Section 41 of the Cybercrime Code Act 2016 is the most intrusive power in the Act — and the one hedged with the most conditions.
Section 41(1)
In an investigation of an offence under this Act, if relevant evidence cannot be collected by applying other instruments under this Part, then the Court, on application by a member of the Police Force or the Public Prosecutor, on being satisfied upon sworn evidence that such evidence is reasonably required for the purposes of an investigation or proceeding, may authorise a member of the Police Force to —
(a) install such software or hardware on the suspect’s electronic system or device in order to collect the relevant evidence; and
(b) use a remote forensic software or hardware,
only for the specific task required for the investigation.
(2) The authorisation to install the software or hardware may include remotely accessing the suspect’s electronic system or device.
Two limits not found elsewhere
Section 41(1) applies “in an investigation of an offence under this Act”.
That is a real restriction, and it is unique in Part IV. Sections 32 and 33 speak of evidence of “an offence”; sections 35 to 40 speak of “an investigation or proceeding” without limitation.
Remote forensic tools are therefore not available in an investigation of an ordinary offence under the Criminal Code Act (Chapter 262) or any other law.
“If relevant evidence cannot be collected by applying other instruments under this Part.”
This is a genuine test of last resort. Before section 41 is available, the applicant must show that the evidence cannot be obtained by:
- Search and seizure under sections 32 and 33;
- Assistance under section 34;
- A production order under section 35;
- Preservation under section 36;
- Partial disclosure under section 37;
- A restraining order under section 38;
- Interception under section 39; or
- Traffic data collection under section 40.
The sworn evidence supporting the application must address each of them.
Section 41(3) — what the application must contain
(a) the name and address of the suspect; and
(b) a description of the targeted electronic system or device; and
(c) a description of the intended measure, extent and duration of the utilisation; and
(d) the grounds for the use of such software or hardware.
Paragraph (a) means there can be no anonymous target. The suspect must be named and located, which rules out the use of section 41 as a tool of identification — that work belongs to section 35(b) and section 37.
Paragraph (b) means the order attaches to a described device, not to whatever the suspect may use.
Paragraph (c) requires the measure, extent and duration to be stated in advance, which is what makes the six-month cap in section 41(7) and the revocation power in section 41(9) workable.
Section 41(4) — limits on modification
An order under subsection (1) shall include a requirement that any modifications to the electronic system or device of the suspect are limited to those relevant to the investigation, and that any changes if possible can be undone at the end of the investigation.
The word is “shall”. An order under section 41 that does not include this requirement is defective on its face.
Two obligations follow: modifications must be limited to what the investigation requires, and they must be reversible where possible.
This is the provision that separates a lawful forensic tool from the conduct criminalised by section 27 and section 8. Installing software on another person’s device is, in itself, exactly what those sections prohibit; the authorisation, and compliance with its terms, is the lawful excuse.
An officer who modifies a device beyond what the order permits acts in excess of a lawful excuse — and section 41(9) allows the Court to revoke the order where satisfied on reasonable grounds that an officer acted in excess of its terms.
Where physical access is needed
Section 41(10) provides that where the installation process requires physical access to a private place, the requirements of sections 32 and 33 shall be complied with — so a warrant is needed in the ordinary way.
Section 41(11) allows the Court, on an application under subsection (1), to order an ICT service provider to assist with the installation process.
The remaining safeguards — recording, protection of what is obtained, the six-month limit, removal on discharge and revocation — are dealt with in the article on section 41(5) to (11).
Sources
- Cybercrime Code Act 2016 — ss 8, 27, 32–41
- Constitution — ss 44, 49; Criminal Code Act (Chapter 262)
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.