Chapter 13

Introduction

Term of reference 3 required the Commission to inquire into and report on the current adequacy and effectiveness of Victoria Police’s processes for the management of human sources subject to legal obligations of confidentiality or privilege. As noted in Chapter 4, the Commission was primarily concerned with legal obligations of confidentiality and privilege arising from professional relationships, and by extension, confidential and privileged information derived from those relationships. In this chapter, the Commission uses the term ‘confidential or privileged information’ in this context.

Term of reference 5b required the Commission to inquire into and report on recommended measures that may be taken to address any systemic or other failures in Victoria Police’s processes for its disclosures about and recruitment, handling and management of this category of human sources. As part of its inquiry into these terms of reference, the Commission considered the need for, and potential benefits of, an external oversight regime for Victoria Police’s use of human sources.

Independent, external oversight encourages police to use their significant powers fairly and to develop and maintain consistently high ethical and professional standards. It also helps to hold police to account when this does not occur and provides critical public assurance that even when police are acting covertly, they are also acting lawfully. In this way, external oversight can help to build, maintain and improve both public trust and confidence in policing, and the quality of work done by police.

This chapter explains why external oversight of police powers and actions is important; describes different oversight models; outlines oversight arrangements for other police powers in Victoria; and identifies the key bodies that make up the current police oversight system—in particular, the Public Interest Monitor (PIM), Victorian Inspectorate (VI) and Independent Broad-based Anti-corruption Commission (IBAC). It then looks at the limited external oversight currently in place for Victoria Police’s use of human sources, along with oversight regimes in other Australian jurisdictions and the United Kingdom.

The chapter also outlines the views of stakeholders consulted by the Commission, including views about the need for stronger external oversight of Victoria Police’s use of human sources, the benefits external oversight offers and the concerns it raises. It then considers evidence heard by the Commission on the features of an effective external oversight model, and the resources and expertise required to administer it.

Taking that research and evidence into account, the Commission concludes that the current lack of external oversight of Victoria Police’s use of human sources is an undesirable gap in the police oversight system. While the use of human sources is a powerful, legitimate tool to detect and prevent crime, the case of Ms Nicola Gobbo amply demonstrates that, used improperly, it can adversely affect individual rights and the administration of justice. External oversight provides a powerful safeguard to ensure that police act ethically, lawfully and with due regard to human rights. The absence of an independent check on Victoria Police’s use of human sources is also at odds with the oversight regimes in place for its use of other covert powers and methods, including surveillance devices, telecommunication intercepts and controlled operations.

Guided by lessons learned in other jurisdictions, and principles of proportionality and accountability, the Commission recommends the establishment of a tiered external oversight model that applies generally to Victoria Police’s use of human sources, with greater scrutiny of decisions about human sources who are reasonably expected to have access to confidential or privileged information (‘reportable human sources’).

The oversight model recommended by the Commission consists of three tiers:

• The PIM would test the appropriateness and rigour of Victoria Police decision making related to the registration of reportable human sources.
• IBAC would monitor Victoria Police’s compliance with the human source management framework recommended by the Commission (outlined in Chapter 12).
• IBAC would retain its current role to review and investigate complaints against Victoria Police officers, including any complaints that may relate to officers’ use of human sources.

The Commission also considers that there may be merit in the Victorian Government reviewing the broader system for external oversight of Victoria Police, particularly the oversight of its use of covert powers, with a view to achieving greater system consistency and coherence.

Current context and practice

This section discusses why police and other law enforcement agencies are subject to external oversight and examines the current institutional and legislative framework for the oversight of Victoria Police.

It outlines:

• the role of independent external oversight of police
• the current police oversight system in Victoria
• approaches to external oversight of the use and management of human sources in Australian and international jurisdictions.

These topics are discussed in turn below.

The role of independent external oversight of police

Independent, external oversight of police is an important check and balance on the use of their wide and significant powers. It aims to ensure that police treat people fairly and act ethically, lawfully and with high professional standards. It balances power with accountability, building public trust and confidence in police.

