McINTYRE, Ms Jennifer, Acting Assisting Secretary, Transnational Crime, Department of Home Affairs REEVE, Mr Parker, Acting First Assistant Secretary, Criminal Justice Division, Department of Home Affairs SPENCER, Ms Ciara, Deputy Secretary, Law Enforcement and Domestic Security, Department of Home Affairs. [13:21] CHAIR: Welcome. The parliament has resolved that an officer of the department of the Commonwealth or of a state shall not be asked to give opinions on matters of policy and shall be given reasonable opportunity to refer questions asked of the officer to superior officers or to a minister. This resolution does not preclude questions asking for explanations of policies or factual questions about when and how policies were adopted. I understand that information on parliamentary privilege and the protection of witnesses giving evidence to parliamentary committees has been provided to you. Would anyone like to make an opening statement? Ms Spencer : We have no opening statement. CHAIR: I will hand over to the deputy chair to put some questions to you. Mr BATT: I want to start with your submission. It speaks about perceived gaps in serious and organised crime. It says: exploiting perceived gaps and vulnerabilities in government systems and regulatory or law enforcement powers and capabilities Do the recent reforms to the AML/CTF Act provide sufficient powers and scope to support law enforcement to address crime as a service? Ms Spencer : Crime as a service is very broad and mimics legitimate business models in the way they go for specialist services. Where we're seeing as the emerging risk is really in the move to encrypted and digital devices. There are some challenges there. We have done some work on AML/CTF to cover digital assets. I'll ask Ms McIntyre to speak in more detail about that. Ms McIntyre : The reforms that were introduced in 2024 have widened the services that are covered in terms of virtual asset providers. That is to modernise the framework and ensure that we're not just capturing digital currency exchange but other services. What that means is entities that may not have been regulated previously now are. That does a couple of things. It enables AUSTRAC, as the regulator, to ensure that they have frameworks in place to counter money laundering and terrorism financing, but it also enables them with virtual asset providers to ensure that they are meeting a higher standard. They are required to register with AUSTRAC, and, in that process, they're able to refuse registration or deny registration if they feel that there is an unacceptable threat. Mr BATT: Can you give me a rundown on who's been brought into the fold? Ms McIntyre : Previously it was digital currency exchange with the services that were covered. That is generally exchanging what they call 'fiat currency', or general currency for digital currency. In the new system, it covers four additional things. That includes virtual asset exchange—for example, exchanging one virtual asset for another—holding or administering virtual assets and initial offerings of virtual assets. So it's more about the whole ecosystem than specifically digital currency exchange. Mr BATT: What's a virtual asset? Ms McIntyre : It includes cryptocurrencies that you'd be familiar with, like bitcoin, but also, previously, for example, stablecoins might not have been covered. It's a digital currency, but it's pegged to a more stable asset like, for example, the US dollar. Mr BATT: How are government agencies working with industry to work in hardening businesses and gaps in the supply chain? How's that looking? Ms Spencer : With crime as a service, it's much like any other crime. It's something we've seen for a long time. As I said, we're seeing the digital environment make it easier, but the law enforcement actions that we already take are still important in managing it. We have a transnational and serious organised crime national strategy that we work with. We have a police council meeting and a whole range of national coordination to make sure everyone's involved and knows what they're looking for. It goes to dealing with the criminal activity and following the money. Where the challenge really is is around getting better access to the digital and encrypted messages. At the moment, I think 95 per cent of content taken via warrant is encrypted. That's a whole change in the way that we operate. Mr Reeve does a lot of work in terms of making sure that our powers are fit for purpose for that digital environment so that we can address some of that threat. CHAIR: Are they really fit for purpose when social media have continued to use cryptocurrency and when those same social media platforms refused to be witnesses in this committee's inquiry? Are they really fit for purpose? Mr Reeve : The work we do with digital platforms, technology companies and multinational telecommunications companies, as Ms Spencer said, is about getting access to the communications that organised criminal syndicates are using to plan and carry out serious organised crime, to recruit people for crime as a service and to target vulnerable individuals through both crime as a service and other serious and organised crimes, such as online child sexual offending as well. Over the last seven or eight years, the parliament has passed a number of world-leading reforms to strengthen the Australian government's ability to work with Australian and multinational companies on this issue and to strengthen the powers of agencies, in particular, to target serious and organised crime use of encrypted communications to carry out their activities. Yesterday and today the committee heard