The central issue
43 It was submitted on WO2 Randall's behalf that the central issue on the appeal was whether, on the whole of the evidence, the prosecution had proved beyond reasonable doubt that he lacked authority to access the email accounts as particularised. As a general proposition and in relation to the unauthorised access (or modification) charges, this is borne out by an analysis of the evidence led at trial and the verdicts returned by the panel. For the reasons given above, it is also, in our view, the central issue in respect of the prejudicial conduct charge convictions.
44 Putting aside the conviction in respect of the prejudicial conduct alternative to Charge 8, which looks to be a special case, the charges upon which the panel has convicted WO2 Randall are those where access was either conceded by WO2 Randall or readily to be inferred from his concessions. The panel's acquittals are readily explicable on the basis of an absence of concession as to access and the existence of a doubt, based on a concern held by the panel about the reliability of the expert evidence that CAPT Peter Martin Kimberly gave on the subject of access. Concessions by CAPT Kimberley in the course of evidence which he gave on a voire dire, his possible partiality and the unreliability of some of the raw data in relation to network access had, in combination, earlier been responsible for the prosecution's decision not to proceed with certain charges. If the panel were persuaded beyond reasonable doubt that the access was unauthorised, it was no great step, in light of the evidence as to WO2 Randall's knowledge and experience, to be likewise persuaded, for the purposes of s 478.1, that the access was intentional and known not to have been authorised.
45 Thus, in relation to the charges of unauthorised access (or modification) contrary to s 478.1 of the Criminal Code, whether want of authority was proved beyond reasonable doubt by the prosecution was indeed critical. As to the alternative prejudicial conduct charges, and assuming the legal burden fell on the prosecution, it was the same body of evidence as to authority which was critical.
46 As to formal orders and instructions, the judge advocate put this to the panel (transcript, p 2352):
It is common ground that the relevant provisions of the Defence Security Manual do apply, together with DI(G) CIS 6-1-001, Appropriate and Inappropriate Use of Information and Communications Technology Resources, exhibit 68. The [DSM] and the DI(G) have the force of general orders. It is also common ground that JTF 633 Standing Instruction OPS 06-11, DLAN User Policy, exhibit 65, and JTF 633 Standing Instruction OPS 06-09, Network Access Policy, exhibit 66, also applied. The lawfulness of such orders and instructions, their proper construction and the way in which such directions might stand with one another, are matters of law where you are bound by my direction.
To assist the understanding of the reader, we set out below an explanation, derived from the evidence, of the service acronyms used in this passage and which have not earlier been identified:
"DI(G)" means "Defence Instructions (General)", as made jointly by the Chief of the Defence Force and the Secretary to the Defence Department under the Defence Act 1903 (Cth);
"DSM" means "Defence Security Manual"; and
"DLAN" means "Deployable Local Area Network".
47 On the subject of authorisation, the judge advocate further directed the panel (transcript, p 2355):
On the basis of the orders and instructions applying here, the prosecution must prove:
(a) that WO2 Randall had no legitimate need to know in connection with the access in question; and
(b) that the access or modification was not sanctioned by a policy, duty statement or directive.
This, in turn, requires proof that any access or modification was not for security compliance and maintenance purposes and did not otherwise fall within the scope of WO2 Randall's duty statement. You will recall that the latter specifically provided responsibility for provision of advice for classified information systems and deployable local area networks.
48 The judge advocate added, accurately on the evidence, that "WO2 Randall has consistently maintained that he considered that any access made by him was authorised by his position and duties".
49 Part 2, Chapter 2.60, of the Defence Security Manual ("the DSM"), appeared at Exhibit 85. Paragraph 60.41 provided, under the heading "Access to Information and Security-Protected Assets", the following:
Access to information and security protected assets is based on a need to know and a need to restrict to authorised people only. Access is unauthorised if it is not based on a legitimate need to know or sanctioned by a policy duty statement or directive.
