”. Heinrich may have infringed this section as arguably caused access to restricted data, in the form of privacy-protected photos, by means of a telecommunications service, with the intent to cause the access and knowing that the access was unauthorised.
The problem with the argument that Heinrich has committed an offence under the Commonwealth Criminal Code Act, is not that one or more of the provisions doesn’t technically cover what Heinrich did, it is that the provisions were drafted in such a way as to be deliberately broad. This makes it quite difficult to know the precise scope of the offences and means that the sections could be construed to potentially covers acts where individuals should not be held to be culpable, either morally or legally.
It seems to me that the actions of Heinrich may well be of this nature. The means by which he obtained access to the privacy-protected photos involved exposing a privacy flaw within Facebook. It is not a case of “hacking” in the sense most people would think of the term.
The broad nature of these provisions means that law enforcement agencies could potentially enforce and apply the law inconsistently and arbitrarily, even including what could be an everyday activity. For example, anyone who gains access to someone else’s privacy-protected Facebook photos, could potentially commit an offence under section 478.1 of the Commonwealth Criminal Code Act. It is illogical to maintain that mere access to someone else’s privacy protected photos should be a criminal offence, especially when Facebook itself makes no such guarantee against unauthorised access in its own Privacy Policy:
Risks inherent in sharing information. Although we allow you to set privacy options that limit access to your information, please be aware that no security measures are perfect or impenetrable. We cannot control the actions of other users with whom you share your information. We cannot guarantee that only authorized persons will view your information. We cannot ensure that information you share on Facebook will not become publicly available. We are not responsible for third party circumvention of any privacy settings or security measures on Facebook. You can reduce these risks by using common sense security practices such as choosing a strong password, using different passwords for different services, and using up to date antivirus software.
Furthermore, when you post your photos to Facebook, the terms of service of Facebook mean that you giving a broad intellectual property license to Facebook to use those photos:
For content that is covered by intellectual property rights, like photos and videos ("IP content"), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook ("IP License"). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.
Against this legal backdrop, I maintain that would be overkill to prosecute Heinrich for an offence under the Commonwealth Criminal Code Act, even if the way the legislation has been drafted may technically cover his conduct.
Nonetheless, for the Queensland Police to arrest Grubb in the manner in which they did, they must nonetheless have reached a view that Heinrich had committed an offence. This is because Grubb was arrested (although not charged) under section 433 of the Queensland Criminal Code Act 1889 which provides that “A person who receives tainted property, and has reason to believe it is tainted property, commits a crime”. Tainted property is defined in section 431 to be “a thing that has been obtained by way of an act constituting an indictable offence”.
Section 433 is an updated version of the old offence of receiving stolen property. Indeed, it is commonly used to prosecute people who have received stolen property, or who are suspected of having stolen property, but cannot be prosecuted for the stealing itself because of a lack of evidence.
In any event the Queensland Police must have formed the view that the photo Grubb had was tainted property obtained by way of an act constituting an indictable offence, possibly by fraud.
Once again, while it may be argued that the Queensland Police were within their rights to arrest Grubb, whether they should have appropriately reached that decision in these circumstances is highly questionable for several reasons.
First, as of last night the Queensland Police were yet to arrest, let alone even question, Heinrich. It seems very strange indeed that they decided to arrest Grubb and yet not even talk to Heinrich.
Second, the suggestion from the head of the Queensland Police Fraud Squad, Brian Hay, that receiving a photograph obtained from a Facebook account without the user's permission is the same as receiving a stolen TV, is in my mind a flawed analogy, especially when you consider the sharing of content in the digital environment and Facebook’s own policies on that matter. I’m sure the Fraud Squad wouldn’t really want the police being contacted every time someone obtains a Facebook photo without the user’s permission.
Third, Grubb is a journalist and was simply reporting on a matter that is of some considerable public interest. There may not be any explicit legal protection for journalists in this situation but you would hope that the Queensland Police would only arrest a journalist in extraordinary circumstances. This, clearly, is not one of those situations. Indeed you would expect that technology journalists would and should report on any instances of Facebook privacy vulnerability.
A related aspect to this is the fact that the Queensland Police seized Grubb’s iPad under the Police Powers and Responsibilities Act 2000 (Qld). While I am not disputing that they had the legal authority to do so (especially given the assumptions they had already made up to that point), I think it is very concerning that the police would decide to seize what effectively was his – a journalist’s – notebook. Journalists understandably need to maintain the confidentiality of their sources, and this should be no different in the digital age.
I think that the Queensland Police have not exercised good judgment in this matter. However, it also raises more substantial issues for potential law reform. In addition to looking at whether we need to reconsider the drafting of our cybercrime legislation to ensure that it is not overly broad, it highlights the need to also think about providing greater protections to journalists in future similar situations.
There is no doubt that the digital age and new communication technologies pose challenges for the legislature as well as for law enforcement. This is why it is vital that we use moments like this to continue the process of updating and modernising the law – both as it is written and as it is applied – to ensure it that strikes the appropriate balance in the future.
Peter Black is senior lecturer in law at the Queensland University of Technology, teaching and researching constitutional law and internet law.
Source:- http://www.abc.net.au/unleashed/2719142.html
77m users. The Sony Online Network (SOE) was also hit in an attack and a further 25m users' details were accessed, including 24,000 credit and debit card details.
