AFP - National Facial Recognition System and the AFP's new data-centre
Scott questions the AFP and Attorney-General George Brandis about the National Facial Recognition System and the AFP's new datacentre.
Senator LUDLAM: I have just two brackets of questions, and they are probably related to each other. One is the recent announcement-and it is good that we have got you back, Senator Brandis, because I believe you might even have chaired the meeting of attorneys-general and police ministers from across Commonwealth, state and territory jurisdictions in Canberra on 22 May. One of the things that fell out of that meeting was a national facial recognition database. AFP, I do not know if you have the lead on this, but you will be part of the puzzle obviously. Can you fill us in on the basics of what you understand of that database, or what its capabilities will be?
Senator Brandis: Yes, that was one of the achievements announced at the meeting. The AFP are the lead agency on this. I will ask Commissioner Colvin.
Mr Colvin : Sorry, Attorney; the department are the lead, but we certainly led the discussion in terms of the operational basis for our ability in terms of identity theft particularly and the utility of having a more joined-up facial recognition software capability across jurisdictions in this country. The Attorney-General's Department are leading a project in relation to that work, so they may wish to say more.
Senator LUDLAM: I am happy for people to chip in as desired. We will come to the applications maybe at the end, but let us talk about the capabilities first. What will the system be capable of doing?
Ms K Jones : I can assist in relation to that. The capability is being established as a hub and spoke, the idea being that, for agencies that already obtain facial biometric material-whether it is the passport office-we are creating a capability to share and compare that with facial biometric holding held by another agency to give an enhanced level of being able to check the accuracy of that facial biometric material and ensure that it matches up adequately to the names. We are not creating a new holding or a collection of facial biometric material. It is about enabling different holdings to at least compare to provide a greater level of certainty that the biometric material is accurate and is connected to the identity of the person who it is purporting to connect to.
Senator LUDLAM: The two largest holdings that occurred to me would be passports-that is one side-and drivers licences. That would be the other.
Ms K Jones : Yes.
Senator LUDLAM: That is in terms of still-portrait-style photographs of people for those two use cases. What about CCTV cameras and licence plate cameras? The reason I put that to you is that, in the Queensland and South Australian jurisdictions, there were election commitments made in both of those two state elections respectively about police making greater use of facial recognition technology for tackling crime, and their uses were specifically related to CCTV cameras.
Ms K Jones : We certainly have been liaising and consulting with road and traffic authority agencies in each of the states and the territories. As far as I am aware, we have had no discussions relating to CCTV material as being capable of connecting into this capability. I could take that on notice to check whether there has been any discussion of that. At this stage, my understanding is that all our discussions with the states and the territories are focused on driver licence material.
Senator LUDLAM: What about passports?
Ms K Jones : Yes, certainly the holdings of the DFAT passport office are one of the holdings that we are looking at.
Senator LUDLAM: You can provide this on notice if you like; it might be dozens for all I know. What are the other major archives that you would be seeking to stitch together?
Ms K Jones : I will take that on notice if you do not mind. You are correct: it is largely passports and drivers licences. I think the number of people over 18 who have a driver's licence in this country is above 80 per cent, so that is the most significant holding.
Senator LUDLAM: The chair is being reasonably strict on timing, so I might ask if you could take on notice for us the holding, the agency that is responsible for holding them and the size of the database.
Ms K Jones : Sorry, just to correct: in a sense we are not creating a database. We are creating a hub-
Senator LUDLAM: Yes, of that kind of catchment.
Ms K Jones : and spoke.
Senator LUDLAM: Describe for us what will be in the hub. Presumably, there is some elaborate piece of software designed to index to make sure that you are deduplicating and that kind of thing. I understand the spokes-I guess they already exist-but tell us a bit about the hub.
Ms K Jones : The hub is essentially-and I will have to be careful in terms of my technical capacity to explain the mechanics of it-a connecting. It is an ability to connect in real time to check the identities. It is not a database as such where these identities will be held. The identities are still in the holdings of the agencies that provide them.
