Construction, Forestry, Mining and Energy Union v Commissioner of the Australian Federal Police

Background facts 12 The events of 19 November 2015 (described in [1] above) occurred during the later stages of the Royal Commission into Trade Union Governance and Corruption (the Royal Commission) conducted by The Honourable Dyson Heydon AC QC. 13 The CFMEU was one of the unions identified in the Royal Commission's Terms of Reference. 14 From July to October 2015, the Royal Commission served a number of notices on the CFMEU pursuant to s 2(3A) of the Royal Commission Act 1902 (Cth). Those notices required the CFMEU to produce documents, records and other things related to a range of subject matters pertinent to the Royal Commission's terms of reference. The documents and things produced in response to those notices were considered by the officers assisting the Royal Commission to be either inconsistent with evidence given to the Royal Commission, or contradicted by other information in its possession. 15 In September 2015, the Royal Commission commenced a case study entitled "CFMEU Queensland Document Destruction Case Study". The particular focus of that case study was the alleged destruction of several tonnes of documents by officers and staff of the CFMEU's Qld/NT Branch in early April 2014. Mr Ravbar was the Secretary of the CFMEU's Qld/NT Branch at that time. 16 Federal Agent Peter Ah Loy was a member of the Joint Agency Police Task Force (the Task Force) which was attached to the Royal Commission. On 18 November 2015, he, along with another Federal Agent, Thoro Demitriou (see immediately below), applied to a Brisbane Magistrate, Ms Christine Roney, for the issue of the search warrant which is at the centre of this proceeding. Having successfully obtained that warrant, he attended at the CFMEU premises on 19 November 2015 to execute it. 17 As mentioned above, Federal Agent Demitriou was also a member of the Task Force which was attached to the Royal Commission. He attended the Brisbane Magistrates Court with Federal Agent Ah Loy on 18 November 2015 when he applied for the issue of the warrant. He also attended the CFMEU premises on 19 November 2015 to assist in executing the warrant.

The terms of the warrant and its three conditions 18 The warrant was seven pages long. As is already mentioned above, it was issued under the provisions of Part IAA of the Crimes Act, particularly s 3E. It authorised Federal Agent Ah Loy and others to enter and search the CFMEU's premises at 14-16 Campbell Street, Bowen Hills, Queensland, including: … all motor vehicles, rooms, safes, storerooms and storage areas to which access is controlled by the occupants, computer equipment, electronic data servers and data storage devices and garbage containers and garbage areas attached to or unattached for the use of the said premises. for: evidential material, as defined in the Crimes Act 1914, which satisfies ALL of the following three conditions namely: 19 The first condition contained a long list of things. It began with the following general description of those things: Originals or copies of any one or more of the following, including any of them which are stored on a computer, or on a computer storage device, or on any other type of storage medium or storage device: There then followed this list of things: • Electronic documents and files; • Computer logs; • Mobile telephones, mobile handsets and Subscriber Identity Module (SIM) cards and numbers; • Telephone numbers and email addresses; • Telephone records including contracts for service, invoices, accounts, statements, agreements and user registers and details; • Telephone registers or documents indicating users and use details; • Emails and associated meta data; • Electronic organisers; • Computers, computer hardware and software, computer hard drives, tablet devices, removable storage devices, cloud storage devices, USB devices, compact discs and digital versatile discs, faxes, and any other storage medium; • Facsimile documents and records; • Petty cash records; • Financial governance instruments and delegation approval records; • Policy documents; • Tax invoices; • Authorisations to deduct monies from wages; • Register of gifts, hospitality and other benefits; • Gift registers; • Address books, notebooks, handwritten notes and diaries; • Correspondence, letters, enterprise bargaining agreements, envelopes, postal articles and receipts; • Access control devices and registers; • Employee attendance records; • Visitor attendance registers; • Closed circuit television storage, recordings, camera positioning, camera field of view information and camera optical capability. 20 The second condition contained a longer list of persons and items. The first person on that list was Mr Michael John Ravbar. As is already mentioned above, Mr Ravbar was the Secretary of the CFMEU Qld/NT Branch. That part of the list contained approximately 60 names as follows: • Michael John RAVBAR; • Jacqueline Louise COLLIE; • Paula Ellen MASTERS; • Leanne Margaret BUTKUS; • David Arthur HANNA; • Darren 'Bob' WILLIAMS; • Brian HUMPHREY; • Phil BLAIR; • Stacey DAVIDSON; • Cherie SHAW; • Michael O'CONNOR; • Alex MILLAR; • Leo SKOURDOUMBIS; • Jane CALVERT; • Frank VARI; • Dave KIRNER; • Brad COATES; • Craig SMITH; • Dave NOONAN; • Frank O'GRADY; • John SETKA; • Brain PARKER; • Joe McDONALD; • Dean HALL; • Aaron CARTLEDGE; • Mick BUCHAN; • Brad PARKER; • Tony MAHER; • Andrew VICKERS; • Wayne McANDREW; • Ian MURRAY; • Stephen SMYTH; • Peter JORDAN; • Andy HONEYSETT; • Chris HINDS; • Gary WOOD; • Luke VAN DER MEULEN; • Lorraine USHER; • Rita MALLIA; • Andrea MAKSIMOVIC; • Tom ROBERTS; • Alex BUKARICA; • Rosalind READ; • Veronica ROONEY; • Jodie ELCOCK; • Alex MORGAN; • Courtney MASTERS; • Amanda ROSS; • Andrea GRIVAS; • Nicki MAKRIS; • Jennifer GLASS; • Peta ARNOLD; • Susan BENTON; • Gail GORMAN; • Ashleigh CHAPMAN; • M MITCHELL; • Hollie BRADSHAW; • Jessica KANOFSKI; • Robert CAMERON; • Brad O'CARROLL; • Allen HICKS; • Helen CAVAYE; • Jade INGHAM; • Nick WILLIAMS; • John BASTEMEYER; 21 The list then set out the names of 12 entities, beginning with the Bastemeyer Group Pty Ltd and including the following: • Bastemeyer Group Pty Ltd; • Bastemeyer; • Cleanaway; • Royal Commission; • Trade Union Royal Commission; • Royal Commission into Trade Union Governance and Corruption; • Construction, Forestry, Mining and Energy Union; • CFMEU; • Builders Labourers Federation; • BLF; • Communications, Electrical, Electronic, Energy, Information, Postal, Plumbing and Allied Services Union; • CEPU; 22 Finally, the list included various documents, email addresses and other items or words, as follows: • Notice to Produce; • "Notice of Intention to Proceed by Summons"; • Document destruction; • Harrington's Bobcat and Excavation Hire; • "Urgent"; • "Clean-up"; • $770.00; • " Excavator"; • "Tip Truck"; • "Dump"; • "Ipswich"; • "New Chum"; • "burn"; • 134 DAR; • Ben James FLANAGAN; • Terry LITTLE; • Caribbean Contractors, PTY LTD; • G.James Glass and Aluminium PTY LTD; • mravbar@qld.cfmeu.asn.au; • brad@plumbersunion.qld.com; • moconnor@cfmeunat.org; • Telecommunications service 0417197118; • Any telecommunications service or device suspected of being used for CFMEU business or that is suspected of providing evidence in relation to the offence. 23 The third condition described the details of three indictable offences, as follows: That between 30 March 2014 and 5 April 2014 at Brisbane in Queensland, Michael John RAVBAR born 1 March 1967, David Arthur HANNA born 5 October 1964, and Paula MASTERS born 12 February 1955, knowing that a book / document / thing is or may be required in evidence in a judicial proceeding, namely the Royal Commission Into Trade Union Governance and Corruption, being a federal judicial proceeding, destroyed that book / document / thing with the intention of preventing it from being used in evidence, contrary to subsection 39(1) of the Crimes Act 1914(Cth). That between 30 March 2014 and 5 April 2014 at Brisbane in Queensland, Michael John RAVBAR born 1 March 1967, David Arthur HANNA born 5 October 1964, and Paula Ellen MASTERS born 12 February 1955 did an act namely disposing of approximately 6 tonnes of documents which resulted in a document namely Notice of Intention to Proceed by Summons being destroyed and the said defendants were reckless as to whether the said document was one that may be required as evidence before a Commission namely the Royal Commission into Trade Union Governance and Corruption. That between 26 August 2015 and 3 September 2015 at Brisbane in Queensland, Michael John RAVBAR born 1 March 1967 being a person who was served with a notice under subsection 2(3A) of the Royal Commissions Act 1902 failed to produce a document namely "Notice Of Intention To Proceed By Summons" that the said defendant was required to produce in accordance with the said notice. 24 Immediately after this third condition, the warrant stated: Together with any storage medium or storage device which contains any of the above things and any manual, instruction, password or other thing which is needed to gain access to or interpret or decode any of the above things. 25 It then stated: I hereby issue this warrant which authorises you to enter and search the premises described above. 26 On its second-last page, the warrant contained the following note: This warrant is issued in recognition that a claim for legal professional privilege may be made in respect of documents covered by this warrant and on the understand that, if that occurs, the executing officer will, as far as is reasonably practicable, follow the course of action set out in the document entitled "Claims for Legal Professional Privilege: Premises other than those of a Lawyer, a Law Society, or Like Institution" a copy of which is attached to this warrant. 27 At this point, it is convenient to note that the AFP has acknowledged that the warrant did not in fact have this document attached to it. I will return to this issue later in these reasons.