External oversight of police is necessary and important because, as noted in the Commission of Inquiry into Possible Illegal Activities and Associated Police Misconduct report into police corruption in Queensland, police officers hold ‘extensive authority over all other citizens, however powerful, coupled with wide discretions concerning its exercise’.¹ As the Royal Commission into the New South Wales Police Service described it:

The powers entrusted to police to carry arms, to use coercive force in the proper course of their duties (and, in extreme circumstances, to take lives), to inquire into personal affairs and to eavesdrop (pursuant to a warrant) on private conversations, to deprive citizens of their liberty, to enter and search their premises, to seize and hold their property, and to initiate proceedings that will require them to defend themselves before the courts, are very substantial powers—possessed by no other class of employee.²

In Victoria, police authority over citizens includes a range of common law and legislative powers to prevent and investigate crime and maintain public order. Often, these powers intrude upon certain human rights in order to uphold others, like a person’s right to life and security and property rights. For example, powers to arrest, preventatively detain, move on and restrict association can limit personal freedoms of movement and association. Investigative powers, such as searches of property, telecommunications interception and use of surveillance devices, curtail personal privacy rights, often without a person’s knowledge.

In Victoria and elsewhere, police officers have significant discretion to decide how and when they use their powers.³ Such discretion is vulnerable to being used arbitrarily, unfairly or in a corrupt manner.⁴ When police powers are used improperly, it can negatively affect not only the individuals subject to them, but also the broader community and its institutions, by reducing trust in the police service and in the criminal justice system.⁵

Governments and academic commentators have recognised the need for external oversight of covert police powers; that is, powers exercised without the knowledge of affected persons. Former police officer, Professor Clive Harfield, University of Queensland, explained:

… the arena of covert investigation is potentially more vulnerable [to corruption], since such investigation, by definition, cannot be challenged by the subject of the investigation in ways that overt investigation powers can be.⁶

More specifically, serving Western Australian police officer and Adjunct Associate Professor, Dr Charl Crous, APM has identified that the covert relationships between police and human sources can lead to corruption and unethical behaviour.⁷

In 2011, risks inherent to the exercise of covert powers prompted the Victorian Parliament to establish an additional oversight and accountability mechanism in the form of the PIM, which commenced operations in 2013. The then responsible Minister described the policy rationale for the PIM as follows:

Covert investigations and coercive powers … are among the most intrusive powers available to integrity and law enforcement bodies in Victoria.

Strong accountability measures should exist for the use of such significant powers. It is critical that the Victorian community has full confidence that applications for covert investigation and coercive powers are subject to optimal safeguards and oversight.⁸

External oversight complements internal governance and control mechanisms, which are critical to ensuring proper and lawful conduct among police, and improving accountability and organisational performance.⁹ As with any organisation, Victoria Police has primary responsibility for ensuring the integrity and professional conduct of its employees, consistent with legislative requirements, the organisation’s code of conduct and values, and broader public sector standards.¹⁰

Current external oversight of Victoria Police

Victoria’s current institutional structure for external oversight of Victoria Police has been in place since 2013. Although there have not been any significant legislative changes since then, the Victorian Parliament has given additional functions to oversight agencies when new police powers have been introduced or existing powers increased.

Within this structure, Victoria Police is subject to external oversight by several agencies:

• IBAC exercises a broad police integrity and oversight jurisdiction by assessing and investigating allegations of police misconduct and corruption.
• IBAC, the VI, PIM, courts and tribunals and the Commonwealth Ombudsman oversee Victoria Police’s use of specific powers and functions, including various powers that are exercised covertly.

Other than Victoria Police itself, IBAC is the only Victorian public sector agency that can investigate allegations against police officers.¹¹

There is currently no external oversight of Victoria Police’s use of human sources, other than potentially through the investigation of a complaint by IBAC, an IBAC own motion investigation (that is, an investigation IBAC initiates itself), or an inquiry or royal commission established under the Inquiries Act 2014 (Vic) to examine a particular issue. This is discussed further below.

The current external oversight arrangements reflect the Victorian and Commonwealth Parliaments’ recognition of the need for independent scrutiny of, and accountability for, Victoria Police’s exercise of extensive powers to prevent and investigate crime.¹²

While there is considerable variation in powers, functions, obligations and enabling legislation, external oversight in Victoria falls into three broad categories: involvement in decision making; review of decisions and/or monitoring compliance with legislation; and review and investigation of complaints.

