This is an application by Sylvia Else ("Ms. Else or the applicant") for administrative review under the Government Information (Public Access) Act 2009 NSW ("the GIPA Act) of a notice of decision of Transport for New South Wales ("Transport NSW or the agency") dated 4 June 2020.
[2]
Relevant Background
On 16 September 2019, Ms. Else made an access application to Transport NSW for information relating to the specification and design of the internal emergency door mechanisms ("IEDR") for different types of trains operated by Sydney Trains. In particular, Ms. Else asked for the following information:
1. Documents relating to the specifications, requirements, design descriptions, implementation details, design reviews, fault analysis, of the internal emergency door release mechanism for the H set, also known as 'Oscar trains'; and
2. As above, but for the K trains, and including documents relating to the decision about whether or not to install internal emergency door release mechanisms on these trains'.
In a notice of decision dated 13 November 2019, Transport NSW identified 40 documents as being within the scope of the access application. It decided to partially release three documents and refused access to the balance of the information on the basis that there was an overriding public interest against disclosure. In its first decision, the agency refused access to the documents on the basis of clauses 1(f), 2(d), 4(c), and 4(d) of the table in s14 of the GIPA Act. It also refused access to two documents (items 1 and 2 to the schedule of its decision) on the basis that the documents were cabinet in confidence, pursuant to clause 2 of schedule 1 of the GIPA Act.
On 8 April 2020, the Information and Privacy Commissioner ("IPC") issued a report recommending that the agency make a new decision under s93 of the GIPA Act. As a general observation, the IPC noted that the agency, in applying the relevant clauses of the table relied upon had not, except for a limited number of documents, identified the specific information in each document which, if disclosed, could reasonably be expected to have the nominated effects.
On 4 June 2020, Transport NSW completed its internal review of Mr. Else's request, following the IPC recommendations, and issued its second notice of decision ("the review decision"). That decision is a reviewable decision under s80(d) of the GIPA Act.
In the review decision, the agency refused to release two documents (items 1 and 2 of the schedule) on the basis they contain cabinet information. Ms. Else does not press her application for access to these documents. The agency provided partial access to three documents after redacting information it said was out of scope under s74 of the GIPA Act. It also identified two documents which it claimed were outside the scope of the access application. The agency refused to disclose the balance of the documents, after applying clauses 1(f), 2(d), 4(c), and 4(d) of the table. Following the recommendations in the IPC report, the agency's review decision considered and applied the relevant clauses of the table relied upon to each item of information in the documents rather than to categories or classes of documents.
Dissatisfied with the agency's review decision, Ms. Else commenced proceedings in the Tribunal for administrative review on 29 June 2020. In her application, Ms. Else contended that the agency had not established that the disclosure of the relevant information could reasonably be expected to have the nominated effects as opposed to theoretical possibilities. She has sought a review of the documents that have been withheld as well as the documents that have only been partially released.
On 23 October 2020, Transport NSW filed three statements in these proceedings and an outline of submissions on 10 November. In these proceedings, the agency no longer relies upon the public interest considerations against disclosure in clauses 4(c) or 4(d) of the table. In addition to clauses 1(f) and 2(d) of the table (relied upon in the review decision), the agency also now relies upon clause 2(f) as a relevant consideration in refusing to release the disputed information.
[3]
The scope of the review
Transport NSW submitted that the only documents in dispute for the purposes of these proceedings are the 31 documents which have been withheld on the basis of an overriding public interest against disclosure. It submitted that the two documents it had determined were not relevant to the access application (namely items [7] and [12]), the three documents it had partially released (namely items [3], [10] and [31]), and the two documents (namely items [1] and [2]) that were subject to the cabinet information presumption were not in issue in these proceedings. In her written submissions, Ms Else stated that she is seeking access to all documents, other than the two documents that contain cabinet information, (namely items [1] and [2]). The scope of the review was not addressed in any detail at the hearing but in any event, as I will explain below under the heading 'the disputed documents:
I am unable to determine the merits of the agency's decision in relation to items [3], [7] and [12].
I have decided to remit item [10] to the agency for reconsideration and suitable redaction.
I have reviewed the contents of item [31] and am satisfied that the document should be withheld from disclosure.
[4]
The Issues
There are three substantive issues for determination in these proceedings:
1. Whether Transport NSW has established that clauses 1(f), 2(d), and 2(f) of the table in s14 of the GIPA Act apply as relevant public interest considerations against disclosure of the various items in this matter;
2. To identify the public interest considerations in favour of disclosure, including any personal factors of the application that can be taken into account;
3. whether the submitted public interest considerations to withhold the disputed information, if made out, outweigh the public interest considerations in favour of disclosure.
[5]
Material before the Tribunal
Transport NSW relied on the following material:
1. A statement from Roy Ale dated 22 October 2020 (including confidential annexures which were tendered in a confidential hearing); a second statement from Mr. Ale dated 24 November 2020. Mr. Ale also gave oral evidence and was cross-examined at the hearing.
2. A statement from Gary James Beavan dated 22 October 2020. Mr. Beavan also gave oral evidence and was cross-examined at the hearing.
3. A statement from William Huon Shipway was filed on 11 November 2020. Mr. Shipway was not required for cross-examination and did not attend the hearing.
4. Written submissions dated 26 October 2020.
5. Further written submissions (dated 24 December 2020) about the confidential documents.
Ms. Else relied on the following material:
1. Her witness statement dated 13 November 2020, which annexed a bundle of PDF documents relating to the emergency brake system. (I will describe these documents in more detail below).
2. Written submissions filed on 18 November 2020.
3. A PDF extract filed on 26 November 2020 entitled 'dead man vigilance'.
Ms. Else was not cross-examined on her evidence.
[6]
Confidentiality
Under s107 of the GIPA Act, the Tribunal must ensure that it does not, in the reasons for decision or otherwise, disclose any information for which there is an overriding public interest against disclosure. The Tribunal must receive evidence and hear argument in the absence of the public, the review applicant, and their representative if in the Tribunal's opinion it is necessary to do so to prevent the disclosure of information for which there is an overriding public interest against disclosure.
Accordingly, I held a confidential session in the absence of Ms. Else and the public. The purpose of the confidential session was to enable the Tribunal to consider the withheld documents that the agency submitted were subject to an overriding public interest against disclosure and the confidential submissions in support of the agency's submissions. I have also considered the agency's further written submissions which were provided on a confidential basis to enable the Tribunal to continue to examine the confidential annexures that were not addressed during the hearing.
I also made an order under s 64 of the Civil and Administrative Tribunal Act 2013 that the material filed by Transport NSW on a confidential basis, and the record of that part of the proceedings conducted in private, are not to be released to the applicant or the public. That order also applies to those sections of these reasons identified as [Not for publication].
[7]
Statutory framework and legal principles
The statutory scheme and applicable legal principles concerning applications under the GIPA Act are well established and not in dispute. In the decision of Veall v Department of Planning and Environment [2018] NSWCATAD 47, Senior Member D Dinnen considered and helpfully summarised the principles in an application for release of information under the GIPA Act (at [7]-[23]) as follows:
Tribunal's jurisdiction and powers
7. The Tribunal's jurisdiction to conduct this review derives from s100 of the GIPA Act read with s 28 of the Civil and Administrative Tribunal Act 2013 (NSW) and s 9 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act).
8. In determining the application, the Tribunal is to decide what the correct and preferable decision is having regard to the material before it: ADR Act, s 63(1). The Respondent bears the onus of satisfying the Tribunal that the decision it has made is the correct and preferable decision: GIPA Act, s 105(1). The Respondent is not limited to defending the matter on the same basis as it made its original decision: Public Service Assn v Premier's Department [2002] NSWADT 277 at [57] and [59].
9. In determining the application, the Tribunal may affirm the decision, vary the decision, set aside the decision and make another decision in substitution for the decision set aside, or set aside the decision and remit the matter for reconsideration by the Respondent in accordance with any directions or recommendations of the Tribunal: ADR Act, s 63(3).
10. In determining the application, the Tribunal is to ensure that it does not, in the reasons for its decision or otherwise, disclose any information for which there is an overriding public interest against disclosure: s 107(1) of the GIPA Act.
The GIPA Act
11. Section 3(1) of the GIPA Act provides:
3 Object of Act (1) In order to maintain and advance a system of responsible and representative democratic Government that is open, accountable, fair, and effective, the object of this Act is to open government information to the public by:
(a) authorising and encouraging the proactive public release of government information by agencies, and
(b) giving members of the public an enforceable right to access government information, and
(c) providing that access to government information is restricted only when there is an overriding public interest against disclosure.
12. Section 3(2)(a) of the GIPA Act requires that the Act be interpreted and applied so as to further that object.
13. Section 5 of the GIPA Act establishes a presumption in favour of disclosure of government information. An access applicant has a legally enforceable right to access the information requested unless there is an overriding public interest against disclosing the information: section 9(1) of the GIPA Act.