Part IAA of the Crimes Act 28 The provisions of Part IAA of the Crimes Act and, in particular, Division 2 (ss 3E to 3S inclusive), which relates to search warrants are complex. It is therefore necessary to set out the details of the provisions of that Division insofar as they are relevant to the determination of this matter. 29 Section 3E of the Crimes Act is the provision that empowers an issuing officer to issue a search warrant. It relevantly provides: When search warrants can be issued (1) An issuing officer may issue a warrant to search premises if the officer is satisfied, by information on oath or affirmation, that there are reasonable grounds for suspecting that there is, or there will be within the next 72 hours, any evidential material at the premises. … (5) If an issuing officer issues a warrant, the officer is to state in the warrant: (a) the offence to which the warrant relates; and (b) a description of the premises to which the warrant relates or the name or description of the person to whom it relates; and (c) the kinds of evidential material that are to be searched for under the warrant; and (d) the name of the constable who, unless he or she inserts the name of another constable in the warrant, is to be responsible for executing the warrant; and (e) the time at which the warrant expires (see subsection (5A)); and (f) whether the warrant may be executed at any time or only during particular hours. … (6) The issuing officer is also to state, in a warrant in relation to premises: (a) that the warrant authorises the seizure of a thing (other than evidential material of the kind referred to in paragraph (5)(c)) found at the premises in the course of the search that the executing officer or a constable assisting believes on reasonable grounds to be: (i) evidential material in relation to an offence to which the warrant relates; or (ii) a thing relevant to another offence that is an indictable offence; or (iii) evidential material (within the meaning of the Proceeds of Crime Act 2002) or tainted property (within the meaning of that Act); if the executing officer or a constable assisting believes on reasonable grounds that seizure of the thing is necessary to prevent its concealment, loss or destruction or its use in committing an offence; and (b) whether the warrant authorises an ordinary search or a frisk search of a person who is at or near the premises when the warrant is executed if the executing officer or a constable assisting suspects on reasonable grounds that the person has any evidential material or seizable items in his or her possession. 30 The expression "evidential material" (see (1) and (5)(c) above) is defined in s 3C(1) to mean: "a thing relevant to an indictable offence or a thing relevant to a summary offence, including such a thing in electronic form". 31 Section 3F confers authority on the executing officer or a constable assisting him or her to execute a warrant and it also prescribes certain limits to that authority. In particular, s 3F(1) provides the executing officers with the following authority: A warrant that is in force in relation to premises authorises the executing officer or a constable assisting: (a) to enter the warrant premises and, if the premises are a conveyance, to enter the conveyance, wherever it is; and (b) to search for and record fingerprints found at the premises and to take samples of things found at the premises for forensic purposes; and (c) to search the premises for the kinds of evidential material specified in the warrant, and to seize things of that kind found at the premises; and (d) to seize other things found at the premises in the course of the search that the executing officer of constable assisting believes on reasonable grounds to be: (i) evidential material in relation to an offence to which the warrant relates; or (ii) evidential material in relation to another offence that is an indictable offence; or (iii) evidential material (within the meaning of the Proceeds of Crime Act 2002) or tainted property (within the meaning of that Act); if the executing officer or a constable assisting believes on reasonable grounds that seizure of the things is necessary to prevent their concealment, loss or destruction or their use in committing an offence; and (e) to seize other things found at the premises in the course of the search that the executing officer or a constable assisting believes on reasonable grounds to be seizable items; and (f) if the warrant so allows - to conduct an ordinary search or a frisk search of a person at or near the premises if the executing officer or a constable assisting suspects on reasonable grounds that the person has any evidential material or seizable items in his or her possession. 32 In relation to this provision, it is to be noted that: (a) the authority to search and seize under it is limited by subsection (1)(c) to "the kinds of evidential material specified in the warrant"; (b) however, the authority to seize is extended by subsections (1)(d) and (e) to "other things found at the premises in the course of the search" subject to the executing officers believing certain things "on reasonable grounds"; (c) in the case of subsection (1)(d), the reasonable grounds for belief must relate to the evidential materials described in subsections (i) to (iii); (d) in the case of subsection (1)(e), the reasonable grounds for belief must relate to "seizable items". That expression is defined in s 3C(1) to mean: "anything that would present a danger to a person or that could be used to assist a person to escape from lawful custody". 33 Section 3H requires that the details of the warrant must be made available to the occupier of any premises concerned, if they are present. Related to this requirement, s 3P relevantly provides that the occupier of premises is entitled to be present during a search. 34 Section 3K permits the executing officers to take equipment to the warrant premises for the purposes of conducting the search and in, certain circumstances, to move things found at the premises to another place. 35 Section 3L is central to the first of the CFMEU's challenges above (at [7]). It sets out the circumstances where the executing officer or constable assisting the execution of the warrant may, among other things: use electronic equipment at the warrant premises, copy data and remove the copy from the premises; and seize electronic equipment and remove it from the premises. It is appropriate to set that section out in full as follows: (1) The executing officer of a warrant in relation to premises, or a constable assisting, may operate electronic equipment at the warrant premises to access data (including data not held at the premises) if he or she suspects on reasonable grounds that the data constitutes evidential material. (1A) If the executing officer or constable assisting suspects on reasonable grounds that any data accessed by operating the electronic equipment constitutes evidential material, he or she may: (a) copy any or all the data accessed by operating the electronic equipment to a disk, tape or other associated device brought to the premises; or (b) if the occupier of the premises agrees in writing - copy any or all of the data accessed by operating the electronic equipment to a disk, tape or other associated device at the premises; and take the device from the premises. (1B) If: (a) the executing officer or constable assisting takes the device from the premises; and (b) the Commissioner is satisfied that the data is not required (or is no longer required) for a purpose mentioned in section 3ZQU or for other judicial or administrative proceedings; the Commissioner must arrange for: (c) the removal of the data from any device in the control of the Australian Federal Police; and (d) the destruction of any other reproduction of the data in the control of the Australian Federal Police. (2) If the executing officer or a constable assisting, after operating the equipment, finds that evidential material is accessible by doing so, he or she may: (a) seize the equipment and any disk, tape or other associated device; or (b) if the material can, by using facilities at the premises, be put in documentary form - operate the facilities to put the material in that form and seize the documents so produced. (3) A constable may seize equipment under paragraph (2)(a) only if: (a) it is not practicable to copy the data as mentioned in subsection (1A) or to put the material in documentary form as mentioned in paragraph (2)(b); or (b) possession by the occupier of the equipment could constitute an offence. (4) If the executing officer or a constable assisting suspects on reasonable grounds that: (a) evidential material may be accessible by operating electronic equipment at the premises; and (b) expert assistance is required to operate the equipment; and (c) if he or she does not take action under this subsection, the material may be destroyed, altered or otherwise interfered with; he or she may do whatever is necessary to secure the equipment, whether by locking it up, placing a guard or otherwise. (5) The executing officer or a constable assisting must give notice to the occupier of the premises of his or her intention to secure equipment and of the fact that the equipment may be secured for up to 24 hours. (6) The equipment may be secured: (a) for a period not exceeding 24 hours; or (b) until the equipment has been operated by the expert; whichever happens first. (7) If the executing officer or a constable assisting believes on reasonable grounds that the expert assistance will not be available within 24 hours, he or she may apply to an issuing officer for an extension of that period. (8) The executing officer or a constable assisting must give notice to the occupier of the premises or his or her intention to apply for an extension, and the occupier is entitled to be heard in relation to the application. (9) The provisions of this Division relating to the issue of warrants apply, with such modifications as are necessary, to the issuing of an extension. (Emphasis added; note omitted) 36 It is to be noted that subsections (1) and (1A) are premised on the executing officers suspecting on "reasonable grounds" that the data in question constitutes evidential material. It is also important to note that (under subsection (1A)), where an executing officer has that suspicion, he or she may copy "any or all" of that data. The amendment to add these words was passed after the decision in Kennedy. 37 Section 3LA(1) allows a constable to apply to a magistrate for an order requiring a specified person to provide any information or assistance that is reasonable and necessary to allow the constable to, among other things, access data held in, or accessible from, a computer or data storage device that is on warrant premises, or to copy data held in, or accessible from, such a computer. Section 3LA(2) sets out the matters about which a magistrate has to be satisfied before granting such an order.

The execution of the warrant 38 Approximately 20 AFP and QPS officers were involved in the execution of the warrant. They were all members of the Task Force. In preparation, they attended an operational briefing at the Brisbane Airport office of the AFP on 18 November 2015. Federal Agent Demitriou conducted that briefing. Many of those officers have filed affidavits in this proceeding. Their versions of the pertinent events of that day, as recounted in those affidavits, are described in the following paragraphs. 39 For the purpose of executing the warrant, Superintendent Mark Reid was the Senior Investigating Officer. He is a QPS police officer. In his affidavit, he said that his role on the day was to: ... overview the operation and to act as the point of contact with members of the CFMEU during the execution of the warrant. Part of my role was the management of the policing response, the safety of the police contingent during the search and the safety of the persons occupying the premises during the search. 40 The Task Force contingent arrived at the front counter of the CFMEU premises at about 7.30 am. When they first arrived, the only person present was a Ms Kristy White. She initially refused to allow the officers to enter the premises, so they gained entry by removing the bars on the front counter and opening a glass door into the main area of the premises. Federal Agent Ah Loy then located Ms White in a room at the rear of the premises. He provided her with a copy of the warrant and persuaded her to go to the lunch room so that he could read it to her. As that was occurring, a number of CFMEU personnel entered the premises. 41 At about 8.00 am, Mr John Payne entered the lunch room and spoke to Federal Agent Ah Loy. Mr Payne is a Principal of Hall Payne Lawyers, the lawyers representing the CFMEU. He replaced Ms White and Federal Agent Ah Loy continued to read the warrant to him. Soon after that process was completed, Federal Agent Ah Loy served a s 3LA order on Ms Leanne Butkus. Ms Butkus was the CFMEU's office manager. That order had been issued under s 3LA of the Crimes Act (see at [37] above) concurrently with the issue of the warrant. It required Ms Butkus to provide information and assistance to allow access to the data held in the computers and other data storage devices on the premises. 42 Superintendent Reid said that, while the warrant was being executed, he had with him a digital tape recorder. He said he used that so that he could obtain an accurate record of his activities while the warrant was being executed. In addition, during the conversations he had with Mr Payne, Federal Agent Demitriou said he used an audio recording device to record those conversations. It was from these recordings that the specific times of the conversations that occurred on 19 November were identified. 43 In his capacity as the Senior Investigating Officer, Superintendent Reid said that he had a conversation with Mr Payne about the management of the process associated with the execution of the warrant. In particular, he said: At 8.26am I had a conversation with Mr Payne about the management of the search to ensure procedural fairness in the collection of evidentiary material. Mr Payne said words to the effect that he agreed with the proposal that he would provide one of his staff to accompany each of the search teams to overview the search process for the purposes of transparency. He further said words to the effect that he agreed that this would expedite the search process. 44 Superintendent Reid delegated Federal Agent Ah Loy "to remain on site in the general office area to manage all documentation located during the search". As for Federal Agent Demitriou, he said that he delegated him "to manage the examination of the CFMEU file server on the second floor". Superintendent Reid described this examination in these terms: "The process for the examination of the file server placed a member of the CFMEU legal team in a position to overview the copying of the computer files in an attempt to take only files deemed to be within the scope of the warrant." He said the Digital Forensics Team commenced the interrogation of the CFMEU computer system at about 8.45 am. He said this included an examination of the CFMEU file server situated on the second floor. 45 Federal Agent Demitriou said that he had a discussion with Superintendent Reid and Mr Payne at about 8.38 am where they discussed a process for the execution of the warrant that was acceptable to all parties. During this conversation, Federal Agent Demitriou said he complained to Mr Payne about the delay associated with procuring additional lawyers to attend the premises. In response Mr Payne told him that he had arranged for additional lawyers to attend from his firm and he had also arranged for some lawyers to attend from Howden Saggers, a criminal law firm. In his affidavit, Federal Agent Demitriou said that "About 8:45am Mark REID and John PAYNE had reached final agreement on the search conduct and the search commenced." 46 The lawyers from Hall Payne Lawyers who attended the premises during the day were Mr James Stedman, Ms Talitha Burson, Mr George Southgate and Mr Corey Cullen. Mr Payne, Mr Stedman and Ms Burson made affidavits and gave oral evidence at the trial of this proceeding. 47 As is noted above, Federal Agent Ah Loy's task was to manage the documents and other items of interest located on the general office area on the ground floor of the premises. For that purpose, he said he prepared a map of the premises. He said that as items were seized, they were listed on a Property Seizure Record (PSR) and the location of the item that was seized was cross-referenced to that map. In all, he said he supervised the seizure of 27 items from the ground floor area of the premises. He said the details of all those items were entered on the PSR. 48 The Task Force officers who had a direct role in the copying and seizure of the electronic materials and hard drive were Superintendent Reid, Federal Agent Demitriou and two Senior Digital Forensic Examiners, Mr Gerard Murphy and Mr Matthew Thomson. The latter two officers were employed within the Digital Forensics Team of the AFP in Brisbane. Their duties included "providing assistance to the AFP and external agencies with the examination of computers and other electronic storage media". They were also responsible for "the installation, maintenance and development of equipment and software used during digital forensic examinations". 49 Federal Agent Demitriou was responsible for copying and seizing the four items that are central to this proceeding. He recorded the details of those items on the PSR in the following terms: Item number Complete Description of Item Seized Specific Location of Item Time Located 013 1 x AFP owned WD Passport Drive Containing Email Documents AFP owned hard drive from file server 1518 015 Samsung Hard Drive HD 322GJ Computer tower ground floor office #7 1532 018 One AFP owned WD elements harddrive containing word docs, exel [sic] docs, pdf docs and emails from file server AFP owned harddrive files from server first floor 1615 021 One WD passport harddrive containing exchange database - AFP owned harddrive AFP owned hard drive files from server first floor 1630

