Kennedy v Baker

Federal Court of Australia|2004-05-06|Before: Gyles J, Branson J

introduction 1 The principal issue to be determined in this proceeding is one of statutory construction. That issue is the extent of the power given to an officer executing a search warrant, or to a constable assisting that officer, by subs 3L(1A) of the Crimes Act 1914 (Cth) ('the Crimes Act') to copy data accessed by operating electronic equipment. The Crimes Act was amended, with effect from 21 December 2001, by the Cybercrime Act 2001 (Cth) ('the Cybercrime Act'). Subsection 3L(1A), which is set out in [45] below, was inserted into s 3L by the Cybercrime Act. 2 During the course of the execution of a warrant issued under the Crimes Act ('the Warrant') to search certain business premises ('the Premises') occupied by the applicant ('Mr Kennedy') a 'forensic image' was made of the entire hard drive of a personal computer ordinarily operated by Mr Kennedy's personal assistant. The nature of that image is discussed below. The image so made was saved to the hard drive of another computer ('the imaged hard drive') and the imaged hard drive was removed from the Premises in reliance on the Warrant. 3 In this proceeding Mr Kennedy seeks orders that would prevent the respondents from examining or otherwise dealing with the imaged hard drive and require the delivery up of the imaged hard drive to Mr Kennedy. 4 The background to the issue of the Warrant, and a related warrant, is set out in Kennedy v Wallace [2004] FCA 332. For present purposes it is sufficient to note the matters summarised by Gyles J at [3]-[4] where his Honour observed: 'The immediate events commenced on 30 October 2003 when The Australian Financial Review newspaper (AFR) published a series of articles over a number of pages (commencing with page 1) concerning what was described as a special investigation. The articles published included headlines such as: "Share-trading secrets: A special investigation Rivkin's Swiss bank scandal"

jurisdiction 5 The application by which this proceeding was initiated does not, as the Federal Court Rules require, identify the source of the Court's jurisdiction to grant the relief claimed (see O 4 r 1 and O 4 r 3(1)(b) of the Federal Court Rules). However, by a document headed 'Applicant's Further Amended Written Statement of Nature and Grounds of Application' the application is described as an application under s 5 of the Administrative Decisions (Judicial Review) Act 1977 (Cth) ('the ADJR Act') or alternatively, or in addition, under s 39B of the Judiciary Act 1903 (Cth) ('the Judiciary Act') and under the general law. 6 The effect of a search warrant is to authorise the doing of things that would otherwise be unlawful. The things that are authorised by a search warrant issued under the Crimes Act are, generally speaking, identified in s 3F of that Act. In broad terms a search warrant issued under the Crimes Act authorises entry onto premises, search of those premises and seizure of things found on those premises concerning which the executing officer or a constable assisting hold certain beliefs on reasonable grounds.

7 It is plain that a decision to issue a search warrant under the Crimes Act is a decision under an enactment within the meaning of the ADJR Act and thus amenable to judicial review under that Act (Salerno v National Crime Authority (1997) 75 FCR 133 at 139). However, it is not, in my view, plain beyond doubt that each decision made in reliance on a search warrant issued under the Crimes Act is a decision amenable to judicial review under the ADJR Act. None of the authorities on which Mr Kennedy placed reliance in this regard provides clear authority for that proposition or even for the more limited position that a decision to seize a particular thing in reliance on a search warrant issued under the Crimes Act is a decision amenable to judicial review under the ADJR Act. The authorities on which Mr Kennedy placed reliance were Commissioner of Taxation v Citibank (1989) 20 FCR 403 at 409 ('Commissioner of Taxation v Citibank'); Hart v Commissioner of Federal Police (2002) 124 FCR 384 at 394 ('Hart v Commissioner of Federal Police'); Harts Australia Ltd v Commissioner of Australian Federal Police (2002) 117 FCR 358 at [2] and [9]; Parker v Churchill (1985) 9 FCR 316 at 317; Crane v Gething (2000) 97 FCR 9 at [46] and Lai-Ha v McCusker (2000) 101 FCR 460 at [69]-[76]. It is not necessary to analyse these authorities in detail. In none of them is full consideration given to whether a decision to seize an item in reliance on a search warrant issued under the Crimes Act, as opposed to the decision to issue the warrant itself, is a decision under an enactment within the meaning of the ADJR Act.

8 I note that in Jacobsen v Rogers (1995) 182 CLR 572, a case concerning search warrants, Mason CJ, Deane, Dawson, Toohey and Gaudron JJ at 589 observed: 'As is demonstrated by Baker v Campbell and by this case, if a dispute arises as to the existence of theimmunity [ie public interest immunity],means are available to obtain a judicial determination of the issue.'

However, it must be remembered that Baker v Campbell (1983) 153 CLR 52 was a case brought in the original jurisdiction of the High Court - presumably in reliance on s 75(v) of the Constitution. In Jacobsen v Rogers the jurisdiction of this Court under the ADJR Act had been invoked so far as the decision of the magistrate to issue the warrants was concerned. However, to the extent that injunctions were sought to restrain members of the Australian Federal Police from acting upon the warrants, it appears that reliance was placed on s 39B of the Judiciary Act as then in force and not on the ADJR Act.

9 It is, however, unnecessary for me to reach a concluded view on the extent of this Court's jurisdiction under s 5 of the ADJR Act in the circumstances of this case. The ADJR Act is not the sole source of the Court's judicial review jurisdiction. Section 39B of the Judiciary Act also vests jurisdiction in this Court to undertake judicial review of administrative decisions (Saitta Pty Ltd v Commonwealth of Australia [2000] FCA 1546; 106 FCR 554 per Weinberg J at [89]; McGowan v Migration Agents Registration Authority [2003] FCA 482 per Branson J at [21]-[35]). In particular, par 39B(1A)(c) of the Judiciary Act vests original jurisdiction in this Court in any matter: 'arising under any laws made by the Parliament, other than a matter in respect of which a criminal prosecution is instituted or any other criminal matter.' 10 As was recognised in Hooper v Kirella Pty Ltd [1999] FCA 1584 (FC); 96 FCR 1 at [69], par 39B(1A)(c) confers a 'broad supplementary jurisdiction on the Court in matters arising under laws made by the Parliament.' This proceeding is a 'matter' in the relevant sense in that it 'involves the existence of a controversy as to "some immediate right, duty or liability to be established by the determination of the Court"' (Truth About Motorways Pty Limited v Macquarie Infrastructure Investment Management Limited [2000] HCA 11; 200 CLR 591 per Gaudron J at [43]). It is not a criminal matter. 11 The matter which is the subject of this proceeding concerns the lawfulness of the conduct of the first respondent ('Mr Baker') in causing or permitting to be created the imaged hard drive and the entitlement of the second respondent ('ASIC') to access the data contained in the imaged hard drive or any of that data. Resolution of that controversy or those controversies depends upon the proper construction of subs 3L(1A) of the Crimes Act. That is, this proceeding involves a matter arising under the Crimes Act. The Crimes Act is a law made by the Parliament within the meaning of par 39B(1A)(c) of the Judiciary Act. 12 The relief that Mr Kennedy seeks in this proceeding is declaratory in nature. In Mirvac Homes (NSW) Pty Limited v Airservices Australia (No 1) [2004] FCA 109 at [14]-[16] I observed: 'The powers of this Court to make declarations arises from s 21 of the Federal Court of Australia Act 1976 (Cth) ('the Federal Court Act'). Section 21 provides: "(1) The Court may, in relation to a matter in which it has original jurisdiction, make binding declarations of right, whether or not any consequential relief is or could be claimed. (2) A suit is not open to objection on the ground that a declaratory order only is sought." As Cooper J has recently pointed out in Direct Factory Outlets Pty Ltd v Westfield Management Ltd [2003] FCA 1095 at [14]: "There need not be a cause of action before the power may be exercised, provided the subject matter in respect of which the declaration is sought is within the jurisdiction of the Court and there is a real controversy to be determined …." (citations omitted) In Ainsworth v Criminal Justice Commission (1992) 175 CLR 564 at 581-582 Mason CJ, Dawson, Toohey and Gaudron JJ observed: "It is now accepted that superior courts have inherent power to grant declaratory relief. It is a discretionary power which '[I]t is neither possible nor desirable to fetter ... by laying down rules as to the manner of its exercise.' Forster v. Jododex Aust. Pty. Ltd. (1972), 127 C.L.R. 421, at p. 437, per Gibbs J. However, it is confined by the considerations which mark out the boundaries of judicial power. Hence, declaratory relief must be directed to the determination of legal controversies and not to answering abstract or hypothetical questions. See In re Judiciary and Navigation Acts (1921), 29 C.L.R. 257. The person seeking relief must have 'a real interest' (Forster (1972), 127 C.L.R., at p. 437, per Gibbs J.; Russian Commercial and Industrial Bank v. British Bank for Foreign Trade, Ltd., [1921] 2 A.C. 438, at p. 448, per Lord Dunedin) and relief will not be granted if the question 'is purely hypothetical', if relief is 'claimed in relation to circumstances that [have] not occurred and might never happen' (University of New South Wales v. Moorhouse (1975), 133 C.L.R. 1, at p. 10, per Gibbs J.) or if 'the Court's declaration will produce no foreseeable consequences for the parties' (Gardner v. Dairy Industry Authority (N.S.W.) (1977), 52 A.L.J.R. 180, at p. 188, per Mason J.; see also p. 189, per Aickin J.; 18 A.L.R. 55, at pp. 69, 71 respectively.)"' 13 Plainly the dispute between the parties in this case is neither abstract nor hypothetical and Mr Kennedy has a demonstrable interest in obtaining the relief that he seeks. I am satisfied that par 39B(1A)(c) vests jurisdiction in this Court to hear and determine this proceeding. There is no need for a determination to be made as to whether s 5 of the ADJR Act is an alternative source of jurisdiction.

