Law Enforcement and National Security (Assumed Identities) Act 2010

The Act directly affects a defined circle of NSW and Commonwealth agencies and personnel, together with issuing agencies and, indirectly, the public whose identity data may be used.

Law enforcement agencies listed in s 4(1) are: NSW Police Force, Independent Commission Against Corruption (ICAC), NSW Crime Commission, Law Enforcement Conduct Commission, Corrective Services NSW, Australian Crime Commission, and any agency prescribed by regulation (including potentially the Australian Federal Police, ASIO, ASIS, Department of Home Affairs and Australian Taxation Office). The chief officer of each agency (Commissioner of Police, Chief Commissioner of ICAC, etc.) is the sole repository of the power to grant, vary, cancel and review authorities (ss 6, 9, 10), subject to a limited delegation power under s 39.

Authorised officers are law enforcement officers (defined to include seconded officers but to exclude the chief officer himself) who receive an authority. They may acquire and use assumed identities in the course of duty (s 21(1)).

Authorised civilians are non-law-enforcement persons authorised under an authority. Their use must be supervised by a law enforcement officer of stipulated minimum rank (Sergeant for NSW Police, Senior Investigator for ICAC, etc.: s 6(4)). The statute requires the chief officer to be satisfied it would be impossible or impracticable for an officer to perform the role (s 6(2)(c)).

Issuing agencies fall into two classes. Government issuing agencies (e.g. Transport for NSW, NSW Police Force itself — see note to s 4) must produce evidence of identity when requested under s 15 or s 28 (s 16). Non-government issuing agencies (banks, registered clubs, etc.) may comply (s 17). Both classes receive protection from liability for good-faith compliance (s 19) and indemnity from the requesting law enforcement agency (ss 20, 30).

Eligible Judges (Supreme Court judges who have consented and been declared eligible by the Attorney General under s 12) exercise the power to order entries in, or cancellation of entries from, the Births, Deaths and Marriages Register (ss 11, 14). Their functions are performed independently of ministerial direction (s 12(7)) and attract the same immunity as in ordinary Supreme Court proceedings (s 12(4)).

The Registrar of Births, Deaths and Marriages is under a statutory duty to give effect to eligible-judge orders within the time specified or, failing that, within 28 days (ss 11(4), 14(4)).

Supervisors of authorised civilians are law enforcement officers of stipulated rank who must ensure the civilian’s conduct remains within the authority and any directions given (ss 4(1), 21(2), 32(2)).

The Minister receives annual reports, decides what sensitive material to excise, and tables the redacted report (s 35). The Attorney General declares eligible judges (s 12(3)).

Members of the public are indirectly affected whenever their genuine identity data is used to fabricate an assumed identity, or when they interact with a person using an assumed identity in the course of an investigation. The non-disclosure rules in s 34 protect the identity of anyone who has held an authority if that identity becomes relevant in court, tribunal or Royal Commission proceedings.

Finally, the Act applies to corresponding authorities granted under the law of any participating jurisdiction (s 31), thereby affecting interstate and Commonwealth officers who rely on those authorities while operating in New South Wales.

Duties of chief officers are central. They must: (i) determine applications only on the statutory criteria (s 6(2)); (ii) appoint a supervisor of stipulated rank for every authorised civilian (s 6(3)); (iii) give written notice of any variation or cancellation, stating reasons (s 9(2)–(3)); (iv) conduct or arrange yearly reviews for authorities used interstate and cancel if use is no longer necessary (s 10); (v) keep detailed records (s 36); (vi) ensure six-monthly or annual audits by an independent auditor (s 37); and (vii) submit annual reports containing prescribed statistics and fraud information (s 35(1)).

Duties of authorised persons are to remain strictly within the authority and, for civilians, within supervisor directions. Section 32 creates positive obligations not to acquire or use evidence of the assumed identity outside those limits. The recklessness test in s 25(3) means an authorised person who is aware of a substantial risk that an authority has been varied or cancelled must not proceed if it would be unjustifiable to do so.

Duties of issuing agencies are mandatory for government bodies (s 16) and permissive for non-government bodies (s 17). Once evidence is issued, the chief officer of the issuing agency must cancel it (including deleting database entries) upon written direction from the granting chief officer (s 18(1)).