50 Turning, first, to (a) (Item 013) and (d) (Item 021) above, Mr Murphy said that, along with Mr Kelioch, an AFP Digital Forensics Examiner, he examined a Dell 720 server that was located in the server room on the second floor of the CFMEU premises. Among other data, this server contained the CFMEU's email database. In order to proceed with his examination, Mr Murphy said it was necessary to shut down the email server and that would suspend the CFMEU's entire email system in Queensland. He said this course was necessary "to minimise the potential for damage or corruption of the email database". However, before proceeding with this shut down, he said he sought a direction from Federal Agent Ah Loy and Superintendent Reid. Having obtained this direction, he said he shut down the email server and commenced to copy the email database. He said he copied the email database from the entire virtual hard disk. He said that the copying process was completed by approximately 12.54 pm (Item 013). However, it became apparent soon thereafter that the copy contained errors and could not be accessed. As a consequence, he said he re-commenced copying that database, this time copying it from within the virtual hard disk. This second attempt was successfully completed later in the afternoon (Item 021). Mr Murphy said that "at no stage were any of the servers copied". Since there is only one server mentioned in the evidence, I take this to mean that he, personally, did not copy any other data from the Dell 720 server mentioned above, apart from the email database. However, there is evidence below that a copy of other parts of the data on that server were copied by other Task Force officers. 51 As to (b) above (Item 015), Mr Thomson said that he examined the computer equipment that was in Mr Ravbar's office on the ground floor of the premises. He said he did that by using digital forensic software to conduct an examination of the contents of the hard drive on that computer. He said he searched for specific email addresses and for specific dates, namely the period from 31 March 2014 to 5 April 2014. He said that during his search he could not identify any emails for that period. He said he then told Mr Murphy about the results of his search. Upon receiving this information, Mr Murphy said he had a conversation with Superintendent Reid, at the conclusion of which he was asked to prepare the hard drive for seizure. 52 Finally, as to (c) above (Item 018), Federal Agent Demitriou said he was informed there were approximately 89,000 files on the CFMEU's file server. Upon hearing this, he said he decided that a keyword search was the most efficient method to narrow the scope of the search of the data on that file server to files containing information relating to the persons, entities and items listed in condition 2 of the warrant (see at [20]-[22] above). He said once those files were identified, the information in them was to be printed into documentary form so that the CFMEU's lawyers could review those documents to decide whether to claim privilege with respect to them. Federal Agent Demitriou said that he informed Mr Payne that he intended to follow this process and Mr Payne replied with words to the effect that he agreed with it. He also confirmed this agreed process in a meeting outside the server room on the second floor at about 10.50 am (see at [75] below). By approximately 3.05 pm, Federal Agent Demitriou said that eight documents had been identified using this process. However, it is apparent from the evidence that this process was abandoned a short time later when Federal Agent Demitriou decided there were reasonable grounds to take and seize a copy of the data on the server. This aspect of the events that occurred in the execution of the warrant is examined in more detail below (see at [77]-[92]).

The issues that arise 53 As indicated earlier (see at [5] and [7]), the CFMEU has raised two challenges arising from the events outlined above. They are: (a) whether the AFP officers had reasonable grounds to copy and seize the electronic materials or to seize the hard drive; (b) whether the AFP officers acted unreasonably by failing to afford the CFMEU an adequate opportunity to claim LPP over the information in the electronic materials and on the hard drive. 54 I will address these issues in turn.

The CFMEU's contentions 55 In advancing this issue, the CFMEU has focused on the necessity under s 3L(1) and (1A) of the Crimes Act for an executing officer to suspect on "reasonable grounds" that the data in question constituted evidential material before he or she may act in the manner authorised by that subsection (see at [35] above). It submitted that Federal Agent Demitriou, the AFP officer who claimed to exercise that authority, did not meet that prerequisite for one or more of the following reasons: a. The data on items 013 and 021 (the email server) was never accessed; b. The data on item 018 (the file server) was not accessed by [Superintendent] Reid who decided to seize the item; c. The decision to seize item 015 (Mr Ravbar's hard drive) was also made by [Superintendent] Reid. He had not accessed the data on the hard drive. The advice he had was that only the OST file on the hard drive contained evidential material.

Section 3L does not require the data to be accessed first 56 In effect, these contentions raise two separate questions. First, with reference to (a) above (the email database: Items 013 and 021), whether an executing officer has to first access the data in question under s 3L(1) before he or she can proceed in the manner authorised by s 3L(1A). Secondly, with reference to both (b) (the file server: Item 018) and (c) (the hard drive: Item 015) above, whether it was in fact Superintendent Reid, and not Federal Agent Demitriou, who had the crucial suspicion on reasonable grounds that the data in question constituted evidential material. 57 On (a) above, there appears to be no issue that Mr Murphy did not access the email database for the purposes of forming the suspicion on reasonable grounds under s 3L(1), but instead he simply proceeded to copy it (see at [50] above). This is so, I assume, because the email database and the evidence it might contain about the commission of the offences described in the third condition to the warrant was self-evidently one of the main objects of the search warrant. Whatever the explanation is, this question was answered in Different Solutions Pty Ltd v Commissioner, Australian Federal Police (No 2) (2008) 190 A Crim R 265; [2008] FCA 1686 (Different Solutions). There, Graham J said (at [93]): It will be appreciated that s 3L(1A) does not require the relevant electronic equipment to be operated nor does it require that evidential material be found which is accessible by operating the equipment before data may be copied to a disk, tape or other associated device brought to the premises by the executing officer or constable assisting. All that is required is that the executing officer or constable assisting "believes" on reasonable grounds "that any data accessed by operating the electronic equipment might constitute evidential material". This of course, does not preclude an executing officer or constable assisting from operating the relevant electronic equipment if he or she holds the requisite belief under s 3L(1) on reasonable grounds. 58 The CFMEU faintly submitted that I should find that Graham J was clearly wrong in this conclusion and I should therefore not follow it. Instead, it submitted I should follow the observations of Flick J in Zhang v Commissioner, Australian Federal Police (2009) 260 ALR 580; [2009] FCA 1170 (Zhang) as follows (at [30]): For the purposes of the present interlocutory application, it is unnecessary to do more than refer to the breadth of the authority conferred by s 3F and to the constraints imposed upon that authority. The authority conferred is that conferred upon the "executing officer or a constable assisting". It is not an authority to seize only that which a court subsequently concludes falls within the terms of the warrant. But the extent of the authority conferred by s 3F is constrained by the requirement that the "executing officer" or "constable assisting" only seize that which he "believes on reasonable grounds" is relevantly either: • "evidential material in relation to an offence to which the warrant relates"; or • "evidential material in relation to another offence that is an indictable offence". In the absence of the "executing officer" or "constable assisting" forming such a belief on "reasonable grounds", the warrant confers no authority to seize anything. No authority has been conferred by the legislature or by the warrants to enter a person's premises and to seize at random documents or things which may be believed to be of interest. There must always remain "reasonable grounds" for the belief set forth in s 3F(1)(d). Authority to seize things other than those described in the warrant (compare Chic Fashions (West Wales) Ltd v Jones [1968] 2 QB 299 at 313; [1968] 1 All ER 229 at 236) is now expressly addressed in s 3F(1)(d)(ii). But that authority also remains confined by the requirement that there be "reasonable grounds" for the belief that is formed and by the requirement that the thing seized be "in relation to another offence that is an indictable offence". 59 I do not accept that submission. First, I do not consider Graham J was clearly wrong in his construction of ss 3L(1) and (1A) in Different Solutions. To the contrary, the conclusion his Honour reached is (with respect) entirely consistent with the text of the provision read in the context of s 3L as a whole. Secondly, I do not consider the observations of Flick J in Zhang are apposite to the construction of these subsections. His Honour's observations were not directed to s 3L, but rather to s 3F. Section 3L is a specific provision which prescribes the manner in which an officer executing a warrant is authorised to access and copy electronic data found during a search. In contrast, s 3F is a general provision which outlines the general authority an executing officer has when executing a warrant. Moreover, in Zhang, Flick J was considering an interlocutory injunction application and whether or not there was a serious question to be tried. In contrast, the conclusion Graham J reached in Different Solutions occurred after a final hearing. I do not therefore consider the CFMEU has made out its challenge in contention (a) above to Federal Agent Demitriou's authority to copy and seize its email database (Items 013 and 021). 60 The CFMEU's contention in (b) above relates to the data on the file server (Item 018). No issue has been raised about prior access to this data similar to that above, presumably because it appears to be common ground that the file server was accessed by Mr Thomson during the execution of the warrant using electronic equipment, namely a computer (see at [51] above). That aside, I consider this contention fails as a matter of fact. As is already alluded to above (at [55]), because the evidence relating to the contentions in (b) and (c) above is interconnected, it is convenient to address both those contentions together.

Some relevant principles 61 Before turning to that evidence, it is convenient to outline a number of principles that bear upon the operation of ss 3L(1), (1A) and (2). 62 First, it is appropriate to set out the meanings of some of the computer terminology that has been used above. "Data", according to the Dictionary of Computing by SMH Collin (5th ed, 2009), is: a collection of facts made up of numbers, characters and symbols, stored on a computer in such a way that it can be processed by the computer … The author added the following important note: Data is different from information in that it is facts stored in machine-readable form. When the facts are processed by the computer into a form that can be understood by people, the data becomes information. To similar effect, see Kennedy at [54]-[56]. 63 Consistent with the meaning and note set out above, "data" is defined in s 3 of the Crimes Act to include: (a) information in any form; and (b) any program (or part of a program). 64 Further, the expression "data held in a computer" is defined in s 3C(1) of the Crimes Act as including: (a) data held in any removable data storage device for the time being held in a computer; or (b) data held in a data storage device on a computer network of which the computer forms a part. 65 Finally, the expression "data storage device" is defined in s 3 to mean "a thing containing, or designed to contain, data for use by a computer". 66 Secondly, in challenging the legality of the AFP's actions in executing this warrant, the CFMEU bears the onus: see Kennedy at [85]-[86]. 67 Thirdly, ss 3L(1A) and 3L(2) distinguish between the acts of copying data onto a device brought onto the premises for that purpose and removing that device from the premises and seizing "equipment and any disk, tape or other associated device" and taking that from the premises, respectively: cf Hart v Commissioner of Australian Federal Police (2002) 124 FCR 384; [2002] FCAFC 392 (Hart) at [78] where a similar distinction was made between s 3K(2) and s 3L(1A). However, as Branson J noted in Kennedy (at [108]), this distinction has been blurred since Hart was decided by the insertion in s 3N(2)(a) of a reference to a thing being "seized" under s 3L(1A). 68 Fourthly, the pertinent question under s 3L(1) and (1A) is whether the executing officer or constable assisting "suspects on reasonable grounds" that the data in question constitutes evidential materials. As to what constitutes a suspicion in this context, in George v Rockett (1990) 170 CLR 104 at 115-116, the High Court observed that: Suspicion, as Lord Devlin said in Hussien v. Chong Fook Kam, "in its ordinary meaning is a state of conjecture or surmise where proof is lacking: 'I suspect but I cannot prove.'" The facts which can reasonably ground a suspicion may be quite insufficient reasonably to ground a belief, yet some factual basis for the suspicion must be shown. In Queensland Bacon Pty. Ltd. v. Rees, a question was raised as to whether a payee had reason to suspect that the payer, a debtor, "was unable to pay [its] debts as they became due" as that phrase was used in s. 95(4) of the Bankruptcy Act 1924 (Cth). Kitto J. said: "A suspicion that something exists is more than a mere idle wondering whether it exists or not; it is a positive feeling of actual apprehension or mistrust, amounting to 'a slight opinion, but without sufficient evidence', as Chambers's Dictionary expresses it. Consequently, a reason to suspect that a fact exists is more than a reason to consider or look into the possibility of its existence. The notion which 'reason to suspect' expresses in sub-s. (4) is, I think, of something which in all the circumstances would create in the mind of a reasonable person in the position of the payee an actual apprehension or fear that the situation of the payer is in actual fact that which the subsection describes - a mistrust of the payer's ability to pay his debts as they become due and of the effect which acceptance of the payment would have as between the payee and the other creditors." (Footnotes omitted) 69 Fifthly, the expression "reasonable grounds" was explained by Hely J in Adler v Gardiner (2002) 43 ACSR 24; [2002] FCA 1141 (Adler) as follows (at [39]): The notion of reasonable grounds for a suspicion imports an objective test, but "reasonable" involves a value or normative judgment (Greiner v Independent Commission Against Corruption (1992) 28 NSWLR 125 at 167), and there may well be legitimate differences of opinion as to what falls within the term, particularly when it is used in relation to a nebulous expression such as "suspicion". A court is not entitled to substitute its own opinion on that question for the opinion of the executing officer or constable assisting. That does not mean that the executing officer, or constable assisting, has an unexaminable discretion; it does mean, however, that the officer's decision is only impeachable if the decision was one which the officer could not lawfully reach on the materials before him or her: Minister for Immigration & Ethnic Affairs v Wu Shan Liang (1996) 185 CLR 259 at 275-276 ... See also Kennedy at [84]-[87]. 70 Sixthly, the expression "afford evidence" (see at (b) above) was also explained by Hely J in Adler as follows (at [20]): The submission misconceives the reach of the expression "afford evidence". Bearing in mind that the power to issue a search warrant is in aid of a criminal investigation, a thing may afford evidence as to the commission of an offence, even though it may not be admissible in evidence at a trial: George v Rockett (1990) 170 CLR 104 at 119 ... A thing will afford evidence of the commission of an offence if it assists, directly or indirectly, in disclosing that an offence has been committed, or in establishing or revealing the details of the offence, the circumstances in which it was committed, the identity of the person or persons who committed it or any other information material to the investigation of those matters: George v Rockett, above, at CLR 120 ... The expression "will afford evidence" does not import a requirement that the documents must necessarily be sufficient to achieve a conviction; it is sufficient that they have relevance to or probative connection with, an issue arising upon an allegation of the offence alleged: Parker v Churchill (1985) 9 FCR 316 at 326 ... That includes things which are adjectivally relevant as well as things which are of substantive relevance: Ozzy Tyre & Tube Pty Ltd v Chief Executive Officer of Customs [2000] FCA 891 … at [30]-[31]. See also Kennedy at [88]-[89]. Based upon the distinction between a suspicion and a belief that is highlighted in [68] above and the two sets of observations set out immediately above, I agree with the AFP's contention that there is a "low level of certainty" for the suspicion on reasonable grounds prescribed by ss 3L(1) and (2). 71 Seventhly and finally, the definition of "evidential material" in s 3C of the Crimes Act (see at [30] above) includes the expression "a thing relevant to an indictable offence". That expression is, in turn, defined in s 3 of the Crimes Act as follows: (a) either of the following: (i) anything with respect to which an indictable offence against any law of the Commonwealth or of a Territory has been committed or is suspected, on reasonable grounds, to have been committed; (ii) anything with respect to which a State offence that has a federal aspect, and that is an indictable offence against the law of that State, has been committed or is suspected, on reasonable grounds, to have been committed; or (b) anything as to which there are reasonable grounds for suspecting that it will afford evidence as to the commission of any such offence; or (c) anything as to which there are reasonable grounds for suspecting that it is intended to be used for the purpose of committing any such offence. In this regard, it is to be noted that the "things" and "offences" at the heart of this proceeding are described in considerable detail in the warrant: see at [19]-[23] above.