facts 14 There is limited dispute between the parties as to the subordinate facts in this case. 15 Part 1AA of the Crimes Act, which is comprised of s 3C - s 3ZX, is concerned with search warrants and powers of arrest. On 12 November 2003 an 'issuing officer' as defined by subs 3C(1) of the Crimes Act, acting in reliance of s 3E of the Crimes Act, issued the Warrant to Federal Agent Warren Dominic Gray ('Mr Gray'). Later that same day Mr Gray, acting in reliance on the definition of 'executing officer' contained in subs 3C(1) of the Crimes Act, wrote the name of Mr Baker on the Warrant thereby conferring on Mr Baker the status of 'executing officer' in relation to the Warrant. 16 The Warrant was issued on the basis that the issuing officer was satisfied by information on oath that there were reasonable grounds for suspecting that there was at the Premises 'evidential material' as defined by the Crimes Act which satisfied each of three conditions set out in the Warrant. The three conditions which were set out in the Warrant may be summarised as follows:

(a) one, that the evidential material be originals or copies or drafts of things in certain described categories, including things in those categories stored in electronic or magnetic form, relating to the period 1 January 1991 to the present 'together with any storage medium or storage device which contains any of the above things and any manual, instruction, password or other thing which is needed to gain access to or interpret or decode any of the above things';

(b) two, that the evidential material relate to one or more of certain named persons, firms or entities, and

(c) three, that the evidential material consist of '[t]hings for which there are reasonable grounds for suspecting they will afford evidence as to the commission of' certain alleged offences against the laws of the Commonwealth.

No party argued that the hard drive of which the forensic image was taken was a 'storage medium or storage device' within the meaning of the concluding lines of the first condition of the Warrant.

