Fears over how the government’s controversial hacking powers would be used appear to have come true as invasive warrants intended for fighting child exploitation, terrorism, and organised crime have been wielded to investigate online harassment.

In 2021, the Coalition government passed a set of unprecedented hacking powers that gave the AFP and Australian Crime Intelligence Commission (ACIC) access to three new warrants: one for offensive data disruption, one for tracking network activity, and one for taking over people’s online accounts.

Both agencies are required to report on their use of these warrants across two annual reports.

The AFP, in its reporting about account takeovers, is required to cite the “relevant offences” for which it used those hacking powers.

In its 2021-22 annual report, the federal police mentioned one offence: using a carriage service for child abuse material.

But in the 2022-23 report, the AFP included a list of sections in the Criminal Code for which it used the account takeover warrant.

Along with offences related to child sexual abuse material, which is what the powers were intended to be used for, the AFP also includes sections 474.15 and 474.17 of the Criminal Code which relate to making death threats and harassing people online.

Back in 2021, when the hacking powers were being discussed in a parliamentary committee, the Human Rights Law Centre wrote a submission saying that the scope of these powers was inadequately defined and that there was not “robust safeguards to minimise the adverse impact of these new powers”.

The submission warned that, because the hacking powers were available for investigating criminal offences with a maximum penalty of at least three years, they could “be used to target relatively minor criminal activities” and even whistleblowers acting in the public interest.

It listed a series of crimes for which the AFP could be allowed to hack into people’s devices, spy on their activities with friends and family, and take control of their online accounts that are far removed from the bill’s stated intentions as a tool for fighting child exploitation, terrorism, and organised crime.

Altering a trademark without permission, dishonestly obtaining cheaper internet, and organising a protest that involves breaking into a farm could all be crimes for which law enforcement could seek powerful, disproportionate, surveillance access to people, the centre warned.

One of the possible scenarios the Human Rights Law Centre put forward was if “a person posts content on social media that is deemed menacing, harassing or offensive”.

That bullet point had a footnote pointing to section 474.17 of the Criminal Code – the very same relevant offence the AFP cited for seeking account takeover warrants in the 2022-23 financial year.

Information Age sought comment from the AFP.

Not being used as intended

Angus Murray, a lawyer and vice-president of the Queensland Council of Civil Liberties – which made a joint submission with other civil society groups calling for the original bill to be withdrawn – said the latest reporting period raised a slew of problems with the AFP and ACIC’s hacking powers.

“These powers, which are incredibly intrusive, were rushed into Australian law and don’t seem to being used as intended,” he told Information Age.

“They should be reserved for particularly heinous criminal offending and not for anything else. The justification was that they are extreme powers to be used in exceptional circumstances, which necessitates extreme responsibility.

“If that’s widened out for not what they’re intended for is a concern.”

Murray also pointed out that the relatively low use of hacking powers – no one used the data disruption warrants, and only three of each network activity and account takeover warrants were issued last financial year – raises questions about why they were pushed through parliament so quickly.

“These powers were introduced on the basis that there was a need for them, and the need was pressing,” Murray, told Information Age.

“The fact they’re not being used brings into focus criticism about the speed with which they were introduced into Australian law.”

Murray wants to see “more close oversight and more open transparency” over the use of powerful surveillance against Australians, though he also suggests the powers could also be abolished “on the basis that they’re not being used for the purpose they’re intended to.”