evidence about the SLAID Act—that is, the powers for the AFP and the Australian Criminal Intelligence Commission to detect, identify and collect intelligence on the use of dedicated encrypted communications devices, darkweb marketplaces and so on. I think you've heard some evidence this morning about the value of that and what it has achieved. It also includes powers to disrupt serious and organised criminal activity where, effectively, a prosecution is not a viable outcome. They may be outside our jurisdiction, beyond our reach or unable to be physically located, for example, so it gives the AFP the ability to take direct action to disrupt and prevent the continuation of serious criminal activity. We've introduced the international production order framework. We've negotiated an agreement with the United States government, which came into force in January 2024, that allows Australian law enforcement agencies, as well as ASIO, to serve orders directly on those major US companies—Google, Apple, Meta and so on—to get access to information from those platforms. Obviously, those are the platforms that consumers are using. That is where a lot of the victims are targeted by serious and organised criminal groups. But some of those are also the platforms that these organisations use to communicate and plan their activities and particularly to engage with other criminal vendors in a crime-as-a-service marketplace. So the ability to go directly to those US companies saves months and, in some cases, years on investigative timelines compared to going through a traditional mutual legal assistance process. The timeliness of the information is critical, but so is the quality of the information, and the ability to enable agencies to accelerate their investigative and decision-making loops based on what they're receiving back from those companies is absolutely critical as well. So I think those reforms really do strengthen the ability of Australian agencies to investigate crime as a service and serious and organised crime where it is using encrypted communications platforms. I think you've heard evidence from the AFP and ACIC this morning about the value of those reforms. Mr BATT: We heard yesterday about this agreement with the US. With what we're getting so far and the positivity of it, are we looking at expanding that to other countries as well as the Googles and the Apples and all that sort of thing? Can we do that too? Mr Reeve : At the moment, our focus is still on fully implementing the agreement with the United States. It is a big undertaking to connect 20-plus Commonwealth, state and territory law enforcement agencies with the dozens and dozens of US vendors—just the major vendors, let alone the smaller ones. Equally, that's a priority that a number of our close partners and like-minded governments share as well. The United Kingdom was the first country to get such an agreement in place. Australia was the second in the world to get that agreement in place. I think you'd understand that, given the centrality of US tech companies when it comes to these sorts of investigations, the priority of most governments is to try to reach similar agreements with the United States first. However, the framework absolutely allows us to enter into agreements with other countries, and that is something that in the fullness of time, we may well consider. Mr BATT: Do these bilateral agreements pose any risk to Australia's data sovereignty at all? Mr Reeve : The agreement contains very strong protections for Australian persons—and for US persons on the other end—to the extent that the agreement directly prohibits agencies from using that direct access to target an Australian person—so an Australian citizen, an Australian permanent resident, an Australian company, an Australian unincorporated association or a person who is physically in Australia. Those requests still do need to be managed through a police-to-police relationship or through a mutual assistance request. The framework also contains very strong protections in the event that an Australian person's information is incidentally collected—if they're in communication with another person—requiring that information to be minimised unless it is essential to understand or assess the information. Obviously, in some circumstances it will be necessary to understand what the communication is to be able to see the other side of it, so to speak. So, from a data sovereignty perspective, there are some very strong protections in place for all Australians, and all people in Australia, as part of those agreements. That was a key feature in the Joint Standing Committee on Treaties' consideration of the agreement. Equally, that's an expectation of the United States government from the reciprocal end, and I expect it would be an expectation of many governments entering into such an agreement. Mr BATT: Back on the digital data that we're receiving—that 94 or 95 per cent that is encrypted—as you said, we heard that yesterday as well. I didn't get to ask about that yesterday. Even though it's encrypted, are our agencies able to access that information after encryption? If not, what are we doing to try and work through that? Ms Spencer : That's really a matter for the AFP, but what I would say is that there are tools they're able to take. What we're finding, though, is that it adds so much more complexity and time to the investigation processes, and that's what the real challenge is. The traditional law enforcement mechanisms don't operate in the same way, and that's why we've had a range of new powers included. We're continuing to work with agencies on that. Mr BATT: Thank you. CHAIR: