News & Views

Identify and Disrupt Act

Update: February 3rd, 2022

The Department of Home Affairs has stated that as of December 2021, they are now using the new powers introduced by the Identify and Disrupt Act. They have not disclosed which type, nor the quantity of warrants exercised; nor whether the Australian Federal Police, the Australian Criminal Intelligence Commission, or other agencies have obtained them. Identify and Disrupt is extremely broad, and is being used with no meaningful oversight.

On Wednesday 25th August 2021, Parliament passed the Surveillance Legislation Amendment (Identify and Disrupt) Act 2020, giving the Australian Federal Police (AFP), the Australian Criminal Intelligence Commission (ACIC)—and by extension, the Australian Signals Directorate the power to spy domestically.1 The Act creates three new warrants, with the purported purpose of targeting “serious and organised crime” that utilise “anonymising technologies” online.

The announcement of these warrants follows a $90 million injection of funding2 in the government’s already-existing and extensive surveillance and intelligence gathering capabilities, but according to the Department, these warrants are “needed to combat cyber-enabled serious and organised crime” and to “disrupt those who organise and engage in other criminal activities.”3

While the government claims the targets of these new powers are organised criminals, the broadness of the new powers could be used to “identify and disrupt” activists, simply by virtue of the offences that are levelled against some types of civil and political activity.

Here’s how.


The new Act provides three new warrants:

  • Data Disruption Warrants, which allow the AFP and the ACIC (or another person on the law enforcement officer’s behalf) the ability to “add, copy, delete or alter” files on a computer or device, so as to “frustrate the commission of crime”4 where a law enforcement officer “reasonably suspects” that one or more “relevant offences” are “being, are about to be, or are likely to be” committed.5
  • Network Activity Warrants, which “allow agencies to collect intelligence on serious criminal activity being conducted by criminal networks”6 by intercepting communications and using surveillance devices on computer networks. The AFP and the ACIC are permitted to do “any thing reasonably necessary to conceal”7 their access and modification to computers, allowing the warrant to be conducted covertly. This is available where there is a “reasonable suspicion” that monitoring the network activity of a “criminal network of individuals” is “relevant to the prevention, detection or frustration of one or more kinds of ‘relevant offences.’”8
  • Account Takeover Warrants, which provide agencies with the ability to take control of a person’s online account “through the modification of data” for the purposes of “gathering evidence to further a criminal investigation.”9 This is available where there is a “reasonable suspicion” that one or more “relevant offences” are “being, are about to be, or are likely to be” committed; an investigation is either imminent or in progress, and taking control of the “target accounts” is “necessary for enabling evidence to be obtained.”10

What constitutes a “relevant offence” is broad, but purportedly means a “serious Commonwealth offence” or a “serious state offence” that has a “federal aspect.”11 “Seriousness” is characterised by an offence carrying a maximum sentence of three or more years’ imprisonment.12

MALS is concerned that this language captures offences with a “federal aspect” that have been levelled at activists in the past, and hence would trip off the low threshold to use such warrants against activists in order to identify and disrupt their activities.

For example, anti-war activists that have staged protests on the Pine Gap surveillance facility in Alice Springs13 over the past decades,14 would be subject to the warrants, because the actions took place on Commonwealth land (federal aspect) and the offences levelled at them attracted maximum sentences of seven years15 (serious offence).

Similar circumstances apply to anti-war groups that have protested on military bases16 or refugee activists who have protested in Parliament17 where Commonwealth land and/or property is an aspect of the charges brought against the activists, and the sentencing times are likewise.

Anti-mining and climate action groups would also be ‘eligible’ for identification and disruption with the Act, because they “oppose critical infrastructure projects”18 and may be considered a “criminal network of individuals”19 or, that they are an “electronically linked group of individuals”20 that have the potential to cause “substantial loss or damage to critical infrastructure or property”21 (emphasis added).

This means the scope of this Act is much more than meets the eye.