14. Section 12 of the GIPA Act sets out the general public interest consideration in favour of access to government information. Section 12(1) of the GIPA Act sets out a general public interest in favour of disclosing government information. Section 12(2) provides that the agency may take into account any other considerations in favour of disclosure which may be relevant.
15. Section 13 of the GIPA Act sets out the public interest balancing test for determining whether there is an overriding public interest against disclosure. The balance is always weighted in favour of disclosure. Before deciding whether to release or withhold information, an agency must apply the public interest test and decide whether or not an overriding public interest against disclosure exists in regard to the information sought. Section 13 requires the decision-maker to:
(1) identify relevant public interest considerations in favour of disclosure,
(2) identify relevant public interest considerations against disclosure,
(3) attribute weight to each consideration for and against disclosure, and
(4) determine whether the balance of the public interest lies in favour of or against disclosure of the government information.
16. The only public interest considerations against disclosure that can be considered are those identified in section 14 of the GIPA Act. This includes considerations set out in schedule 1 to the GIPA Act. Considerations against disclosure will only be relevant if it is established that the disclosure of the information could reasonably be expected to have the effect outlined in the table to section 14 of the GIPA Act. (Omitted).
17. Pursuant to section 105 of the GIPA Act the burden of establishing that the decision is justified lies on the Respondent.
18. The Tribunal is to determine where the balance lies between the public interest considerations for and against disclosure. The balancing exercise "is a question of fact and degree, requiring the weighing of competing matters, and is a task not amenable to mathematical calculation": Battin v University of New England [2013] NSWADT 73 at paragraph [74]. In undertaking this exercise the Tribunal is to be guided by section 15 of the GIPA Act.
19. Section 54 of the GIPA Act requires an agency to take such steps (if any) as are reasonably practicable to consult with a person before providing access to information relating to the person in response to an access application.
20. Under section 55 of the GIPA Act, the Tribunal is entitled to consider the Applicant's motives for making the application to the extent that it is relevant to whether disclosure could reasonably be expected to have any of the effects referred to in clauses 2 - 5 of the Table to section 14. The personal factors of the application can also be taken into account as factors in favour of providing the Applicant with access to the information.
"Could reasonably be expected…"
21. The words "could reasonably be expected to" have been held to require "something more than a mere risk or chance. It must be based on real and substantial grounds, and it must not be purely speculative, fanciful, imaginary or contrived": Leech v Sydney Water Corporation [2010] NSWADT 198 at [28], adopted in Flack v Commissioner of Police, NSW Police Force [2011] NSWADT 286 at [41]-[42] and cited in Roy v Commissioner of Police, NSW Police Force [2012] NSWADT 120 at [28]. While it must be a "real" risk, the chance of it materialising need not be more probable than not: Neary v State Rail Authority [1999] NSWADT 107 at [35]-[36] and the cases there cited. The phrase "'simply calls for an "objective assessment', on the evidence before the Tribunal, as to whether the claimed effects could be expected to arise, from the standpoint of a reasonable administrator. Ultimately, it is, of course, a question of fact": Hall v Department of Premier and Cabinet (NSW) [2012] NSWADT 46 at [45].
22. In Attorney General's Department v Cockcroft [1986] FCA 35; (1986) 10 FCR 180 at 190, Bowen CJ and Beaumont JJ interpreted the term in the following way:
In our opinion, in the present context, the words "could reasonably be expected to prejudice the future supply of information" were intended to receive their ordinary meaning. That is to say, they require a judgment to be made by the decision-maker as to whether it is reasonable, as distinct from something that is irrational, absurd, or ridiculous, to expect that those who would otherwise supply information of the prescribed kind to the Commonwealth or any agency would decline to do so if the document in question were disclosed under the Act. It is undesirable to attempt any paraphrase of these words. In particular, it is undesirable to consider the operation of the provision in terms of probabilities or possibilities or the like...
23. The word "expected" is not to be given too wide a meaning in light of the objectives of the statute: Cockcroft per Sheppard J at 112. The occurrence of the prejudice does not have to be established on the balance of probabilities but there must be something more than a possibility, risk, or chance of the event occurring: Cockcroft per Bowen CJ and Beaumont J at [106].
As to the standard of evidence required to establish that disclosure could reasonably be expected to have a nominated effect, Principal Member Pearson in Forbidden Foods Pty Ltd v Rice Marketing Board of New South Wales [2020] NSWCATAD 18 said:
In Newcastle City Council v Newcastle East Residents Action Group [2018] NSWCATAP 254 the Appeal Panel considered the nature and probity of the evidence required to establish that disclosure of the information could reasonably be expected to have one of the effects in the Table to s 14, referring to Searle and the authorities discussed in that decision, and held:
59. Based on these authorities when considering the evidence on which it is asserted that disclosure "could reasonably be expected" to have a particular effect, the following principles should be kept in mind:
(1) a mere statement that disclosure could reasonably be expected to have a particular effect is insufficient;
(2) there must be real and substantial grounds supporting an opinion that disclosure could reasonably be expected to have a particular effect;
(3) prominence should be given to inferences capable of being drawn from established facts, rather than on the subjective views of witnesses.
As Senior Member Goodman SC noted in Page v Commissioner of Police [2020] NSWCATAD 163 at [58], the requirements for proof of questions of fact in administrative review proceedings generally were summarised recently by the Appeal Panel in Meacham v Commissioner of Police [2020] NSWCATAP 107 at [54] and [83] as follows:
[54] Despite not being bound by the rules of evidence, the Tribunal is required to base its findings of fact on "logically probative material", and not on "mere suspicion or speculation", as a corollary of its obligation to act reasonably: Minister for Immigration and Ethnic Affairs v Pochi (1980) 44 FLR 41 ("Pochi") at 62, 68 (Deane J); [1980] FCA 85; Sullivan v Civil Aviation Authority (2014) 22 FCR 555; [2014] FCAFC 93 ("Sullivan") at [5]-[8], [15]-[17] (Logan J). It is an error of law for the Tribunal to make a finding of fact with no evidence, or no probative evidence, to support it.
…
[83] Proof of matters which are asserted is required in a practical sense, and a party asserting a fact is generally required to provide evidence to substantiate it. As noted above, the Tribunal is required to base its findings of fact on "logically probative material": Pochi at 62, 68; Sullivan at [5]-[8], [15]-[17].
In balancing the competing public interest considerations under s 13 of GIPA Act, the Appeal Panel has recently stated in Transport for NSW v Searle [2018] NSWCATAP 93 at [104], that while the process in s 13 of the GIPA Act requires a broad value judgment to be made, it is not made in a vacuum, but having regard to the objects of the legislation, the general presumption in favour of disclosure of government information, and the principles set out in s 15 of the GIPA Act.
In determining whether there is a public interest in favour of disclosure, an agency is entitled to take the personal factors of the application into account: s 55(2) of the GIPA Act.
The 'personal factors of an application' that can be considered in relation to an access application are set out in s 55 of the GIPA Act as follows:
(1) In determining whether there is an overriding public interest against disclosure of information in response to an access application, an agency is entitled to take the following factors (the personal factors of the application) into account as provided by this section:
(a) the applicant's identity and relationship with any other person,
(b) the applicant's motives for making the access application,
(c) any other factors particular to the applicant.
(2) The personal factors of the application can also be taken into account as factors in favour of providing the applicant with access to the information.
[8]
Evidence of Mr. Roy Ale
Mr. Ale is employed as Associate Director, Fleet Program Delivery at Sydney Trains. In this role, Mr. Ale leads a team responsible for the development, design, and delivery of multiple fleet programs within Sydney Trains. In his statements, Mr. Ale stated that:
1. the IEDR system is an emergency train door release that can be operated by passengers inside the train. If a passenger activates the IEDR system where there is no emergency, the train will stop and the passenger doors will open.
2. the disclosure of the disputed information would include technical aspects of the IEDR system which would expose the weaknesses and vulnerabilities of the IEDR system; reveal the location of critical components of the IEDR system, including data connections, cabling, electrical connections, and gear plate locations.
3. A person, with the relevant skills, could use the technical information about the IEDR system to tamper with the system which could prevent passengers from escaping the train in the event of an emergency; compromise, sabotage or tamper with a train's brakes and doors; compromise the software and hardware of the IEDR and the operating system of the train; and reverse engineer how the IEDR was installed and designed.
4. It would not be feasible to decommission or alter the existing IEDR system to address the safety concerns that would arise from the disclosure of the disputed information, other than a complete rebuilding of Sydney Trains' existing stock at a cost of tens of millions of dollars.
In addition to addressing each of the disputed documents separately, Mr Ale, in his first statement, has organised the disputed documents into seven categories as follows.
Category one is 'design description documents' which includes items 6, 15, 16, 17, 18, 21 and 22. Mr Ale states that these documents include information about the electronic design, cabling and mechanical operations of the IEDR, which if released, would pose a significant risk to public safety because it would enable a person, with the requisite skills, to interfere with the safe and normal operations of the IEDR system.