The contentions on who had the critical suspicion on reasonable grounds 72 On this issue, the AFP relied solely on the evidence of Federal Agent Demitriou. It contended that his evidence showed that he was satisfied that the file server (Item 018) was covered by the terms of the warrant and was properly copied and seized under ss 3L(1A) and 3L(2)(a). I take the word "seized" in this contention to reflect the point noted at [67] above. The AFP made a similar contention with respect to the seizure of the hard drive (Item 015), relying upon s 3L(1A), (2) and (3). 73 The CFMEU contended that Superintendent Reid, and not Federal Agent Demitriou, seized both the file server and the hard drive. In making this contention, it relied upon the evidence of Superintendent Reid and Mr Murphy. Further, as can be seen from (b) above (at [55]), it contended that the file server was seized without authority because it was not accessed by Superintendent Reid, and he could not, therefore, have formed the necessary suspicion on reasonable grounds that the data on it contained evidential material. With respect to the hard drive, it contended (see [55(c)] above) that Superintendent Reid acted on a misunderstanding of the information that had been conveyed to him by Mr Murphy and, as a result, he acted unreasonably. Specifically, it contended that Mr Murphy only advised Superintendent Reid to seize the .OST file and not the whole hard drive. The CFMEU's junior counsel informed me at the trial, without demur from the AFP's counsel, that an .OST file is a sub-set of a hard drive. 74 The pertinent parts of the affidavit evidence of Federal Agent Demitriou, Superintendent Reid, Mr Murphy and Mr Thomson on this issue are set out below.

The evidence on who had the critical suspicion on reasonable grounds

Federal Agent Demitriou's evidence 75 Federal Agent Demitriou's involvement in the execution of the warrant until approximately mid-morning is already described above and does not require repeating. The following evidence specifically relates to the copying and seizure of the data on the file server and the seizure of the hard drive. At approximately 10.50 am, Federal Agent Demitriou said he held a meeting outside the server room on the second floor of the premises. At that meeting, Mr Murphy, Tash (an IT Specialist employed by the CFMEU), Ms Burson and Mr Cullen (two lawyers from Hall Payne) were present. In his affidavit, he described that meeting in the following terms: 59.1 All persons present agreed that the making of copies was prudent given the risk if the live server was accessed. 59.2 That the copying was to allow for forensic analysis and review only at that time and that copies could not be seized; however there was a possibility that should we be left with no choice the copy may be seized at a later time. 59.3 In regards to the file registry/server GERARD MURPHY had advised that he had already identified documents that were potentially relevant to the warrant however prior to any further action on that an investigator would review those files. 59.4 That once a file has been identified by Digital Forensics Team it will then be cross checked by an investigator and decisions made on the file. The team would not physically go through the entire file registry. It will be a targeted search of identified files. 59.5 Once investigators are satisfied they wish to seize a particular file that the CFMEU legal team will be advised and given a chance to review the file as per the agreement reached with the physical documents. 59.6 Should this plan be unachievable for technical or hardware reasons, I reserved the right to seize the entire file registry and server noting that evidential material had already been identified at that stage, however this would be a last resort. 59.7 All parties agree that they are briefed on the intention of the AFP in relation to the searching of electronic material and no further issues were raised. 76 In relation to the Notice of Intention to Proceed by Summons documents (NOITPBS) which were the subject of the third indictable offence described in the third condition of the warrant (see at [23] above), Federal Agent Demitriou said: 44. At about 9:43am I had a conversation with Leanne BUTKUS regarding "Notice of Intention To Proceed By Summons" documents (NOITPBS). Leanne BUTKUS said to me words to the effect "Kristy WHITE generates them on her computer and sends them out" we do not keep or store any hard copies of these documents". I said words to the effect "how do you know who you have and have not summonsed and how do you know who owes money or who has paid if you have no records". John PAYNE interjected and said words to the effect "I'm not sure exactly how this meets the 3rd condition of the warrant". I then again offered the Senior Investigating Officer and the legal team to John PAYNE. He again declined the offer. However he lodged an objection in any case on the "Notice of intention to proceed by summons" documents. This was the first objection raised by John PAYNE … 45. At about 9:50am I had a conversation with Alasdair WATSON a financial analyst assisting the [Task Force] team. We discussed how the CFMEU could have no record of who they have summonsed for payment. We both agreed it does not seem correct that no record at all is kept. 46. I then had a further conversation with Leanne BUTKUS in which I said words to the effect that I had concerns about the absence of any paper records of the summonses for payment. She then said words to the effect "the blank NOITPBS forms are put into the printer and then sent off then a report is generated and this report is held on the computer". … 73. At about 12:25pm I had a conversation with Gerard MURPHY and Marcin KELIOCH from Digital Forensics Team regarding date ranges for the File registry and the email server. I said to them words to the effect "the file registry is relevant back to 2009 for the NOITPBS documents and I am aware that a file should exist as no hard copies are kept and information has been provided that they are done on the computer". GERARD MURPHY then said words to the effect "it may be some time for the search parameters to run through the file registry now that it has been copied and we have a working copy". (Emphasis in original) 77 With respect to the file server (Item 018) and the email database (about which there is no issue on this aspect), he said: 89. At about 3:00pm I said to John PAYNE words to the effect "are we both still happy with the process, the [Digital Forensics] team will now run the second batch of key search words and I will come find you when its ready for review" At this point in time I formed the belief that evidence was located on the file registry and email server. … 91. At about 3:07pm I attended Mr RAVBAR's office when Matthew THOMPSON [sic] said to me words to the effect "I am still trying to find the missing information on the hard drive". I replied with words to the effect "you need to find a way to capture that the files/emails are missing if you can't recover them for possible production in future". 92. At about 3:10pm I had a conversation with Mark REID in which I said words to the effect "the first batch of files has been reviewed and about 8 documents have been identified as relevant "Mark REID replied with words to the effect "I want the Email server and the File registry made ready for seizure. I have been informed that key pertinent periods of relevant to our investigation are missing from the email server and file registry and that this means we are not getting the full picture upon review, the petitioning and review of individual files is to cease as we are most likely not seeing the full registry". 93. At about 3:13pm I attended the server room and said to Gerard MURPHY and Marcin KELIOCH words to the effect "I want to confirm to you that when I reviewed the files with John PAYNE I did identify documents that were relevant to the warrant and investigation so I am satisfied the file registry contains evidential material. Can you prepare the email server and file registry for seizure" KELIOCH responds with words to the effect "the working copy was placed on the lap top to enable review it will take some time to get it off the laptop and onto another storage medium". 94. At about 3:18pm I attended the property room and signed: PSR 380854 for item number 013 being 1X AFP owned WD Passport drive containing email documents from the file server. This item was sealed with AFP seal 544 703. (Emphasis added) 78 Mr Ravbar's hard disk was the subject of discussions between Federal Agent Demitriou, Mr Thomson, Superintendent Reid and Mr Murphy. Federal Agent Demitriou described the details of those discussions as follows: 95. At about 3:25pm I attended Mr Ravbars [sic] office and said to Matthew THOMPSON [sic] words to the effect "are the email and files held on RAVBARS [sic] hard drive also held on the main registry and server?" THOMPSON [sic] replied with words to the effect "I can't be sure. All I can guarantee is that I have some photographs of the missing files. If you want best available evidence then the hard drive itself must be seized from RAVBARS [sic] computer". I then sought out Gerard MURPHY and said to him words to the effect of "hey about the hard drive in RAVBARS [sic] office. Will that need to be seized in order to provide best evidence and to have any chance of recovering the deleted files and emails". MURPHY replied "Yes". 96. At about 3:30pm I said to Mark REID words to the effect "we need to seize the hard drive unit from RAVBAR's computer as well". Mark REID replied with words to the effect "we need to take the hard drive itself if it is best evidence". The hard drive was to be seized in addition to the file registry and email. A few minutes later I sought a final formal position from Gerard MURPHY the Team Leader Digital Forensics Team as a final check that the seizure of the hard drive was 100% necessary. Gerard MURPHY said to me words to the effect "the only possibility of having a chance to recover the deleted material is to do a data carve of the entire hard drive and Digital Forensics Team do not have the capacity to do that on site so it must be seized". I then requested MURPHY to prepare the hard drive for seizure as I was satisfied that it contained evidential material upon it. 97. About 3:32pm I signed PSR 380854 item number 015, James STEADMAN [sic] said words to the effect to me "how can you verify to me that the hard drive contains emails, no one from my legal team know what's on the hard drive". I replied with words to the effect "throughout the day I have had multiple persons from Hall Payne review, question and record items seized by police, I have provided detailed briefs to John PAYNE and other lawyers, if you are suggesting you want to know exactly what's on the hard drive then this is unfeasible, if you wish not to sign for the PSR you are under no obligation to do so". James STEADMAN [sic] then indicated that he wanted the wording of the PST changed to a wording of his choice. I responded with words to the effect "I am the seizing officer and as such I am satisfied with the description annotated upon the PSR and I will not be changing it. 79 Finally, Federal Agent Demitriou summarised the details of the five items he was responsible for copying and seizing in two of the concluding paragraphs of his affidavit, as follows: 106. Annexed to this affidavit and marked TD-1 is a copy of Property Seizure Record (PSR) 380854 - 380855 which record those documents. I was responsible for the decision to seize items 013, 015, 016, 018 and 021. I was satisfied in respect of each item that it was covered by the terms of the warrant and that its seizure was permitted under the warrant. 107. The following electronic items were seized during the search of the premises: 107.1. Item 013 - This refers to an AFP owned hard drive containing email documents from the CFMEU file server. I was satisfied that this item met Condition 1 of the search warrant being; but not limited to "emails and associated meta data, electronic documents and files & Computers, computer hardware and software, computer hard drives'. I was also satisfied that it met condition 2 being but not limited to "CFMEU", "BLF". Further, I had the suspicion that it could provide evidence in relation to the offence listed in condition 3. 107.2. Item 015 - This item refers to a Samsung hard drive. I was satisfied that this item met condition 1 of the search warrant being; but not limited to "emails and associated meta data, electronic documents and files & Computers, computer hardware and software , computer hard drives". I was also satisfied that it met condition 2 being but not limited to "Michael RAVBAR", "CFMEU". Further, I had the suspicion that it could provide evidence in relation to the offence listed in condition 3. 107.3. Item 016 - This item refers to an AFP owned USB containing screen shots of CCTV Cameras. I was satisfied that this item met condition 1 of the search warrant being; but not limited to Closed circuit television storage, recordings, camera positioning, camera field of view information and camera optical capability. I was also satisfied that it met condition 2 being but not limited to "Builders Labours federation", "BLF", "CFMEU". Further I had the suspicion that it could provide evidence in relation to the offence listed in condition 3. 107.4. Item 018 - This item refers to an AFP owned hard drive containing word docs, excel docs, and emails from file server. I was satisfied that these items met Condition 1 of the search warrant being; but not limited to "emails and associated meta data, electronic documents and files, electronic documents and files & Computers, computer hardware and software". I was also satisfied that it met condition 2 being but not limited to "CFMEU", "BLF". Further, I had the suspicion that it could provide evidence in relation to the offence listed in condition 3. 107.5. Item 021 - This item refers to a WD passport hard drive containing exchange database. I was satisfied that this item met Condition 1 of the search warrant being; but not limited to "emails and associated meta data, electronic documents and files & Computers, computer hardware and software , computer hard drives". I was also satisfied that it met condition 2 being but not limited to "CFMEU", "BLF". Further, I had the suspicion that it could provide evidence in relation to the offence listed in condition 3. (Emphasis omitted) 80 No issue has been raised in this matter about Item 016 above.