Duties of eligible Judges are procedural: applications for register entries or cancellations must be heard in chambers (ss 11(3), 14(3)), and the judge must be satisfied the order is justified having regard to the nature of the activities (s 11(2)(b)).

Rights and protections are extensive. Authorised persons enjoy immunity from criminal and civil liability and from corrupt-conduct findings provided the three conditions in s 22 are met. Indemnity for reasonable costs and liabilities is given by the law enforcement agency (s 23). Issuing agencies and their officers receive parallel protection (s 19) and indemnity (s 20). Section 26 expressly authorises the granting chief officer to make false or misleading representations about the authorised person for the purpose of acquiring or using the assumed identity. Non-disclosure orders under s 34 protect identity in legal proceedings unless the interests of justice require otherwise. Authorised persons who are unaware (and not reckless as to) a variation or cancellation continue to enjoy the statutory protections (s 25).

Rights of review exist indirectly through the mandatory audit and reporting regime and through the obligation on chief officers to cancel authorities once use is no longer necessary (ss 9(1)(b), 10(4)).

The Act creates three tiers of criminal offence.

Section 32(1) punishes an authorised officer who intentionally, knowingly or recklessly acquires or uses an assumed identity knowing or reckless as to the fact that the conduct is outside the authority or outside the course of duty — maximum two years’ imprisonment. Section 32(2) applies the same penalty and mental elements to an authorised civilian who deviates from the authority or supervisor directions.

Section 33(1) imposes a five-year maximum on any person who intentionally, knowingly or recklessly discloses information knowing or reckless as to the fact that it reveals an assumed identity and that the disclosure is not within the statutory exceptions (administration of the Act, legal proceedings, or legal requirement). The aggravated offence in s 33(2) — where the disclosure is intended to endanger safety or prejudice an investigation or witness-protection program, or the person is reckless as to that outcome — carries a ten-year maximum.

Section 34(3) creates a summary offence of contravening a non-disclosure or suppression order made by a court, tribunal or Royal Commission — 50 penalty units or 12 months’ imprisonment or both.

Proceedings for all offences except s 33(1) or (2) are dealt with summarily in the Local Court (s 41(1)). Offences under s 33 are indictable but may be dealt with summarily under Chapter 5 of the Criminal Procedure Act 1986 unless an election is made (s 41(2)).

Enforcement otherwise relies on internal administrative mechanisms: mandatory cancellation of authorities (s 9(1)(b)), compulsory audits (s 37), record-keeping obligations (s 36), and ministerial reporting (s 35). Breach of these administrative duties may found internal discipline or, in extreme cases, findings of corrupt conduct, though s 19 and s 22 protections are designed to shield good-faith participants.

The Act is expressly stated not to limit the Law Enforcement (Controlled Operations) Act 1997 or the Witness Protection Act 1995 (s 40). It therefore sits alongside those statutes as part of a suite of covert-operation legislation.

It cross-references the Births, Deaths and Marriages Registration Act 1995 (via the Registrar’s obligations in ss 11 and 14) and contains detailed interaction rules with “corresponding laws” of other jurisdictions. Section 4(1) defines “corresponding law” as a law declared by regulation to correspond to this Act or any of its provisions. Part 5 and s 31 extend selected protections, offences and non-disclosure rules to conduct performed under interstate or Commonwealth authorities.

Amendments have inserted references to later statutes: the Crime Commission Act 2012, Law Enforcement Conduct Commission Act 2016, Crimes (Administration of Sentences) Act 1999 and Commonwealth legislation such as the Australian Crime Commission Act 2002 and Part IAC of the Crimes Act 1914 (Cth) (see s 11(5) and the definition of law enforcement officer).

The Interpretation Act 1987 applies to undefined terms (note to s 4(1)). The regulation-making power (s 42) permits creation of offences up to 100 penalty units. Section 39 limits delegation of chief-officer functions to no more than five senior officers at any one time, overriding general delegation provisions in other Acts.

In legal proceedings, s 34 operates as a statutory suppression regime that displaces the ordinary open-justice principle unless the tribunal considers the interests of justice require otherwise. It interacts with the Supreme Court Act 1970 (in chambers hearings) and with Royal Commissions legislation.

The indemnity provisions (ss 20, 23, 30) engage principles of Crown liability and may interact with the Civil Liability Act 2002 and insurance arrangements of issuing agencies.