17 The Warrant, amongst other things, authorised the executing officer or a constable assisting to: '… search the premises for any evidential material that satisfies ALL of the THREE conditions specified above and to seize any such evidential material that may be found.' 18 The Warrant further authorised the executing officer or a constable assisting to exercise such of the powers available under Division 2 of Part 1AA of the Crimes Act as 'are appropriate in the circumstances of the case'. Section 3L of the Crimes Act is a power available under Division 2 of Part 1AA of the Crimes Act. 19 Section 3ZX of the Crimes Act provides that Part 1AA of that Act does not affect the law relating to legal professional privilege. In apparent recognition of that provision, the Warrant contained the following note: 'This warrant is issued in recognition that a claim for legal professional privilege may be made in respect of documents covered by this warrant and on the understanding that, if that occurs, the executing officer will, as far as is reasonably practicable, follow the course of action set out in the document entitled "Claims for Legal Professional Privilege: Premises other than those of a Lawyer, Law Society or Like Institution" a copy of which is attached to this warrant.' 20 The document entitled 'Claims for Legal Professional Privilege: Premises other than those of a Lawyer, Law Society or Like Institution' ('the Claim for LPP document') which was attached to the warrant was, it may be assumed, drafted before the enactment of the Cybercrime Act. Relevantly the Claim for LPP document provides: 'If a claim is made for legal professional privilege in respect of any document covered by the warrant, and if the person claiming privilege is prepared to cooperate with the executing officer, the following procedure will be followed to the extent to which it is possible to do so: 1. The executing officer or a constable assisting will prepare a list of the relevant documents in cooperation with the person claiming privilege. The list will show the general nature of each document, the ground on which privilege is claimed, and the name of the person claiming privilege; 2. The documents will be placed in an envelope or other container which will be sealed; 3. The list and the container will be endorsed with a note to the effect that, having regard to the claim for privilege, the warrant has not been executed in respect of the documents set out in the list and that those documents have been sealed in the container pending resolution of the claim; 4. The list and the container will be signed by the executing officer or constable assisting and the person claiming privilege; 5. The sealed container and a copy of the list will be delivered to a third party agreed between the executing officer or constable assisting and the person claiming privilege; 6. The third party shall hold the container and the copy of the list pending resolution of the claim for privilege; …' 21 On 13 November 2003 at approximately 7.55 am Mr Baker, together with two other members of the Australian Federal Police, three officers of ASIC including Ronald Frederick Dunlop ('Mr Dunlop') and John Hunter, an employee of PricewaterhouseCoopers, entered the Premises for the purpose of executing the Warrant. During the course of the day additional employees of PricewaterhouseCoopers arrived at the Premises to assist in the search for evidential material located on computers on the Premises. Graham Donald Henley ('Mr Henley'), who leads PricewaterhouseCoopers' Australian computer forensic team, arrived at the Premises at some time after 9.00 am on 13 November 2003. It is accepted that each of the individuals who assisted Mr Baker in the execution of the Warrant was a 'constable assisting' within the meaning of Part 1AA of the Crimes Act. 22 Cristin Cecilia Toman ('Ms Toman') is a solicitor employed by the firm Atanaskovic Hartnell. As at 13 November 2003 Atanaskovic Hartnell were Mr Kennedy's solicitors. At about 9.40 am on 13 November 2003 Ms Toman arrived at the Premises and identified herself to Mr Baker as a solicitor acting on behalf of Mr Kennedy. Mr Baker provided her with a copy of the Warrant and the annexures to the Warrant which included the Claim for LPP document. 23 Soon after her arrival at the Premises, Ms Toman asked to examine material being collected for seizure under the Warrant. She subsequently repeated her request and shortly before noon she was allowed to examine a number of items that had been identified for seizure. In respect to a particular document that she was allowed to examine Ms Toman made a claim of legal professional privilege. That document was thereafter sealed in an envelope and lodged with the Court. The imaged hard drive had not been made at the time that Ms Toman made this claim of legal professional privilege. 24 It was Mr Henley who made the imaged hard drive. The following three paragraphs summarise unchallenged affidavit evidence given by Mr Henley. 25 Computer data can be easily altered and merely turning a computer on causes data stored within the computer to change. A principal objective in the forensic examination of a computer system is to ensure that data on the computer system is not altered by the examiner during the examination process. 26 The first step that Mr Henley took in his examination of the computer ordinarily used by Mr Kennedy's personal assistant was to remove the hard drive ('the examined hard drive'); that is, the component inside the computer containing a magnetic medium on which computer files are stored. After taking steps to ensure that the examined hard drive could later be identified, Mr Henley connected it to a device known as a 'Fastbloc'. Once a hard drive is connected to a Fastbloc it is not possible to alter its contents. Mr Henley then connected the Fastbloc to his own computer system and used additional forensic software to preview, in a read‑only environment, the contents of the examined hard drive. The forensic software used by Mr Henley allowed him to access all parts of the examined hard drive including those areas which contain deleted files. 27 To assist Mr Baker in making a determination as to whether the examined hard drive contained data relevant to the search warrant, Mr Henley used the forensic software available to him to search the examined hard drive for specific keywords. This search took approximately an hour and a half to complete. Thereafter Mr Henley, by operating his computer to put data that contained keyword 'hits' into readable form on the computer, identified a number of files and certain deleted data that he believed may have been relevant to the search warrant. At approximately 11.30 am he showed this data in readable form to Mr Baker and Mr Dunlop. 28 The case of the respondent with respect to the imaged hard drive is dependent upon the view formed by Mr Baker of a single file located by Mr Henley on the examined hard drive. Mr Baker gave evidence, which was not challenged, that he read on the screen of a computer being operated by Mr Henley the entire content of a file that Mr Henley drew to his attention. I understand Mr Baker to intend to convey by this evidence that he read, on the screen of a computer being operated by Mr Henley, text that resulted from the file located by Mr Henley being put into readable form. I am satisfied that what was read by Mr Baker is reproduced as annexure 'L' ('Annexure 'L') to Mr Baker's affidavit sworn on 6 February 2004. It is not necessary to reproduce Annexure 'L' here. It is sufficient to note that it appears to be a short communication sent by Mr Kennedy to the Private Client Settlement Department of Bell Securities Limited on 27 October 1994. It contains what might readily be inferred to be instructions concerning settlement of a contract note for the sale of 83,000 shares in Offset Alpine Printing Limited ('OAP'). Those instructions apparently require the proceeds of the sale of the shares to be made payable to Timsa 69 Pty Ltd notwithstanding that the relevant script was not held in the name of that company. 29 Mr Baker gave evidence that he formed the view that the file, which I will refer to for convenience as 'Annexure 'L'', met all three conditions of the Warrant. Mr Kennedy invited me to find that Mr Baker formed no such belief. He placed reliance particularly on the fact that the property seizure record entry in respect of the imaged hard drive, unlike the equivalent entries for other items seized, does not identify in respect of the third condition an alleged offence specified in the Warrant. Mr Baker, who signed but did not create the property seizure record, was not able under cross-examination to provide an explanation for that fact. However, he did give evidence of the process of reasoning which caused him to conclude that there were reasonable grounds for suspecting that Annexure 'L' would afford evidence as to the commission of the following offences against the laws of the Commonwealth identified in the third condition of the Warrant under the heading 'RIVKIN': '(a) An offence or offences against s.64(1) of the ASIC Act, 1989 as taken to be included in the ASIC Act, 2001 by s.276 of that Act, namely that on 6 June 1995 and 6 September 1995 Rivkin gave evidence in the course of a s.19 ASIC Act examination ("s.19 examination") that was false or misleading in a material particular, namely in relation to the ownership of shares held by EBC and Leumi in OAP. (b) An offence or offences against s.35 of the Crimes Act 1914 ("the Crimes Act"), namely that on 6 June 1995 and 6 September 1995 Rivkin intentionally gave false testimony in the course of a s.19 examination, namely in relation to the ownership of shares held by EBC and Leumi in OAP. ….' 30 Mr Baker gave evidence, which I accept, first that he believed Timsa 69 Pty Ltd to be a company with which Mr Rivkin had some involvement and secondly, that, having regard to the date of Annexure 'L', he formed the view that the file was relevant to, in effect, the veracity of evidence which he understood Mr Rivkin to have given to ASIC in 1995 that he had no information concerning the true ownership of shares in OAP which were held by the Swiss Banks, Leumi and EBC. 31 The accuracy and reasonableness of Mr Baker's beliefs that Timsa 69 Pty Ltd was a company with which Mr Rivkin had some involvement and that Mr Rivkin had given evidence to ASIC in 1995 that he had no information concerning the true ownership of shares in OAP that were held by the Swiss Banks, Leumi and EBC, were not challenged. 32 Mr Baker instructed Mr Henley to take an image of the examined hard drive. Immediately thereafter Mr Baker advised Ms Toman that a copy was to be made of the examined hard drive. Ms Toman asked him why the files containing the key words could not be printed and I find that Mr Baker responded in terms that indicated that such a process was impractical because of the time that it would take. Mr Henley's acquisition notes in respect of the imaged hard drive disclose that the imaged hard drive was made at 11.46 am. 33 I am satisfied that Ms Toman did not on 13 November 2003 claim legal professional privilege in respect of the imaged hard drive, or any of the data copied to the imaged hard drive. Nor did Ms Toman on that day raise with Mr Baker, or any persons assisting him in the execution of the Warrant, the possibility that the imaged hard drive might contain material that would attract legal professional privilege. She did not seek further time within which to give consideration to her client's rights with respect to the imaged hard drive, or any of the data copied to it, before the imaged hard drive was removed from the Premises. 34 Lawrence John Tucker‑Gardiner ('Mr Tucker-Gardiner'), a member of the Australian Federal Police, fulfilled the role of property officer in respect of the execution of the Warrant. In that role it was his responsibility to collect and record the details of items that were collected for seizure in a property seizure record ('PSR'). The search of the Premises was completed at about 5.00 pm on 13 November 2003. Not long thereafter Mr Baker reviewed the collected items and indicated that certain of them were not to be seized. 35 At about 5.25 pm on 13 November 2003, while another member of the Australian Federal Police operated a video camera to record the process, Mr Tucker-Gardiner showed Ms Toman all of the items seized during the search and their corresponding entry in the PSR for the purpose of completing the PSR. Mr Baker and Mr Kennedy's son, Joseph Kennedy, were also present while the PSR was being completed. Both the video recording and a transcript of the audio component of the recording were received in evidence. 36 Of the eighteen items collected for seizure, Mr Baker determined that only five were to be removed from the Premises. The remaining items were returned by being handed to Ms Toman who signed the PSR against the relevant entries to acknowledge that she had received them. The document in respect of which Ms Toman had earlier made a claim of legal professional privilege had, as is mentioned above, been sealed in an envelope and taken from the Premises to be lodged with the Court. Of the remaining four items consideration needs be given here only to the imaged hard drive. 37 The imaged hard drive was drawn to the attention of Ms Toman at the time that the PSR was being completed. She was advised that it was to be retained. The transcript of the audio component of the recording referred to above is incomplete. A number of things said by Ms Toman in particular are not clearly audible on the recording. Ms Toman gave affidavit evidence that she has no memory of raising the question of legal professional privilege in relation to data on the imaged hard drive and, as is mentioned above, I am satisfied that she did not do so. However, Ms Toman gave affidavit evidence that some time on 13 November 2003 she said to Mr Baker words to the effect: 'I am concerned about the hard drive' and that, after Mr Baker advised her that objections concerning the material to be seized should be raised with ASIC, she responded: 'We will write to ASIC and raise our concerns tomorrow.' Ms Toman also gave affidavit evidence that as the PSR was being completed she said to Mr Baker words to the effect: 'We've got some questions about the hard drive. So what I'll do is, I'll go back to my office and write to ASIC raising my concerns.' 38 Mr Baker's affidavit evidence was that he did not recall Ms Toman saying that she had concerns about the hard drive and that if she had mentioned concerns about the hard drive he would have asked her to identify her concerns. I think that it is more likely than not that if Ms Toman had stated expressly that she had concerns about the hard drive Mr Baker would have pursued the issue of the nature of her concerns with her. I do not consider that Ms Toman sought in any way to mislead the Court but I find that Ms Toman did not expressly state to Mr Baker that she has 'concerns' about the hard drive. Ms Toman's recollection in this regard may have been influenced by the fact that, as it appears, she did have concerns about the imaging of the hard drive and, as is not disputed, when she was advised that the hard drive would be copied, she queried why it would not be sufficient for the files containing the key words to be printed out. 39 I am satisfied that at the conclusion of the process of completing the PSR Ms Toman, in response to a question from Mr Baker, indicated that she had no complaints about the way the search had been conducted. Almost immediately thereafter she said something to Mr Baker about contacting, or possibly contacting, ASIC and Mr Baker responded by acknowledging ASIC as the appropriate body to contact on the basis that Mr Dunlop 'has actually signed receipt for those items now'. Having viewed and listened with great care to the relevant portion of the video recording, I am satisfied that Ms Toman made a shorter statement than her recollection now suggests. I think it likely that she did not refer specifically to the hard drive. I conclude that she probably made a statement by which she confirmed her understanding that any concerns that might thereafter arise with respect to any of the items seized should be raised with ASIC. 40 Although I do not understand it to be disputed, I formally find that on 13 November 2003 Ms Toman could not have reviewed on a computer screen, in documentary form or, indeed, in any form, the content of the imaged hard drive or even the files thereon which gave rise to the keyword 'hits'. Assuming that a claim for legal professional privilege may be made in respect of a hard drive (see [47] below), she could not on that day have determined by reviewing the content of the imaged hard drive whether the imaged hard drive was or included material for which legal professional privilege could have been claimed.