Category two is 'technical specification documents', which includes items 3, 30, 31 and 32. Mr Ale states that these documents provide information about the critical wiring and cabling, as well as connections and interfaces with various systems on the train. He states that the public release of this information could enable a person with the requisite skills to exploit weaknesses and vulnerabilities in, and reverse engineer how the IEDR system was designed and to tamper with or compromise the train's safety systems.
Category three is 'installation process documents', which includes items 26, 27, 28 and 29. Mr Ale states that these documents provide installation and software activation instructions for the train's various systems, emergency procedures for the IEDR which, if publicly released, could enable a person to exploit the vulnerabilities in, and compromise the emergency functions of the IEDR.
Category four is 'feasibility studies or planning documents' which includes items 4, 8, 9, 10, 11, 13 and 14. Mr Ales states that these documents provide the limitations and constraints of the IEDR system and identify the location of equipment and system architecture of the IEDR system. He states that if publicly released, these documents could enable a person to exploit the vulnerabilities in, and compromise the emergency features of the IEDR system.
Category five is 'design review minutes' which includes items 19 and 20. Mr Ale states that these documents describe the design of the IEDR system including changes and modifications to the design.
Category six is 'testing process documents' and includes items 23, 224, 25, 33, 34, 35, 36 and 37. He states that documents in this category identify the location of equipment, details of the software used in the IEDR as well as safety issues which, if disclosed, would enable a person to reverse engineer the IEDR system and compromise the operating system of the train.
Category seven is 'engineering process documents' being item 5. This document shows the design and architecture of the IEDR system which if released, he says could enable a person to cause harm by compromising aspects of the IEDR system.
Under cross-examination Mr. Ale conceded, contrary to his written statements, that access to the disputed information would not allow a person to control the speed of the train, prevent a train from stopping or cause a train to crash. He also acknowledged, when asked about his professional background under cross-examination, that some of his evidence is based on the knowledge and experience of technical experts within his team rather than based on his own expertise.
In re-examination, Mr. Ale told the Tribunal that:
1. he had consulted with subject matter experts in his team in preparing his evidence; and
2. disclosure of the disputed information could cause the IEDR system to fail or not function properly, causing the train to stop.
[9]
Evidence of Gary James Beavan
Mr. Beavan is the Director of Security at Sydney Trains and leads several teams responsible for managing security information, security intelligence, and security investigation within Sydney Trains. He is also a member of several inter-agency groups which assess the likelihood of terrorist attacks on mass surface transport services. Prior to his appointment at Transport NSW, Mr Beavan held various positions within the NSW Police Force including as an intelligence analyst and supervisor.
In his written statement, Mr. Beavan stated that:
1. The national terrorism threat level is currently 'probable', which means there is credible intelligence of individuals or groups that have the intent and capability to conduct a terrorist attack in Australia.
2. Surface transport, such as the train network, is considered to be an ideal terrorist target because an attack could result in mass causalities and significant media attention and because of the large number of passengers within a contained area.
3. In his opinion, the disclosure of the design and engineering information about how the IEDR system operates, how it is integrated into the train, and the mechanical components and operating information of the train itself, is likely to increase the risk of a credible terrorist threat to the train network.
4. In his opinion, the disclosure of the technical information could be used by organised graffiti groups to commit vandalism by interfering with or activating the emergency door mechanisms. He stated that by operating the IEDR, a train will stop or remain stationary, enabling a person to carry out graffiti attacks on a train.
In oral evidence, Mr. Beavan told the Tribunal that:
1. As to the risk of a terrorist attack on the train network, there is a blueprint available for terrorist attacks on trains, such as the Madrid bombings (2004), the London Bombings (2005), and the Thalys train attack (2015).
2. Terrorists would be interested in stopping a train as part of a hostage crisis or as part of a pre-meditated attack.
Under cross-examination, in response to a question as to whether there were easier ways of stopping a train than activating the IEDR, Mr. Beavan acknowledged that there were various other ways that a person could stop a train. In response to a question about his statement that a detailed knowledge of the IEDR system may enable a person to disable the device remotely, causing a train to shut down, Mr. Beavan acknowledged that his evidence was based on his understanding of the train's systems rather than any detailed knowledge of the functioning of those systems.
[10]
Evidence of William Shipway
Mr. Shipway is a senior security manager, IT Architecture & Security at Sydney Trains. Mr. Shipway, whose evidence was not challenged at the hearing, outlined the systems and procedures in place within Sydney Trains to control access to the disputed information. His evidence establishes that there is no public access to the disputed information which is attached as confidential annexures to Mr. Ale's first statement.
[11]
Ms. Else's Evidence
While Ms. Else did not provide any oral evidence at the hearing, she relied on her written statement dated 13 November 2020 and a bundle of technical documents that accompanied her statement as follows. The first document is a PDF excerpt of the technical specifications of the OSCAR trains, including information relating to the braking controls and mechanisms. The second is an excerpt that sets out the emergency brake requirements. The third document is an excerpt on the braking release mechanisms. The fourth document is an extract from RailCorp achieves relating to the Oscar train project. The fifth document comprises photographs from inside an OSCAR carriage including the location of the IEDR mechanisms. The final attachment is an email sent by Ms. Else to the agency's lawyers asking for a concession that access to the IEDR would not override the driver and other controls to stop a train.
By way of summary, Ms. Else in her statement:
1. Referred to the Waterfall Rail Accident Inquiry that recommended the installation of an IEDR mechanism to enable passenger self-evacuation in the event of an emergency. In particular, she relied upon an extract from Hansard of a statement from the Minister for Transport in Parliament on 29 August 2006 that passenger evacuation from a train using the IEDR system should not be subject to a crew override facility, so as to limit the risks to passenger safety.
2. Noted that the IEDR system as implemented includes a crew override facility contrary to the public statements of the Minister for Transport.
3. Explained that her motivation for seeking access to the documents is to examine whether the agency has properly considered passenger safety by including the crew override and to test whether the decision to include the crew override was based on scheduling and timetabling considerations rather than safety considerations.
[12]
Public interest considerations in favour of disclosure
In addition to the general public interest in favour of disclosure of government information set out in s 12 and the statutory presumption in favour of disclosure under s5 of the GIPA Act, Transport NSW identified the following as relevant public interest considerations in favour of disclosure:
There is a public interest in disclosing information that facilitates public scrutiny of and promotes transparency of decision making, particularly in relation to carrying out its primary objective of providing safe services to passengers.
There is a public interest in having oversight of the expenditure of public funds by the agency.
There is a public interest in being informed about public transport safety.
Ms. Else submitted that, in addition to the considerations raised above, there is a public interest in the public being informed of any weaknesses or faults in the design and functioning of the IEDR system that would compromise or undermine passenger safety.
Transport NSW submitted at the hearing that the public interest considerations in favour of disclosure were not contested. Based on the material before me, I am satisfied that, in addition to the statutory presumption in favour of disclosure and the general right of the public to have access to government information, all of the public interest considerations in favour of disclosure identified by both parties are to be taken into account and are relevant to the balancing exercise under s13 of the GIPA Act.
[13]
Personal factors of the application
Under section 55 of the GIPA Act, the personal factors of the applicant, including identity and motives, can be taken into account as factors in favour of providing the applicant with access to the information (s 55(2)).
Ms. Else stated that her motivation for seeking access to the documents is to test whether passenger safety has been compromised by including a crew override facility. Transport NSW did not make any submissions on whether this consideration should be taken into account as favouring disclosure. Based on the material before the Tribunal, I am satisfied that the reasons given by Ms. Else for making this application can be taken into account as personal factors that support disclosure. Transport NSW did not rely on any personal factors, including Ms. Else's motivation for wanting access to the disputed information, as a public interest consideration against disclosure. Accordingly, no issue arises in these proceedings as to any personal factors that may be taken into account as public interest considerations against disclosure under s 55(3).
[14]
Public interest considerations against disclosure
In the present matter, Transport NSW relied upon clauses 1(f), 2(d), and 2(f) of the table in s14 of the GIPA Act as the relevant public interest considerations against disclosure of the disputed documents, other than items [1] and [2], (which it submitted contained cabinet information) and items [7] and [12] which it submitted were outside the scope of the application. The relevant provisions of the table in s14 provide as follows:
[Note: 1 Responsible and effective government
There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects (whether in a particular case or generally:
(f) prejudice the effective exercise by an agency of the agency's functions.
[Note: 2 Law enforcement and security
There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects (whether in a particular case or generally) -
(d) endanger, or prejudice any system or procedure for protecting, the life, health, or safety of any person,
(f) facilitate the commission of a criminal act (including a terrorist act within the meaning of the Terrorism (Police Powers) Act 2002)
I will deal with the public interest considerations in the order they were raised in the agency's submissions and at the hearing.