This was the source of the "need to know" principle referred to in the court martial proceedings. There was no issue at the trial that each of the networks mentioned in the charges, the Deployed Defence Secret Network ("DDSN") and the Deployed Defence Restricted Network ("DDRN"), the computers which served those networks, and the information on those computers, were "Information and Security Protected Assets" within the terms of the DSM and a "Commonwealth computer system" as pleaded in the charges. Nor was it in issue and the evidence was that the computers on these networks housed "restricted data" for the purposes of s 478.1 of the Criminal Code. What was in issue and for the prosecution to prove was that WO2 Randall had no legitimate "need to know" and that access (or modification) was not sanctioned by a "policy, duty statement or directive"; in others words, that the access (or modification) charged was unauthorised.
50 Neither party sought to make anything of the Defence Instructions (General) ("the DI(G)") (Exhibit 68) mentioned in the judge advocate's summing up. It appears to be directed to the subject of the terms on which personnel are permitted personal (as opposed to duty) access to Defence Department computer networks and what is appropriate and inappropriate personal access. It does not specify the limits of access to such networks associated with the position within the FCU to which WO2 Randall was posted. It is not necessary further to consider the DI(G).
51 Sitting under the DSM and DI(G), as apparent from the explicit reference to them in each document, are the JTF 633 Standing Instruction OPS06-11, DLAN User Policy (Exhibit 65), and the JTF 633 Standing Instruction OPS 06-09, Network Access Policy (Exhibit 66). These do give particularity to the role of the appointment held by WO2 Randall and related access rights and limits.
52 Exhibit 65 received particular prominence in the course of submissions on the appeal. It was also a restricted exhibit in the court martial proceeding. For these reasons, it is necessary to set out and consider this instruction's contents and application, as well as the authority it conferred, in some detail but to do so in a way which respects the existing restriction.
53 This instruction expressly (at paragraph 4) applied to both networks, the DDSN and the DDRN. It identified (at paragraph 6) a hierarchy or level of user within the MEAO. There were three levels:
a. System User. A general user of JTF633 ICT systems who has basic access granted after an approved Network Access Request ("NAR") has been submitted.
b. System Administrator (SA). A System User who has been granted administrator privileges by virtue of their employment within TG 633.14. The roles and responsibilities of the SA are detailed in annex A.
c. System Manager (SM). The SM is the senior SA within TG 633.14 and would normally be the Information System Engineer (ISE) or the Information Systems Manager (ISM). The SM is responsible for obtaining and maintaining security accreditation of the Commander Joint Operations Command (CJOPS) force assigned networks. The roles and responsibilities for the SM are detailed in annex B.
"ICT" is yet another service acronym. On the evidence, it means Australian "Information Communication and Technology". In service parlance, a Defence Department computer connected to either or each of the two networks mentioned would be an "ICT asset".
54 According to his "Army Other Ranks Performance Appraisal Report" of 25 April 2014 (Exhibit 73), WO2 Randall's employment category within the FCU was "Information Systems". The evidence was that, within this employment category and while posted to the FCU, WO2 Randall, acting as a WO1, simultaneously undertook the roles of Information System Engineer ("ISE") and Information System Manager ("ISM"). He was also the Information System Security Officer. In terms of the hierarchy of users described in Exhibit 65, he was both a "System Administrator" and a "System Manager". In undertaking these roles, he was what CAPT Kimberly described in evidence as a "Domino administrator". CAPT Kimberley described (ibid) the access rights of a "Domino administrator" in this way:
[A] Domino administrator has the ability to open any mailbox they choose on the server they are connected to. And, in some cases in theatre, as was explained yesterday, they could also access mailbox between locations as well.
55 The JTF 633 Standing Instruction, which was Exhibit 65, specified (at paragraph 8) the following over-arching objective for the computers, networks and other information systems operated by JTF 633:
JTF 633 provides computer devices, networks and other electronic information systems to assist in meeting its mission objectives. To meet these objectives JTF 633 must manage these resources responsibly to maintain the confidentiality, integrity and availability of its information. This policy requires the users of information assets to comply with departmental policies and protect Defence and Government against potentially damaging reputational and legal issues.
