Anti-encryption laws yet to be used by Asio or AFP to compel tech firms' help, inquiry told

Neither the spy agency, Asio, nor the Australian federal police have compelled tech companies to provide assistance under the country’s controversial anti-encryption laws that have been in force for nearly two years, a parliamentary inquiry has heard.

Both agencies said on Friday they had so far secured voluntary cooperation from tech and communications companies – even though there had been times when they had come close to issuing a compulsory notice – and they still might need to use the tougher powers in future.

The situation exasperated the shadow attorney general, Mark Dreyfus, who said during the hearing: “Two and a half years ago the AFP told this committee that it urgently needed these powers and here we are two and a half years later and you haven’t used them”.

Related: Peter Dutton confirms Australia could spy on its own citizens under cybersecurity plan

The 2018 laws increased penalties for criminal suspects who refused to unlock devices such as phones and created a new framework for law enforcement agencies to request or compel technical assistance from tech companies – and even to create new capabilities such as back doors to get around the encryption in some of their products.

Those laws are now being reviewed by the bipartisan security and intelligence committee, amid fresh calls for safeguards to be tightened.

The AFP commissioner, Reece Kershaw, said that the AFP had so far issued eight voluntary technical assistance requests to communications providers – but it had not yet sought to use the compulsory tools known as technical assistance notices or technical capability notices.

The AFP’s representatives also confirmed that no Australian law enforcement agency had used a technical assistance notice to date.

Superintendent Robert Nelson, from the AFP’s digital surveillance section, said there were cases of providers being “quite uncomfortable with what we had requested prior to the institution of this act, and then post institution [in] some subsequent discussions they were a lot more receptive”.

Nelson said some providers had been able to provide assistance within their existing capabilities.

“In other instances they’ve actually built a capability or modified parts of their system to be able to facilitate that voluntary assistance request.”

Mike Burgess, who is head of the Australian Security Intelligence Organisation, said his agency had used the industry assistance powers “fewer than 20 times and always to protect Australians from threats to their security – and the internet has not broken as a result”.

Burgess described the legislation as a licence to cooperate with industry. He said while he would not give precise details in a public hearing, he could confirm that all of Asio’s engagement with industry so far had involved the voluntary technical assistance requests.

He said industry partners negotiated with Asio “about how the work will be managed”. But he argued that Asio’s preference to use voluntary processes first “does not mean the compulsory powers are not needed”.

Related: Australia's world-first anti-encryption law should be overhauled, independent monitor says

“There have been points in time where Asio has come close to issuing a compulsory notice; however, our preference will always be to engage as much as possible with the industry partners who have also been committed to helping keep Australians safe.”

The hearing on Friday also examined other parts of the Telecommunications and other Legislation Amendment (Assistance and Access) Act. The AFP said it had also obtained 23 computer access warrants as part of drug trafficking, cybercrime, terrorism and corruption investigations.

Kershaw told the committee that the powers had been “critical” in enabling AFP investigations into malware allegedly developed by an Australian national.

He said this malware allowed cyber criminals to remotely and secretly gain control over a victim’s computer or other device and view files, log keystrokes and activate their webcam.

“Our investigation showed that a high percentage of the Australian-based purchasers of this malware were named as respondents on domestic violence orders.”

Kershaw said there were a number of technical challenges in investigating this, including the encryption of data between the malware user and the victim, and the use of cryptocurrency to conceal payments. Without the powers, the AFP would not have been able to capture relevant data and evidence, he said.

“In late 2019 the AFP, in partnership with more than a dozen law enforcement agencies in Australia and Europe, undertook a week of action against people who had purchased and used the malware,” Kershaw said.

Related: Encryption laws are hurting Australia's tech sector, Atlassian says

“In that week of action, 85 warrants had been executed internationally, 434 devices had been seized (laptops, phones and servers), 13 people had been arrested, and the website selling the malware had been taken down. This is just one example of where TOLA has been a valuable tool in the AFP’s fight against online criminality.”

Last month, a report by the Independent National Security Legislation Monitor called for changes to the laws in an attempt to improve safeguards.

The report said agency heads should be stripped of the power to issue technical assistance notices and the attorney general should lose the power to approve technical capability notices – with these powers instead handed to the administrative appeals tribunal.

Burgess said he respected the right of the government and parliament to reform the laws, but argued the existing oversight measures were appropriate. “What is the problem you’re trying to solve? I don’t believe we have one at this stage,” he said in response to the proposed change.

Scrutiny of the laws comes as the government prepares a separate bill to boost powers to “deter, disrupt and defeat the criminal exploitation of anonymising technology and the dark web”.

The home affairs minister, Peter Dutton, confirmed this week that the government’s new $1.6bn cyberstrategy would include capability for the Australian Signals Directorate to help law enforcement agencies identify and disrupt serious criminal activity – including in Australia.