These three categories are outlined in Figure 13.1 and discussed below.

Figure 13.1: Three categories of external oversight of Victoria Police

Some police powers are subject to one type of oversight only; for example, monitoring of Victoria Police’s compliance with DNA sampling laws is overseen by IBAC and no other body.¹³ Other powers are subject to a tiered approach, with different agencies performing different oversight functions.

Figure 13.2 below provides a snapshot of how the three oversight categories apply across various Victoria Police powers and functions, some of which are comparable to the use of human sources due to their covert nature and/or their lawful limitation of human rights. Certain other Victorian law enforcement and integrity bodies can also use some of these powers.¹⁴

The enabling legislation for all of these powers and functions requires the agency exercising the power or function and/or the oversight agency to report to the responsible Minister or Parliament about their exercise and, in some cases, the effectiveness or appropriateness of their use.

Figure 13.2: External oversight of certain Victoria Police powers and functions ¹⁵

Involvement in decision making

The first category of external oversight in Victoria is involvement in decisions about the use of certain powers by police.

Victoria Police is often required to apply to a court for authorisation to use covert powers. These applications are heard ex parte—that is, without notice to, or hearing from, the person proposed to be subject to the use of these powers (often referred to as the ‘target’). In some cases, the PIM has a statutory role to test the content and sufficiency of police applications to use such powers; for example, in relation to surveillance devices, telecommunications interceptions and covert search warrants.

As the decision maker, the court must weigh up the evidence supporting the police application and decide whether the legal test for granting the authorisation has been met. For example, a judge or magistrate may issue a surveillance device warrant if satisfied that there are reasonable grounds for the suspicion or belief that an offence has or will occur, and that a surveillance device will help gather evidence. In making this decision, the court has regard to:

• the nature and gravity of the alleged offence in respect of which the warrant is sought
• the extent to which the privacy of any person is likely to be affected
• the existence of any alternative means of obtaining the evidence or information sought to be obtained
• the evidentiary or intelligence value of any information sought to be obtained
• any previous warrant sought or issued in connection with the same offence
• any submissions the PIM has made.¹⁶

As noted above, since 2013, the PIM has provided an additional safeguard for certain covert powers and functions exercised by police.¹⁷ The PIM’s role in ex parte applications is to ‘represent the public interest and provide greater accountability in the collection of evidence from warrants and orders that intrude on the privacy and civil liberties of Victorian citizens’.¹⁸

This safeguard operates by:

• Victoria Police notifying the PIM of relevant applications to the court and providing the PIM with documents relating to the application
• the PIM appearing at a hearing to test the sufficiency of the information relied upon and the circumstances of the application; and making submissions as to the appropriateness of granting the application.¹⁹

An example of this form of oversight is the PIM’s involvement in applications for covert search warrants under the Terrorism (Community Protection) Act 2003 (Vic), outlined in Box 13.1.

Since commencing operation in 2013, the PIM’s role has expanded to include involvement in decisions made by Victoria Police (in addition to decisions made by a court) about its exercise of certain powers and functions; specifically, police detention decisions relating to terrorism suspects and administration of the witness protection scheme. The role of the PIM in relation to the witness protection scheme is outlined in Box 13.2 below.²⁵ Procedural requirements for the PIM’s involvement in these decisions broadly mirror those that underpin its involvement in court decisions about Victoria Police’s use of other covert powers.

Review of decisions and/or monitoring compliance with legislation

The second category of external oversight in Victoria is reviewing decisions and/or monitoring compliance with legislation. While arrangements vary across regimes, in Victoria this type of oversight often focuses primarily on Victoria Police’s compliance with procedural requirements, such as record keeping.