Superintendent Reid's evidence 81 Superintendent Reid's evidence about the discussions he had with Mr Murphy and the actions he took thereafter is as follows: 21. At 2.45 pm I had a conversation with Mr Gerard Murphy of AFP Digital Forensics Unit Brisbane. Mr Murphy said to me words to the effect that Mr Matt Thompson [sic], a member of his team conducting the examination of the Mr Ravbar's computer hard drive, located in Mr Ravbar's office (ground floor office), had indicated that on the locally cached copy (Ravbar's computer hard drive) that between 31 March and 5 April 2014 no records exist for the email account of Mr Ravbar and that the email traffic consisting of the emails incoming and outgoing appeared to have been removed. Mr Murphy said to me words to the effect that this situation led him to believe there was a gap during that time period, which is the relevant time under investigation by the Task Force relating to the destruction of documents sought by the Trade Union Royal Commission. Murphy's advice to me was to take a copy of the file server (CFMEU file server - second floor computer room) in its entirety in the belief that the information that had been removed could be located through forensic examination. 22. This advice led me to believe that a persons or persons had cleared the Ravbar hard drive in an attempt to destroy information that could support the investigation we were undertaking. Mr Murphy also indicated to me in that same conversation that they had also had some technical difficulties with the copying and viewing of the file server. It was at this time that Mr Murphy stated to me that in his expert opinion a complete copy of the file server should be taken for examination. 23. As a result of the conversation with Mr Murphy, I made the decision, having regard to the terms of the warrant, that a full copy of the CFMEU file server should be seized for examination under more controlled conditions to ensure the best level of evidence was obtained. I then advised Mr Murphy and FA [Federal Agent] Demetriou [sic] that they should make a full copy of the file server. 24. At 4.49pm I had a conversation with Mr Payne in which I said to him words to the effect that previous processes adopted for the reviewing of the computer files had been seized due to the discovery by Digital Forensics that portions of Mr Ravbar's computer had been deleted for the relevant time period 31 March 2014 to 5 April 2014. I further said to him words to the effect that I had received expert advice from Digital Forensics (Mr Murphy 2.45pm conversation) that a full copy of the file server should be seized in an attempt to establish how the data was deleted and by who.

Mr Murphy's evidence 82 Mr Murphy's evidence about his involvement in the execution of the warrant is already described in some detail above (see at [50]-[51]). It is appropriate to set out the following paragraphs of his affidavit because they specify the timing of the discussions he had with Superintendent Reid and Federal Agent Demitriou, among others: 32. At 2:45pm I had a conversation with Matt THOMSON who informed me that he was unable to find any emails on Michael RAVBAR's computer for the time period between 31/3/2014 and 5/4/2014. 33. At 2:55pm I had a conversation with Superintendent REID and informed him of the lack of any emails for that time period and of the problems that we were having with copying the Exchange email database. I informed him that to have the best chance of recovering deleted emails and determining the circumstances surrounding any such deleted emails would be to obtain a copy of the email database and the .OST file from the users local computer. At the conclusion of that conversation Superintendent REID requested that I prepare copies of both for seizure. 34. I was involved in several discussions with Matt THOMSON and FA DEMETRIOU [sic] in relation to the .OST file on the computer in Michael RAVBAR's office. I don't recall the exact conversations but I do recall that in addition to the .OST file there was also material of relevance located in other areas of the hard drive. I was informed by FA DEMETRIOU [sic] that the hard drive was being seized. 35. As a result of the decision to seize the hard drive from Michael RAVBAR's computer a copy of the individual .OST file was not required.

Mr Thomson's evidence 83 As with Mr Murphy's evidence, Mr Thomson's evidence about his involvement in the execution of the warrant is set out in some detail above (see at [51]). However, the following parts of his affidavit are pertinent to the timing of his discussion with Federal Agent Demitriou during the afternoon. 84 Mr Thomson said at about 1.00 pm he had a conversation with Federal Agent Demitriou during which he was requested to identify any emails within the email database that had creation dates between 31 March 2014 and 5 April 2014. He said that when he examined that database he was not able to identify any emails between that period. He said he then had a further conversation with Federal Agent Demitriou during which he was requested to conduct a further examination of the contents of the hard drive for the same purpose. On undertaking that examination, he said he was unable to identify any email files on the hard disk for that period. He said he then informed Federal Agent Demitriou of those results. 85 At approximately 3.30 pm, he said that he had a conversation with Federal Agent Demitriou which related to his examination of the "email and file system artefacts on the … hard disk drive". He said Federal Agent Demitriou then informed him that the hard drive was to be seized. He said he then removed the hard drive from the Hewlett Packard computer and provided it to Federal Agent Demitriou for seizure. 86 He said he left the CFMEU premises at approximately 5.00 pm, along with Mr Murphy and a number of other Task Force members.

Analysis of the evidence on who had the critical suspicion on reasonable grounds 87 I will first deal with the file server (Item 018). The evidence set out above shows that from about 10.50 am Federal Agent Demitriou arranged to put in place a process whereby the file "registry/server" was to be accessed and keyword searches were to be undertaken on it (see at [52] and [75] above). As a result of that process, at about 3.00 pm, Federal Agent Demitriou formed a belief (as emphasised in [77(89)] above) that "evidence was located on the file registry and email server". Related to this belief or suspicion, the evidence above shows that, much earlier in the day, at about 12.25 pm, Federal Agent Demitriou had already formed certain views as to what the data on the file server may reveal about any NOITPBS documents issued by the CFMEU (see at [76(73) above]. Furthermore, Federal Agent Demitriou reiterated his beliefs or suspicions about the presence of evidence on the file server when he summarised the details of the things he had seized in one of the concluding paragraphs of his affidavit (see at [79(107.4)] above). While he used the word "belief" in this and other parts of his affidavit, I take this to mean suspicion. If I am mistaken about this, it matters not because, as is explained at [68] above, a belief is a stronger opinion about the existence of a fact than a suspicion. Taken in context, I consider this evidence supports a finding that Federal Agent Demitriou held the requisite suspicion on reasonable grounds that the data on the file server and email database constituted evidential material. In making this finding, I take into account the matters set out above (at [68]-[70]) and the low level of certainty that applies to the formation of this suspicion. 88 Further, I find that this suspicion was formed prior to the discussion he had with Superintendent Reid at about 3.10 pm (see [77(92)] above) about seizing the file server and the email database. I therefore find it was formed independently of any suspicion Superintendent Reid may have formed about the same matter. Whether or not Superintendent Reid accessed the file server before forming his opinion is therefore immaterial. 89 For these reasons, I consider there is ample evidence to find that Federal Agent Demitriou formed the requisite suspicion on reasonable grounds that the data on the file server constituted evidential material such that he was authorised to copy it under s 3L(1A) of the Crimes Act. Having formed that suspicion, under s 3L(1A)(a) he was authorised to copy any, or all, of that data to a device brought to the premises, namely the AFP-owned hard drive recorded on the PSR. He was further authorised by the concluding words to s 3L(1A) to take that device from the premises. All of these actions were authorised under s 3L(1A). I therefore reject the CFMEU's contentions above with respect to the copying and seizure of the file server. 90 The evidence discloses that a similar series of events occurred in relation to the hard drive. Federal Agent Demitriou's suspicions about the data on the hard drive first came to the fore as a result of the discussions he had with Mr Thomson at about 3.07 pm (see [77(91)] above) and at about 3.25 pm (see [78(95)] above). Leading up to and between these two discussions, it is apparent from the evidence that Mr Thomson accessed the data on Mr Ravbar's computer and ascertained that there were no email records on it for the critical period 31 March to 5 April 2014 (see at [84]-[85] above). The suspicions Federal Agent Demitriou had as a result of these discussions with Mr Thomson were confirmed in a discussion he had with Mr Murphy shortly after his second discussion with Mr Thomson (see at [78(95)] above). Then, at about 3.30 pm, they were further confirmed in a discussion he had with Superintendent Reid. However, it is apparent from his evidence that Federal Agent Demitriou did not finally confirm his suspicions until he had his further discussion with Mr Murphy "as a final check" (see at [78(96)] above). As with the file server, Federal Agent Demitriou reiterated these beliefs or suspicions in the summary set out in one of the concluding paragraphs of his affidavit (see at [79(107.2) above). Mr Murphy's evidence is broadly consistent with Federal Agent Demitriou's on this series of events (see at [82(32)]-[82(35)] above). 91 As with the file server, it appears from the evidence that Superintendent Reid may have formed the same suspicion and drawn the same conclusion independently of Federal Agent Demitriou, following a separate discussion he had with Mr Murphy (see at [81(21)]-[81(22)] above). As with the file server, the basis upon which Superintendent Reid may have formed this opinion is immaterial. Thus, whether or not Superintendent Reid misunderstood something said to him by Mr Murphy is also immaterial. 92 I therefore consider there is also ample evidence to find that Federal Agent Demitriou formed the requisite suspicion on reasonable grounds that the data on the hard drive of Mr Ravbar's computer constituted evidential material such that he was authorised to seize that material under s 3L(2)(a). His authority under that section extended to seizing "the equipment and any disk, tape or other associated device". In this instance, "the equipment" was Mr Ravbar's computer that Mr Thomson had used to access the evidential material. Plainly, the hard drive was a device associated with that computer. He was therefore authorised under s 3L(2)(a) to seize it. The fact it contained within it an .OST file is, in my view, immaterial. Similarly, the fact that he decided to seize only the hard drive and not the whole computer does not, in my view, affect his authority to seize only the former. I should add that the CFMEU did not raise any issue related to the qualification on seizure under s 3L(2)(a) contained in s 3L(3). I therefore reject the CFMEU's contentions above with respect to the seizure of Mr Ravbar's hard drive.