Read in context, where, in this instruction, the words, "manage" or "management" are used, they necessarily refer to the management of the JTF 633 resources mentioned in this paragraph to the end of maintaining "the confidentiality, integrity and availability of its information".
56 In his capacity as a "System Administrator", WO2 Randall was bound by and had the roles and responsibilities specified in Annex A to the instruction which is Exhibit 65. Materially, this annex emphasised in its introduction the need for strict adherence to specified administration processes in order to ensure the deployable ICT systems in the MEAO performed at an optimal level to support the operational scheme of manoeuvre. It also offered the guidance that a System Administrator should have completed "Deployable Standard Operating Environment (DSEO) training".
57 Though there was no evidence as to the formal content of "Deployable Standard Operating Environment (DSEO) training", there was evidence, as will be seen, of what, in practice, were the necessary administrative processes for someone in WO2 Randall's position in order to "support the operational scheme of manoeuvre". It was common ground between the parties that, although WO2 Randall had not undertaken that course, in so far as the course was intended to ensure that System Administrators had the necessary background knowledge to undertake that role, there was no deficit in WO2 Randall's knowledge.
58 Annex A recognised that System Administrators required a privileged level of network access but did not detail the nature and extent of this permitted access. Rather, it specified the types of accounts which System Administrators were to maintain. Consistent with the sentiments in its introduction, Annex A reiterated in its closing summary that deployable ICT systems in the MEAO were a key operational capability that required careful management and administration.
59 Given that WO2 Randall was also a "System Manager" for the purposes of standing instruction which constituted Exhibit 65, Annex B to that instruction was also applicable to his role. Materially, this annex:
(a) emphasised the critical nature of the provision of secure and reliable ICT services to the command and control of deployed ADF elements;
(b) highlighted the importance of management and maintenance of equipment to ensure that it was up-to-date; and
(c) made reference to privacy rights when personnel accessed Defence ICT systems but emphasised that users did not have a right to total anonymity.
60 The position which emerges from this instruction is that the administration and management of deployed ICT systems and related assets to the end of supporting operations was the core responsibility of a System Manager such as WO2 Randall. It was this end which governed the nature and extent of permitted access. For that purpose, a person so posted was given sweeping access privileges to network accounts. That was corroborated by CAPT Kimberley's evidence as to the rights enjoyed by a "Domino administrator". These included an ability to access personal email accounts on the networks for the purpose of discharging that responsibility. The existence of those rights explains why Annex B to Exhibit 65 stated (at paragraph 21) that, while users' rights to privacy are "maintained", "users do not have a right to total anonymity".
61 The Chief of Army submitted that a limitation in those access privileges was to be found in paragraph 27 of Exhibit 65. That is true only in respect of personal, as opposed to duty-related, access when that paragraph is read in context. Paragraph 27 provides:
An effective test of "inappropriate" use is not a personal test. Rather, ask yourself would you be comfortable discussing the type of use with your supervisor, Commanding Officer, CJTF633, or the Chief of the Defence Force. If you have any concerns, then the usage is very probably inappropriate and must not be conducted. Detailed guidance on appropriate use can be found in ref C.
62 Paragraphs 24 to 27 of this instruction are directed to the terms on which members are granted access to the JTF 633 provided internet services for personal use. Read in context, paragraph 27 makes it plain that the list of prohibited, personal use purposes specified in paragraph 26 is not exhaustive. It imposes an overarching touchstone in respect of personal use by a member. It may be accepted that paragraph 27 of this instruction identifies types of usage which would be inappropriate unless otherwise authorised (because that usage fell within the duties of a particular appointment) but it has nothing at all to say about the network access (or modification) privileges of a member when undertaking the duties of a System Manager.