The VI and IBAC have primary responsibility for compliance monitoring under Victorian law. The VI currently monitors Victoria Police's and IBAC's compliance with legislation regulating covert or intrusive powers that both of these agencies are able to use in conducting their investigations, such as telecommunications interception and use of surveillance devices.³³ IBAC monitors Victoria Police compliance with legislation regulating certain powers and functions that are conferred on Victoria Police alone; for example, DNA sampling and making of firearm prohibition orders. In some cases, IBAC has a deeper oversight function that goes beyond assessing compliance with record-keeping requirements and involves reviewing the appropriateness of Victoria Police decisions.

Table 13.1 outlines some of the key compliance-monitoring regimes relevant to Victoria Police powers and functions. There are also other statutory schemes that provide for external oversight of Victoria Police powers and functions. For example, IBAC also has a range of other compliance-monitoring responsibilities under the Firearms Act 1996 (Vic) (Firearms Act), Sex Offenders Registration Act 2004 (Vic), Crimes Act 1958 (Vic), Drugs, Poisons and Controlled Substances Act 1981 (Vic) and the Terrorism (Community Protection) Act 2003 (Vic).

Table 13.1: Examples of compliance monitoring regimes in relation to Victoria Police³⁴

As detailed in Box 13.3, the VI also undertakes compliance monitoring of Victoria Police’s use of powers relating to telecommunications interception; that is, where an agency can intercept the communication passing over a telecommunications system without the knowledge of the people engaged in the communication.

Box 13.4 below outlines IBAC’s oversight role in relation to Victoria Police’s making of firearm prohibition orders. These orders prohibit a person from acquiring a firearm or related item. IBAC’s oversight role involves reviewing not just Victoria Police’s compliance with record-keeping or other procedural requirements, but also the appropriateness of its decisions about issuing such orders and its administration of the broader scheme.

Review and investigation of complaints

The third category of external oversight in Victoria is the review and investigation of complaints. This involves IBAC’s review and investigation of complaints under its broad police integrity jurisdiction. Under the Independent Broad-based Anti-corruption Commission Act 2011 (Vic) (IBAC Act), IBAC’s functions include:

• identifying, exposing and investigating corrupt conduct and police misconduct
• assessing police conduct
• ensuring the highest ethical and professional standards are maintained by police officers, and that police officers have regard to human rights set out in the Charter of Human Rights and Responsibilities Act 2006 (Vic)
• investigating complaints about corrupt conduct or misconduct of police
• undertaking education and prevention functions to achieve the objects of the IBAC Act.⁴⁷

Complaints, notifications and investigations

IBAC can conduct investigations in response to complaints from members of the public, notifications from Victoria Police or on its own motion.⁴⁸ IBAC can also receive public interest disclosures about police, sometimes known as ‘whistle-blower complaints’. These are assessed by IBAC and the complainant may be afforded protections under the Public Interest Disclosures Act 2012 (Vic).⁴⁹

On receiving a complaint or notification, IBAC assesses whether the matter should be referred to Victoria Police for internal action, investigated by IBAC or dismissed.

While IBAC must give priority to the investigation and exposure of serious and systemic corruption, it has the discretion to investigate any corrupt conduct or police misconduct.⁵⁰ In practice, IBAC ‘primarily investigates police matters that involve serious, systemic and/or sensitive allegations, and which [it has] the capacity and capability to best handle’.⁵¹

In its 2018 Inquiry into the external oversight of police corruption and misconduct in Victoria, the IBAC Committee of the Victorian Parliament (IBAC Committee Inquiry) described the system for handling complaints and disclosures about police as ‘extremely complex’.⁵² The IBAC Committee noted that the vast majority of complaints are referred back to Victoria Police for investigation.⁵³ Where this occurs, IBAC receives and monitors the outcomes.⁵⁴ IBAC also reviews a sample of internal investigations to ensure that they were handled appropriately and audits Victoria Police’s complaint-handling system.⁵⁵

Approaches to external oversight of the use of human sources in Australia

In Victoria, no external oversight agency has a specific, legislated function to oversee Victoria Police’s or other agencies’ use and management of human sources.

Under IBAC’s broad mandate to oversee Victoria Police’s integrity, IBAC could examine Victoria Police’s use of human sources if:

• it was the subject of a complaint, notification or disclosure; or
• IBAC initiated an own motion investigation into suspected serious or systemic police misconduct or corruption regarding the use of human sources.⁵⁶

Similarly, the VI could investigate suspected or alleged improper use of human sources by IBAC if it fell within its general jurisdiction to investigate and assess the conduct of IBAC and its officers.