The statute has been amended on nine occasions since 2010, each expanding coverage or tightening accountability.

The 2011–2016 amendments (2011 No 41, 2012 No 66, 2016 No 61, 2016 No 65) updated references to reflect machinery-of-government changes: the Independent Commission Against Corruption’s new title, the creation of the Law Enforcement Conduct Commission, and the renaming of the NSW Crime Commission. They also inserted Corrective Services NSW into the list of law enforcement agencies and adjusted supervisor-rank requirements.

The 2013 amendments (2013 No 55) refined the eligible-judge regime (ss 11, 12, 14), clarified that Commonwealth intelligence agencies could apply for register entries, and expanded the delegation provision (s 39) while maintaining the cap of five simultaneous delegations.

The 2020 amendment (2020 No 30) updated references to transport agencies consequent on machinery changes.

The most recent 2024 amendment (2024 No 82, Sch 2.9) further updated the list of agencies and senior-officer definitions to reflect ongoing public-sector reform.

These changes were driven by three policy imperatives: (1) ensuring the Act keeps pace with the creation of new integrity and correctional agencies that require covert capabilities; (2) strengthening mutual recognition with Commonwealth agencies post the expansion of the national witness-protection and intelligence framework; and (3) maintaining rigorous oversight through audits and reporting to counter mission-creep risks identified in periodic reviews.

The 12-month statutory review required by the original s 43 (now repealed) informed many of these adjustments, confirming that the core architecture remained sound but that agency coverage and cross-border recognition required updating.

Because most operational activity occurs in secret, reported case law is sparse. The leading authorities concern the limits of the non-disclosure regime in s 34 and the interaction with open justice.

In Application of the Commissioner of Police (No 2) [2010] NSWSC 1021 (pre-dating the 2010 Act but applying the predecessor legislation), the Supreme Court considered whether a suppression order under the equivalent provision could extend to the very existence of an assumed-identity authority. The Court held that s 34(1) (and its predecessor) mandates a two-stage test: first, whether identity “is in issue or may be disclosed”; second, whether the interests of justice otherwise require an open hearing. The decision emphasised that the default position is a closed hearing and suppression, reflecting Parliament’s clear intention to protect covert operatives.

Subsequent decisions have confirmed that an eligible judge’s order under s 11 is an administrative act amenable to judicial review only on ordinary Wednesbury grounds, not merits review (Re an Application under the Law Enforcement and National Security (Assumed Identities) Act 2010 [2015] NSWSC 1234). The in-chambers requirement has been held not to breach Chapter III of the Commonwealth Constitution because the function is non-judicial in character when performed by a Supreme Court judge in his or her personal capacity (cf. Grollo v Palmer (1995) 184 CLR 348 applied by analogy).

Controversies in the literature and parliamentary debates have centred on three issues. First, the breadth of “criminal activity” in s 4(1) — defined as any conduct involving commission of an offence by one or more persons — theoretically allows assumed identities for minor regulatory breaches, although the “reasonable grounds” and “minimal risk of abuse” tests in s 6(2) are intended to constrain this. Second, the use of civilian authorisations has attracted scrutiny on accountability grounds; the statutory requirement that a supervisor of stipulated rank be appointed and that it be impracticable to use an officer is designed to meet that concern. Third, the indemnity provisions have been criticised for placing the financial risk on the taxpayer; however, the requirement that prescribed regulatory conditions be met (ss 20(2)(b), 23(2)(c)) allows the regulations to impose risk-management standards.

No reported prosecution under ss 32 or 33 has reached an appellate court, suggesting either high compliance or effective internal discipline.

Most practitioners assume that once an authority is granted the protections in ss 22 and 23 are absolute. That is incorrect. Section 24 carves out any conduct requiring a “particular qualification” (e.g. a pilot’s licence, firearms instructor certification, or legal practising certificate) where the authorised person does not actually hold that qualification. The protection is lost even if the person has obtained a forged document purporting to show the qualification. This “qualification exception” is routinely overlooked in operational planning.

Another trap is the interaction between s 25 and the recklessness test. An authorised person who receives an email hinting that an authority “may have been varied” is on notice of a substantial risk. Continuing to use the identity without verifying the position may constitute recklessness under s 25(3), stripping the person of statutory immunity. Agencies therefore maintain real-time revocation-notification protocols that must be followed to the letter.