63 Given the rights of access (and modification) which WO2 Randall enjoyed, by virtue of the position which he held, the evidence led by the prosecution from the holders of the various personal accounts as to their not having given him permission to access those accounts was never, even if accepted in full by the panel, sufficient to prove absence of authority beyond reasonable doubt.
64 Exhibit 66, the JTF 633 Standing Instruction OPS 06-09, Network Access Policy, applied to all personnel deployed to the MEAO. It provided direction on access to the DDSN and DDRN by such personnel (at paragraph 4). The "MEAO Network Access Request Form", which appeared at Annex A of the standing instruction, required an applicant, under the heading "Part C - Applicant Declaration", to acknowledge, in relation to both networks, that he or she was "aware that the Chief Information Officer Group (CIOG) and local CIS [Communications and Information Systems] staff may access any information stored on the system for administrative purposes and the investigat[ion] of any security issues."
65 A question arose as to the scope of the word "administrative" in Exhibit 66. Counsel for the respondent drew on evidence from the appellant at trial to submit that the term should be confined to tasks related to the appellant's roles as an ISE and ISSO as they pertain to system management; it should not be read as encompassing other aspects of his job or personal administration. Paragraph 11 of Exhibit 65 was also said by the respondent to give some content to the term "administrative". That paragraph provided: "For security, compliance and maintenance purposes authorised personnel monitor equipment, systems and network traffic. Breaches will be referred to the chain of command, Defence investigative authorities or the Australian Federal Police as appropriate." It was agreed between the parties that, at the relevant times, WO2 Randall fitted within the description of "authorised personnel". It may be observed, however, that Exhibit 66 is directed more to what a user of the networks may expect rather than to the duties and authorisation of a person in WO2 Randall's position.
66 In terms of documentary evidence, greater particularity as to the duties undertaken by WO2 Randall when posted to the FCU was provided by the duty statement which formed part of Exhibit 73. In that document, his duties were specified as the following:
1. Assisting in the production of all CIS Operational Orders, Directives and Instructions.
2. Provision of advice for Classified Information Systems and Deployable Local Area Networks.
3. Management of UNCLAS Amenities Internet Access across the MEAO.
4. Liaison with external agencies on Information Systems Issues.
5. Attend meetings and teleconferences with BAE wrt FCU Sharepoint issues.
6. Provide direction and advice on Information systems to Squadron Communications Control Groups.
7. Supervise Information Systems projects and implementations.
8. Any other tasks assigned by the OPSO.
Within this duty statement, we understand that the meaning of the service abbreviations used is as follows:
"wrt" means "with respect to";
"CIS" means "Classified Information Systems";
"OPSO" means "Operations Officer"; and
"UNCLAS" means "Unclassified".
The express reference in this duty statement to "BAE" and to "SharePoint" will be noted. It is also a feature of these specified duties that they are broadly stated (especially paragraph 7) and ultimately open-ended (having regard to paragraph 8). Nominally, this duty statement has a limited duration but in context it appears to be descriptive of WO2 Randall's duties while posted to the FCU.
67 WO2 Randall was also the Information System Security Officer ("the ISSO"). The duties of a person in this role were detailed in Exhibit 84, the Defence Security Manual, Part 2.6 Security Officer, at Annex B:
Information System Security Officer duties
1. In support of a system owner, Information System Security Officers (ISSO) may be required to carry out the following duties:
a. Implement and maintain network security in accordance with the Defence Security Manual (DSM);
b. Maintain system-specific standard operating procedures;
c Maintain a system-specific security register;
d. Provide advice and briefings to that system owner and to commanders and managers on ways in which network security could be enhanced;
e. Perform administrative tasks in support of network security and the application of Defence security policies and standards as required;
f. Perform network security incident response if instructed by Defence Investigative Authorities (for further information see DSM Part 2:12 Security Incidents and Investigations);
g. Liaise with the accreditation authority and other information system security organisations within Defence, other ISSOs, Information System Security Liaison Officers (ISSLO), and security officers on matters related to network security; and
h. Undertake post-accreditation activities as required by the DSM, system-specific instructions and the Australian Government Information and Communications Technology Manual (ISM), including ongoing testing for vulnerabilities.