[15]
Clause 2(d) -Endanger or prejudice any system or procedure for protecting the life, health, or safety of any person
Clause 2(d) provides that there is a public interest consideration against disclosure if disclosure of that information could reasonably be expected to have the effect (whether in a particular case or generally) of endangering or prejudicing any system or procedure for protecting the life, health or safety of any person.
The concept of 'reasonably be expected' is referred to above at [17] - [18].
"Prejudice" under the GIPA Act is to be given its ordinary meaning, that is, "to cause detriment or disadvantage" or "to impede or derogate from"; Hurst v Wagga Wagga City Council [2011] NSWADT 307 at [60].
As to the concept of endangerment, the Appeal Panel in Electoral Commissioner, State Electoral Office v McCabe [2003] NSWADTAP 28, at [36] stated:
We simply note that it is a very serious matter for an agency to invoke an exemption based on 'endangerment'. In our view, agency opinions making such a grave assessment must be closely scrutinised and not easily accepted. The Tribunal is, we consider, obliged to bring some scepticism to the task of assessing what are necessarily self-serving statements by agencies as to the availability of grounds for exemption which involve matters of judgment. The question is always whether the material, statements of opinion, and submissions put forward by the agency justifies reliance on the exemption
[16]
The submissions
Transport NSW's submissions (including oral submissions made by counsel at the hearing) may be summarised broadly as follows:
At the commencement of the hearing, the agency withdrew its claim that accessing the information contained in the disputed documents would enable a person to control the speed of a train or cause the train to crash. It also acknowledged that there are, as Ms. Else submitted, mechanisms in place to control a train's braking systems in the event of driver incapacity.
The agency submitted that notwithstanding these concessions, a person armed with the confidential information could endanger passenger safety by disabling the IEDR system which would prevent passengers from escaping the train in the event of an emergency and cause the train to stop despite the crew override. It also submitted that disclosure of information about the train's operating system and critical cabling could facilitate a person interfering with the safe and normal operation of the IEDR system.
The agency submitted that Mr. Ale's evidence establishes that the confidential information discloses weaknesses and vulnerabilities of the IEDR system, discloses critical cabling and wiring components of the IEDR system, and discloses how the IEDR system is integrated into the overall electronic architecture of the train. The agency submitted that Mr. Ale's evidence demonstrates that this information could reasonably be expected to assist a person, so minded, to compromise, sabotage, or tamper with the train including preventing passengers from evacuating in the event of an emergency and causing the train to stop.
The agency submitted that because there is no mechanism under the GIPA Act to impose conditions on the way the material is used, the documents would be released to the public at large. It submitted that there is a real risk that this information could be used by a person who wished to cause harm by endangering public safety or prejudicing the IEDR system for protecting the life and safety of train passengers.
The agency referred the Tribunal to the Appeal Panel decision in McCabe to the effect that any claim of endangerment requires 'grave assessment' which 'must be closely scrutinised and not easily accepted'. The agency submitted that Mr. Ale's evidence satisfied this threshold.
The agency also submitted that the Tribunal decision in Griffin v Sydney Trains [2020] NSWCATAD 234, in which the agency's decision to refuse access to overhead wiring diagrams based on clauses 2(d) and 2(f) was affirmed, supports its position in this matter.
The agency submitted that it was not appropriate to redact any of the information in the disputed documents because, [NOT FOR PUBLICATION.]
By way of summary, Ms. Else submitted that:
Mr. Ale's evidence and the agency's written submissions that disclosure of the disputed information could assist a person control the speed of the train and cause the train to crash is contradicted by the agency's own published standards and technical specification documents. As I have already noted above, the agency withdrew this claim in its opening submissions and Mr. Ale conceded under cross-examination that his evidence on this point was incorrect. He also agreed that the emergency brake mechanisms could effectively override any attempt to crash the train.
Neither Mr. Ale nor Mr. Beavan was subject matter experts and their evidence should be discounted because, for the most part, it was not based on their knowledge or expertise. She also submitted that their evidence was based on speculation and conjecture rather than facts and that the relevant information would provide little, if any, assistance to a person wishing to cause harm.
The risks to public safety identified by the agency are not real and substantial risks because there is alternative, easier, lower-risk ways of causing delays to or disrupting a train, which Transport NSW did not address in its evidence.
That it would be consistent with the objects of the GIPA Act for the agency to redact any material in the documents that may be subject to an overriding public interest against disclosure rather than refusing access to the entire document.
[17]
Consideration
I now turn to consider whether Transport NSW has established that the public interest consideration in clause 2(d) applies to the disputed information. In doing so, I have considered all the material before the Tribunal including the confidential evidence and submissions. I have also reminded myself that the agency bears the onus of establishing that the relevant public interest consideration applies to the information; that claims concerning "endangerment" require serious consideration; (McCabe at [36]); that the Tribunal must be satisfied, on logically probative material, that there are real and substantial grounds for expecting the submitted effects, and that the evidence must show more than a mere risk, possibility or chance that the consequences asserted by Transport NSW could occur.
I accept Mr. Shipway's evidence and the Respondent's submissions that the disputed information is not publicly available or observable and that it is held confidentially.
I accept Mr. Ale's evidence that the IEDR is a system designed to protect the life and safety of passengers and staff on a train in the event of an emergency by providing passengers with a secondary means to exit a train where the crew is unable to activate the primary emergency egress through the guard or driver cabins. I am satisfied on Mr. Ale's evidence that the IEDR system allows passengers inside an Oscar train, subject to a crew override, to unlock and open the train doors and stop the train by operating the emergency door release.
Having reviewed the contents of each of the disputed documents provided to the Tribunal in confidence, (which I will discuss in detail below under the heading 'the disputed documents'), I am satisfied that, other than items [3], [5], [7], [9], [10], [12], [14], [16] and [35], the content of each of the disputed documents contains sufficient critical information relating to the IEDR system, including the location of critical cabling, wiring and data connections; how the IEDR system is installed and operates; and how the IEDR system is integrated into the overall electronic architecture of a train.
I am satisfied, based on Mr. Ale's evidence, and my examination of each of the disputed documents that, except for items [3], [5], [7], [9], [10], [12], [14], [16] and [35], the disclosure of this technical information could reasonably be expected to enable, or assist materially, a well-informed person, with a level of technical training or expertise, to tamper with the IEDR and prevent passengers from escaping from a train in the event of an emergency; operate or tamper with other train systems such as the breaks and the doors; cause the IEDR system to fail or not function properly resulting in the train stopping despite the crew override; compromise the emergency features, software and hardware of the IEDR as well as compromise the operating system of a train.
The fact that Mr. Ale conceded and accepted in oral evidence before the Tribunal that disclosure of the disputed information about the IEDR system could not enable a well-informed person to gain control of the speed of a train or cause the train to crash, does not undermine the validity of the other evidence he presented. Nor does the fact that Mr. Ale consulted members of his team on the electronic and mechanical aspects of the IEDR system in preparing his statement undermine his overall evidence as to the particular effects that could reasonably be expected if the disputed documents were released.
In reaching this conclusion, I have considered Ms. Else's submission that it is implausible or (to paraphrase) far-fetched that anyone would use the technical information relating to the IEDR system to delay, disrupt or compromise passenger safety on the train network because there are less risky and more effective ways of achieving those outcomes. Even if that is true, and the risk of the expected effect is low, the agency does not need to establish that the submitted effects are more likely than not, more probable than not, or that there is greater than a 50% chance of endangerment. Instead, the burden that falls on the agency is to show that the chance, possibility, or risk of the submitted effects occurring is a real one, a chance that is 'fair', sufficient or worth noting'; an expectation that is reasonably based: Department of Agriculture and Rural Affairs v Binnie [1989] V.R. 836 at [840] and [841]. In my view it cannot be said, based on Mr. Ale's evidence and my consideration of the disputed documents, that the expectation of the claimed effect is 'irrational, absurd or ridiculous'.
As explained below (in my discussion of the disputed documents), I am not satisfied that there is a sufficient connection between the contents of the information in items [5], [14], and [35] and the requirements set out in clause 2(d). As to items [9], [10], and [16], I have determined that the relevant public interest consideration applies to some of the information. However, I am not satisfied that disclosing some of the material would have the potential impacts given in the agency's evidence. As to items [7] and [12], the Tribunal does not have a copy of the withheld information and accordingly is unable to determine the merits of the agency's decision that the documents are not relevant to the access application. As to item [3], the agency has not provided the Tribunal with a copy of the redacted information and therefore I am unable to determine the merits of the agency's decision to only release part of the document.
While acknowledging that a claim of endangerment or prejudice is a serious matter that requires "grave assessment (which) must be closely scrutinised and not easily accepted", I am persuaded, on the evidence, and having considered the content of the disputed documents, that the release of the information about the IEDR system could provide assistance to or make it easier for a well-informed person to endanger the systems for protecting the life and safety of train passengers, staff and members of the public. I am also satisfied, for the same reasons, that the disclosure of the technical specifications of the IEDR system in each of the disputed documents which I have identified above, could cause detriment to or disadvantage the agency's existing emergency and safety procedures for passengers and staff travelling on a train.