The Commission consulted with nine police oversight agencies in other Australian jurisdictions during its inquiry. A list of the oversight agencies consulted can be found at Appendix G.

Consistent with the current approach in Victoria, these Australian agencies do not have specific functions to oversee the use of human sources by police. Like IBAC, agencies can generally investigate matters relating to the use of human sources as part of their broader police integrity functions.⁵⁷ For example, some oversight agencies have investigated allegations of improper conduct by police in their use of human sources, such as corrupt relationships with sources or the provision of inappropriate financial rewards to sources.⁵⁸

The Commonwealth Inspector-General of Intelligence and Security (IGIS) oversees six national intelligence agencies, including the Australian Security Intelligence Organisation (ASIO) and Australian Secret Intelligence Service. IGIS monitors agencies’ operational activities through regular inspections, and reviews human source management processes to ensure agencies act legally and with propriety, comply with ministerial guidelines and directives, and respect human rights.⁵⁹ For example, IGIS reviewed ASIO human source case files in 2018–19 and met with ASIO staff to discuss related activities.⁶⁰

Approaches to external oversight of the use of human sources internationally

The Commission understands that, with the exception of the Investigatory Powers Commissioner’s Office (IPCO) in the United Kingdom and certain federal agencies in the United States of America, oversight agencies in comparable countries do not have specific functions to oversee the use of human sources by police services. As is the case in Australia, these agencies could examine the use of human sources as part of their broader complaint-handling,⁶¹ inspection⁶² and audit jurisdictions.⁶³

As noted in Chapter 12, the Commission paid particular attention to the United Kingdom’s legislative and external oversight framework for human source management due to the specific requirements in place for the use of human sources and the similarities between the legal and human rights systems of Victoria and of the United Kingdom.

Investigatory Powers Commissioner’s Office, United Kingdom

In the United Kingdom, IPCO provides external oversight of public authorities’ use of investigatory powers, including their use of human sources. Public authorities are defined to include police services. IPCO consists of the Investigatory Powers Commissioner, a team of Judicial Commissioners and IPCO staff.⁶⁴ Chapter 12 outlines the regulatory framework for public authorities’ use of investigatory powers in the United Kingdom. This chapter focuses on the aspects of this regulatory framework that are relevant to external oversight.

Oversight by the Investigatory Powers Commissioner’s Office and Commissioner

Among IPCO’s oversight functions under the Investigatory Powers Act 2016 (UK) (Investigatory Powers Act) is the requirement to review—by audit, inspection or investigation—public authorities’ exercise of functions relating to human sources under the Regulation of Investigatory Powers Act 2000 (UK) and their adherence to the practices and processes prescribed in the Covert Human Intelligence Sources Revised Code of Practice (Code of Practice).⁶⁵ IPCO can undertake inspections on its own initiative or it can be asked to investigate a specific issue by the Prime Minister. It can also produce guidance to public authorities on the use of investigatory powers.⁶⁶

The Investigatory Powers Act also gives IPCO powers to discharge its oversight functions.⁶⁷ The Code of Practice notes that the Investigatory Powers Commissioner ‘will have unfettered access to all locations, documentation and information systems as are necessary to carry out their full functions and duties’.⁶⁸

Public authorities are required to keep detailed and extensive records relating to the registration and use of human sources.⁶⁹ This includes records about:

• a human source’s identity
• the officers responsible for managing the source
• the tasks given and demands made of the source
• all contacts and communications between the source and the authority
• the information obtained and disseminated
• any payment, benefit or reward given or offered to the source
• copies of key documents, including registrations, reviews, renewals and risk assessments.