The warrants would be issued by a judge, an Administrative Appeals Tribunal (AAT) member, or in the case of an “Account Takeover Warrant,” a magistrate.22

Members of the AAT are appointed by the Governor-General, and work on a full-time or part-time basis for a term of up to seven years. Members may be reappointed,23 and are part of the government, not the judiciary.24 The tribunal has a history of government cronyism and stacking that makes the independence of the AAT questionable at best.25 The Government has rejected the recommendation to limit the power to issue warrants to judges,26 saying it would be a “departure from long-standing government policy.”27

MALS has been tracking the evolution of this new set of laws, and notes that a ‘sunset’ period of 5 years has been introduced, where the provisions for each warrant purportedly expire. But it is useful to note that as we’ve seen in the United States, “national security laws” face little-to-no political opposition and are often reauthorised successively, sometimes for many decades.28 This means sunsets are of little comfort, especially given the bipartisan support of this Act in Australia.

Likewise, we note there has been some “consideration” introduced to the Act for journalists and their sources,29 but that these protections are extremely weak as they hinge on the interpretation of the phrase ‘public interest’ which the Federal and High court have historically interpreted to be limiting.30 Legal practitioners also remain vulnerable. For example, if a lawyer or journalist assists a government whistleblower in a manner deemed to be ‘incitement’ it will be a relevant offence for the warrants under Section 11.4 of the Commonwealth Criminal Code Act.31

Concerns for Activists and Human Rights Defenders

So what does this have to do with activists and human rights defenders in Victoria?

Data Disruption Warrants

The Act states that the AFP and ACIC (or another person on the law enforcement officer’s behalf) will have the ability to “add, copy, delete or alter”32 files on a computer33 so as to “frustrate the commission of crime.” In an activist context, what this means is that police and intelligence agencies will have the ability to install malware on target computers and even whole computer networks34 and modify files—including the possibility of planting and manipulating evidence35 that can be used in a prosecution36 even though it is claimed the warrants are not “for the purpose of evidence-gathering”, according an explanatory memorandum from the government.37

The “frustration” element would also include preventing certain actions from taking place before they happen, much like predictive policing. For instance, taking the Pine Gap actions for example, this would mean that the participants of that action—as well as everyone they know—could become targets, and the content of their communications “deleted, altered, or added to” as the police see fit, so as to not only stop the action itself, but also provide opportunity for law enforcement to mount prosecutions against related persons using evidence that has been manufactured or embellished, for the purposes of disrupting these movements.

The prospect of police and intelligence agencies having the ability to admit evidence to a court that they have tampered with is extremely concerning, let alone the lacklustre checks on the powers of these provisions by external oversight. In the past, police have used parallel construction to conceal how unlawful investigations have started against Persons of Interest in precisely the same way, getting around the protections courts provide pertaining to the admissibility of evidence that is not obtained legally. This Act changes the scope of such evidence gathering methods to one that fundamentally enshrines these dubious methods of both collection and “chain of custody” with little to no recourse or accountability.

Network Activity Warrants

The purpose of this warrant is essentially comprehensive surveillance of a target—and everyone loosely connected to that target—carried out through the co-opting of their Internet-connected digital devices.

As mentioned above, these warrants could be deployed against all sorts of activist movements—groups undertaking direct action to stop climate change, anti-war groups or activists opposing military bases, those undertaking protest on Commonwealth land or in regards to Commonwealth “property,” etc. However, the language of the Act is still broad enough to capture other types of protest.

For example, Section 474.17 of the Criminal Code Act (Cth) makes any communication by Internet, text, or other electronic means vulnerable, because that section makes the use of “a carriage service” to “menace, harass, or offend” a crime under Commonwealth law. “Menacing, harassing, or offending” can be in either the content of the communication (what’s said or shown) or the use of the communication (organising or ‘inciting’ to act in some way).

This means this type of warrant has the potential to capture38 for example, animal rights activists, particularly those who may use hidden cameras to capture footage and that footage is then shared.39 Or, even more broadly, this warrant could provide police and intelligence agencies access to anyone’s communications even if they are only loosely connected to someone under investigation of a relevant Commonwealth offence. As explained by the Human Rights Law Centre, this is because (citations omitted):

An “electronically linked group of individuals” simply means any 2 or more people who use the same electronic service (including a website), or communicate with other individuals in the group electronically.