Conclusion 93 For these reasons, I do not consider the CFMEU has made out its challenge (see [53(a)] above) that the AFP officers did not have reasonable grounds to copy and seize the electronic materials or the hard drive.

The issue and the contentions 94 The gist of this second issue (see [53(b)] above) is that the AFP acted unreasonably by failing to adequately accommodate any claims for LPP the CFMEU may have had over the information contained in the data on its file server, in its email database and on Mr Ravbar's hard drive. 95 In particular, the CFMEU submitted that "when the [Task Force] officers informed Mr Payne that they would proceed with seizing the copies of the server the officers did not have in place a process of identifying what particular parts of a mass of electronic data could be the subject of a claim for privilege". 96 The AFP submitted that the CFMEU made no clear and unambiguous claim to LPP over the electronic data or, if it did, it was "insufficiently expressed". It therefore submitted that Mr Payne's evidence that he made such a claim should not be accepted. It contended that, although Mr Payne utilised the AFP protocol in relation to hard copy documents, he did not employ it in relation to the electronic data. With regard to that protocol, the AFP submitted that it "was more than adequate for the purposes of protecting any legal professional privilege asserted" by the CFMEU and that, in putting it forward, it had acted more than reasonably. It submitted that: "If a perfectly appropriate proposal for protecting legal professional privilege is provided to the solicitor representing the occupier and the solicitor, on instructions, deliberately refrains from seeking to make use of it, it cannot be said that the search was … conducted unreasonably." Before turning to examine the evidence pertinent to these submissions, it is convenient to identify the relevant principles bearing upon the resolution of this issue.

The relevant principles are not in dispute 97 There is no dispute in relation to the basic principle. The AFP agreed that "the concept of reasonableness in the execution of a warrant requires that the officer allow the person in possession of the documents a reasonable opportunity to make a claim for legal professional privilege". It quoted from the decision of Branson J in Kennedy in support of this basic principle, as follows (at [96]): It is settled law that, generally speaking, those executing a warrant in respect of premises must ensure that the occupier of the premises has, having had regard to the circumstances surrounding the search, an adequate opportunity to make a claim of privilege (Commissioner of Taxation v Citibank per Bowen CJ and Fisher J at 417). 98 The AFP also cited the judgment of Doyle CJ in Question of Law Reserved (No 1 of 1998) (1998) 70 SASR 281 where his Honour said (at 290) that: I … accept that a police officer should allow an adequate opportunity to make a claim to privilege when the circumstances of the search and intended seizure are such that the police officer exercising the relevant powers should reasonably anticipate that a claim might be made. In other words, the obligation is to allow an adequate opportunity for the claim to be made, and not just to respond reasonably to a claim when made. An obvious illustration is a search of a solicitor's office, the solicitor being absent. Another illustration is a seizure of documents, not from a solicitor, the documents on their face suggesting that they might well be subject to legal professional privilege. It would not be sufficient for the police officers to say that in such a case no claim to privilege was made, and to argue that accordingly they were free to act as if no claim could be made. 99 Finally, the AFP referred to the Full Court decision in JMA Accounting Pty Ltd v Commissioner of Taxation (2004) 139 FCR 537; [2004] FCAFC 274 (JMA Accounting) per Spender, Madgwick and Finklestein JJ. In that matter, the Court considered the lawfulness of the copying and seizure under s 263 of the Income Tax Assessment Act 1936 (Cth) of various documents, including those in email folders and a work file directory on computers at JMA's offices in Brisbane. The Court stated the basic principle applicable to the examination and seizure of privileged documents in the following terms (at [6]): For the prohibition against the examination and seizure of privileged documents to be of any value, there must be some method by which the existence of any claimed privilege can be tested before the documents are read. While the reason for this is so obvious it needs no explanation, it is still useful to refer to the comments of Southey J in re Borden & Elliot v The Queen (1975) 70 DLR (3d) 579 at 585-586, a case involving the execution of a search warrant at a solicitor's office: If the privilege could not be invoked to prevent the seizure and examination of documents under a search warrant, the Crown would be free in any case to seize and examine the files and brief of defence counsel in a criminal prosecution. It would be small comfort indeed to the accused and to his counsel to discover that his only protection in such a case was to prevent the introduction into evidence of the documents that had been seized and examined. Such a result, in my view, would be absurd. 100 The Court emphasised that reasonableness was the touchstone for the exercise of any power to search and seize, as follows (at [16]): The cases also establish three broad propositions concerning the conduct of a search and seizure, each of which is relevant to the outcome of this appeal. First, a person exercising a power to search and seize (such as that conferred by s 263) is only entitled to seize those documents which he is authorised to seize by the relevant power: Crowley v Murphy (1981) 52 FLR 123 at 152 and 155; Carter R, The Law Relating to Search Warrants (1939), pp 69-70. Second, both the search and the seizure must reasonably be carried out: Reynolds v Commissioner of Police of the Metropolis [1985] QB 881 at 889; Bartlett v Weir (1994) 72 A Crim R 511 at 518. Third, the repository of the power must do not more than is reasonably necessary to satisfy himself that he has the documents which he is entitled to seize. 101 Finally, the Court observed that the reasonableness of a search and seizure depended upon the circumstances of each case, as follows (at [27]): One problem which confronted the officers when conducting the search is that they were faced with a vast number of documents to go through. If the officers had looked at each document carefully they would be there for days. In our opinion, such a search is not required by s 263. At the end of the day the only obligation imposed upon the officers was to conduct the search in a reasonable fashion. Whether or not they were acting reasonably depended upon the circumstances of the case. Those circumstances included, among other things, the nature and volume of documents to be examined and their location.

The evidence on the LPP issue 102 The resolution of this issue requires an examination of the evidence of Mr Payne, Federal Agent Demitriou and others relating to this LPP issue. Some parts of that evidence are already set out above. The following paragraphs descend into greater detail.

Mr Payne 103 In support of the CFMEU's application for the interim injunction, Mr Payne made an affidavit in which he said that during the day on 19 November he objected to: (a) the exercise of the warrant at 9.52 am; (b) the breadth of the search of the CFMEU's server at 10.21 am, specifically that the document search went beyond the scope of the third condition in the warrant; (c) all material taken from all computers, server and any other information technology on the CFMEU premises at 10.58 am; (d) the seizure of the file server if the AFP officers could not perform in situ searches at 12.29 pm; and (e) the global copying of the server or the removal of parts of the server from the premises, at 12.35 pm. 104 At the conclusion of that affidavit, Mr Payne described his concerns with respect to the CFMEU's claims to LPP over the data in the file server in the following terms (at [11]): We formally raised an objection at approximately 12:35PM to globally copying the server or removing the server from the premises, specifically with regard to maintaining our client's legal professional privilege on documents that would be contained on the server and other information technology equipment. Put another way, we are concerned that the manner in which electronic material is being accessed may mean that material that is properly the subject of legal professional privilege is being accessed and we cannot contemporaneously make a claim for legal professional privilege over this material. 105 In a further affidavit made for the trial of this matter, Mr Payne said that, at 4.10 pm, he informed Mr Fryer that he was likely to make a claim for LPP over the electronic material. He claimed he told Mr Fryer: We are likely to make a legal professional privilege claim over electronic material. However, as no specific electronic documents have been identified at this point, the documents that we are likely to claim privilege over are unable to be particularised. 106 Under cross-examination, Mr Payne repeatedly said that, on a number of occasions during the day on 19 November 2015, he made a formal claim to LPP over all of the electronic data. He expressly denied merely signalling an intention to make such a claim. He explained that he made the claim to privilege in this form because: I had made the claim in relation to electronic data as broadly as I could make the claim. We didn't have any particular documents to make a specific claim in relation to. There had been a process that had been commenced, but not completed, and the claim could only be made in a general way and that was how I made the claim. 107 Later in his cross-examination, Mr Payne said: "The police were working through and we had a process where it was hoped that documents would [be] able to be individually looked at, but that process stopped." Mr Payne also repeated this claim a number of times in cross-examination. He added that that process ceased at some point later in the day. In response to questioning, he said he did not ask the police officers to stop their investigation so that he could claim LPP. Instead, he said: "I participated in the commencement of a process that was never completed." Finally, Mr Payne said he did not regard the AFP protocol in relation to electronic data as relevant because the agreed process described above only operated with respect to hard copy documents.

Mr Stedman 108 Mr Stedman's evidence in cross-examination was broadly similar to Mr Payne's on this issue, although he did not make a clear distinction between electronic data and other materials. He agreed that the arrangement was that, if a document were identified that might be covered by LPP, he would either make a claim immediately or speak to Mr Payne about making a claim (see further the evidence re his discussion with Mr Fryer at [119] below).

Superintendent Reid 109 Superintendent Reid did not specifically mention the question of legal professional privilege in his first affidavit and while the topic is mentioned in some of the transcripts set out in his second affidavit, there is no discussion of it. However, he did give some evidence which was pertinent to the cessation of the agreed process described by Mr Payne above. He said, about 25 minutes before the Task Force officers left the building at 5.10 pm, he had a conversation with Mr Payne where he told him that "previous processes adopted for the reviewing of the computer files had been seized [sic - ceased] due to the discovery by Digital Forensics that portions of Mr Ravbar's computer had been deleted for the relevant time period 31 March 2014 to 5 April 2014". Superintendent Reid said that he also told Mr Payne that he had received expert advice from a Digital Forensics officer (Mr Murphy at 2.45 pm) that a full copy of the file server should be seized in an attempt to establish how the data had been deleted and by whom.