Crimes Act 1914 (Cth) 41 Subsection 3C(1) of the Crimes Act contains definitions which, unless the contrary intention appears, are relevant to the interpretation of Part 1AA of the Crimes Act. The following are some of the definitions contained in subs 3C(1): data includes: (a) information in any form; or (b) any program (or part of a program). data held in a computer includes: (a) data held in any removable data storage device for the time being held in a computer; or (b) data held in a data storage device on a computer network of which the computer forms a part. data storage device means a thing containing, or designed to contain, data for use by a computer. evidential material means a thing relevant to an indictable offence or a thing relevant to a summary offence, including such a thing in electronic form. executing officer, in relation to a warrant, means: (a) the constable named in the warrant by the issuing officer as being responsible for executing the warrant; or (b) if that constable does not intend to be present at the execution of the warrant - another constable whose name has been written in the warrant by the constable so named; or (c) another constable whose name has been written in the warrant by the constable last named in the warrant. offence means: (a) an offence against a law of the Commonwealth (other than the Defence Force Discipline Act 1982); or (b) an offence against a law of a Territory other than the Australian Capital Territory. warrant means a warrant under this Part. warrant premises means premises in relation to which a warrant is in force. 42 Section 3F is concerned to identify the things that are authorised by a search warrant. Subsection (1) of the section relevantly provides: 'A warrant that is in force in relation to premises authorises the executing officer or a constable assisting: … (c) to search the premises for the kinds of evidential material specified in the warrant, and to seize things of that kind found at the premises; and (d) to seize other things found at the premises in the course of the search that the executing officer or a constable assisting believes on reasonable grounds to be: (i) evidential material in relation to an offence to which the warrant relates; or (ii) evidential material in relation to another offence that is an indictable offence; or (iii) evidential material (within the meaning of the Proceeds of Crime Act 2002) or tainted property (within the meaning of that Act); if the executing officer or a constable assisting believes on reasonable grounds that seizure of the things is necessary to prevent their concealment, loss or destruction or their use in committing an offence; and ….' 43 Section 3G authorises an executing officer to obtain such assistance in executing a warrant as is necessary and reasonable in the circumstances. 44 Section 3K is concerned to authorise the examination of things found at search premises. Relevantly s 3K provides: '(1) The executing officer or constable assisting may bring to the warrant premises any equipment reasonably necessary for the examination or processing of a thing found at the premises in order to determine whether it is a thing that may be seized under the warrant. (2) A thing found at the premises may be moved to another place for examination or processing in order to determine whether it may be seized under a warrant if: (a) both of the following apply: (i) it is significantly more practicable to do so having regard to the timeliness and cost of examining or processing the thing at another place and the availability of expert assistance; (ii) there are reasonable grounds to believe that the thing contains or constitutes evidential material; or (b) the occupier of the premises consents in writing. (3) If a thing is moved to another place for the purpose of examination or processing under subsection (2), the executing officer must, if it is practicable to do so: (a) inform the occupier of the address of the place and the time at which the examination or processing will be carried out; and (b) allow the occupier or his or her representative to be present during the examination or processing.' 45 The terms of s 3L, as is mentioned above, are critical to the present application. Relevantly, s 3L provides: '(1) The executing officer or a constable assisting may operate electronic equipment at the warrant premises to access data (including data not held at the premises) if he or she believes on reasonable grounds that: (a) the data might constitute evidential material; and (b) the equipment can be operated without damaging it. (1A) If the executing officer or constable assisting believes on reasonable grounds that any data accessed by operating the electronic equipment might constitute evidential material, he or she may: (a) copy the data to a disk, tape or other associated device brought to the premises; or (b) if the occupier of the premises agrees in writing - copy the data to a disk, tape or other associated device at the premises; and take the device from the premises. (1B) If: (a) the executing officer or constable assisting takes the device from the premises; and (b) the Commissioner is satisfied that the data is not required (or is no longer required) for: (i) investigating an offence against the law of the Commonwealth, a State or a Territory; or (ii) judicial proceedings or administrative review proceedings; or (iii) investigating or resolving a complaint under the Complaints (Australian Federal Police) Act 1981 or the Privacy Act 1988; the Commissioner must arrange for: (c) the removal of the data from any device in the control of the Australian Federal Police; and (d) the destruction of any other reproduction of the data in the control of the Australian Federal Police. (2) If the executing officer or a constable assisting, after operating the equipment, finds that evidential material is accessible by doing so, he or she may: (a) seize the equipment and any disk, tape or other associated device; or (b) if the material can, by using facilities at the premises, be put in documentary form - operate the facilities to put the material in that form and seize the documents so produced. (3) A constable may seize equipment under paragraph (2)(a) only if: (a) it is not practicable to copy the data as mentioned in subsection (1A) or to put the material in documentary form as mentioned in paragraph (2)(b); or (b) possession by the occupier of the equipment could constitute an offence. (4) If the executing officer or a constable assisting believes on reasonable grounds that: (a) evidential material may be accessible by operating electronic equipment at the premises; and (b) expert assistance is required to operate the equipment; and (c) if he or she does not take action under this subsection, the material may be destroyed, altered or otherwise interfered with; he or she may do whatever is necessary to secure the equipment, whether by locking it up, placing a guard or otherwise.' 46 Section 3N is concerned with the provision of copies of things seized under a warrant relating to premises. Section 3N provides: '(1) Subject to subsection (2), if a constable seizes, under a warrant relating to premises: (a) a document, film, computer file or other thing that can be readily copied; or (b) a storage device the information in which can be readily copied; the constable must, if requested to do so by the occupier of the premises or another person who apparently represents the occupier and who is present when the warrant is executed, give a copy of the thing or the information to that person as soon as practicable after the seizure. (2) Subsection (1) does not apply if: (a) the thing that has been seized was seized under subsection 3L(1A) or paragraph 3L(2)(b); or (b) possession by the occupier of the document, film, computer file, thing or information could constitute an offence.'

Identification of grounds 47 The written outline of Mr Kennedy's final submissions identifies four grounds upon which Mr Kennedy contends that he is entitled to the relief sought by him in this proceeding. The four grounds are as follows: 'First, on its proper construction section 3L(1A) of the Crimes Act 1914 (Cth) (the Crimes Act) did not authorise Mr Baker's imaging and removal of the entire content of the imaged hard drive. Secondly, the respondents, who effectively bear the onus of proof, have failed to establish that any file on the imaged hard drive (including the file that is annexure L to Mr Baker's affidavit sworn 6 February 2004) (Annexure L) satisfied all three of the conditions described in the warrant, or in more technical terms that Mr Baker believed on reasonable grounds that any data on the hard drive might constitute evidential material as the basis for exercising the powers under s 3L(1A) of the Crimes Act. Thirdly, the first respondent failed to give the applicant any or adequate opportunity to claim legal professional privilege. Fourthly, … the imaging and removal of the content of the imaged hard drive was unlawful because the said content included communications to which legal professional privilege attached.'

I shall consider the grounds upon which Mr Kennedy relies in the above order.

Subsection 3L(1A) of the Crimes Act 48 Mr Kennedy submitted: 'Even if Mr Baker formed the belief on reasonable grounds that Annexure L satisfied all three conditions described in the warrant (although as to which see further below), and might constitute evidential material, Baker was not authorised by section 3L(1A) of the Crimes Act to image and seize all of the data on the hard drive. Baker should have copied into documentary form under section 3L(2) or imaged under section 3L(1A)(a) the single file which, in his belief, satisfied the three conditions, namely Annexure L, or if circumstances permitted moved the computer under section 3K(2) The opening words of section 3L(1A) refer to "any data accessed by operating the electronic equipment". Sub-paragraphs 3L(1A)(a) and (b) authorise the executing officer to copy "the data". The reference to "the data" in sub-paragraphs 1A(a) and (b) must be to the same "data" referred to in the opening words of section 3L(1A): had the legislature intended to draw some distinction between the operation and effect of the word "data" appearing in the fourth and fifth lines of section 3L(1A) from its operation and effect in the second line it would have said so. Search warrant provisions are strictly construed because they concern interferences with previously existing common law rights: Crowley v Murphy (1981) 52 FCR 123 at 129; Commissioner of Taxation v Citibank (1989) 20 FCR 403, 432-433; Question of Law Reserved (No 1 of 1998) (1998) 70 SASR 281, 296; Hart v Commissioner, Federal Police (2002) 124 FCR 384, 399-401.' 49 By contrast, Mr Baker argued that 'data on a hard drive is one thing, a unit: it is either there or it is not'. On that basis Mr Baker contended: 'Section 3L(1) as amended proceeds on the basis that data, as a whole, might or might not constitute evidential material. Under s. 3L(1) that data (including data not held at the premises) may be accessed by the executing officer or a constable assisting by operating electronic equipment at the warrant premises. Then, by s. 3L(1A) if the executing officer or constable assisting believes on reasonable grounds that any data accessed (including data not held at the premises) might constitute evidential material he or she may copy the data. The word in s. 3L(1A) "any" data means "any of the data (including data not held at the premises)" or "some of the data (including data not held at the premises)". If any of the data might constitute evidential material then the data is authorised to be copied to a disk, tape or other associated device brought to the premises and s.3L(1A) authorises the taking of the device from the premises. "The data" does not mean "only that part of the data that the officer believed might constitute evidential material.' (footnote omitted)

ASIC adopted the submissions of Mr Baker in this regard.