On a broad, but not unreasonable, interpretation of these definitions, the effect is that a person who visits the same website as a person engaging in conduct facilitating or constituting a relevant offence is in a “criminal network of individuals.” This is regardless of whether the website or communication bears any relation to the offence, or whether the individuals have any knowledge of, involvement in or connection to the offence.

Human Rights Law Centre: Submission to the Parliamentary Joint Committee on Intelligence and Security

As the Centre explains, “if someone commits a relevant offence using WhatApp, then … every user of WhatsApp worldwide would be a member of that “criminal network of individuals.”

Recognising how much surveillance is already undertaken to track and repress activism, it is not too far a leap to see how such broadly defined warrants will add to this.

Account Take-over Warrants

This warrant provides agencies with the ability to take “covert and forced takeovers”40 of a person’s online account for the purposes of “gathering evidence to further a criminal investigation.”41 This includes accounts that are outside Australian jurisdiction, and those that operate on systems in other countries.

Any account takeover will be done covertly and “without consent of the account holder.”42

These warrants are authorised by a magistrate.43

Not surprisingly, some technology megacorporations have criticised this warrant, as their use would directly effect Internet communications, and compromise their products. Twitter labelled the warrant “antithetical to democracy”44 and Amazon is seeking legal indemnity regarding the exercising of them,45 stating that the warrants were “developed for a radically different purpose in law enforcement compared to the warrants currently available to law enforcement agencies.”

In an activist context, it’s unclear how this type of warrant could be used, but its broad scope, just like the others, allows for all sorts of possible adverse outcomes. For example, one could imagine one’s social media accounts being taken over by law enforcement agencies, and then law enforcement agents posing as activists for the purpose of entrapment or incitement of other activists, as seen in the United States.46

Where can I find out more?

The Identify and Disrupt Act operates as part of an extensive suite of surveillance laws in Australia, including the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (TOLA), and the Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015 (the Mandatory Metadata Retention Scheme). All of these laws working in tandem create a powerful mass surveillance system in Australia. The Identify and Disrupt Act adds to the extensive legal structure to now make it practically impossible to implement end-to-end encryption to protect information and communications. As AccessNow explains:

“Authorities could use the Technical Capability Notice under TOLA to compel a service provider to build the prescribed technical capability, including decryption, to assist the government and intelligence agencies. Thereafter, law enforcement may utilise warrants under the Identify and Disrupt Act to gain access to all kinds of data. A combination of TOLA and the Identify and Disrupt Act effectively brings any kind of information in existence within the reach of law enforcement in an entirely unnecessary and disproportionate manner, to the grave detriment of cybersecurity and users’ privacy.”

MALS opposes this Act, not only for the reasons outlined above, but also for the fundamental lack of a compelling justification for creating such expansive, invasive, and secretive powers that add to an already extensive surveillance state in the first place.

To find out more, see:

Jordan Brown, Alec Miguel, Jennifer Keene-McCann
Melbourne Activist Legal Support

Melbourne Activist Legal Support (MALS)

is an independent volunteer group of lawyers, human rights advocates, law students and para-legals. MALS trains and fields Legal Observer Teams at protest events, provides training and advice to activist groups on legal support structures, and develops and distributes legal resources for social movements. MALS works in conjunction with law firms, community legal centres, and a range of local, national, and international human rights agencies. We stand up for civil and political rights.