Accordingly, I am satisfied that clause 2(d) of the Table in section 14 applies to the disputed information, other than items [3], [5], [7], [9], [10], [12], [14], [16] and [35].
[18]
Clause 2(f) - facilitate the commission of a criminal act (including a terrorist act within the meaning of the Terrorism (Police Powers) Act 2002
Clause 2(f) provides that there is a public interest consideration against disclosure if disclosure of that information could reasonably be expected to facilitate (whether in a particular case or generally) the commission of a criminal offence, including an act of terrorism.
The concept of 'reasonably be expected' is referred to above at [17] and [18].
Facilitate is to be given its ordinary meaning, that is to make easier. In the context of clause 2(f), to make easier a criminal act by a person minded to carry out such an act: Griffin v Sydney Trains [2020] NSWCATAD 234, at [51].
This clause has been the subject of some consideration by the Tribunal. In Hutchinson v Roads and Traffic Authority [2006] NSWADT 147, the Tribunal found that the disclosure of photographs of the Sydney Harbour Bridge "showing structural detail not normally visible by or accessible to the public" could reasonably be expected to facilitate the commission of a terrorist act.
In Wordsworth v Roads and Maritime Services [2017] NSWCATAD 201 the Tribunal concluded that disclosure of information concerning "major technical engineering studies affecting the entire structure" of the Sydney Harbour Bridge could reasonably be expected to have the effect of facilitating a terrorist attack on the Bridge. The Tribunal stated at [39]-[40] that:
39 In this case, it is clear from the evidence that there are real or substantial grounds for expecting a terrorist attack in Sydney in the future. The applicant attempted to argue that terrorist attacks are currently unlikely to use complex technical means to attack a structure. However, the real risk of an attack that involves a major structure with an iconic status cannot be said to be irrational or absurd, based on the evidence of threats against the Bridge and the efforts put into protecting it. Should a person be minded to carry out a terrorist attack on the Bridge, in my view the disclosure of the information could reasonably be expected to have the effect of facilitating that attack.
40 In my view, the respondent has established that disclosure could reasonably be expected to prejudice any system or procedure for protecting the Sydney Harbour Bridge, and facilitate the commission of a criminal act (including a terrorist act within the meaning of the Terrorism (Police Powers) Act 2002). Those public interests against disclosure in my view outweigh the general public interest in favour of disclosure of government information, and the specific public interest in favour of the public having information about the maintenance and condition of the Sydney Harbour Bridge as a major piece of infrastructure and an important landmark.
[19]
Submissions
Transport NSW's submissions may be summarised broadly as follows:
Mr. Beavan's evidence establishes that the national terrorism alert of attacks on mass transport services (including trains) is currently 'probable', and that surface transport (such as a train) are an ideal terrorist target.
Mr. Beavan's evidence also demonstrates that the disclosure of the design and engineering information about how the IEDR system operates and is integrated into the train is likely to increase the risk of a credible threat to the rail network.
While the agency agrees with Ms. Else that access to the IEDR information could not assist a person take control of the speed of, or crash a train, it submits that the evidence establishes that a person may, as part of an organised terrorism attack, interfere with or disable the IEDR and other operating systems of the train, causing the train to stop and preventing passengers from escaping a train.
That access to the confidential information would increase the capacity of organised criminal groups to interfere with the emergency door release, causing the train to stop and thereby facilitating targeted and organised graffiti vandalism. According to Mr. Beavan, between 2015 and 2020 there have been 113 incidents involving the activation of the emergency door mechanisms by people involved in graffiti and vandalism offences. Mr. Beavan's evidence also establishes that graffiti vandalism is becoming increasingly sophisticated in its targeting of access systems which would be assisted by having access to the disputed information.
The agency relied on the decision in Wordsworth in which the Tribunal refused access to documents relating to the maintenance of the Sydney Harbour Bridge because it could facilitate a terrorist offence. It contended that this decision supports its position in this case.
The agency submitted that three criminal acts could be facilitated by the release of the disputed information. Firstly, any action to interfere with or disable the IEDY system would itself constitute a criminal offence. Secondly, that it could facilitate or make easier graffiti and vandalism offences; and thirdly, it could facilitate the commission of a terrorism offence.
Ms. Else's submissions about clause 2(d) are also relevant to the agency's claim under clause 2(f). She also submitted that the threshold for 'facilitating' a criminal offence in clause 2(f) is to make the commission of the criminal offence (at least) substantially easier.
[20]
Consideration
For the reasons I have given above in relation to the agency's claim under clause 2(d) and having considered the contents of each document (which I discuss in detail below under the heading 'the disputed documents'), I am satisfied that, except for items [items [3], [5], [7], [9], [10], [12], [14], [16] and [35], the disputed documents include technical information about the IEDR system that is not publicly available that could reasonably be expected to enable, or materially assist, a person to compromise or tamper with a train's brakes and doors; prevent passengers from exiting a train and causing a train to stop.
I am satisfied that the disclosure of the disputed documents could reasonably be expected to facilitate, as Transport NSW has contended, three criminal acts. In reaching this conclusion, I have adopted the definition of facilitate as meaning 'to make easier', applying the reasoning of the Tribunal in Griffin.
Firstly, I accept the agency's submission that any action taken by a person to interfere with, endanger, or prejudice Sydney Trains' IEDR system would itself amount to a criminal offence.
Secondly, I am satisfied, on the basis of Mr. Beavan's evidence, and from my examination of the confidential annexures, that it could reasonably be expected that the disclosure of the design and engineering information about the IEDR system could have the effect, both generally and in this particular case, of facilitating (that is, making easier) graffiti offences and acts of vandalism. Mr Beavan's evidence establishes that there have been numerous cases of vandalism on Sydney Trains over the past five years which have involved improper interference with the emergency door mechanisms. According to Mr. Beavan, graffiti offences and organised acts of vandalism are becoming increasingly more sophisticated in their targeting of access systems and the disclosure of the disputed information could assist, in a material way, someone who is minded to carry out such offences. I accept his evidence. While Mr Beavan made some concessions about the extent of his understanding of the functioning of the train's IEDR system and the possibility that there were other ways in which a person could stop a train, I do not consider that those concessions undermine the substance of his evidence.
Thirdly, I accept Mr. Beavan's evidence that general publication of the technical information about the IEDR could facilitate an act of terrorism on the Train network. I accept his evidence that the National Terrorism Threat Level is currently classified as "Probable" and that critical infrastructure, such as surface transport, is an attractive terrorist target, particularly because it could result in mass causalities and significant media attention. I also accept his evidence that knowledge about the technical aspects of the IEDR system contained in the disputed documents could provide real assistance to a person inclined to carry out a terrorist attack by stopping a train as part of a hostage crisis and by preventing passengers from exiting a train to maximise casualties. Based on my review of the confidential annexures (which I discuss below) and the evidence before me, I am satisfied that it is not fanciful or contrived to expect that disclosure of the specific information in the disputed documents could facilitate and materially assist a person commit a terrorist attack.
Accordingly, I am satisfied that clause 2(f) applies to the disputed information except for items [3], [5], [7], [9], [10], [12], [14], [16] and [35], as a public interest consideration against disclosure.
As explained below, (in my discussion of the disputed documents) I am not satisfied that clause 2(f) applies to the contents of items [5],[14], and [35]. I have also concluded that the relevant public interest consideration applies to some but not all of the information in items [9], [10], and [16].
[21]
Clause 1(f) - prejudice the effective exercise by an agency of the agency's functions
Clause 1(f) provides that there is a public interest consideration against disclosure of information if it could reasonably be expected to have the effect of prejudicing the effective exercise by an agency of the agency's functions.
Transport NSW submitted that one of its key statutory functions is to deliver safe and reliable passenger services in an efficient, effective, and financially responsible manner: s36A of the Transport Administration Act 1998 (NSW). It further submitted that the disclosure of the disputed information could detrimentally impact on, and disadvantage, public and passenger safety and compromise the capacity of the agency to perform its functions to ensure public safety. Mr. Ale stated in his evidence that there is no practical or economical way to respond to the risk of harm, should the documents be released, other than by redesigning and rebuilding the IEDR system at a cost of tens of millions of dollars. The agency submitted that, as a result, the disclosure of the disputed documents would impede or derogate from its functions to ensure passenger safety and so constitute a significant prejudice.
While Ms. Else did not make any submissions disputing the functions identified by Transport NSW, she contended that there would be no prejudice to the performance of those functions should the documents be released.
