Section 41(1) to (4) of the Cybercrime Code Act 2016 creates the forensic tools power. Subsections (5) to (11) constrain it — more tightly than any other power in the Act.
Section 41(5) — the recording obligation
During the investigation it is necessary to record —
(a) the technical means used and the time and date of the application; and
(b) the identification of the electronic system or device and details of its modifications; and
(c) any information obtained.
Accountability. The record is what allows the Court to determine, under subsection (9), whether an officer acted in excess of the order’s terms.
Admissibility. Evidence obtained by installing software on a device raises obvious questions about whether the device was altered and whether the material is what it purports to be. The record in subsection (5)(b) — details of its modifications — is the answer to those questions at trial. See electronic evidence.
An investigation that does not keep the subsection (5) record leaves the prosecution unable to prove the integrity of what was collected.
Section 41(6) — protecting what is obtained
Information obtained by the use of such software or hardware is to be protected against any unauthorised modification, deletion or access.
The three risks named are the same three that the substantive offences address — modification and deletion under section 8, and access under section 6. The material seized from a suspect’s device is often highly personal, and subsection (6) places the obligation to secure it on those who hold it.
Section 41(7) — six months
The duration of an order under subsection (1) shall not exceed six months.
| Power | Maximum duration |
|---|---|
| s 36 preservation notice | 14 days, extendable once by 14 days |
| s 38 restraining order | None stated |
| s 39 interception | None stated |
| s 40 traffic data | None stated — “a specified period” |
| s 41 forensic tools | Six months — the only express cap in Division 3 |
The section provides no extension mechanism. Where a further period is needed, a fresh application under subsection (1) would be required — and that application would again have to satisfy the last resort test and contain the four particulars in subsection (3).
Section 41(8) — removal on discharge
Where an order under subsection (1) is discharged, the software or hardware installed shall immediately be removed.
The obligation is unqualified and mandatory. Once the order ends, the tool comes off.
Read with subsection (4) — modifications limited to those relevant to the investigation, and reversible where possible — the scheme is that the suspect’s device should be restored, so far as possible, to the state it was in.
Software left installed after discharge is no longer covered by the authorisation. On the ordinary construction, its continued presence and operation would be conduct in excess of a lawful excuse, capable of engaging section 6 or section 27.
Section 41(9) — revocation for excess
The Court may revoke an order under subsection (1) where it is satisfied, on reasonable grounds, that in discharging the order, a member of the Police Force acted in excess of its terms.
No other provision allows the Court to withdraw an authorisation because it was misused. Subsection (9) does.
It works together with subsection (5): the record of the technical means used, the device, its modifications and the information obtained is what enables the Court to determine whether the terms were exceeded.
Revocation would also trigger subsection (8), requiring immediate removal of the installed software or hardware.
Sections 41(10) and (11)
(10) Where the installation process requires physical access to a private place, the requirements of sections 32 and 33 shall be complied with.
(11) In an application under subsection (1), the Court may order an ICT Service Provider to assist with the installation process.
A provider may be ordered to help install monitoring software on a customer’s device. That is a significant obligation, and it sits alongside section 44(1)(d), under which failure to comply with a court order requiring assistance is a crime carrying 25 years, or K1,000,000 for a body corporate.
A provider so ordered must also observe section 45, which makes disclosure of a confidential order a crime carrying 25 years. It cannot warn the customer.
What the safeguards do not include
There is no requirement to notify the suspect at any stage, no requirement to report to the Court on what was collected, and no independent oversight body. There is also no express provision for destruction of material obtained where no charge follows.
The safeguards that exist are nonetheless the strongest attached to any power in the Act. See privacy protections in PNG cybercrime law.
Sources
- Cybercrime Code Act 2016 — ss 6, 8, 27, 32, 33, 36, 38–41, 43, 44, 45
- Constitution — ss 44, 49
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.