Two years ago, The Guardian‘s Paul Farrell wrote a piece showing that an Australian vessel engaged in policing our border against asylum seekers went deep into Indonesia’s internal waters to do so. A government review of the incident had previously said the crossing into Indonesian waters was inadvertent. By showing how far the vessel had actually gone, Farrell’s story cast serious doubt on this claim.

Since then, various parts of the Australian state have been doing all they can to discover who Paul Farrell’s source for the story was. And Farrell has been using FOI law to shine a light on how this is happening.

Yesterday, The Guardian revealed that the Australian Federal Police had admitted to the Privacy Commissioner that it had sought a “subscriber check” on Farrell to be conducted in 2014, without a warrant. This check is, in essence, a request to a telco for all the metadata it holds on a person, including billing details, call logs, any stored internet usage information and the like. It’s not the first time Farrell has uncovered chilling evidence of how the AFP has tried to find his sources — in February, a request by Farrell for any files police have kept on him, obtained under privacy law, revealed 200 pages of “meeting minutes, file notes, interview records and a plan for an investigation” into Farrell’s story, including a list of leak suspects, complete with what crime they could possibly be charged with.

Farrell has been happy to publicly detail his own experiences with the surveillance state, giving a first-hand account of how metadata laws endanger investigative journalism. But is Farrell unusual, or do all similar journalists risk the same?

Alas, we can’t tell you for sure. We’d love to fire off requests for the police’s files on the country’s best investigative journalists (maybe we could rank them based on metadata requests?), but the Privacy Act makes that impossible. So we thought we’d do the next best thing and tell you, using our own experiences of doing this, how to find the AFP’s files on yourself. If you want to share your results when you get them, we’re all ears.

The Privacy Act allows people to access personal information held about themselves by government agencies, Australian companies and the Australian Federal Police, such as criminal records, investigation records and just about anything (with some exceptions as the Farrell case has revealed). To access these documents, you need to file a privacy request with the Australian Federal Police. This can be done by emailing privacy@afp.gov.au, or by post to:

Australian Federal Police
Government Relations, Information Access
GPO Box 401 Canberra ACT 2601

In order to get your own private information, you’ll need to hand over your own personal information in the request, including:

  • Your name
  • Date of birth
  • Address
  • Contact details
  • The type of information you are seeking
  • Photo ID

One way you could word this request, as a journalist, would be to say the following:

“Under the Privacy Act, I request access to all documents held by AFP mentioning my name related to referrals to the AFP for investigation regarding leaks to me in my capacity as a journalist for [publication name].”

If you’re worried you’re implicated in a leak, or if you’re just curious, you could word a request:

“Under the Privacy Act, I request access to all documents held by AFP mentioning my name created between [date] and [date].”

The AFP has 30 days to respond. It has a sophisticated name search database and should be able to pull up records by name if asked. If you’re unhappy with the response, or don’t think the AFP handed over the information you believe they have on you, you can file a privacy complaint (as Farrell has), and the Privacy Commissioner can consider whether to investigate the matter.

“That’s largely the process I went through,” Farrell confirmed to Crikey today. He suggests people also lodge a request for documents under the FOI act if they can. “One benefit of lodging under both is that you reserve appeal rights under both processes.”

Farrell is not the first journalist to use the Privacy Act to find out what information is being held on him. Former Fairfax journalist Ben Grubb took Telstra to the Privacy Commissioner seeking to obtain the metadata the telco held on him. Privacy Commissioner Timothy Pilgrim found in Grubb’s favour and said Telstra was required to hand over a significant amount of data it held on him, but Telstra then appealed the case to the Administrative Appeals Tribunal. Telstra won on appeal, but the Privacy Commissioner has appealed that decision to the Federal Court. Grubb is understood to be no longer involved in the case, leaving Fairfax late last year to work in public relations. The Federal Court is due to hear the case over one day in August.

Since Farrell’s reveal, Crikey understands several journalists have also lodged requests for their documents with the AFP under the Privacy Act. We hope they also make what they can public — sunlight is the best disinfectant.