The Federal Court of Australia recently found in Luppino v Fisher that a mobile phone should not be treated as a “computer” or a “data storage device”. This had the effect of invalidating an earlier order made under s3LA of the Crimes Act 1914 (Cth) requiring the plaintiff to assist police to access data stored on a mobile phone, on the basis that the mobile phone was not a computer. The Australian Federal Police (AFP) has appealed this finding, with the appeal to be heard at a date to be determined.
Background
The case concerned an order made in October 2018 under s3LA of the Crimes Act requiring the plaintiff in the case to provide to the AFP information (specifically, a password) to enable the AFP to access data held on a Samsung mobile phone.
Notwithstanding the October order, the plaintiff continued to refuse to provide the password to the AFP and commenced proceedings alleging that the order had been made erroneously.
Key issue
Section 3LA of the Crimes Act authorises the court to grant an order requiring a person to provide any information or assistance that is reasonable and necessary to allow police to access data held in, or accessible from, a computer or data storage device . The order is able to be granted where, relevantly, the magistrate is satisfied that the computer or data storage device may hold relevant evidentiary material and the person in respect of whom the order is made has relevant information (in this case, the password) necessary to enable the police to access that evidentiary material. The purpose of s3LA is to provide police with a means of overcoming impediments to accessing evidence that is held as electronic data where those impediments are created by the use of tools such as password protection and encryption.
The key issue considered by the court in Luppino v Fisher was whether the Samsung mobile phone in question was a “computer” or “data storage device” within the scope of s3LA. If it was not, then no order could be made.
Decision
Justice White was not satisfied that the Samsung mobile phone in question should be treated as a “computer” or “data storage device” for the purposes of s3LA.
No reference to “mobile phones”
When s3LA was introduced in 2001 , the second reading speech referred to “computers”, “hard drives” and “disks”, without reference to mobile phones. Similarly, there was no mention of mobile phones in a 2010 amendment to expand the scope of s3LA to apply to “data storage devices”. However, in 2001, mobile phones had relatively little computing ability and even in 2010 computing capability in mobile phones was not as sophisticated, nor as ubiquitous, as it is today.
Mobile phones are not computers
Notably, the Crimes Act itself does not define “computer”. Given the repeated usage of the term “computer” in the Act, it is possible this omission was deliberate, to allow it to reflect changing understandings of the term as technology develops.
Ultimately, White J’s conclusion rested predominantly on the assumption that if Parliament had intended mobile phones be covered by s3LA, they would have expressly included them in the provision. He acknowledged that mobile phones could be used for computing, however, he noted that the primary function of mobile phones is for communication, not computing, and that there was not sufficient evidence put forward to justify them being called a computer.
His Honour also noted that Parliament has specifically not chosen to use the term “electronic equipment” in s3LA, even though that terminology is used elsewhere (with a broader meaning) in the Act. For example, there are sections of the Act dealing with child abuse material, which refer separately to a computer, a data storage device and “another piece of electronic equipment”.
Mobile phones are not “data storage devices”
The Crimes Act does include a definition for a “data storage device”, which is defined to mean a thing containing, or designed to contain, data for use by a computer. “Data” is defined to include information in any form and any program (or part of a program).
Justice White noted that the concept of a “data storage device” was intended to include USB drives and external hard drives, DVDs, CDs and computer servers, as distinct from a computer itself. His Honour concluded that the term does not seem apt to encompass a mobile phone, and that there was nothing in the legislative history that suggested that the term was intended to encompass mobile phones. Whilst acknowledging that a mobile phone will contain data, His Honour did not consider that the requirement that the data be for “use by a computer” (as required by the definition of “data storage device”) was satisfied.
What's next
His Honour compared mobile phones to other devices such as cars, televisions and refrigerators that may contain a computer but could not be said to be a computer. However, in the case of smart phones, and the variety of functions their computing capability allows them to be used for, this distinction seems very fine. It also seems very artificial to distinguish between standalone computers, and computers housed in other objects or devices such as hybrid laptops or tablets.
It is important to keep in mind that this decision is subject to appeal. However, given the universality of mobile phones and their importance to communication and information storage, as well as the emergence of more and more technology with similar computing ability, it is reasonable to expect that we will see Parliament step in to clarify this definition.
Authors: Lucy Cottier, Isobel O’Brien and Lesley Sutton