50 Additionally, ASIC argued that the construction of subs 3L(1A) for which Mr Kennedy contended ignores the fact that the subsection was inserted in the Crimes Act by the Cybercrime Act for the purpose of expanding, not contracting, the ambit of search warrant powers in respect of computers. The construction attributed to subs 3L(1A) by Mr Kennedy, ASIC argued, would, if correct, place an officer executing a search warrant in a more restricted position in relation to data than would be the case at common law. 51 The provisions of s 3L of the Crimes Act that are relevant for present purposes are set out in [45] above. The appropriate approach to the construction of statues that authorise the search of premises and the seizure of things from them was considered by the Full Court in Hart v Commissioner of Federal Police (French, Sackville and R D Nicholson JJ) at [64]‑[68]. In particular at [64]-[65] their Honours observed: 'The construction of statutes authorising the search of premises and the seizure of things from them begins with the ordinary meaning of the words considered according to their context and the legislative purpose. This reflects the primary object of all statutory construction which, according to Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355 at 381, per McHugh, Gummow, Kirby and Hayne JJ, is "to construe the relevant provision so that it is consistent with the language and purpose of all the provisions of the statute". The importance of purpose and policy was emphasised in that case by reference to the observation of Dixon CJ in Commissioner for Railways (NSW) v Agalianos (1955) 92 CLR 390 at 397: "the context, the general purpose and policy of a provision and its consistency and fairness are surer guides to its meaning than the logic with which it is constructed." The purpose of search and seizure provisions is to provide for the gathering ofinformation to determine whether offences have been committed and to facilitate proof of them: Rogers v Moore (1992) 39 FCR 201 at 217 per French J. Recognition of that purpose may yield a construction of the legislative words that is not necessarily narrowly defined. Remaining ambiguity or doubt whether of meaning or application will, in accordance with authority, be resolved in favour of the rights and freedoms of the subject.' 52 Section 3L is to be construed in the context provided by Part 1AA of the Crimes Act. The general purpose and policy of s 3L in its present terms is, however, to be identified having regard to the fact that s 3L, together with some of the other provisions in Part 1AA, were significantly amended by the Cybercrime Act. In particular, subs 3L(1A) was inserted into Part 1AA by the Cybercrime Act. The long title of the Cybercrime Act is 'An Act to amend the law relating to computer offences, and for other purposes'. 53 I consider it appropriate to commence consideration of the proper construction of subs 3L(1A) by seeking to identify how the term 'data' is used in Part 1AA of the Crimes Act. The definitions of 'data' and 'data held in a computer', which were added to s 3C of the Crimes Act by the Cybercrime Act, are not exhaustive in nature; rather they extend the ordinary meaning of the word 'data' and the phrase 'data held in a computer'. It appears that the Cybercrime Act was drafted using 'data' as a singular collective noun. For example, in s 3LB of the Crimes Act, which was inserted by cl 12 of Schedule 2 of the Cybercrime Act, the phrases 'data that is held on premises' and 'the data has been accessed under a warrant' appear. This usage of 'data' as a singular collective noun is in accord with the Australian Government Style Manual 5th Edition which at par 3.16 states: 'Data is the plural of the singular noun datum. However,data is commonly treated as a singular collective noun in data processing. For example: Ensure that the data entered is rigorously checked.' 54 The Macquarie Dictionary 2nd Edition relevantly defines 'data' in the following way: '(construed as sing. or pl.) figures, etc., known or available; information.' 55 The Oxford English Dictionary 2nd Edition does not, it seems, accept the use of 'data' as a singular collective noun. However, a relevant meaning given by the Oxford English Dictionary to the plural of 'datum' is: 'The quantities, characters, or symbols on which operations are performed by computers and other automatic equipment, which may be stored or transmitted in the form of electrical signals, records on magnetic tape or punched cards, etc.' 56 I conclude that in Part 1AA of the Crimes Act the term 'data' is used as a singular collective noun in the sense of a mass or body of characters or symbols constituting information capable of being processed into accessible form by electronic equipment. It may, I think, be assumed that computers are the kind of electronic equipment to which s 3L is primarily directed. For ease of expression I will hereafter refer to 'computers' rather than to 'electronic equipment'. 57 The fact that in Part IAA of the Crimes Act, as I conclude, the term 'data' is used as a singular collective noun does not mean that, within the meaning of Part IAA, any individual computer necessarily has access to only one body of data. It may, I think, now be regarded as notorious that by operating a computer, data from a number of quite separate sources may be able to be accessed. A personal computer, for example, will be able to access data in its own hard drive or hard drives. It is likely also to be able to access data held in a floppy disk or compact disk. If it forms part of a network, it may be able to access data in the hard drive of another computer in the same network. These statements are not intended to be exhaustive as to the data that may be able to be accessed from a personal computer. 58 Subsection 3L(1) (see [45] above) authorises the executing officer or a constable assisting to operate a computer to access data if he or she believes on reasonable grounds the things set out in paragraphs (a) and (b) of the subsection. I doubt that subs 3L(1) is intended to authorise the executing officer to operate a personal computer to access, for example, data in the computer's hard drive because he or she believes on reasonable grounds that data in a floppy disk might constitute evidential material (par 3L(1)(a)) and the computer can be operated without damaging it (par 3L(1)(b)). However, I am not presently required to determine this question. 59 The language of subs 3L(1A), by contrast with subs 3L(1), demonstrates, as it seems to me, a clear recognition that data from separate sources may be able to be accessed by operating a computer. It is concerned, in my view, to give an authority to copy to an executing officer, or constable assisting, who holds a certain belief on reasonable grounds concerning data from a particular source that can be accessed by operating the computer. 60 The critical issue for present purposes, as it seems to me, is whether, for the purposes of subs 3L(1A), the information stored in the hard drive of a personal computer is to be regarded as data from a single source, in the sense that it is a single thing constituted by a body of characters or symbols, or whether it is to be regarded as a collection of computer files each of which constitutes a source of data. The only technical evidence placed before me relevant to this issue is the evidence of Mr Henley, referred to above, that a hard drive is a computer component containing a magnetic medium on which computer files are stored. Mr Henley's evidence suggests that a hard drive does not consist of a number of individual components of magnetic media such that, for example, on one component is stored files constituting an operating system, on another component is stored files constituting application software and on other components are stored files created by the user or users of the computer. Rather Mr Henley's evidence suggests that a hard drive contains a single magnetic medium. On this basis I infer that in reality a hard drive contains one body of information in the sense of one mass or block of characters or symbols ‑ albeit that the computer can be operated to access selectively certain parts of that information. 61 A more important consideration, however, is whether the context in which subs 3L(1A) is found assists in determining the issue identified in [60] above. In my view, assistance is to be found in Part 1AA of the Crimes Act. 62 First, Part 1AA recognises a distinction between 'data' and a 'computer file'. Section 3N, which is set out in [46] above, contains references to computer files. As the Full Court noted in Hart v Commissioner of Federal Police at [95]: 'The expression "computer file" is not defined in the Crimes Act. A technical dictionary published shortly before the enactment of Pt 1AA of the Crimes Act (Chambers Science and Technology Dictionary (1988)) defines "file" in relation to a computer as a "General term for named set of data items stored in machine readable form". A more recent technical dictionary, Prentice Hall's Illustrated Dictionary of Computing (2nd ed, 1995) defines a "file" as "A collection of records each stored on a secondary storage medium such as a diskette or hard disk". ….'

The above technical definitions carry the implication, as it seems to me, that a computer file is a subset of a larger body of data.

63 Secondly, subs 3L(1B) is drawn in terms that assume that the data authorised to be copied by subs 3L(1A) is a single thing. If the drafter of the provision had proceeded on the basis that each file within, for example, a hard drive had its own data, it seems to me that par 3L(1B)(b) would have been drawn to reflect the possibility of some of the data being no longer required. 64 Thirdly, it seems to me that the language of subs 3L(1A) itself is suggestive of the drafter proceeding on the basis that the data referred to in the phrase 'any data accessed by operating the electronic equipment' is a single thing, not a collection of things. Had the drafter not proceeded on this basis, one would have expected subsection (1A) to have been drawn to authorise the copying of 'that data' rather than, as it does, the copying of 'the data'. 65 An additional consideration relevant to the context in which subs 3L(1A) is found, is that Part 1AA of the Crimes Act was amended by the Cybercrime Act. Although subs 3L(1A) has general application to the execution of search warrants issued under the Crimes Act, it may be assumed to have been intended particularly to assist law enforcement officers in the investigation of the offences created by the Cybercrime Act. Offences created by the Cybercrime Act ('computer offences') include causing unauthorised access to data held in a computer, causing unauthorised modification of data held in a computer and causing unauthorised impairment of electronic communication to or from a computer (see Schedule 1 to the Cybercrime Act). A construction of subs 3L(1A) which meant that the subsection only authorised the copying of data in a hard drive where that data was held in a file concerning which the executing officer or constable assisting held a belief on reasonable grounds that the data from that file might constitute evidential material would, as it seems to me, significantly limit the subsection's capacity to assist law enforcement officers investigate computer offences. 66 Having regard to the above factors, I take the view that the ordinary meaning conveyed by the text of par 3L(1A)(a) is that if the executing officer or constable assisting believes on reasonable grounds that data from a particular source accessed by operating a computer might constitute evidential material, he or she may copy the data from that source to a disk, tape or other associated device brought to the premises. A computer hard drive is, in my view, a single source of data within that meaning. 67 Reference to the Explanatory Memorandum circulated in respect of the Cybercrime Bill 2001 ('the Explanatory Memorandum') and to the Attorney-General's second reading speech for the Cybercrime Bill ('the Second Reading Speech') confirms that the intended meaning of par 3L(1A)(a) is the ordinary meaning conveyed by the text as identified above. Authority for referring to these extrinsic materials is, in the circumstances, found in s 15AB of the Acts Interpretation Act 1901 (Cth). 68 The Explanatory Memorandum at pp 16-17 states: 'Proposed subsection 3L(1A) would enable law enforcement officers executing a search warrant to copy data held on any electronic equipment or associated devices at search premises to a storage device where there are reasonable grounds for suspecting that the data contains evidential material. This will permit officers to copy all data held on a computer hard drive or data storage device if some of the data contains evidential material or if there are reasonable grounds to suspect the data contains evidential material. The existing provision only allows evidential material to be copied (Crimes Act, paragraph 3L(2)(c)). Electronic equipment, such as a computer hard drive, can hold large amounts of data. It is often not practicable for officers to search all the data for evidential material while at the search premises and to then copy only the evidential material which is found. The proposed provision would allow officers to copy all the data on a piece of electronic equipment (by imaging a computer hard drive for example) in situations where an initial search of the data uncovers some evidential material or where the officer believes on reasonable grounds that the equipment might contain evidential material.' 69 The Second Reading Speech includes the following passage: 'A further proposed amendment would permit officers to copy all data held on a computer hard drive or data storage device where some of the data is evidential material or if there are reasonable grounds to suspect the data contains evidential material.' 70 I reject the contention that, even if Mr Baker formed the belief that Annexure 'L' satisfied all three conditions described in the Warrant, Mr Baker was not authorised by subs 3L(1A) of the Crimes Act to copy all of the data held on the examined hard drive, thus creating the imaged hard drive, and to take the imaged hard drive from the Premises. 71 Mr Kennedy contended that the appropriate course for Mr Baker to have followed was one or more of the following:

(a) to remove the personal computer ordinarily used by Mr Kennedy's personal assistant, to another place for the purpose of subsequent examination (see subs 3K(2) of the Crimes Act); (b) to operate the personal computer to put Annexure 'L', or any of the other computer files identified by Mr Henley as a result of his keyword search, into documentary form and seize the documents so produced (see par 3L(2)(b); or (c) to secure the personal computer (see subs 3L(4)).

