Crimes Act 1914

Part IAAC - Account takeover warrants  

Division 2 - Account takeover warrants  

SECTION 3ZZUR   What an account takeover warrant authorises  

(1)    
An account takeover warrant must authorise the doing of specified things (subject to any restrictions or conditions specified in the warrant) in relation to each target account.

(2)    
The things that may be specified are any of the following that the magistrate considers appropriate in the circumstances:

(a)    taking control of the target account at any time while the warrant is in force, if doing so is necessary, in the course of the investigation to which the warrant relates, for the purpose of enabling evidence to be obtained of the commission of the alleged relevant offence, or alleged relevant offences, in respect of which the warrant is issued;

(b)    using:

(i) a computer; or

(ii) a telecommunications facility operated or provided by the Commonwealth or a carrier; or

(iii) any other electronic equipment; or

(iv) a data storage device;

for the purpose of taking control of the target account as mentioned in paragraph (a) ;

(c)    if necessary for the purpose of taking control of the target account as mentioned in paragraph (a) :

(i) accessing account-based data to which the target account relates; or

(ii) adding, copying, deleting or altering account credentials to which the target account relates; or

(iii) adding, copying, deleting or altering data in a computer;

(d)    if, having regard to other methods (if any) of taking control of the target account which are likely to be as effective, it is reasonable in all the circumstances to do so:

(i) using a communication in transit for the purpose of taking control of the target account as mentioned in paragraph (a) ; and

(ii) if necessary to achieve that purpose - adding, copying, deleting or altering data in the communication in transit;

(e)    copying any account-based data to which the target account relates, and that:

(i) appears to be relevant for the purposes of determining whether the account-based data is covered by the warrant; or

(ii) is covered by the warrant;

(f)    copying any account credentials to which the target account relates;

(g)    any other thing reasonably incidental to any of the above.

(3)    
For the purposes of paragraph (2)(e) , if:

(a)    access has been obtained to account-based data; and

(b)    the account-based data is subject to a form of electronic protection;

the account-based data is taken to be relevant for the purposes of determining whether the account-based data is covered by the warrant.

When account-based data is covered by a warrant

(4)    
For the purposes of this section, account-based data is covered by a warrant if access to the data is necessary, in the course of the investigation to which the warrant relates, for the purpose of enabling evidence to be obtained of the commission of the alleged relevant offence, or alleged relevant offences, in respect of which the warrant is issued.

Certain acts not authorised

(5)    
Subsection (2) does not authorise the addition, deletion or alteration of data, or the doing of any thing, that is likely to:

(a)    materially interfere with, interrupt or obstruct:

(i) a communication in transit; or

(ii) the lawful use by other persons of a computer;

unless the addition, deletion or alteration, or the doing of the thing, is necessary to do one or more of the things specified in the warrant; or

(b)    cause any other material loss or damage to other persons lawfully using a computer.

Concealment of access etc.

(6)    
If any thing has been done under:

(a)    an account takeover warrant; or

(b)    this subsection;

then, in addition to the things specified in the warrant, the warrant authorises the doing of any of the following:

(c)    any thing reasonably necessary to conceal the fact that any thing has been done under the warrant or under this subsection;

(d)    if, having regard to other methods (if any) of doing the things mentioned in paragraph (c) which are likely to be as effective, it is reasonable in all the circumstances to do so:

(i) using a computer or a communication in transit to do those things; and

(ii) if necessary to achieve that purpose - adding, copying, deleting or altering other data in the computer or the communication in transit;

(e)    any other thing reasonably incidental to any of the above;

at the following time:

(f)    at any time while the warrant is in force or within 28 days after it ceases to be in force;

(g)    if none of the things mentioned in paragraph (c) are done within the 28-day period mentioned in paragraph (f) - at the earliest time after that 28-day period at which it is reasonably practicable to do the things mentioned in paragraph (c) .

(7)    
Subsection (6) does not authorise the doing of a thing that is likely to:

(a)    materially interfere with, interrupt or obstruct:

(i) a communication in transit; or

(ii) the lawful use by other persons of a computer;

unless the doing of the thing is necessary to do one or more of the things specified in subsection (6) ; or

(b)    cause any other material loss or damage to other persons lawfully using a computer.

Statutory conditions

(8)    
An account takeover warrant is subject to the following conditions:

(a)    the warrant must not be executed in a manner that results in loss or damage to data unless the damage is justified and proportionate, having regard to the alleged relevant offence, or alleged relevant offences, in respect of which the warrant is issued;

(b)    the warrant must not be executed in a manner that causes a person to suffer a permanent loss of:

(i) money; or

(ii) digital currency; or

(iii) property (other than data).

(9)    
Subsection (8) does not, by implication, limit the conditions to which an account takeover warrant may be subject.

(10)    
The conditions set out in subsection (8) must be specified in an account takeover warrant.