Federal Agent Demitriou 110 Federal Agent Demitriou's evidence about the advice he received concerning the massive quantity of files on the file server and the process he, Mr Payne and others agreed upon to identify the relevant information in the data, convert it into hard copy form and then allow the CFMEU's lawyers to consider whether to claim LPP in relation to it, is already set out in detail above (see at [52] and [75]). The following evidence relates to various conversations Federal Agent Demitriou had with Mr Payne and others in relation to the general objections Mr Payne made in relation to the seizure of items in general and claims for LPP in particular. 111 During the morning of 19 November, Federal Agent Demitriou said he had a number of discussions with Mr Payne relating to, among other issues, a proposed process to photograph each item as it was seized. During one of those conversations, he said that Mr Payne told him that he objected "to any mirror or copy of the server being taken". Federal Agent Demitriou's account of that discussion and the events immediately thereafter was as follows: 49. At about 10:00am John PAYNE and TASH said to me words to the effect that they object to any mirror or copy of the server being taken and will want copies of whatever is taken. I said words to the effect that I would like any further conversation on the copying of the server to involve the Digital Forensics Team. I then escorted Talitha BURSON and TASH to the server room located upstairs. 50. Upon arriving at the server room I then introduced Simone FRYER (AFP Senior Investigations Advisor) and Marty FRYER (AFP LPP Specialist) and the Digital Forensics Team to Talitha BURSON and TASH. 51. I then went back downstairs and said words to the effect "the AFP Legal representative and LPP specialist are on site and also upstairs outside the server room so if Talitha BURSON has any concerns she has the relevant people at her immediate disposal up in the server room", John PAYNE said to me words to the effect that he was satisfied with this and further said words to the effect "Talitha is one of our better lawyers and very experienced". Tash was a CFMEU employee who had responsibilities for its computer system and Ms Burson is a lawyer who was employed with Hall Payne Lawyers. Curiously, Ms Burson claimed in cross-examination that no LPP-related issues were discussed with her during the day on 19 November. 112 At about 12.40 pm, Federal Agent Demitriou said he had a conversation with Mr Payne and Superintendent Reid about claims for LPP as follows: 75. At about 12:40pm John PAYNE approached Mark REID and me and said words to the effect "I have concerns about LPP on the server I am getting a general objection drafted and texted to me and I will read it directly onto your tapes". Mark REID said words to the effect "it is very difficult if you can't be more specific about what may or may not be LPP", John PAYNE responded with words to the effect "I know and understand that but I can't be any more specific so I can only take a general objection". I then said words to the effect "Should I go get Marty FRYER to come downstairs into the conversation". Mark REID then said words to the effect "that is not required as its impossible to accurately respond to given it is such a broad and general objection", John PAYNE then said words the effect "Look I agree". 113 A short time later, Federal Agent Demitriou confirmed the agreed process that had earlier been put in place (described at [52] and [75] above), as follows: 76. A short time later [after 12.40 pm] I had a conversation with John PAYNE in which I said words to the effect "in relation to your LPP concerns how about when the file registry is ready for review after the key word search that a member of your team or you sit with me and view the files and any files that I flag as evidentiary you will then have an opportunity to raise any LPP concerns over at that time". John PAYNE said words to the effect that he agreed with this process and made no formal claim to me over the file registry. 114 About an hour later, Federal Agent Demitriou said he had a discussion with one of the other Task Force officers, Mr Marty Fryer about Mr Payne's LPP claims. He described that conversation and his understanding arising from it in the following terms: 81. At about 1:35pm I had a conversation with Marty FRYER regarding LPP on the server in which: 81.1. Marty FRYER said words to the effect that John PAYNE had only made an official LPP claim over the one physical document at this stage. 81.2. Marty FRYER said words to the effect that John PAYNE needed to make a formal claim for LPP over the server and file registry and this had not occurred at that stage. 81.3. I said words to the effect that the Digital Forensics Team would continue what was being done but as soon as an official claim for LPP was made on the server this would cease and it would be handled by Marty FRYER in accordance with the LPP protocol. 82. I came away from that conversation believing I could continue with my current course of action in relation to the electronic material reviews and if for any reason John PAYNE or any other person representing the interests of the CFMEU made an official claim for LPP over the electronic material I would immediately cease what was occurring and Marty FRYER would give direction on the isolation of the material and its handling in accordance with the AFP LPP protocols. My understanding was that this would result in the email server/file registry and any other items being isolated from investigators until such time as the LPP protocols had been met. I believed that John PAYNE did not want this to occur at this stage as he preferred to observe the individual items that I may seize as evidentiary material thus allowing him to gain an insight into my investigative strategy and to prepare defences in advance of any potential charges being laid. 115 Notwithstanding this understanding, Federal Agent Demitriou described how he continued to follow the agreed process at least until about 3.00 pm, as follows: 86. At about 2:00pm I attended the server room with John PAYNE to begin a review of the files identified with key word searches from the first batch of key search words from condition 2 of the warrant conditions. I said words to the effect to John PAYNE "as you know it is my intention to identify relevant documents and prior to seizing them give you and your team an opportunity to review them as we have been doing downstairs". A review of the first batch of files then began with John PAYNE. 87. A short time later I identified a file that I may have wished to seize. A member of the Digital Forensics Team I believe Matthew THOMPSON (sic) showed me and John PAYNE how to tag files and at the end they could place all the flagged files on one disk or drive for further review and seizure. … 89. At about 3:00pm I said to John PAYNE words to the effect "are we both still happy with the process, the DFT team will now run the second batch of key search words and I will come find you when its ready for review" At this point in time I formed the belief that evidence was located on the file registry and email server. 116 The timing of and circumstances in which the agreed process was ceased are described by Federal Agent Demitriou as arising, first, from his decision to take a copy of the email database and file server and, secondly, his subsequent decision to seize Mr Ravbar's hard drive. The conversations and events that led to those two decisions occurred between approximately 3.00 pm and 3.30 pm. They have already been described in some detail and analysed above (at [77]-[92]), so it is not necessary to repeat that exercise here. However, it is pertinent to record a conversation Federal Agent Demitriou had with Mr Payne shortly before the Task Force officers left the building where Mr Payne complained about not being informed about the decision to seize the file server. Federal Agent Demitriou described that conversation and a subsequent one between Mr Payne and Superintendent Reid when he was present, as follows: 103. At about 4:45pm John PAYNE said to me words to the effect "no one shared with me that you had made a decision to seize the server" I responded with words to the effect "I will refer you to the SIO" I was then present when PAYNE and REID had a conversation about the seizure of the electronic material. The conversation then turned to how the seizure of the server is recorded. I said words to the effect to PAYNE "the property is recorded on the PSR just like all other items and that a member of your team is reviewing all items as listed on the PSR. Come with me I will show you" I then took John PAYNE to the property room where James STEDMAN had been observing all seizures. John PAYNE appeared to be satisfied that all items were recorded. (Errors in original)

Mr Fryer's evidence and the AFP's protocols 117 Mr Martin Fryer was the Task Force officer whose role was to deal with any LPP claims that may be made with respect to any items located during the execution of the warrant. His role included engaging with Mr Payne and coordinating the procedures and protocols for any such claims. 118 In his affidavit, Mr Fryer said that during the afternoon Mr Payne told him that he was considering making a claim to LPP over the electronic material. He said he advised Mr Payne to speak with Federal Agent Ah Loy about that claim and he recommended that he review the LPP protocol in relation to electronic material. Apart from this conversation, Mr Fryer claimed that, while he was on the premises, he did not recall Mr Payne ever indicating to him that he was making such a claim. 119 During the execution of the warrant, the AFP provided the CFMEU's lawyers with two protocols which set out procedures for dealing with claims to LPP. Those protocols were entitled "Legal professional privilege: AFP procedure for dealing with claims over material stored on electronic devices" and "Legal professional privilege: AFP procedure for dealing with claims over hard copy documents". The latter protocol in relation to hard copy documents was provided to Mr Stedman by Mr Fryer at approximately 12.30 pm. Mr Stedman said he received the former protocol in relation to electronic material from Ms Weimer, Legal Counsel for the AFP, by email at approximately 2.08 pm. That protocol appears to have been provided as a result of an earlier request Mr Payne made of Mr Fryer. Mr Stedman and Mr Fryer said that during the day the protocol relating to hard copy documents was used to record claims for LPP that were made in relation to a number of documents. There is no evidence that the other protocol relating to electronic materials was used. 120 Despite this, since the AFP placed particular reliance on it, it is appropriate to record the salient parts of that protocol. The first page of it contained the following statement: The AFP acknowledges that the Occupier of the premises (the Occupier) wishes, or may wish, to make a legal professional privilege (LPP) claim over material which is included in the data listed in Categories A and B. This document outlines the AFP's procedures for dealing with electronic data while preserving the Occupier's claims for LPP. The Occupier acknowledges receipt of this document and agrees that the Occupier or their legal representative will respond to the AFP within 4 days, that is by [insert date] to advise which option or options they propose to adopt for quarantining data. (Emphasis omitted) 121 The three options under which data was to be quarantined for the purposes of making claims for LPP as outlined in that protocol were as follows: The options which may be used to quarantine data are as set out in Procedure 1, 2 and 3 below. These options are not mutually exclusive and do not preclude the Occupier from advising the AFP that they wish to use a combination of procedures to quarantine data which may be the subject of an LPP claim. Procedure 1 - AFP reviews data and quarantines material which may be subject to LPP claim 7.1 Unless the Occupier or their representative notifies the AFP in writing by 11 am four days after completion of the search, that is by [insert date], that they wish to adopt procedures 2 or 3, the AFP will adopt the following procedure to quarantine LPP data: (a) On the fifth day after the search, that is by [insert date], AFP Digital Forensics will release the data to AFP Investigators who will commence reviewing the data on the basis that the Occupier does not waive LPP over any of the material that may be subject to a claim of LPP (in whole or in part). (b) If AFP Investigators identify any material that appears, on its face, to be potentially subject to a claim of LPP by the Occupier (Potential LPP Material), the Potential LPP Material will be quarantined from the remainder of the data and not further examined by AFP Investigators pending next steps in the procedure. (c) The AFP will notify the Occupier in writing of all Potential LPP material identified during the examination process and provide an electronic spreadsheet of that material to the Occupier, and, if requested as per paragraph 6, provide a copy of the data. (d) Within 14 days of being notified about the Potential LPP Material, the Occupier will return the electronic spreadsheet updated with particulars of any LPP claims that they wish to make over the Potential LPP material or over any other data (the LPP List). The LPP List is to include the details identified in Annexure A to this agreement. (e) Potential LPP Material over which there is no claim will be released by AFP Digital Forensics to AFP Investigators for review on the basis that no LPP claim has been made by the Occupier over this material. (f) If no LPP list is received within 14 days (or any later time agreed in writing by the AFP), AFP Investigators will review all of the Potential LPP material on the basis that no LPP claim has been made by the Occupier in respect of that material. (g) Any material identified on the LPP List will be dealt with in accordance with paragraph 8. Procedure 2 - Occupier provides LPP search terms to the AFP to search for and quarantine material which may be subject to a LPP claim 7.2 If the Occupier or their representative notifies the AFP in writing by 11am 4 days after completion of the search, that is by [insert date] that they want Procedure 2 to be followed: (a) AFP Investigators will not review the data prior to the expiry of 7 days after receiving notification that the Occupier wants to follow Procedure 2. This does not preclude AFP Digital Forensics from processing the data so that it is in a suitable form to be searched. (b) Within these 7 days the Occupier will provide to the AFP a list of effective search terms (the LPP Search Terms) to identify Potential LPP Material. (c) The LPP Search Terms will include names and email addresses of solicitors or barristers involved in providing legal advice and key subject words. (d) The AFP may ask for additional LPP Search Terms if AFP Digital Forensics assesses that the search terms provided will not be effective in isolating data. (e) Upon receipt of the LPP Search Terms AFP Digital Forensics will search for and quarantine data which may be subject to a LPP claim (Potential LPP material). (f) The Occupier or their representative may request to be present and assist during the searching and quarantining process. (g) Once the Potential LPP Material is quarantined, the data that has not been quarantined will be released by AFP Digital Forensics to AFP Investigators for examination. AFP Investigators will adopt Procedure 1 in reviewing this material. (h) AFP will provide an electronic spreadsheet of all Potential LPP material identified during the quarantining process to the Occupier for the purpose of review, and, if requested, a copy of the data. (i) Within 14 days of being notified about the Potential LPP Material, the Occupier will return the electronic spreadsheet updated with particulars of any LPP claims that they wish to make over the Potential LPP Material or over other the other data (the LPP List). The LPP List is to include the details identified in Annexure A to this agreement. (j) Potential LPP Material over which there is no claim will be released by AFP Digital Forensics to AFP Investigators for review on the basis that no LPP claim has been made by the Occupier over this material. (k) If no LPP list is provided to the AFP within 14 days (or any later time agreed in writing by the AFP), AFP Investigators will review all of the Potential LPP material on the basis that no LPP claim has been made by the Occupier in respect of that material. (l) Any material identified on the LPP List will be dealt with in accordance with paragraph 8. Procedure 3 - Occupier reviews data and notifies AFP of material which is subject to a LPP claim 7.3 If the Occupier or their representative notifies the AFP in writing by 11am 4 days after completion of the search , that is by [insert date] that they want Procedure 3 to be followed: (a) If a copy of the data has not already been provided, the AFP will provide a copy of the data to the Occupier or their representative. If a copy is to be provided, the AFP may ask the Occupier to provide a storage device for the data. The AFP will also provide an electronic spreadsheet containing, among other things, file names and MD5 hash values. (b) AFP Investigators will not review the data for 14 days after the Occupier receives a copy of the electronic data. This does not preclude AFP Digital Forensics from processing the data so that it is in a suitable form to be searched. (c) Within 14 days after receiving a copy of the data, the Occupier must provide to the AFP an electronic spreadsheet identifying any material contained within the data in respect of which a claim of LPP is asserted, in whole or in part (the LPP List). The LPP List is to include the details identified in Annexure A. (d) AFP Investigators will review data other than that identified on the LPP List, on the basis that no claim of LPP has been made in respect of such material. (e) If no LPP is provided to the AFP within 14 days (or any later time agreed by the AFP), AFP Investigators will review all of the data on the basis that no claim of LPP has been made by the Occupier in respect of any of that material. (f) Any material identified on the LPP List will be dealt with in accordance with paragraph 8.2 below. (Emphasis omitted) 122 The procedure under which any claims to LPP were to be assessed and resolved was described in the protocol as follows: 8.1 AFP Investigators will not review the content of any material on the LPP List other than in accordance with paragraph 8.2 below. 8.2 In respect of any material identified on the LPP List: (a) The AFP will assess any claims for LPP in good faith and promptly identify any material in respect of which a claim is accepted or not contested. AFP Investigators will not review or rely on any such material and, as practicable, AFP Digital Forensics will maintain it as quarantined data, delete it or return it to the Occupier. (b) The AFP may request any additional information in respect of any material identified on the LPP List that is reasonably necessary for the AFP to determine whether a claim of LPP is justified. (c) The AFP may dispute any claim of LPP in respect of any material identified on the LPP List. (d) The AFP and the Occupier will both act in good faith and use their best endeavours to seek to resolve any dispute claims of LPP, including, by agreement, appointing an independent arbitrator to assess documents and determine whether they are privileged. (e) If, following reasonable attempts to resolve any disputed claims of LPP, the AFP notifies the Occupier in writing that it does not accept a claim of LPP in respect of any material identified on the LPP List, the Occupier may commence proceedings to establish the privilege claimed. (f) If the Occupier commences such proceedings within 7 days of such notice being provided, the AFP will not review the relevant material before those proceedings are resolved (including dismissed or discontinued). If the Occupier does not commence such proceedings within 7 days of such notice being provided, the AFP will review the material on the basis that no claim of LPP is maintained in respect of the material.