68 A pithy way of describing the position occupied by WO2 Randall within the FCU was offered in evidence (transcript, p 1745) by a peer of commensurate experience, WO1 Wright, in expressing his agreement with the proposition that WO2 Randall was "the top of the pile, so to speak, in terms of the technical chain of command". WO1 Wright was familiar both with the duties undertaken in practice on deployment by a member posted to this position as well as with the particular skills and repute of WO2 Randall. As to WO2 Randall's skills and repute, WO1 Wright was asked to assess his level of knowledge of policy during the period in 2009 in which he was deployed in the United Arab Emirates and the appellant was deployed in Afghanistan. WO1 Wright offered this view (transcript, p 1739) in his evidence in chief:
WO2 Randall is held in high regard and there's probably two things that I can say that he is probably very good at, from my opinion, is policy and the other one is Lotus Notes as well. So I would defer on occasions to his knowledge because I believe he's got a very good understanding of that.
(Emphasis added.)
69 Significantly, the evidence was that each of the networks (the DDRN and DDSN) in the theatre of operations to which WO2 Randall was deployed had Lotus Notes databases. The evidence also was that, for the purpose of discharging the duties of the position to which he was posted, he was entitled to access all Lotus Notes databases, including the personal user accounts of each of the persons mentioned in the charges.
70 When asked in examination-in-chief (transcript, p 1739) to detail the tasks on deployment of an Information System Manager, WO1 Wright stated:
Look, to list the set of tasks, accreditation is high on one of those tasks, you know, maintenance, monitoring, performance, auditing. I could go through security. I guess you advise policy, advise officers on technology. Some of the tasks that you do is development, so new technology. You provide advice. And improvements to the network would be something that you'd be responsible for as well. That's a list but essentially you could say anything to do with computers is the remit of the ISE and the demarcation would be the router, all the way to the user, or the computer. So anything that belongs in that space and has a remit is your responsibility. So it's pretty wide and pretty broad and there's a lot of sort of knowledge to be had to sort of be across it all.
(Emphasis added.)
71 It will be noticed that WO1 Wright used the abbreviation ISE ("Information Systems Engineer") in this answer. Immediately after giving that answer, the prosecutor specifically asked him (transcript, p 1739) about the tasks of an ISE, to which he replied:
I'm going to say the same but at a higher level. I know it's probably not the answer but the - I guess you get a broader requirement. You look after more servers and you may step away from some of the - and may go more into policy, would be my characterisation of it.
72 In WO1 Wright's view (transcript, p 1740), the tasks of Information System Manager and Information System Engineer were not mutually exclusive.
73 In his evidence in chief, WO1 Wright also confirmed (transcript, pp 1741-1742) that the duties of an Information System Manager included a number of tasks, amongst which were:
planning and managing the implementation of Information Systems ("IS") networks, domains, to assist the commander in meeting his intent;
managing an IS node in order to provide integrated information systems support to command;
managing IS networks and domains within the tactical environment;
interpreting data-routing requirements and providing solutions to enable routing of data around the battlespace;
providing advice on and managing all security aspects of IS and data protection;
managing maintenance of IS for the purpose of assuring system accreditation;
performing threat risk assessments on local systems for the purpose of assuring system accreditation;
managing the conduct of trials or tests of equipment configuration at all levels; and
acting as a communications duty officer.