In relation to encryption and the continual development and use of that, particularly for criminal activities, does this actually point to a need for ASD, along with the AFP, to get more support in terms of them being able to decode that information and needing more expertise? Have you developed any information and presented that yet to the government to assist in that process? Ms Spencer : Again, that would be a matter for the ASD and AFP to raise with government. They have the technical expertise and understand their agency's requirements. CHAIR: So government has not requested any advice from the department as to the need to address the use of encryption and our abilities to fight organised crime and to protect our children? Ms Spencer : We obviously provide a range of advice on policy and legislative matters, in terms of how to address that, and, as Mr Parker said, there are a range of initiatives and legislative changes we've made, and we continue to review the changes in the environment and how we can best support agencies to manage that. CHAIR: Is there a recognition by the department, in relation to AI, of the tools that are now available through that process? If we already have an issue with encryption, then has there been any analysis done in terms of the sorts of legislation that may need to be changed to deal with AI and the tools and the continual evolution of cybercrime and the use of AI? Ms Spencer : Absolutely. We are very focused on the national security implications of AI. We're continuing to get as much access as we can from the technology companies to understand their models and how they operate. We're working with international partners as well, to understand what they're seeing and how we can work together, and we are looking at the policy responses to manage that. The other piece is this: AI brings volume to a lot of these cybercrime issues, but it's also able to be used by law enforcement and other agencies in ways that help mitigate the threat. So there are opportunities and benefits there, and that is a lot of the work we're doing at the moment. Obviously, we also now have the AI Safety Institute, which does some of that work. CHAIR: So, currently, there are no legislative roadblocks in the use of AI for law enforcement and how they use it? Ms Spencer : There is work underway across all of government as to what the appropriate guardrails are and how that can be used. Parker can talk to the way that law enforcement powers are considered and the oversight mechanisms we have for powers that we use. CHAIR: And just noting that the criminals are not bound by guardrails in how they use it! Mr Reeve : Certainly, Chair. From a law-enforcement-powers perspective, the way we try to approach those powers is to keep them as technology agnostic as possible, to ensure that our agencies have the ability to use powers that are effective when dealing with in-person crime, to target the sort of crime you would see on the street, as well as in an online and cyber domain, and to follow criminality that's being enabled through artificial intelligence. In a law enforcement context, it is obviously very important that the decisions that law enforcement agencies make are of the highest standard, and I think there has been lots of discussion over the years about the risks of AI. In terms of the quality of decision-making—whether it will hallucinate or the like—that is an issue that is taken very seriously by the department and by our law enforcement partners, and the ultimate safeguards around law enforcement activity are the requirements for those agencies to have the exercise of their powers independently authorised under warrant, under various authorisations and orders and the like, to ensure that the decisions they are making and the operational approaches they want to take are reasonable, justified and consistent with law. CHAIR: You would have heard evidence, just before you came before the committee, in relation to consumers and their experiences through the process of scams and scamming. My question, in relation to the concerns around AI, is that you can get a text message or a phone call from your supposed child—like I did. I don't have any sons, so I knew that that was a scam. That's a little bit easier for laypeople to identify, whether it's a scam or not. But now, with AI—and we know politicians have already been targeted—they reuse an image of you and use your voice. That will make it more difficult for consumers to identify whether it is a legitimate call or not from their loved one. What sort of work is going in and why has there been a delay in this legislation, around communications, that has been referred to? Ms Spencer : Sorry, what legislation were you referring to? CHAIR: It was in relation to a telecommunications bill that passed in 2025. ACCAN have been waiting for it to be implemented and, just recently, Minister Mulino said that there was a further delay. Are you aware of what the hold-up is with that legislation, if it was passed in February 2025? Ms Spencer : I'm not aware. We can take that on notice. It may be legislation that sits, potentially, with the communications portfolio rather than— CHAIR: I'd say it probably does, but if you—because you're very powerful—can take it on and give us some information, on notice, that would be really useful for us. Ms Spencer : Yes. CHAIR: You would have seen, from the commission, evidence and submissions put to us that there is still—it's been referred to as a ping-pong game, a merry-go-round, when people report a cybercrime, whether it's a scam or another vicious crime—more work to be done around how people report. There's