Analysis of the evidence on the LPP issue 123 This matter once again highlights the complexities associated with executing a search warrant where the executing officer is confronted with a massive quantity of data stored in computers or file servers on the premises being searched. In this case, as is already noted above, the data related to information in 89,000 files. It was therefore necessary, first, for the executing officers to identify what information in that data fell within the terms of the warrant. That stage of the execution of this search warrant has already been closely examined above. There, I have found that Federal Agent Demitriou was ultimately duly authorised to copy and seize the CFMEU's file server, its email database and Mr Ravbar's hard drive (see at [87]-[92] above). 124 This LPP issue concerns the next stage: the executing officers allowing the CFMEU an adequate opportunity to make a claim for LPP with respect to the information so seized. On this issue, it is clear that, on the morning of 19 November, a process was agreed between Federal Agent Demitriou and Mr Payne with respect to the conduct of searches of the electronic data and accommodating claims for LPP in relation to any relevant information identified by those searches (see at [52] and [75] above). To facilitate the latter, the information identified as relevant was produced in documentary form. This process was followed by all concerned from approximately 9.00 am until 3.00 pm and confirmed a number of times in the meantime (see, for example, at [113] above). During that period, eight documents were created from the data with respect to which the CFMEU raised a claim for LPP. Because the information had been converted into documentary form, the AFP's hard copy documents protocol was utilised to deal with those claims. While the AFP's electronic data protocol was made available at approximately 2.08 pm (see at [119] above), it was plainly irrelevant to this process. Thus, there is no evidence it was utilised. 125 Between approximately 3.00 pm and 3.30 pm, Federal Agent Demitriou made two critical decisions. Significantly, immediately before making those decisions, he reconfirmed this agreed process with Mr Payne (see at [115(89)] above). The first decision was that he had sufficient grounds under s 3L(1A) to take a copy of the email database and file server and to remove that copy from the premises (see at [89] above). The second decision was that he had sufficient grounds under s 3L(2)(a) to seize the hard drive on Mr Ravbar's computer (see at [92] above). Together, these two decisions removed the necessity to continue following the process of searching the data in situ using keyword searches to identify information relevant to the conditions stated in the warrant. That, in turn, significantly affected the agreed process for claiming LPP described above. Specifically, the opportunity to make claims with respect to the information in particular hard copy documents printed from the data no longer existed and it therefore became necessary to focus on the privileged information that might exist in the massive quantity of electronic data that had been seized. That, in turn, meant that the protocol relevant to that exercise would change from the hard copy documents protocol to the electronic data protocol. 126 Given the circumstances and significance of these changes to the CFMEU's ability to claim LPP over the information in the data that was seized, I consider that, once they occurred, Federal Agent Demitriou, or someone in authority in the Task Force, was obligated to give notice to Mr Payne that, first, the agreed process no longer applied because all the electronic data in question had been seized and, secondly, and most importantly, that the AFP proposed to follow the electronic data protocol when dealing with claims by the CFMEU to LPP over the information in that data. The need to give the latter notice is underscored by the fact that the electronic data protocol contains a default procedure which applied in the absence of any notice by the occupier of the premises (see Procedure 1 at [121] above). Unless Mr Payne was specifically notified that the electronic data protocol applied, he would not have been aware that this default provision would operate and his client may lose its ability to elect to pursue one of the other two procedures outlined in the protocol (see Procedures 2 and 3 at [121] above). 127 The view that Federal Agent Demitriou and Mr Fryer had (see at [114] above), that Mr Payne was, in the circumstances, obligated to make a "formal" or "official" claim to LPP over the data, was, in my view, erroneous. At that point in time (approximately 2.00 pm), the agreed process was being followed using the AFP's hard copy documents protocol. The need to make a claim over all the electronic data had not arisen and indeed the electronic data protocol had not even been provided to Mr Payne or Mr Stedman (see at [119] above). The need to make such a claim only arose when all the data was seized at about 3.30 pm. In the meantime, Mr Payne was properly following the agreed process in good faith and making claims to LPP pursuant to it. Once Federal Agent Demitriou decided he wished to seize all the electronic data, as I have found he was entitled to do, that necessarily rendered the agreed process nugatory. In that event, I consider he was obligated to give notice to Mr Payne of that fact and accommodate its consequences for the CFMEU's claims for LPP. For these reasons, I reject the AFP's submissions that it was Mr Payne who was obligated to make a clear and unambiguous claim to LPP over the electronic data. Having rejected that submission, it is unnecessary to consider the related contention about whether Mr Payne did in fact make such a claim. It is, however, worth adding that, aside from objecting to the copying of the file server and expressing concern about the AFP taking data from the premises, the evidence does not support a conclusion that he made such a clear and unambiguous claim. This is, of course, entirely consistent with him not realising, because he had not been told, that the entire focus had changed from claiming LPP over particular documents under the agreed process to making a claim to LPP over all the data. In any event, making such a "formal" or "official" claim in relation to such a vast quantity of data would have been meaningless. The real question was not whether the CFMEU wished to pursue such a claim, but what process was to be employed to allow that to happen once all the data had been seized. 128 Mr Payne was not notified that the agreed process no longer applied until a short time before the Task Force officers left the CFMEU premises. As the record of that discussion discloses, he was clearly peeved by that change of position (see at [116] above). More importantly, it is clear he was not notified at that time as to what process the AFP proposed to adopt in its place. If Superintendent Reid or Federal Agent Demitriou had explained to him that they intended to follow the electronic data protocol and reassured him that his client's rights to claim LPP would be respected, my conclusion about the reasonableness of their conduct would have been different. In the absence of such notification or explanation, in all the circumstances outlined above, I do not consider the AFP provided a reasonable or adequate opportunity to the CFMEU to make whatever LPP claims it wished to over the information in the data it had seized. 129 However, I do not consider these failings justify the orders sought by the CFMEU that the AFP should not now be entitled to access and examine any of the electronic data it had seized (see at [10] above). In saying this, I should emphasise that the CFMEU has not claimed that all the data seized is covered by LPP. If it had, the seizure of it may have justified the order sought. That aside, the proposition that a lack of reasonableness of this kind renders a search warrant invalid was rejected by the Full Court in JMA Accounting: see at [11]-[12]. Then, putting aside invalidity, the remedy proposed is not warranted because the CFMEU has not suffered any loss of its right to claim LPP over the information in the data that was seized. The mere seizure of a document or data files without them being read does not destroy any LPP that attaches to it: see JMA Accounting at [13]. Similarly, any cursory reading of the information in such a document or data file would constitute a "lawful violation" and would not therefore destroy any LPP attaching to that information: see JMA Accounting at [14]-[15]. Furthermore, since the morning of 20 November 2015, the interim injunction order has meant that any LPP attaching to any of the information in the data has been protected by court order. Finally, both parties agreed at the trial that, for the future, the Court should put in place a process whereby any claims to LPP the CFMEU may have over any information in the seized data can be made and determined. In this respect, I might add that I do not disagree with the AFP's submissions that the electronic data protocol contained a reasonable procedure for dealing with such claims. For these reasons, I do not consider it would be appropriate to exercise my discretion to make the order sought by the CFMEU. Instead, I consider a process of the kind suggested by the parties at trial should now be put in place.

The failure to attach the LPP document 130 Before concluding, it is necessary to deal with an issue which I alluded to earlier in these reasons. As I recorded above (at [27]), the AFP acknowledged that the document described in the warrant entitled "Claims for Legal Professional Privilege: Premises other than those of a Lawyer, a Law Society, or Like Institution" (see at [26] above) was not in fact attached to the warrant. This gave rise to a contention by the CFMEU that s 3H(1) of the Crimes Act required a copy of the warrant to be made available to the occupier of the premises and, since this document formed a part of the warrant, the failure to attach it to the warrant meant that the executing officer had not met this requirement. It contended that this "may" be sufficient to render the execution of the warrant unlawful. 131 Section 3E(5) and (6) of the Crimes Act (see at [29] above) set out the matters that an issuing officer must state in a warrant in relation to premises. This privilege document is not one of those matters. Moreover, there is no requirement in those subsections, or elsewhere in Part IAA, that requires a warrant to contain a statement about the necessity for an executing officer to allow the occupier of premises an adequate opportunity to claim LPP over any information affected by the search. In Oke v Commissioner of the Australian Federal Police (2007) 168 A Crim R 503; [2007] FCA 27, Mansfield J was required to consider a similar submission in relation to a warrant issued under Part IAA of the Crimes Act. At the outset of his consideration of these issues (at [64]), Mansfield J noted the High Court decision in Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355; [1998] HCA 28 at [91] (per McHugh, Gummow, Kirby and Hayne JJ) to the effect that: An act done in breach of a condition regulating the exercise of a statutory power is not necessarily invalid and of no effect. Whether it is depends upon whether there can be discerned a legislative purpose to invalidate any act that fails to comply with the condition. 132 His Honour also noted that s 3E(5), (6) and (7) specified what must appear in a warrant (see at [72]). After considering these provisions and other matters, he concluded that the failure to attach the privilege document did not render the execution of the warrant unlawful (see at [84]). I respectfully agree with his Honour's reasoning on this aspect. I do not therefore consider that the failure to attach the privilege document to the copy of the warrant that was made available under s 3H(1) of the Crimes Act led to any unlawfulness in the execution of this warrant.

Conclusion 133 For these reasons, I propose to dismiss the CFMEU's second further amended originating application. However, before making that order, I require the parties to produce an agreed set of directions or, failing agreement, to make submissions about a suitable process whereby any claims to LPP the CFMEU may have over any information in the data seized can be made and determined. I will also receive submissions on the question of costs. I certify that the preceding one hundred and thirty-three (133) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Reeves.