While, given my findings above, I do not consider it necessary to make separate findings in respect of the ground raised by Transport NSW under clause 1(f), I am satisfied nevertheless, for the same reasons I have given above in my consideration of clause 2(d) and 2(f), that the disclosure of the disputed information, other than the information contained in items [3], [5], [7], [9], [10], [12], [14], [16] and [35], could cause a detriment to or prejudice the capacity of the agency to (continue to) provide safe passenger services. Mr. Ale's evidence establishes that public transport safety is a core function for Transport NSW and that the disclosure of the relevant information could prejudice the effective exercise of those core functions.
As explained below, (in my discussion of the disputed documents) I am not satisfied that clause 1(f) applies to the contents of items [5],[14], and [35]. I have also concluded that the relevant public interest consideration applies to some but not all of the information in items [9], [10], and [16]. Accordingly, the public interest consideration in clause 1(f) does not apply to these items.
[22]
Balancing the Public Interest
Having determined that clauses 1(f), 2(d) and 2(f) apply to each item of the disputed documents, other than items [3], [5], [7], [9], [10], [12], [14], [16] and [35] as public interest considerations against disclosure, I will now turn to balance the public interest considerations for and against disclosure of those documents to determine whether there is an overriding public interest against disclosure, as required by s13 of the GIPA Act. In doing so, I have reminded myself of the applicable principles summarised at [17]-[20] above.
In weighing the competing interests, I have taken into account the public interest considerations in favour of disclosure discussed at [33]-[35] above. The protection of public (and passenger) safety is a matter of significant public interest and is entitled to considerable weight. The general public interest in, and the presumption of, disclosure are also weighty considerations although not determinative.
The personal factors in favour of disclosure, including Ms. Else's motive for making the access application, discussed at [36] and [37] above, is also a relevant consideration in determining where the balance of the public interest lies. In my view, Ms. Else's stated motives for seeking access to the disputed documents correspond to the broader public interest of ensuring public and passenger safety on Sydney Trains. On that basis, the personal factors in this matter are entitled to considerable weight.
I have also given some weight to the fact that an agency is not entitled to impose any conditions on the use of, or the further disclosure of the information relating to the IEDR system and that if released, it could fall into the hands of someone who wishes to cause harm.
As I have concluded above, disclosure of the disputed information (except for the documents in items other than items [3], [5], [7], [9], [10], [12], [14], [16] and [35] could reasonably be expected to endanger or prejudice the IEDR system for protecting the life and safety of train passengers or facilitate the commission of a criminal act, including terrorism offences and graffiti offences, within the meaning of clauses 2(d) and 2(f). These are very serious and grave matters which could result in death or serious injury to train passengers and members of the public. In my view, these are very powerful considerations against disclosure and are entitled to significant weight.
I have also found that disclosure of the disputed information could reasonably be expected to undermine, compromise, and prejudice the agency's capacity to deliver safe transport services to the public. Public (passenger) safety is a matter of great public importance and a matter of central concern for the agency. I regard this as a very powerful factor against disclosing the relevant information.
In the final result, having considered the evidence and the submissions, including reading the disputed documents and having considered and applied the principles referred to at [17]-[20] above, including the principles in s15 of the GIPA Act, I have concluded that on balance, the considerations against disclosure of the withheld information outweigh those factors in favour by a comfortable margin. Accordingly, I am satisfied that there is an overriding public interest against disclosure of the disputed documents except for items [3], [5], [7], [9], [10], [12], [14], [16] and [35].
[23]
The documents in dispute
Now turning to the disputed documents, I will set out in the paragraphs that follow my findings in relation to the information contained in each item of the disputed documents based on the evidence and reasoning set out above in this decision. While the agency grouped the disputed documents into seven categories (which I summarised at [23] above), the task of the Tribunal is to consider the effect of disclosing each particular piece of information contained within a document, and not to categories of documents or a document as a whole: Destination NSW v Taylor [2019] NSWCATAP 123 at [69]. The withheld documents are attached as a confidential annexure to Mr. Ale's first statement and consist of 1780 pages. I have adopted the document numbers used by Transport NSW in the schedule of documents.
[24]
Items 1 and 2
As to items 1 and 2, I do not need to determine the agency's claim that there is an overriding public interest against disclosure of those documents on the basis they contain cabinet information. That is so because, as I have already noted, Ms. Else does not press her application for access to those documents.
[25]
Item 3
Item 3 is an internal briefing note for Sydney Train Directors dated 2 March 2015 on IEDR compliance to RISSB AS7522-3-2012. It is a three-page document. Transport NSW has released this document but with redactions under s74 of the GIPA Act. Ms. Else pressed for the redacted information to be released. Transport NSW has not provided the Tribunal with a copy of the redacted information or addressed the document in Mr. Ale's evidence or the agency's submissions. For that reason, I am unable to determine the grounds on which the agency submits the redacted information is out of scope or not relevant to the access application. Accordingly, I will remit item 3 to Transport NSW for reconsideration.
[26]
Item 4
Item 4 is a 25-page safety risk assessment report dated 1 July 2016 on the limitations in operating the IEDR system on Oscar and Hunter Rail Car when a train is on its side. The agency has grouped this document as part of the feasibility studies or planning documents.
I am satisfied from the contents of the report and the evidence of Mr. Ale that the document contains sufficient critical information on the operational limitations and constraints of the IEDR system which, if publicly released, could reasonably be expected to materially assist a person to exploit the vulnerabilities in and compromise the emergency features of the IEDR. It could also undermine the agency's capacity to protect public safety. Accordingly, I am satisfied that the release of item 4 could reasonably be expected to have the submitted effects under clauses 1(f), 2(d), and 2(f) of the table. In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given at [75]-[81] above, that there is an overriding public interest consideration against the disclosure of this item.
[27]
Item 5
Item 5 is 24-page systems engineering management plan, prepared by UGL Limited, on the IEDR Mk 11 for the Oscar trains, which the agency has grouped in the emergency process documents category.
[NOT FOR PUBLICATION].
Much of the document seems to me to consist of material that could not reasonably be expected to have the submitted effects. While some of this material deals with the various components of the IEDR system, it is expressed at a high level, in general terms and, in my view, does not contain sufficient detail as to meet the reasonable expectation requirement. Accordingly, there is no public interest consideration against disclosure in relation to this item and the document should be released within 28 days of the publication of these reasons.
[28]
Item 6
Item 6 is a two-page system interface diagram of the IEDR Mk11 for the Oscar train, prepared by UGL Limited dated 5 May 2014. The agency has grouped this document as part of the design description documents.
[NOT FOR PUBLICATION].
Based on my examination of the diagram, I am satisfied that the information in the item is consistent with Mr. Ale's evidence that it could reasonably be expected to assist or enable a person to interfere with the IEDR system and endanger the agency's system for protecting the life and safety of passengers. I also accept that disclosure could cause detriment to or disadvantage the agency's function to ensure passenger safety. For the same reason, I am also satisfied that the public release of the document could be used to facilitate a graffiti offence or act of terrorism. Accordingly, the agency's claim that clauses 1(f), 2(d), and 2(f) apply to this item, is made out. In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given at [75]-[81] above, that there is an overriding public interest consideration against the disclosure of this item.
[29]
Item 7
The agency contends that this item is not responsive to the application and has not been considered for disclosure.
The Tribunal has not been provided with a copy or description of the document and accordingly, is unable the asess the merits of the agency's decision for item 7. Ms. Else states in her written submissions that she is seeking access to all documents, including any documents that have only partially been released. Against this, Transport NSW contends that the scope of the present proceedings is confined to those documents which the agency has refused to release. If Ms. Else is pressing her request for access to this document, which the agency has determined is out of scope, the document will need to be remitted to the agency for reconsideration.
[30]
Item 8
Item 8 is a 45-page technical report entitled 'OSCAR internal emergency door release - concept design'. The agency has grouped this document as part of the feasibility studies or planning documents. The document contains a substantial amount of material of a detailed nature (including electrical arrangements; [NOT FOR PUBLICATION].
Having reviewed the document, I am satisfied that it supports Mr. Ale's evidence that the release of this item could reasonably be expected to have the submitted effects in clauses 1(f), 2(d), and 2(f). In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given at [75]-[81] above, that there is an overriding public interest consideration against the disclosure of this item.
[31]
Item 9
Item 9 is a 41-page feasibility study on the OSCAR IEDR, which the agency has grouped as part of the feasibility studies or planning documents. As with item 8, this document contains detailed and specific information [NOT FOR PUBLICATION].
Based on my examination of the document and the evidence of Mr. Ale, I am satisfied that the specific pages of item 9 identified in the schedule accompanying the agency's confidential submissions contain sufficient technical information that identifies system vulnerabilities which, if released, could reasonably be expected to endanger passenger safety, prejudice the IEDR system, and to have a detrimental impact on the agency's functions and capacity to provide passenger safety. I also find that the disclosure of this critical information could reasonably be expected to facilitate graffiti offences and increase the risk of a terrorist attack. However, withholding the balance of the document on the grounds identified by the agency is not supported by the evidence. [NOT FOR PUBLICATION].