74 In relation to an ISE, WO1 Wright confirmed (transcript, pp 1741-1742) that the duties of the holder of that position included:
planning, designing and managing an integrated IS network to support the command and control of subordinate units and headquarters formations;
acting as an equipment fleet manager for equipment controlled;
planning future data communications and migration plans;
interpreting the detailed plans, policies and doctrines for the deployment, employment and management of varied IS devices;
evaluating employed IS for possible security breaches and implementing security measures to ensure an integrated security approach across the battlespace;
planning and managing the implementation of IS networks/domains to assist the commander in meeting his or her intent;
acting as the subject-matter expert in the operations group in his or her role as the manager of command support systems;
liaising with strategic defence planners for the integration of tactical and operational IS;
preparing and delivering technical orders for IS equipment configuration and deployment;
diagnosing faulty complex systems or designing communication systems for implementing formation moves;
managing classified electronic media;
liaising with national and foreign service personnel in order to develop interoperable systems, communications and foster cooperation;
maintaining the confidentiality, integrity and availability of IS applications and data through passive and active computer network defence measures; and
instructing and counselling trainees, managing instructors and administering training.
75 None of this evidence was challenged in the cross-examination by the defence of WO1 Wright. In the course of that cross-examination, this exchange occurred (transcript, p 1746) between the Defending Officer and him in relation to WO2 Randall:
Is that, to your knowledge, his reputation more widely within the signals community? - So most of my peers would probably agree that - within our trade there are certain people that are good at certain things. Some people specialise in Cisco. Some people specialise in VoIP. WO2 Randall is very professional, a consummate professional, and I would say his speciality is probably both Lotus Notes and policy. He's deployed on numerous occasions and has done it more times than anybody I know. So if I have a question about it, I would ask him.
(Emphasis added.)
Once again, the explicit reference to "Lotus Notes" will be noted.
76 As to whether, either as a System Administrator or System Manager, his understanding was that advance permission from the account holder was needed on deployment to access a personal account on a network, WO1 Wright cited multiple examples as to circumstances when access without such permission might occur. There was some exploration of this in re-examination with the essence of that being found in this passage (see transcript, p 1760):
The examples you gave, what they are conducting - what is that hypothetical system administrator doing? - So the primary goal of a system administrator in this instance is to make the system run at its peak performance, to ensure that it's maintained - predominantly maintained and that operational effectiveness of the system is of the highest order. They're the three sort[s] of mandates that I think I have, or an ISE has, to that system. If you're not doing it with those three things in mind, then, I suggest, you're probably doing something wrong, if there's a nefarious thing.
77 The prosecution led no evidence that any of the access events in respect of which a conviction was recorded by the panel fell outside the "three mandates" to which WO1 Wright referred. Certainly in respect of the unauthorised access (or modification) charges, and also, in our view, in respect of the prejudicial conduct charges, the legal burden of so doing so as to prove beyond reasonable doubt want of authority fell on the prosecution. It was never up to WO2 Randall to prove that any conceded access fell within these "mandates". At most, the prosecution could point to evidence given in respect of some of the charges of so-called apologies by WO2 Randall. We deal with these below.
78 Given that its own case contained evidence that access to (or modification of) a personal email account could permissibly occur without the approval of the holder of that email account, it was never sufficient for the prosecution to prove that the account holder had not given WO2 Randall permission to access (or modify) his or her personal email account. The respondent's description in submissions of the evidence of the personal account holders as "competing evidence" to that of WO2 Randall utterly misapprehends this feature of the prosecution evidence and the legal burden which fell on it in relation to lack of access (or modification) authority.
79 Further, it raises the distinct and reasonable possibility that, in respect of the prejudicial conduct charge convictions the panel thought that the negation of the existence of a reasonable excuse was nothing more than a matter of preferring the evidence of the personal account holders over that of WO2 Randall. For reasons already given in relation to what was present in the prosecution's own evidentiary case, it was never so confined.
80 This same misapprehension by the prosecution and possibility are evident, for example, in the reference in the written submissions on appeal in respect of Charges 4, 5 and 6 (relating to Lieutenant ("LEUT") Jagiello), to "his computers" and "his email accounts". The prosecution's own evidence was that these computers were "ICT assets" owned by the Commonwealth of Australia, not by an individual member, and that no member permitted to have a personal account on the networks had exclusive dominion over that account. That is an apt note upon which to consider the position in relation to particular convictions against the background of the evidence as to authority.