also been evidence given around the importance of education of our law enforcement officers, to think about how quickly this environment has changed over the last decade. Imagine people who came into law enforcement 20 or 30 years ago and there was a fund available—there has been, but that runs out at the end of 2026-27—to assist AFP train law enforcement officers, including state police. Has there been any consideration given to ongoing funding of that program? Ms Spencer : My understanding is there is no ongoing funding for the National Cybercrime Capability Fund. There is a range of work, and I understand that at the hearing yesterday my colleague spoke about the launch of horizon 2 of the cybersecurity strategy. There are initiatives in that strategy to support cybercrime but also to support increasing awareness of cybersecurity, with a focus on small and medium enterprises but also more vulnerable members of the community. What we're seeing is, there are very simple cybersecurity actions that you can take, around passwords and multi-factor authentication, that will offer a degree of protection against these scams as well as an increasing awareness not just of the scams and the way they operate but of the actions that you can take in response to them and also in preventing and securing yourself. CHAIR: Everything you said is correct, but we've also had evidence given to us that we are leaving vulnerable Australians to be able to comprehend a very quickly emerging changing environment around cybersecurity. The messaging is probably too complicated and goes over most people's heads. They don't understand it. That's why there was legislation to reduce access to 16-year-olds on the internet. It was because a lot of parents know very little about the internet. They don't supervise their children. They have their computers in their bedrooms. They don't know the chat rooms they're going into. Please take on notice the sorts of things that are currently being implemented and the language that is being used to explain that, because if we keep throwing information at consumers it becomes too complicated and they go, 'I'm just not going to worry about it. It's not going to happen to me,' when, in fact, it. We know that people who are impacted on one occasion are more likely to be in impacted a second or third time. Please take that on notice for us. We know there's a lot of really good work that's going on, but we also know that cybercrime is increasing. Ms Spencer : We will absolutely take that on notice. The other point I would make is that part of Horizon 2, which we launched yesterday, is really challenging the perception that cybersecurity and cybercrime are about technology. It's about people, and it's that cultural change that makes a difference—being able to talk to people very simply about the simple things they can do, all the technological developments aside, saying that, if you can get the basics right, you're a long, long way ahead. It's making sure we can get that out simply. As you say, there are a range of initiatives, and we will provide on notice more detail about each of those. CHAIR: That would be very useful. It was very coincidental that announcement was made yesterday. I certainly haven't got my head around all of that as yet, but I'll be very interested to see how we're progressing and going forward. In terms of where we're at and the evidence that's been given to us, more still needs to be done. There's been some criticism, even though we have a great reputation internationally, we could actually look at some of the changes that the UK has made, just like we did around money laundering from Ireland. Let's face it, we were a long way behind where we should have been, and there was some urgency about changing the legislation to play catch-up. I'm just urging, as a member of the government, that we have to be ahead of this and be able to adapt to a very quickly changing environment. Any final questions from you, Deputy Chair? Mr BATT: You mentioned Horizon 2, which was announced yesterday, and the support for SMEs and other victims in giving them some ideas and training—understanding. From what we hear, the funding we were talking about, which you mentioned runs out at the end of June next year, is more about training our police, our first responders and our trainees across Australia so they're all on the same page so that we don't get this issue of going to the wrong door or police not understanding that there is a crime and then telling people that there is no offence and sending them away or that sort of thing. Are you aware if that is not being refunded and there being the idea to just fund for the three years so that the AFP and other states then continue that work and fund it themselves, or is it that the funding has basically run out? Ms Spencer : The funding has run out. But, in terms of law enforcement, we work very closely across all the jurisdictions, so there is ongoing collaboration and joint operations. ASD runs some joint cybercommand centres as well. There are a range of initiatives to ensure that we're continuing to share information and working together to understand the threat from a national level and be able to respond consistently. Mr BATT: That's great. I love that too. It's more about the training those police coming in to each of those agencies to start with to make sure they're all on the same page so you're not getting different information from one person to the next and one state to the next, which I thought was a great idea. We've heard today again that recruits are under the pump, obviously, and they're learning a lot, but some information