72 Nothing in the language of subs 3L(1A) suggests that the authority that the subsection gives to an executing officer may only be exercised where no other course is reasonably open to that executing officer. In any event, difficulties attend the alternative courses identified by Mr Kennedy. 73 Subsection 3K(2) authorises the removal of '[a] thing found at the premises' to another place for examination or processing in order to determine 'whether it may be seized under a warrant'. That is, subs 3K(2) appears to contemplate the eventual seizure of the thing moved itself, not the seizure by copying of some part of that thing, or the processing of that thing to put some material from it into documentary form and the seizure of the documents so created. 74 As I understand Mr Kennedy's contentions, they do not accept that Mr Baker could ever have concluded that the personal computer could be seized under the Warrant. In any event, the time limits imposed by subs 3K(3A) and (3B), and by the Warrant itself (Hart v Commissioner of Federal Police at [86]), could have rendered impracticable full examination at another place of the examined hard drive. 75 The difficulties that would, or might, have attending reliance of subs 3K(2) would in large part have also attended a decision to secure the personal computer in reliance on subs 3L(4). 76 As to the option of putting the files identified by Mr Henley, or those of them considered relevant by Mr Baker, into documentary form and seizing the documents so produced, Mr Henley gave evidence as follows: 'It is technically possible to copy from [the examined] hard drive … the files identified as relevant by Federal Agent Baker. However, this is not the standard forensic practice for reasons that include: (i) The files identified by Federal Agent Baker as relevant exist on the hard drive in a complex relationship with all other files, including the Microsoft Windows Operating System. For example, it may likely be essential for either party in the proceedings to determine the date and time the relevant files were created, modified or last accessed, or the user responsible for the creation and the circumstances in which they were created (for example, were they received by email or were they typed at the keyboard). All this information comes both from the file in question and from interrelated system files and their various attributes; (ii) A file extracted from an examined hard drive may be meaningless without the ability to interpret it with the program or programs installed on the computer which created it; (iii) Current Forensic software is designed to deal with complete hard drives. Extractions of individual files greatly reduces the ability to maintain forensic integrity. Due to search warrant time limitations, the opportunity to complete a full forensic analysis and determine all relevant material is rarely available. Identifying all relevant files and their associated system files may take many days and in the end, my recommendation to take a forensic image of the computer would be the same.' 77 Support for the 'standard forensic practice' to which Mr Henley referred is found in Adler v Gardiner [2002] FCA 1141; 43 ACSR 24 ('Adler v Gardiner') at [21] Hely J there observed: 'The executing officer or constable assisting has to make a judgment as to whether seizure of a document is authorised by the warrant. The executing officer or constable assisting has to consider whether "there are reasonable grounds for suspecting" that the document will afford evidence as to the commission of a warrant offence. This is judgment which the executing officer must make in relation to every "thing" which is to be seized in reliance upon the warrant. But where the relevant thing consists of a folder or file, there may well be justification for an executing officer, or constable assisting, to take the entirety of the folder or file in which he or she locates an individual document itself within the warrant, because the context in which the document is found may itself be of assistance in evaluating the true evidentiary significance of the document in question: Harts Australia Ltd v Cmr, Australian Federal Police [2002] FCA 245 at [39].' 78 I reject the contention that, on its proper construction, subs 3L(1A) of the Crimes Act did not authorise the imaging of the examined hard drive and the taking of the imaged hard drive from the Premises.

Did Mr Baker hold on reasonable grounds the belief required by subs 3L(1A)? 79 Mr Kennedy challenged on two bases the adequacy of Mr Baker's asserted belief that any data accessed by operating the personal computer ordinarily operated by Mr Kennedy's personal assistant might constitute evidential material. First, he argued that it had not been established that Mr Baker at the relevant time believed that Annexure 'L' satisfied the three conditions of the Warrant. Secondly, he argued that Mr Baker did not have reasonable grounds for suspecting that Annexure 'L' would afford evidence of the commission of an offence to which the Warrant related or for believing that any data accessed by operating the relevant personal computer might constitute evidential material. 80 The contention that Mr Baker did not at the relevant time form a belief that Annexure 'L' satisfied the third condition of the Warrant is founded on the fact, referred to in [29] above, that the PSR entry in respect of the imaged hard drives does not identify an alleged offence specified in the Warrant. Mr Baker gave both affidavit and oral evidence that, when he read Annexure 'L' on a computer screen on 13 November 2003, he formed the belief that it met all three conditions of the Warrant, told Mr Henley of his belief and indicated that the hard drive should be copied. Mr Henley gave unchallenged affidavit evidence that Mr Baker, after he had seen a document that I am satisfied was Annexure 'L' on a computer screen, said to him words to the effect: 'I think the computer that you have shown me contains information relevant to the search warrant. Can you please take an image of the computer?' 81 I am satisfied that on 13 November 2003, before the examined hard drive was copied, Mr Baker asserted a belief that Annexure 'L' satisfied the three conditions of the Warrant. I do not understand Mr Kennedy to suggest to the contrary. The contention is that Mr Baker did not in fact hold the belief that he asserted. 82 Mr Baker denied the suggestion put to him in cross‑examination that: 'The property seizure record in relation to the imaged hard drive didn't have any specificity as to which offence may have been applicable concerning Mr Rivkin because you had absolutely no idea whether it was (a), (b), (c) or (d) or none of the above.'

Mr Baker summarised the process of reasoning which led him to believe that Annexure 'L' satisfied the third condition of the Warrant in the way outlined in [30] above. The totality of the evidence before me suggests that on 13 November 2003 Mr Baker acted in a measured way giving careful consideration to his authority to seize items in reliance on the Warrant. I accept that Mr Baker's process of reasoning concerning Annexure 'L' was as he outlined in his evidence. I accept that at the relevant time Mr Baker believed that Annexure 'L' satisfied the three conditions of the Warrant.

83 In considering the contentions that Mr Baker did not have reasonable grounds for suspecting that Annexure 'L' would afford evidence of the commission of an offence to which the Warrant related, or for believing that Annexure 'L' might constitute evidential material, I bear in mind that this proceeding does not involve a challenge to the validity of the Warrant. Mr Wood, who appeared with Mr Stoljar for Mr Kennedy, criticised the way in which offences (a) and (b) concerning Mr Rivkin were described in the third condition of the Warrant (see [29] above). Mr Wood's criticism is for present purposes relevant only to the issue of the reasonableness of the belief that I am satisfied that Mr Baker held concerning Annexure 'L'. 84 As is mentioned above, the Warrant authorised Mr Baker to search for and seize only evidential material that satisfied all of the three conditions of the Warrant. The third condition of the Warrant required the evidential material to be '[t]hings for which there are reasonable grounds for suspecting they will afford evidence as to the commission of' certain nominated offences which included the offences identified in [29] above. In Adler v Gardiner at [39] Hely J said: 'The notion of reasonable grounds for a suspicion imports an objective test, but "reasonable" involves a value or normative judgment (Greiner v Independent Commission Against Corruption (1992) 28 NSWLR 125 at 167), and there may well be legitimate differences of opinion as to what falls within the term, particularly when it is used in relation to a nebulous expression such as "suspicion". A court is not entitled to substitute its own opinion on that question for the opinion of the executing officer or constable assisting. That does not mean that the executing officer, or constable assisting, has an unexaminable discretion; it does mean, however, that the officer's decision is only impeachable if the decision was one which the officer could not lawfully reach on the materials before him or her: Minister for Immigration & Ethnic Affairs v Wu Shan Liang (1996) 185 CLR 259 at 275-276.' 85 It was contended by Mr Kennedy that: '[w]here the exercise of executive discretion interferes with liberty or property rights, once the person has shown a prima facie case the burden of justifying the legality of the decision vests in the executive: Challenger Plastics v Collector of Customs (No 2) (1994) 49 FCR 541, 543; R v Secretary of State for the Home Department; Ex parte Khawaja [1984] AC 74, 112.'