[NOT FOR PUBLICATION].
Accordingly, while I am satisfied that clauses 1(f), 2(d), and 2(f) apply to the specific pages of item 9 referred to in the agency's confidential submissions, I propose to remit the document to the agency for reconsideration and suitable redaction.
[32]
Item 10
Item 10 is a 59-page document entitled 'IEDR project outer suburban cars (OSCARs). Part E Design Specification'. The agency has grouped this with the feasibility studies or planning documents. This document sets out in some detail information about the IEDR system functionality and performance and includes [NOT FOR PUBLICATION].
I am satisfied that the content of the specific pages of item 10 referred to in the agency's confidential submissions supports Mr. Ale's and Mr. Beavan's evidence that the release of this information could reasonably be expected to have the particular effects described in clause 1(f), 2((d) and 2(f) by assisting a person interfere with, sabotage, or tamper the IEDR system and prejudicing the performance of the agency's core functions of protecting passenger safety. However, the agency has not adequately explained how the other information in item 10 could reasonably be expected to have the particular effects described in clauses 1(f), 2((d), and 2(f). [NOT FOR PUBLICATION]. According to the agency's schedule of documents, it has released part of item 10 to Ms Else, however it is not clear from the documents in evidence what information has been redacted. In the circumstances, I propose to order that item 10 be remitted to the agency for reconsideration and suitable redaction in accordance with these reasons.
[33]
Item 11
Item 11 is an 11-page document entitled 'IEDR - variation (R630) for the outer suburban cars (OSC) - engineering design and technical specification'. It has been categorised by the agency as a feasibility/ planning document.
I am satisfied, having reviewed the contents of the document, that its disclosure would [NOT FOR PUBLICATION] that could reasonably be expected to have the adverse effects submitted by the agency in clause 1(f), 2((d) and 2(f), including assisting a person to interfere with the IEDR system. In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given at [75]-[81] above, that there is an overriding public interest consideration against the disclosure of this item.
[34]
Item 12
The agency contends that this item is not responsive to the application and has not been considered for disclosure. For the same reasons I have given in relation to item [7], this document should be remitted to the agency for reconsideration.
[35]
Item 13
Item 13 is a 46-page feasibility study on the OSCAR IEDR, prepared by UGL Limited. It has been categorised by the agency as a feasibility study/ planning document.
I accept the evidence of Mr. Ale, and the agency's submissions, that item 13 contains sufficiently detailed technical information [NOT FOR PUBLICATION]. I also accept Mr. Ale's and Mr. Beavan's evidence that public disclosure of this information could reasonably be expected to assist a person wishing to exploit the vulnerabilities of the IEDR system or cause the adverse effects in clauses 1(f), 2(d), and 2(f). In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given at [75]-[81] above, that there is an overriding public interest consideration against the disclosure of this item.
[36]
Item 14
Item 14 is a 4-page document prepared by UGL entitled 'IEDR Mk11 for OSCAR Production Breakdown Structure 2014'. It has been categorised by the agency as a feasibility study/ planning document.
This document [NOT FOR PUBLICATION], contains little detail of the components which make up the IEDR system and is expressed at a high level. I do not consider that it contains sufficient detailed technical information that is likely to have the particular effects described in clauses 1(f), 2(d) and 2(f).
As there are no public interest considerations against disclosure concerning item14, the information should be disclosed to the applicant within 28 days of the publication of these reasons.
[37]
Item 15
Item 15 is a 37-page document entitled 'IEDR MkII for OSCAR and HRC Hardware Design Description, prepared by UGL and dated March 2015. It has been categorised by the agency as a design description document. The document describes the architectural design of the IEDR which includes details of the cabling and wiring used on each train car. [NOT FOR PUBLICATION].
I am satisfied that the contents of item 15 and the evidence of Mr. Ale establish that the withheld information contains sufficient technical detail that could reasonably be expected to assist a person endanger or prejudice the IEDR system and the performance of agency functions, or make easier the commission of a criminal offence, within the meaning of clauses 1(f), 2(d) and 2(f). In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given at [75]-[81] above, that there is an overriding public interest consideration against the disclosure of this item.
[38]
Item 16
Item 16 is a101-page PCU software design description for the IEDR MkII for OSCAR and HRC, dated June 2016, prepared by UGL Limited. It has been categorised by the agency as a design description document. The document includes details of the software configuration and architecture of the IEDR system, [NOT FOR PUBLICATION].
I am satisfied that the content of the specific pages of item 16 referred to in the agency's confidential submissions supports Mr. Ale's and Mr. Beavan's evidence that the release of this information could reasonably be expected to have the particular effects described in clause 1(f), 2((d) and 2(f). I am not satisfied, however, that withholding much of the other information in the document is justified under the clauses relied upon by the agency. [NOT FOR PUBLICATION].
In the circumstances, I consider it appropriate to remit this document to the agency for reconsideration and suitable redaction.
[39]
Item 17
Item 17 is a 122-page CCIU software design description for the IEDR MkII for OSCAR and HRC, dated February 2017, prepared by UGL. It has been categorised by the agency as a design description document.
Having reviewed the document, I am satisfied that it contains a substantial amount of material of a detailed nature (including critical components of the IEDR system) that could reasonably be expected to have the nominated effects in clauses 1(f), 2(d) and 2(f). In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given at [75]-[81] above, that there is an overriding public interest consideration against the disclosure of this item.
[40]
Item 18
Item 118 is a 27-page document prepared by UGL Limited for IEDR Mk II for OSCAR Housings design description. It has been categorised by the agency as a design description document.
[NOT FOR PUBLICATION].
Having reviewed the document, I am satisfied that it contains sufficient material of a detailed nature that could reasonably be expected to have the nominated effects in clauses 1(f), 2(d), and 2(f). In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given at [75]-[81] above, that there is an overriding public interest consideration against the disclosure of this item.
[41]
Item 19
Item 19 is an 11-page document entitled 'Nova Systems, UGL Limited IEDR OSCAR critical design review minutes, dated 23 July 2012'. It has been categorised by the agency as a design review minutes document. The document has been prepared in tabular form that records items that were discussed during the meeting including information about the IEDR design and modifications in design as well as [NOT FOR PUBLICATION].
I am satisfied from my consideration of the minutes that disclosure could reasonably be expected to have the submitted effects in clauses 1(f), 2(d), and 2(f). This is so because the minutes describe in sufficient detail information about the location of critical train components that could assist someone with the requisite technical skill to interfere with the operation of the IEDR system. In balancing the competing public interest considerations for and against disclosure I have determined, for the reasons I have given above at [75]-[81], that there is an overriding public interest consideration against the disclosure of this item.
[42]
Item 20
Item 20 is a 10-page document entitled 'IEDR OSCAR preliminary design review close out minutes dated 2 June 2012'. As with item 19, the minutes have been prepared in tabular form that record items that were discussed during the meeting including information about the critical design review of the IEDR and [NOT FOR PUBLICATION].
I am satisfied that the minutes describe in sufficient detail technical aspects of the IEDR system that, if released, could reasonably be expected to have the adverse effects referred to in the evidence of Mr. Ale and Mr. Beavan, within the meaning of clauses 1(f), 2(d) and 2(f). I am also satisfied, for the reasons I have given above at [75]-[81], that the public interest considerations against disclosure outweigh the considerations in support.
[43]
Item 21
Item 21 is a 109-page document entitled 'Nova systems: UGL Limited. IEDR installation design and description dated 20 July 2012. It has been categorised by the agency as a design description document.
[NOT FOR PUBLICATION].
I am satisfied that the document sets out in some detail technical aspects and vulnerabilities of the IEDR system that could be exploited by a person with the requisite knowledge to endanger or prejudice the safety of train passengers and to cause detriment to the effective exercise of the agency's core functions, within the meaning of clauses 1(f) and 2(d). I am also satisfied that access to this information could reasonably be expected to assist a person, so minded, to commit the criminal offences referred to in Mr. Beavan's evidence, within the meaning of clause 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support for the reasons I have given above at [75]-[81].
[44]
Item 22
Item 22 is a 106-page document entitled 'Nova Systems; UGL Limited; IEDR installation design description dated 20 July 2012'. It has been categorised by the agency as a design description document.
I am satisfied, from my consideration of the document, that it includes (as the agency contends) particulars and diagrams of cables and connections and mountings and brackets for the IEDR installation. I am satisfied that the technical information contained in the document supports Mr. Ale's evidence that that the release of the document would expose vulnerabilities of the IEDR system that could reasonably be expected to be exploited by a person, so minded, to endanger the life or safety of passengers within the meaning of clause 2(d). I also accept that disclosure would also prejudice the effective exercise of the agency's core functions under clause 1(f). For the same reason, I am satisfied that the disclosure of the document could facilitate any of the criminal acts referred to in Mr. Beavan's evidence.