Senator LUDLAM: How will it be used? If I am a law enforcement agency and I come into this new thing with a photograph of somebody who is suspected of doing something, do I hand this photo over to this service and they then try and get me a match? How will it actually be used in practice?
Ms K Jones : If I could give an example: if someone were seeking to get a drivers license in one jurisdiction-the issuing agency for that divers license-and they produced another form of identity in order to be able to satisfy the points requirements to get that type of document, they could then use that to check with the original issuing agency. Perhaps if they have both a passport and a drivers license in another jurisdiction, you would be able to do a real-time crosscheck to check that the photo and the name are accurate.
Senator LUDLAM: Matched. Got it. Which agencies will be able to access it?
Ms K Jones : It will be law enforcement agencies, initially. In terms of the full list, I will take that on notice; it will be subject to finalisation in the legislation.
Senator LUDLAM: Yes, I guess it is fairly new. It will need to be legislated. Are we amending a particular something, or are we introducing a new act to bring it into being?
Ms K Jones : It will require amendment of state and territory legislation, because obviously their legislation covers the issuing of their identity facial biometric material, whether it is drivers licenses or anything else. I think our current assessment is in terms of the Commonwealth. We may not have to make any legislative provision for it, because it relates to material that is already collected under legislative provision, say, the Passports Act. Any legal requirements about the use of that facial biometric material will be covered in that original act, including any privacy limitations related to that.
Senator LUDLAM: Understanding that this is a reasonably new proposition, could you provide us with a list of the agencies that will be able to access it and under what circumstances what will govern access to the database-so, having search rites and so on. Will it be administered? Again, I am talking about the hub, because I well understand that you are looking at collections all over the country in different archives. Will it be administered by the department?
Ms K Jones : Yes
Senator LUDLAM: Does it have a particular funding appropriation? I do not know if that was in the communique or not.
Ms K Jones : Yes.
Senator LUDLAM: Can you tell us a bit about that?
Ms K Jones : The department was appropriated funding in September 2014, as part of the broad package of national security funding that the government announced at that time. We have $12.6 million in departmental funding for implementation and operation of the hub and $5.8 million in administered funding, which we are providing in order to able to assist the states and territories, should they choose to be involved in the mechanism, for them to be able to connect into the hub.
Senator LUDLAM: I want to be clear, because I am not sure if we have got anything going in on notice or not. Police forces around the country are increasingly linking facial recognition technology and live access to CCTV cameras. I think even Facebook is getting better and better at automatically recognising and tagging people's faces. There are big open source photo archives and then there is obviously access to CCTV feeds, and that is for tracking individuals of interest almost, effectively, on a real-time basis. It feels to me to be inevitable that this system would be patched into those systems if they are being developed by state law enforcement agencies or whatever the AFP has afoot. What can you tell us about how this hub will be linked or coordinated with other facial recognition technologies that are being rolled out in the states and territories or at a Commonwealth level?
Ms K Jones : As I said before, at this stage we have not got to that point. The focus has simply been on the sharing of materials such as driver's licence, passport material. But I would like to take that on notice. There have been a range of discussions with the states and the territories. I cannot say that people have flagged that that might be something that they were interested into looking at further down the track, but it is not currently envisaged as part of the operating model.
Senator LUDLAM: I would find it extraordinarily implausible if I were the first person to have thought of the idea of maybe matching those various technologies together. That would be quite something.
Senator O'SULLIVAN: It is highly unlikely.
Senator LUDLAM: So I am presuming those ideas have been had. Whatever you can provide us with, I would greatly appreciate. How is the database to be linked in with systems used by the immigration department in tracking people coming in and out of the country? That is part of the use case presumably.
Ms K Jones : We have been talking with the department of immigration, because they have obviously been enhancing their capability at the borders as well, with the SmartGate. In terms of the specifics of how they will interact, I think it is subject to discussions but it has not been worked through finally. If I could take that on notice.