The Commission consulted with IPCO and understands that:

• On-site inspections of law enforcement agencies generally occur annually, though there may be more frequent inspections of larger public authorities.
• Following an inspection, IPCO provides the agency with a report identifying any areas of legal non-compliance, its recommendations and any broader observations, drawing attention to relevant legislation and any other available guidance.
• If any ongoing compliance issues are observed, IPCO may conduct a focused revisit.
• While focusing on compliance, IPCO also considers authorities’ internal policies and processes and shares information with them about good practice.⁷⁰

Public authorities can seek general advice from the Investigatory Powers Commissioner about any issue that falls within the Commissioner’s responsibilities as regards to the law and the applicability of investigatory powers, though IPCO does not issue formal advice on operational decisions given the critical need to maintain its independence from the authorities it oversees.⁷¹

Approval of a Judicial Commissioner

In the United Kingdom, there are enhanced registration procedures where a public authority intends to use a human source to obtain, provide access to or disclose knowledge of legally privileged material.⁷² Where the public authority is a law enforcement agency, an IPCO Judicial Commissioner must approve the use of a human source in these circumstances.⁷³

The legal test for registration of a human source in these circumstances is also stricter. In addition to the normal considerations of proportionality and necessity, as discussed in Chapter 12, an IPCO Judicial Commissioner can only approve the registration of a human source in these circumstances if there are reasonable grounds for believing it is necessary on grounds of national security, the prevention or detection of serious crime, or the economic wellbeing of the United Kingdom.⁷⁴

The Code of Practice states that registration of a human source for these purposes should only be sought in ‘exceptional or compelling’ circumstances:

Circumstances which can be regarded as ‘exceptional and compelling’ will only arise in a very restricted range of cases, where there is a threat to life or limb or in the interests of national security. The exceptional and compelling test can only be met when the public interest in obtaining the information sought outweighs the public interest in maintaining the confidentiality of legally privileged material, and when there are no other reasonable means of obtaining the required information.⁷⁵

Requirement to report relevant errors relating to the use of a human source

Under the Investigatory Powers Act, the Investigatory Powers Commissioner must report any ‘relevant error’ to an affected person if the Commissioner thinks it is a serious error (that is, one causing significant prejudice or harm to the person concerned) and it is in the public interest to do so.⁷⁶

A ‘relevant error’ is an error in complying with any requirement of an Act that is subject to review by an IPCO Judicial Commissioner or an error described in the Code of Practice.⁷⁷ Examples of a relevant error include the use of a human source without lawful authorisation, and non-adherence to the safeguards in relevant legislation and the Code of Practice.⁷⁸

Relevant errors must be reported ‘as soon as reasonably practicable’ and no later than 10 working days after they are identified (or in such other timeframe as agreed with the Investigatory Powers Commissioner) along with:

• information on the cause of the error
• the human source’s activities
• how any material obtained from the human source is being managed
• a summary of the steps taken to prevent recurrence of the error.⁷⁹

The Investigatory Powers Tribunal, United Kingdom

The Investigatory Powers Tribunal in the United Kingdom can consider and investigate complaints about law enforcement agencies’ use of certain investigatory powers, including human sources. Members of the public can make a complaint if they believe they are a victim of unlawful action, or that their rights have been breached by any unlawful activity or a contravention of the Human Rights Act 1998 (UK).⁸⁰ For example, in 2019, the Tribunal heard a case concerning the legality of an intelligence agency’s policy in respect of human sources who participate in criminality.⁸¹

Challenges and opportunities

This section discusses key issues identified by the Commission and raised by stakeholders regarding external oversight of the use and management of human sources in Victoria, including:

• opportunities for external oversight of Victoria Police’s use and management of human sources
• potential models of external oversight that might be suitable
• key features of an effective external oversight framework
• opportunities for the alignment of any new external oversight model with Victoria’s current police oversight system.

These topics are discussed in turn below.

Opportunities for external oversight of Victoria Police’s use of human sources

Benefits of external oversight

As noted in Chapters 11 and 12, recent internal audits and historical external and internal reviews have identified non-compliance among some Victoria Police officers with the organisation’s human source management policy and procedures.⁸²

A broad consensus emerged from evidence and information provided to the Commission that external oversight is needed for the use and management of human sources by Victoria Police, although views on the most appropriate model differ. In summary, there was broad agreement that external oversight would:

• encourage compliance with legal and policy requirements for the registration and use of human sources
• raise policing standards, including by assisting police to balance competing public interests and make ethical decisions
• mitigate risks to Victoria Police, human sources and the criminal justice system
• support transparency and improve community confidence in Victoria Police’s use of human sources
• address a gap in Victoria’s current oversight system, noting that other covert police powers and methods are subject to external oversight.