It seems that a similar submission was made to Hely J in Williams v Keelty [2001] FCA 1301; 111 FCR 175, a case concerning search warrants for which ASIC applied. In that case at [236] his Honour said:

'I agree that once the applicants show an invasion of their premises or property by ASIC, the onus is upon ASIC to adduce evidence, and to persuade the trier of fact that its invasion of what would otherwise be the applicants' rights was undertaken with lawful justification. But ASIC discharges that onus by the production of the search warrants, and by demonstrating that its actions were within the scope of the authority conferred by the warrants. If the applicants wish to challenge the issue of the warrants on administrative law grounds, then the onus is on them to make good that challenge. This result is consistent with the decision of the Full Court in Malubel v Elder at 249 where the Court held that the issue of a warrant is an administrative act, and steps taken pursuant to it may be presumed to be valid unless and until the warrant is set aside. The observations of Gummow J in Ousley v R at 130-131 are to like effect.' 86 I am not satisfied that the approach adopted by Hely J in Adler v Gardiner and Williams v Keetly is plainly wrong. Rather, with respect, it seems to me to be the correct approach. It is appropriate that I follow it (see K Mart Australia Limited v Commissioner of Taxation [1995] FCA 760 and the cases there cited). 87 I therefore approach the question of whether, within the meaning of subs 3L(1A), Mr Baker believed on reasonable grounds that Annexure 'L' might constitute evidential material on the basis that it is for Mr Kennedy to show that it was not reasonably open to Mr Baker to form the belief that Annexure 'L' might constitute evidential material. The definition of 'evidential material' contained in s 3C of the Crimes Act is set out in [41] above. Its import can only be understood if reference is made also to the definitions of 'thing relevant to an indictable offence' and 'thing relevant to a summary offence' contained in subs 3(1) of the Crimes Act. Relevantly each of those definitions includes within the meaning of the respective phrases: 'anything as to which there are reasonable grounds for suspecting that it will afford evidence as to the commission of any such offence.' 88 I do not accept the submission of Mr Kennedy that, without knowing how the evidence said to have been given by Mr Rivkin in 1995 'in relation to the ownership of shares held by EBC and Leumi in OAP' was false or misleading, Mr Baker was not able to hold on reasonable grounds the belief required by subs 3L(1A). The belief that Mr Baker was required to hold on reasonable grounds was that Annexure 'L' 'might constitute evidential material'. To constitute 'evidential material' Annexure 'L' had to be 'a thing relevant to an indictable offence or a thing relevant to a summary office'. That is, Mr Baker was required to believe on reasonable grounds that Annexure 'L' might constitute a thing as to which there were reasonable grounds for suspecting that it will afford evidence as to the commission of an offence to which the Warrant related. 89 In Adler v Gardiner at [20] Hely J observed: 'A thing will afford evidence of the commission of an offence if it assists, directly or indirectly, in disclosing that an offence has been committed, or in establishing or revealing the details of the offence, the circumstances in which it was committed, the identity of the person or persons who committed it or any other information material to the investigation of those matters: George v Rockett (supra) at 120. The expression "will afford evidence" does not import a requirement that the documents must necessarily be sufficient to achieve a conviction; it is sufficient that they have relevance to or probative connection with, an issue arising upon an allegation of the offence alleged: Parker v Churchill (1985) 9 FCR 316 at 326. That includes things which are adjectivally relevant as well as things which are of substantive relevance: Ozzy Tyre & Tube Pty Ltd v Chief Executive Officer of Customs [2000] FCA 891 at [30]-[31].' 90 As is mentioned in [30] above, the accuracy and reasonableness of Mr Baker's beliefs that Timsa 69 Pty Ltd was a company with which Mr Rivkin had some involvement and that Mr Rivkin had given evidence to ASIC in 1995 that he had no information concerning the true ownership of shares in OAP that were held by the Swiss Banks, Leumi and EBC, were not challenged. 91 As I understand his evidence, Mr Baker believed that Annexure 'L' was a thing that tended to establish that in late 1994 Mr Rivkin, because of his association with Timsa 69 Pty Ltd, had knowledge concerning the ownership of at least 83,000 shares in OAP, being shares which were apparently not owned beneficially by the entity in whose name the script was held. This belief was, in my view, plainly held on reasonable grounds (see [28] above). On that basis it becomes necessary to consider whether it was open to Mr Baker to conclude that a document that tended to establish that Mr Rivkin had the above knowledge might have relevance to, or probative connection with, an issue arising upon allegations that, in effect, Mr Rivkin gave false evidence in 1995 when he said that he had no information concerning the true ownership of certain shares in OAP. In my view it was. The word 'might' is apt to express theoretical possibility. The relevant allegations concern the veracity of testimony given by Mr Rivkin; that is, they allege offences touching on Mr Rivkin's credibility. The relevant testimony given by Mr Rivkin concerned the true ownership of shares where the script did not reveal that true ownership. A number of circumstances can readily be envisaged in which proof that Mr Rivkin had knowledge in late 1994 concerning the ownership of at least 83,000 shares in OAP that were not owned beneficially by the entity in whose name the relevant script was held could rationally affect the assessment of the probability that he gave false evidence in 1995 when he said that he had no information concerning the ownership of certain shares in OAP. I do not consider it necessary to identify those circumstances with specificity. 92 I am not satisfied that it was not open to Mr Baker to conclude that Annexure 'L' might constitute evidential material. Indeed, I am positively satisfied that Mr Baker held, on reasonable grounds, the belief required by subs 3L(1A) in respect of Annexure 'L'. I am similarly satisfied that Mr Baker had reasonable grounds for suspecting that Annexure 'L' would afford evidence of the offences to which the Warrant related.