Senator LUDLAM: All right. That is quite a bit of homework; sorry about that. I have only got a few minutes to go. Commissioner Colvin, the AFP's new Data Centre Transition Project-do you want to just tell us why that is occurring and roughly what the scope of that is?
Mr Colvin : I will hand over to the Chief Operating Officer, Andrew Wood.
Mr Wood : The AFP currently has a data centre at a site here in Canberra, in a suburb called Holder. That particular site does not meet our future requirements, and our lease on the site is also expiring. We do have a second data centre, in the Canberra suburb of Hume, and we are in the process of going to the market to look for what would become our backup site. It is because our existing second site in Weston-sorry; not Holder-is not going to be operable in about 24 months time.
Senator LUDLAM: So is the proposal to build another two or another one? Does the AFP actually build them? Do you contract them? Do you use commercial providers? Can you just let us know how you run that end of the business?
Mr Wood : The engagement with industry will look at the most cost-effective option, but certainly it is government policy for agencies not as a matter of course to build their own data centres but rather, firstly, to work collectively as a whole of government and, secondly, to look at the capacity of industry to provide solutions, rather than the Commonwealth owning those solutions.
Senator LUDLAM: What is the current set-up?
Mr Wood : The one at Weston is on our own leased site, so we own that data centre. The one we have in Hall is co-leased with the Department of Finance, and we own the equipment inside that site. So, at the moment, the AFP controls both its data centres, but we would be looking to abide by whole-of-government policy in this space in any new arrangement, and that therefore means that we would be looking more closely at a whole-of-government and industry partnering arrangement.
Senator LUDLAM: Do you run all your own email accounts? Presumably that is all held internally. I am presuming that is not outsourced to a commercial provider.
Mr Wood : There is one very small exception to that, and that is we have an unclassified email system to ensure that we maintain good communications with staff offshore who do not necessarily have access to classified systems. That particular system is in the cloud space, but certainly all our AFP business systems that are at a protected or higher level are in various environments that are Commonwealth controlled.
Senator LUDLAM: So the 17-and-a-bit million dollars will provide you with one or two new facilities by the time we are done?
Mr Wood : We will have two, but the money is for one additional-
Senator LUDLAM: Is for the new one.
Mr Wood : to replace Weston.
Senator LUDLAM: This might sound like an odd question, but you are running email servers for your staff and operatives; are you subject to the same obligations as commercial service providers as regards data retention of all of that material?
Mr Wood : I imagine the Archives Act actually puts even more obligations on us. There is a mix of requirements placed on us. We are not an internet service provider, though, and we are not a telecommunications company, so I suspect legislatively we are probably not captured by what you are referring to. But, because of our archives requirements and our requirement to maintain information in relation to matters that may still be appearing before court et cetera, there are a range of requirements on our retention of data.
Senator LUDLAM: Do your staff use commercial service providers for your mobile phone use or do you have separate arrangements?
Mr Wood : The AFP has a contract with one provider.
Senator LUDLAM: Is that with a commercial service provider?
Mr Wood : Yes.
Senator LUDLAM: So you are not also running your own phone company.
Mr Wood : Yes, that is correct, we are not.
Senator LUDLAM: Presumably, they are then subject to the department's new requirements for mandatory data retention.
Mr Wood : Yes, they have been one of the very active participants in some of the debate.
Senator LUDLAM: I have absolutely no doubt about that. I do not know who it is and I probably do not even to need know unless you are able to tell us. It does not matter who it is as the Chair is about to shut that line of questioning down
Mr Wood : It is Telstra.
Senator LUDLAM: It is Telstra.
Mr Wood : Because it is engaged through a normal government procurement process it is on the public record already.
Senator LUDLAM: Does that include undercover people or people working in very sensitive areas?
Mr Wood : It is probably not appropriate to answer that one.
Senator LUDLAM: I will let that one go. Thank you.