in relation to cybercrime and this technology, as to whether it is an offence or not, is definitely worthwhile. We know that people do walk in to the front counter of a police station and say, 'I've had this happen,' and they're being told, 'Well, that's not for me. Go away,' or, 'That's the AFP. Ring them,' or whatever it is. It would be a great way forward if there were a one-door or one-entrance policy where someone can deal with it and send it to the right organisation. CHAIR: I will just say in wrapping up that the JPC3 is a prime example of when government has invested and it's proving to be invaluable to the extent that you can't put a dollar figure on the lives that have been changed, altered or protected through that agency. You have taken a few things on notice, so we look forward to getting them. Mr BATT: I have one more question, if that's alright, Chair? CHAIR: Oh, I don't know. You're testing my patience! Mr BATT: I had one left that I hadn't asked about. In your submission you talked about AUSTRAC showing that cryptocurrency ATMs are increasingly used for scams and fraud. They're convenient and accessible and open 24 hours a day. Globally, Australia has the third-largest cryptocurrency ATM population. That's the background to it. AUSTRAC has found that some of these cryptocurrency ATMs do not comply with the AML/CTF regime. Are we looking at how that can be sorted out? What's the answer to that? Ms Spencer : There have been some developments in that regard. I'll ask Ms McIntyre to answer. Ms McIntyre : The Anti-Money Laundering and Counter-Terrorism Financing Amendment Bill 2026 is currently before parliament. One of the schedules within that talks to a new power that is proposed for 'the AUSTRAC CEO to restrict or prohibit, via legislative instrument, reporting entities from using high-risk mechanisms to provide designated services'. I know that's very broad. A mechanism for providing a designated service is a product, channel or thing. As an example—and it is hypothetical; it's not in the proposed legislation—a high-risk mechanism could be a cryptocurrency ATM which is providing a financial service. To meet that threshold, however, the AUSTRAC CEO would have to be satisfied that the mechanism proposes 'significant harm to either or both the financial system and the Australian community' and that it would also be in the public interest. That legislation has not yet been passed, but that is one power that we are considering enabling. When a tool arises that is very high risk to our community, there could be a mechanism to prohibit or restrict its use. Ms Spencer : That community harm or public interest would go to things like criminality. We see them a lot in illicit tobacco establishments. There are elements that would go to them being high risk. Mr BATT: You're keeping it open, which is great, because there could be things to come that we don't know about. That's why you're not listing them. But that legislation is about trying to sort out these issues of the crypto ATMs that aren't currently under the AML/CTF regime. Ms McIntyre : There are two things I'd say. Firstly, how that would be applied would be a decision for the AUSTRAC CEO. It is broad mostly because we don't know what's coming in the future. It is designed to be flexible to not restrict too much in case there is a new thing of concern that arises. Secondly, cryptocurrency ATMs are subject to regulation at the moment, in the sense that they fall in that virtual asset provider sector. The difference is that, at the moment, the CEO can restrict an entity. If an entity is noncompliant with the act, they can, effectively, deregister them. But the proposal that would go forward in the bill is a broader mechanism in general, as opposed to a specific provider. CHAIR: When's that bill going before the parliament? Ms McIntyre : I'm not entirely sure. Ms Spencer : We will take it on notice, but it is before parliament. Mr Reeve : Yes, it's been introduced. Mr BATT: It's been brought into the House. CHAIR: They're dragging their feet in that place! In terms of the department having a full breadth of understanding of the development in this area, how many people do you have working in relation to cryptocurrency and that regime who have a full and comprehensive understanding of that within the financial sector? Or do you leave that to AUSTRAC? Ms Spencer : No. We have a section dedicated to AML and CTF. Mr Reeve, can you give the number for that section? Mr Reeve : Ms McIntyre, what's the current staffing? Ms McIntyre : I would estimate that there are around 20 people working on broader AML/CTF legislation and associated policy. CHAIR: And they have a full, comprehensive understanding of how cryptocurrency is used and how it's being used by criminals? Ms Spencer : There are also, more broadly, people involved in law enforcement policy, law enforcement powers, transnational serious and organised crime in the cybersecurity division, as well as in Border Force. That isn't the number of people working on that issue; that's one subset. There are a whole range of people with varying interests working on these issues. CHAIR: I appreciate that. Thank you for your time. If we could have the answers to any questions that you've taken on notice by 3 July, that would be fantastic. To be fair, all the witnesses had very well thought through answers, and they weren't asking for extra money, but I think they certainly want the government to know that this is a very complex area and that we need to resource law enforcement appropriately. Thank you to Hansard and the secretariat for all their support and help. Committee adjourned at 13:55