Learn More »


  1. Dark web crime: how Australia’s powerful new warrants would work, the Guardian, 3 December 2020.
  2. Australian govt makes play for sweeping online account takeover powers, IT News, 3 December 2020.
  3. Review of the Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020, Parliamentary Joint Committee on Intelligence and Security (PJCIS).
  4. Paragraph 6, Revised Explanatory Memorandum for the Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020 (‘EM’).
  5. Section 27KA(1)(a) Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020, (‘The Bill’).
  6. Paragraph 6 EM.
  7. s 27KP(8)(c) Bill.
  8. s 27KK(1) Bill.
  9. Paragraph 6, EM.
  10. s 3ZZUN(1) Bill.
  11. The definitions of “State offences that have a federal aspect” are provided in Section 3AA, Crimes Act 1914 and cover a wide range of offences, such as conduct constituting an offence “involved an electronic communication” or that was “engaged in in a Commonwealth place” or “affects the interests of the Commonwealth”, etc.
  12. Paragraphs 5, 974, 1004 EM.
  13. Pine Gap activists found guilty over entering top-secret US-Australian facility, ABC News, 24 Nov 2017.
  14. Pine Gap protesters escape jail term, Sydney Morning Herald, 15 June 2007.
  15. Pine Gap facility essential to US drone strikes, expert called at activists’ trial says, ABC News, 21 Nov 2017.
  16. Anti-war activists who broke into Swan Island military base to be charged, the Guardian, 2 Oct 2014.
  17. Superglue seven found not guilty after Question Time protest, Canberra Times, 29 March 2018.
  18. ASIO eyes green groups, Sydney Morning Herald, 12 April 2012.
  19. s 7A Bill.
  20. Sch 2, part 1, s3 Bill.
  21. s 27KC(3)(e)(i) or (3)(a)(ii) Bill.
  22. s 3ZZUJ Bill.
  23. Who we are‘, Administrative Appeals Tribunal; List of current members, Administrative Appeals Tribunal.
  24. Parliamentary Joint Committee on Human Rights, Report 3 of 2021, p. 71.
  25. The Big Stack, Crikey, September 2019.
  26. see Recommendation 9, Parliamentary Joint Committee on Intelligence and Security, Advisory report on the Surveillance Legislation Amendment (Identify and Disrupt) Bill 2020.
  27. Australian powers to spy on cybercrime suspects given green light, the Guardian, 25 August 2021.
  28. The PATRIOT Act “temporarily” existed for almost two decades.
  29. see, eg. s 27KC(2)(ce) Bill for Data Disruption Warrants (mirrored for Network Activity and Account Takeover Warrants).
  30. AIAL Forum No. 48 The Public Interest, Chris Wheeler; Meaning of Public Interest, Serious Invasions of Privacy in the Digital Era, Australian Law Reform Commission, 27 March 2014.
  31. Section 11.4 of the Commonwealth Criminal Code Act 1995.
  32. s 27KE(d) Bill
  33. In the Surveillance Devices Act 2004, “computer” means: (a) one or more computers; or (b) one or more computer systems; or (c) one or more computer networks; or (d) any combination of the above. Emphasis added.
  34. Ibid.
  35. see, eg. s 27KC(2)(ce) Bill for Data Disruption Warrants (mirrored for Network Activity and Account Takeover Warrants).
  36. Australia’s proposed new surveillance legislation: Combatting the dark web, Angela Flannery, 25 January 2021.
  37. Paragraph 9, EM.
  38. Law Council of Australia submission to the Parliamentary Joint Committee on Intelligence and Security.
  39. High court to hear bid to overturn New South Wales hidden camera laws, the Guardian, 29 Jun 2021.
  40. Paragraph 27, EM.
  41. Paragraph 26, EM.
  42. Paragraph 997, EM.
  43. s 3ZZUJ Bill.
  44. Twitter deems Australia’s account takeover warrant as antithetical to democratic law, ZDNet, 16 February 2021.
  45. AWS asks new Australian computer warrant provide immunity for account takeovers, ZDNet, 15 February 2021.
  46. Undercover Policing in the Age of Social Media, Policing Project, NYU School of Law; Undercover cops break Facebook rules to track protesters, ensnare criminals, NBC News, 5 October 2018; The Wildly Unregulated Practice of Undercover Cops Friending People on Facebook, Kashmir Hill, 23 October 2018; Yes, there are undercover cops on Instagram, Splinter, 18 December 2014; Better This World, PBS, 5 September 2011; Austin RNC Informant is Provocateur Not Hero, Houston Indymedia, 6 January 2009.