Accordingly, I am satisfied that clauses 1(f), 2(d), and 2(f) apply to item 22.as a public interest consideration against disclosure. I am also satisfied, for the reasons I have given above at [75]-[81], that the public interest considerations against disclosure outweigh the considerations in support.
[45]
Item 23
Item 23 is a 26-page document entitled 'IEDR MkII for OSCAR test specification for spurious fault alarm investigation, prepared by UGL Limited, and dated June 2017. It has been categorised by the agency as a testing process document.
I have considered the document. I am satisfied that it reveals [NOT FOR PUBLICATION].
For the reasons I have given above in relation to item 21, I am satisfied that the disclosure of this document may assist someone to tamper or interfere with the IEDR system that could reasonably be expected to have the particular effects in clauses 1(f) and 2(d) by endangering or prejudicing the agency's systems for protecting passenger safety. I am also satisfied, for the same reasons, that the information, if disclosed, could have the specified effects in clause 2(f) by facilitating a terrorist or graffiti offence. I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support.
[46]
Item 24
Item 24 is a 7-page document entitled 'IEDR MkII for OSCAR test specification for spurious fault alarm investigation, revision 2, prepared by UGL Limited. It has been categorised by the agency as a testing process document. This document contains information of substantially the same nature that is set out in item 23. For the same reasons given in relation to item 23, I am satisfied that the disclosure of item 24 could reasonably be expected to have the nominated effects in clauses 1(f), 2(d), and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support.
[47]
Item 25
Item 25 is a 45-page draft investigation report (dated 1 June 2017) that contains information of substantially the same nature as that set out in item 23. For the reasons I have given above in relation to item 23, I am satisfied that the disclosure of item 25 could reasonably be expected to have the nominated effects explained in Mr. Ale's and Mr. Beavan's statements, within the meaning of clauses 1(f), 2(d) and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support, for the reasons I have given above at [75]-[81].
[48]
Item 26
Item 26 is a 51-page installation process document entitled 'IEDR MkII for OSCAR - electrical install field modification instruction', prepared by UGL Limited. It has been categorised by the agency as an 'installation process document.'
[NOT FOR PUBLICATION].
Having regard to the content of the document, I am satisfied that the public interest against disclosure in clauses 1(f), 2(d), and 2(f) is established in relation to item 26 and that the public interest considerations against disclosure outweigh the considerations in support.
[49]
Item 27
Item 27 is a 56-page installation process document equipment fit-out filed modification instruction for the IEDR system, dated August 2015. It has been categorised by the agency as an 'installation process document.' The document sets out in considerable detail [NOT FOR PUBLICATION].
I am satisfied from my consideration of the document that it contains sufficient technical information about the layout and installation of the IEDR system that could reasonably be expected to have the particular effects described in Mr. Ale's and Mr. Beavan's evidence, within the meaning of clauses 1(f), 2(d) and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support, for the reasons I have given above at [75]-[81].
[50]
Item 28
Item 28 is a 14-page installation process document that [NOT FOR PUBLICATION].
I am satisfied that the contents of this document support the agency's evidence that disclosure of the document could reasonably be expected to assist a person to interfere with the functioning of the IEDR system that could have the particular effects in clauses 1(f), 2(d) and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support.
[51]
Item 29
Item 29 is a 27-page installation process document dated January 2019 which, in my view, provides specific information in relation to the IEDR software and functionality that could reasonably be expected to expose vulnerabilities of the IEDR system that could be exploited to endanger the life or safety of train passengers or to assist someone commit a criminal offence within the meaning of clause 2(d) and 2(f). It also satisfies the requirements of clause 1(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support.
[52]
Item 30
Item 30 is a 13-page technical specification document that [NOT FOR PUBLICATION].
Having reviewed the document, I am satisfied it contains sufficient technical information which if disclosed could reasonably be expected to have the particular effects in clauses 1(f), 2(d), and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support, for the reasons I have given above at [75]-[81].
[53]
Item 31
Item 31 is a 16-page technical specification document (dated September 2010) that includes information that [NOT FOR PUBLICATION].
In its submissions dated 26 October 2020, Transport NSW submitted it had released part of item 31 to Ms Else. The information that has been redacted from the document however, is not in evidence. Nonetheless, I am satisfied that the document contains sufficient technical information that could reasonably be expected to assist a person interfere with the IEDR system to cause the harm described in Mr. Ale's and Mr. Beavan's evidence within the meaning of clauses 1(f), 2(d) and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support, for the reasons I have given above at [75]-[81].
[54]
Item 32
Item 32 is a 93-page document that identifies the system specification requirements for the IEDR dated June 2016. It has been categorised by the agency as a technical specification document. The document sets out in significant detail information about the IEDR [NOT FOR PUBLICATION].
In my view, the disclosure of this information could reasonably be expected to assist someone to endanger or prejudice the agency's systems for protecting the safety of its passengers, undermine the agency's capacity to undertake its core functions, and facilitate a terrorist offence or graffiti offence, within the meaning of clauses 1(f), 2(d) and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support.
[55]
Item 33
Item 33 is a 36-page testing process document that includes [NOT FOR PUBLICATION].
Having considered the document, I am satisfied that it contains sufficient technical information that could be exploited by a person so minded to cause the particular harm identified in the agency's evidence, within the meaning of clauses 1(f), 2(d), and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support.
[56]
Item 34
Item 34 is an 18-page testing process document that [NOT FOR PUBLICATION].
Having examined the document, I am satisfied that the public interest considerations in clauses 1(f), 2(d), and 2(f) apply to this information and that those considerations outweigh the considerations in favour of disclosure.
[57]
Item 35
The Tribunal notes that Transport NSW has withdrawn its claim that there is an overriding public interest against the disclosure of this document. Accordingly, this document should be released.
[58]
Item 36
Item 36 is a 238-page factory acceptance test report dated July 2015 which sets out particulars of test results and recommendations in relation to the performance of the IEDR system of an OSCAR train. It has been categorised by the agency as a testing process document.
[NOT FOR PUBLICATION].
I am satisfied the document contains sufficient technical information that could, if disclosed, reasonably be expected to assist a person to interfere with, endanger or prejudice the normal functioning of the IEDR system, within the meaning of clause 2(d). For the same reason, the disclosure could also assist someone commit a criminal offence by undermining the normal operation of the IEDR system. I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support.
[59]
Item 37
Item 37 is a 143-page document that sets out the safety requirements and a compliance assessment for the IEDR system dated August 2016. It has been categorised by the agency as a testing process document.
[NOT FOR PUBLICATION].
I am satisfied that the contents of this report support Mr. Ale's evidence that disclosure of this information could reasonably be expected to provide real assistance to a person, so minded, to interfere with the intended functioning of, or tamper with the IEDR system. By doing so, a person could cause the harm described in the agency's evidence within the meaning of clauses 1(f), 2(d), and 2(f). I am also satisfied that the public interest considerations against disclosure outweigh the considerations in support.
[60]
Item 38
Item 38 is a 142-page compliance statement dated February 2017 that includes information of substantially the same nature referred to in item 37. It has been categorised by the agency as a testing process document. For the reasons I have given in relation to item 37, I am satisfied that the particular effects in clauses 1(f), 2(d), and 2(f) have been established and that there is an overriding public interest consideration against disclosure of this item, for the reasons I have given above at [75]-[81].
[61]
Conclusion and Orders
For the reasons that I have given above I have concluded that, except for the documents in items [3], [5], [7], [9], [10], [12], [14], [16] and [35], the correct and preferable decision is to affirm the agency's decision not to disclose the disputed information to the applicant.
In relation to items [3], [7] and [12], these documents should be remitted to the agency for reconsideration.
In relation to items [9], [10] and [16], these documents be remitted to the agency for reconsideration and redaction in accordance with these reasons.
In relation to items [5], [14], and [35], these documents should be released to Ms. Else within 28 days of the publication of these reasons.
Accordingly, the Tribunal Orders that:
1. The decision of NSW Treasury dated 22 November 2019 is varied to the following effect:
1. Items [5], [14] and [35] be released to the Applicant within 28 days of these orders.
2. Items [3], [7] and [12] be remitted to the agency for reconsideration.
3. Items [9], [10] and [16] be remitted to the agency for reconsideration and redaction in accordance with these reasons.
4. the decision of Transport NSW is otherwise affirmed.
1. Pursuant to s 64 of the Civil and Administrative Tribunal Act 2013 disclosure of:
1. the material filed by the respondent on a confidential basis,
2. those paragraphs of these reasons identified as [NOT FOR PUBLICATION],
3. the submissions made in private before the Tribunal, and
4. the record of that part of the proceedings conducted in private pursuant to s 49 of the Civil and Administrative Tribunal Act 2013,
is prohibited. That material is not to be released to the applicant or the public.
[62]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 12 March 2021
of Police [2020] NSWCATAD 163
Category: Principal judgment
Parties: Sylvia Else (Applicant)
Transport for NSW (Respondent)
Representation: Counsel:
A Edwards (Respondent)