An adequate opportunity to claim legal professional privilege 93 The parties all acknowledge that legal professional privilege is not displaced by Part 1AA of the Crimes Act. Indeed, as is mentioned above at [19] the Warrant contains a note indicating that it was issued 'in recognition that a claim for legal professional privilege may be made in respect of documents covered by this warrant'. The Claim for LPP document, a portion of which is reproduced at [20] above, was attached to the Warrant. 94 The parties approached this case on the basis that it was open to Ms Toman on 13 November 2003 to claim legal professional privilege in respect of the imaged hard drive. The authorities show that legal professional privilege attaches to the communication of information (Commissioner of Australian Federal Police v Propend Finance Pty Ltd (1997) 188 CLR 501 per Dawson J at 515 and Toohey J at 525). I experience some conceptual difficulty in regarding a magnetic medium on which computer files are stores as constituting or including a communication. By itself that magnetic medium communicates nothing. However, no party contended that it was not open to Mr Kennedy to claim legal professional privilege in the imaged hard drive, as opposed to claiming legal professional privilege in a document or documents later brought into existence should a computer be used to access the data in the imaged hard drive. 95 The Warrant was executed on 13 November 2003 in circumstances where all concerned, including Ms Toman, were aware that the Warrant did not purport to displace legal professional privilege. The procedure set out in the Claim for LPP document was followed in respect of one document identified during the course of the execution of the Warrant (see [23] above). 96 It is settled law that, generally speaking, those executing a warrant in respect of premises must ensure that the occupier of the premises have in the circumstances an adequate opportunity to make a claim of privilege (Commissioner of Taxation v Citibank per Bowen CJ and Fisher J at 417; Baker v Campbell per Gibbs CJ at 70). No claim of legal professional privilege was in fact made on 13 November 2003 in respect of the imaged hard drive. Nor did Ms Toman, or any other person apparently authorised to speak on Mr Kennedy's behalf, raise with Mr Baker or any person assisting him in the execution of the Warrant, the possibility that the imaged hard drive might contain material in respect of which a claim for legal professional privilege could be made. Was Mr Kennedy, in the circumstances that attended the execution of the Warrant, given an adequate opportunity to make a claim of privilege in respect of the imaged hard drive? 97 The enormity of the task that would have confronted Ms Toman had she sought to review the content of the imaged hard drive is revealed by the evidence touching on later endeavours to review that content. On 30 January 2004, Arnold Bloch Leibler, the solicitors now acting on behalf of Mr Kennedy, provided a DVD-ROM copy of the imaged hard drive to Jason Robert Plumridge ('Mr Plumridge'), the manager of the Computer Forensic Services Unit at Ernst & Young in Sydney. On 6 February 2004 Mr Plumridge carried out a keyword search of the data on the DVD-ROM copy of the imaged hard drive using the keywords utilised by Mr Henley in his search of the examined hard drive. It appears that documents printed from the files that were identified by the keyword search conducted by Mr Plumridge filled twenty-five lever arch folders. 98 A further search was required to be carried out by Mr Plumridge before any document for which a claim for legal professional privilege could be made. In the days immediately preceding the hearing of this matter Mr Plumridge undertook another search of the data in the copy imaged hard drive using keywords of obvious legal significance (eg lawyer, legal advice, barrister etc). On the afternoon of the day before the hearing of this matter a solicitor employed by Arnold Bloch Leibler identified two documents identified by this further search, being documents that were not included in the twenty-five lever arch files, in which it appears that legal professional privilege could be claimed. It is not suggested that the documents have any relevance to any offence with which the Warrant was concerned. They concern litigation currently being conducted in the Supreme Court of New South Wales to which a company of which Mr Kennedy is a director is a party. 99 In contending that no adequate opportunity was provided to him to claim legal professional privilege in the imaged hard drive, Mr Kennedy placed reliance on the reasons for judgment of Doyle CJ, with whom Cox and Matheson JJ agreed, in Question of Law Reserved (No 1 of 1998) (1998) 70 SASR 281. The Chief Justice at 290 said in respect of a general search warrant: 'I … accept that a police officer should allow an adequate opportunity to make a claim to privilege when the circumstances of the search and intended seizure are such that the police officer exercising the relevant powers should reasonably anticipate that a claim might be made. In other words, the obligation is to allow an adequate opportunity for the claim to be made, and not just to respond reasonably to a claim when made. An obvious illustration is a search of a solicitor's office, the solicitor being absent. Another illustration is a seizure of documents, not from a solicitor, the documents on their face suggesting that they might well be subject to legal professional privilege. It would not be sufficient for the police officers to say that in such a case no claim to privilege was made, and to argue that accordingly they were free to act as if no claim could be made.' 100 I accept that the above observation of Doyle CJ concerning the execution of a general search warrant under the Summary Offences Act 1953 (SA) apply equally to the execution of a warrant under the Crimes Act. However, the circumstances which surrounded the execution of the Warrant are a long way from the circumstances postulated by the Chief Justice. In particular, a solicitor representing Mr Kennedy was present at all relevant times during the execution of the Warrant and was alerted to the making of the imaged hard drive and the decision to take it from the Premises. 101 The circumstances of this case are also a long way from those considered by Mildren J in R v Fraser-Adams [2001] NTSC 32; 161 FLR 120. Although his Honour in that case was concerned with the lawfulness of a decision to copy the hard drive of a computer, the warrant relied upon to justify the copying was a warrant issued under the Police Administration Act 1978 (NT). That Act contained no equivalent or analogous provision to s 3L of the Crimes Act. The warrant purported expressly to authorise the seizure of a computer containing certain accounting system records. The computer in question at all relevant times had a label on it stating, as was the case, that it contained material the subject of legal professional privilege. Nonetheless the computer was seized in purported reliance on the warrant and its hard drive subsequently imaged. Mildren J at [46] concluded: 'As Citibank and the other authorities show, the circumstances which arise where there may be a need to afford an opportunity to obtain legal redress to protect a claim of privilege will vary considerably. In this case, a claim was made, and forcefully made, by Fraser-Adams and Mr Berkley. The conclusion I have reached is that the seizure of the computer and the taking of the computer to the police station was not authorised by the warrant because the computer contained privileged material on it, which claim to privilege was being maintained, and which privileged material could not be severed from the material on the hard drives in respect of which the warrant did authorize seizure and search. … However, because the warrant expressly authorised the computer to be seized, in so far as it did contain Ochre's accounting system records it would not have been unreasonable for the police to have held the computer for a time sufficient to enable Mr Berkley to obtain a court order without removing it or examining it, or to have taken the computer to this Court in the company of Mr Berkley to enable an order to be obtained as to whether or not privileged documents or other documents not authorised by the warrant existed on the computer, and if so, what should be done about that.' 102 As has been mentioned a number of times already, a solicitor representing Mr Kennedy was present during the execution of the Warrant. It was known to that solicitor from shortly before noon, when Mr Baker told her of his decision to copy the examined hard drive, until sometime after 5.00 pm, when Mr Dunlop took possession of the imaged hard drive, that the imaged hard drive would probably be taken from the Premises in reliance on the Warrant. There is no evidence which suggests that during that period of more than five hours any impediment was placed in the way of Ms Toman taking instructions from her client, or from his personal assistant, as to the actual, likely or even possible content of the imaged hard drive. No evidence was led to suggest that they, or either of them, could not have been contacted by Ms Toman during the afternoon of 13 November 2003. Neither Mr Kennedy nor his personal assistant gave evidence in this proceeding as to their respective knowledge of the content of the examined hard drive. 103 I accept that, during the course of the execution of the Warrant, Ms Toman could not have reviewed the data held on the imaged hard drive to ascertain whether it in fact included anything that attracted legal professional privilege. The data held on the imaged hard drive was too extensive for this to have been done. However, I am satisfied that more than adequate time was given to Ms Toman to consider the significance of the making of the imaged hard drive and to take instructions on whether the data in the examined hard drive included, or might include, anything in respect of which legal professional privilege should be claimed. Had Ms Toman told Mr Baker that, on her instructions, the imaged hard drive might contain information which attracted legal professional privilege, I am confident that he would have taken steps to have the imaged hard drive placed into the custody of the Court. 104 I conclude that it has not been established that Mr Kennedy, in the circumstances that attended the execution of the Warrant, did not have an adequate opportunity to make a claim of privilege in respect of the imaged hard drive or in respect of anything. 105 I further conclude that Ms Toman, by failing to take any of the following steps: (a) to claim legal professional privilege in respect of the imaged hard drive; (b) to raise the possibility that the imaged hard drive might contain something that would attract legal professional privilege; (c) to ask for further time within which to give consideration to her client's rights with respect of the imaged hard drive before it was removed from the Premises; or (d) to make complaint concerning the way in which the Warrant was executed when given the opportunity to do so; rendered it objectively reasonable for Mr Baker to proceed on the basis that it was acknowledged on behalf of Mr Kennedy that he had been given an adequate opportunity to claim legal professional privilege in respect of the imaged hard drive.

Removal unlawful because of the documents to which legal professional privilege attached 106 As I understand the submissions of Mr Kennedy, the contention that the removal of the imaged hard drive was unlawful because the content of the imaged hard drive included communications to which legal professional privilege attached was only pressed should I find that Mr Kennedy did not have a reasonable opportunity to claim legal professional privilege in the imaged hard drive. As indicated above, I am not satisfied that the evidence adduced is sufficient to support such a finding. In my view Mr Baker was entitled to remove, or permit to be removed, the imaged hard drive from the Premises. 107 In the circumstances it is, I think, strictly unnecessary for me to determine an issue concerning which the parties disagree, namely whether the removal of the imaged hard drive from the Premises constituted a seizure under the Warrant. In Hart v Commissioner of Federal Police the Full Court at [90], dealing with the Crimes Act as in force before it was amended by the Cybercrime Act, observed: 'A storage device brought onto the premises by the executing officer cannot be "seized". So much is clear from the use in s 3L of the distinction between seizing things found at the premises and "tak[ing]" from the premises such storage devices with downloaded information.' 108 However, the distinction upon which the Full Court relied in Hart v Commissioner of Federal Police has now been blurred, particularly by par 3N(2)(a) which assumed its present form upon the coming into operation of the Cybercrime Act. Paragraph 3N(2)(a) now refers expressly to a thing 'seized' under subs 3L(1A). I conclude that the better view now is probably that the taking of the imaged hard drive from the Premises did constitute a 'seizure' of the copy data on it within the meaning of Part 1AA of the Crimes Act. 109 However, no party before me suggested that the removal of the imaged hard drive from the Premises has resulted in the loss of legal professional privilege in any communication that can be accessed via the hard drive. In particular the respondents do not assert that there has been a loss of legal professional privilege consequent upon the hard drive passing into the possession of ASIC. Indeed ASIC asserts that an agreement has been reached between it and Mr Kennedy as to the way in which objections to its accessing the data held in the imaged hard drive are to be dealt with. 110 In the circumstance that no party asserts that there has been a loss of legal professional privilege in respect of any communication that can be accessed by utilising the hard drive, I doubt that it is necessary for me to give further consideration to this issue. In particular, I doubt that any declaration should be made on Mr Kennedy's application concerning the entitlement of the respondents to access or use the imaged hard drive or any copy thereof or any information contained therein. However, perhaps out of an abundance of caution, I consider it appropriate to hear from the parties before making the order that presently seem to me to be the appropriate order having regard to my above reasons, namely that the application be dismissed with costs.

conclusion 111 In my view, Mr Kennedy has not established an entitlement to a declaration that Mr Baker was not entitled to create, or cause to be created, the imaged hard drive. Nor has he established an entitlement to a declaration that Mr Baker was not entitled to remove, or cause to be removed, the imaged hard drive from the Premises. I will hear the parties as to the appropriate orders to be made in the circumstances. I certify that the preceding one hundred and eleven (111) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Branson.

Counsel for the Applicant: P M Wood and J Stoljar

Solicitor for the Applicant: Arnold Bloch Leibler

Counsel for the First Respondent: A Robertson SC and K Morgan

Solicitor for the First Respondent: Commonwealth Director of Public Prosecutions

Counsel for the Second Respondent: G Lindsay SC and M Sneddon

Solicitor for the Second Respondent: Australian Securities and Investment Commission

Date of Hearing: 19 & 22 March 2004

Cybercrime Act 2001(Cth)

Statutory Provisions Crimes Act 1914(Cth)

At a glance

Court

Decision date

Before

Source

Judgment (38 paragraphs)

Parties

Legislation Cited (9)

Cases Cited (35)

Cited By (6)