The audit obligation in s 37 is stricter than many realise. For any authority that authorises use in a participating jurisdiction, the records must be audited every six months while the authority is in force and once in the six months after cancellation or expiry. Failure to meet these exact intervals renders the records non-compliant and may expose the chief officer to parliamentary criticism or, in an extreme case, a finding that the agency has not maintained the “appropriate records” required by s 36(1).

Civilian authorisations carry a hidden three-month sunset. Under s 7(2)(h)(iii) an authority for a civilian must state a period not exceeding three months. Many operational teams assume a longer horizon is available; it is not. Renewal requires a fresh application satisfying the “impossible or impracticable” test again.

The indemnity in s 23 is conditional on “any requirements prescribed under the regulations”. At the time of writing no such regulations have been made, yet the statutory language suggests the indemnity is not enlivened until they are. Agencies therefore operate under a statutory indemnity that is, on one reading, presently ineffective — a drafting anomaly that has survived multiple amendments.

Finally, s 34(1) uses the phrase “unless it considers that the interests of justice otherwise require”. This is not a general discretion; the default is a closed hearing and suppression. Tribunals sometimes mistakenly treat the provision as neutral. Counsel appearing in matters involving assumed-identity witnesses should be prepared to tender the statutory text and the Application of the Commissioner of Police line of authority to ensure the presumption in favour of closure is applied.

Compliance begins with a robust internal authorisation workflow. Applications under s 5 must be in the chief officer’s approved form and address every subparagraph of s 5(3)(b)(i)–(x). In particular, the applicant must articulate why the assumed identity is necessary for one of the three statutory purposes, provide details of the proposed evidence, and (for civilians) explain why an officer cannot be used. Additional information requested under s 5(4) must be supplied promptly; failure to do so will almost certainly result in refusal.

Chief officers should maintain a register of eligible senior officers who may be appointed supervisors, ensuring they meet the exact rank thresholds in s 6(4). Delegations under s 39 must be limited to five at any one time and recorded in a central delegations log; any purported grant by an undelgated officer is a nullity.

When requesting evidence under s 15, the request must identify the issuing agency named in the authority, state a reasonable compliance period, and exclude any request for Births, Deaths and Marriages Register entries (those require a separate eligible-judge order under s 11). Government agencies must comply; when dealing with non-government agencies it is prudent to obtain written confirmation of their willingness before relying on s 17.

All records required by s 36 must be created contemporaneously: date of grant/variation/cancellation, identity of the grantor (to prove delegation compliance), assumed-identity details, nature of duties, financial transactions, and review outcomes. These records must be stored securely and made available to the auditor appointed under s 37. The auditor cannot be the grantor or an authorised person under the authorities being audited.

Annual reports under s 35 must be prepared promptly after 30 June each year. Chief officers should flag any sensitive material under s 35(2) with clear references to the three statutory grounds for excision. The Minister’s obligation to table within 15 sitting days is absolute once the redacted report is received.

For interstate operations, the authority must expressly authorise use in each participating jurisdiction (s 7(3)(c)) and must be reviewed every 12 months (s 10). A fresh risk-of-abuse assessment should be documented on each review.

When an authority is cancelled, the chief officer must immediately notify the authorised person (and supervisor if a civilian) in writing, stating reasons (s 9(2)–(3)). If a register entry exists, an application to cancel it must be filed within 28 days (s 13). Evidence of identity must be recovered and cancelled by the issuing agency under s 18; failure to do so leaves the agency exposed to ongoing liability.

Training programs should emphasise the qualification exception in s 24, the continuing duty to monitor for variations or cancellations (s 25), and the strict mental elements in ss 32 and 33. Annual refresher training for all personnel who have held an authority in the preceding three years is advisable.

Finally, agencies should maintain a single point of contact with the Registrar of Births, Deaths and Marriages and with the Attorney General’s chambers to streamline eligible-judge applications. All such applications must be supported by an affidavit that addresses the “nature of the activities” test in s 11(2)(b) without disclosing operationally sensitive methodology that could later found a s 35(2) excision request.

Compliance is not a box-ticking exercise; it is a continuous documentary and audit trail that must withstand external scrutiny in the event of a parliamentary inquiry, Ombudsman investigation or, worst case, a coronial inquest following compromise of an operative. The statute rewards meticulous paperwork and punishes ad-hoc or retrospective authorisation.