Data Retention
Protection Guide

About Data Retention

The Australian Federal Parliament voted to give law enforcement and intelligence agencies access to an unprecedented amount of information on all Australians. The Coalition Government and Australian Labor Party goose-stepped together to pass legislation requiring telecommunications service providers to store enormous amounts of personal data of every Australian for a minimum of two years under the mandatory data retention scheme.

This data retention scheme takes effect on October 13, 2015.
See here: "Data regime will see us funding our own surveillance", Leanne O'Donnell, 08/10/2015 for a good recent overview of the scheme.

This creates a mass surveillance regime that will target all Australians at a time when other countries have abandoned this approach,more info and Australians will likely pay for this increased surveillance through taxes and additional phone and Internet charges. This is despite overwhelming evidence that mandatory data retention schemes do not work to reduce serious crime and are a substantial assault on privacy.

This page contains an overview of what this is and what it means to you (also, there are some handy videos to watch and share as well).  

Video Overviews

• Metadata: Australian government's data retention plans explained
• The Roast takes on metadata, with a gazillion ways around it :-)

What You Can Do

The new impending Data Retention regime in Australia puts you and your family's privacy at risk. To assist in preventing your personal information from falling into the wrong hands you should take action to protect yourself now. What follow is a simple guide to some sample technologies that can help protect your privacy.

For more in depth information on protecting your privacy that goes beyond this guide, a good starting point is the EFF's "Surveillance Self Defence" site. In fact, many of the links below in regard to specific items will send you there.

Please note that this guide is intended for average everyday citizens desiring to take some action to protect their metadata from the ubiquitous mass surveillance of the new Australian data retention regime. If you are a journalist, a dissident, a whistleblower or political activist, or have some other higher order threat model, then you should seek further more specific technical & professional advice than this guide.

But for an easily digestible overview of a range of options to minimise your risk from the incoming Australian Data Retention regime, see below.

Whether you are using your desktop computer, or a mobile device, you should protect your actions from indiscriminate surveillance. Despite claims that data retention does not intend to collect and store your browsing history, any interaction online that is not encrypted will leak private data about you, your activities and connections. The below options will go some way to protect your actions from some aspects of casual surveillance if set up correctly.

Important: How careful you are and what tools you choose to use will depend on decisions you make about your "Threat Model"

If you are worried about Data Retention, then you may also be concerned about other means by which companies, security agencies, governments and so on can track what you do and build a picture via your online activity.

Even if the current definition of what is to be retained under the data retention regime is limited to certain information, there is the likelihood that this definition will expand at a later date. Additionally there is the threat that innocuous activity could inadvertently raise suspicion through false positive identification. This could in turn increase the amount of warrants issued on innocent people, warrants which will then cause the retention of extra content in relation to these people. Thus, average users could be more likely to come under the increased scrutiny of a preservation order so protecting data that is outside the purview of the mandatory data retention regime may be advisable.

Keeping these expanded threats in mind, there are some other general tools and practices that you may also wish to start employing as a result of the new data retention regime and a general increase in surveillance of communication activities.

(Don't forget there are also the wide ranging NSA programs, copyright violation monitoring, censorship efforts, and criminal activities such as identity theft, in addition to our new domestic data retention regime).

This article from the Sydney Morning Herald gives a general overview of why just masking your IP address through a VPN may not be enough to protect you: Will Australia's metadata retention scheme track your digital browser fingerprints?

There are a number of services like Wickr (as used by Malcolm Turnbull recently, he has since moved on to Signal) which provide endpoint to endpoint encryption; or encryption between their servers and all endpoints. These provide an unknowable level of protection and it cannot be guaranteed that there are no backdoor agreements between these services and any governments.

One should be especially careful when using a service that does not run on open source or freely auditable code as you are placing trust entirely within the organisation to deliver what they advertise. There have been examples where a company claims to protect your security and privacy have been found wanting when exposed to closer scrutiny.

The value of these services is often pinned on your trust of the company in question. The below apps are widely considered the best options at this time (but make your own judgement call).