IBAC told the Commission:

There is a significant gap in the present oversight system in respect to Victoria Police’s registration and use of human sources. It is concerning that this area of covert operation by all Victorian law enforcement bodies (including IBAC) is currently not subject to any express statutory oversight.

…

IBAC also considers that the management of human sources, as with other areas of covert and intrusive operations, is strengthened by oversight by an independent body or bodies.⁸³

This sentiment was shared by the International Commission of Jurists Victoria, which referred to the covert nature of human source management and suggested that Victoria Police has long exercised broad discretionary powers without external oversight to act as a check and balance against the improper use of such powers.⁸⁴

Some members of Victoria Police Executive Command also saw merit in external oversight as a means of encouraging compliance and helping police balance competing public interests.

Deputy Commissioner Wendy Steendam, APM, Specialist Operations, told the Commission, ‘Victoria Police agrees that external oversight may be appropriate for the registration, use and management of human sources who have a legal obligation of privilege or confidentiality’.⁸⁵ In her statement to the Commission, Ms Steendam noted that ‘the benefits of external oversight are clear and supported by Victoria Police’, pointing to the role it can play in supporting Victoria Police’s compliance with legal requirements and internal policy.⁸⁶

Assistant Commissioner Thomas (Luke) Cornelius, APM told the Commission that he has long been a ‘strong advocate for independent oversight’. He explained:

… the best disinfectant … is daylight and I just think in fraught areas such as these … that [an] open and transparent framework that might support the balancing of potentially competing public interest considerations would be of significant benefit to us, and independent oversight is a very healthy way of supporting that process.⁸⁷

Dr John Buckley, former police officer and now a provider of human source training and consultancy services, told the Commission that external oversight in the United Kingdom has raised standards and helped police services mitigate risk. Dr Buckley noted that IPCO’s role:

… had a positive impact on raising policing standards and ensuring that senior officers pay attention to their directions … From a police perspective, it protects the organisation from damage, offers an advisory and objective perspective and provides independent oversight.⁸⁸

The VI told the Commission that external oversight would support ethical decision making, manage risk, and promote public confidence in Victoria Police’s use of human sources:

… an ethical perspective on the use of human sources, as well as an objective to control the serious risks involved in those activities, would favour ongoing external oversight …

Victorians might reasonably expect that police activities that generate these risks should be subject to ongoing external oversight. Beyond any expectation in usual circumstances, the events that have led to the Royal Commission require public confidence in Victoria Police’s use of human sources to be repaired. The VI suggests that this can only be achieved by some form of external oversight.⁸⁹

Professor Alexandra Natapoff, University of California, told the Commission that ‘transparency and external oversight are key’ to the use of human sources and that ‘it is not sufficient for mechanisms to better regulate the use of [human sources] to be triggered by an exceptional event; they should be routine’.⁹⁰ Similarly, Mr Arthur Moses, SC, former president of the Law Council of Australia, considered that oversight agencies ‘should, if they do not already, conduct annual audits of the human sources used by law enforcement agencies’.⁹¹

The Law Council of Australia, noting the High Court of Australia's decision regarding Victoria Police’s use of Ms Gobbo as a human source, highlighted ‘the need for strong and properly resourced oversight bodies to supervise the activities of law enforcement’.⁹² In a submission to the Commission, Victoria Legal Aid suggested the Commission should recommend stronger transparency, accountability and external oversight mechanisms to ensure that, as a starting point, legal practitioners (or those in similar occupations) are not used as human sources and are only used in exceptional circumstances with the endorsement of an independent oversight body.⁹³

Concerns about external oversight

Some stakeholders expressed concerns that an external oversight regime may undermine the effectiveness of police services’ use of human sources in the prevention, detection and investigation of criminal activity.

As noted in Chapter 12, most Australian law enforcement and intelligence agencies told the Commission they have robust internal governance and oversight mechanisms in place to mitigate the risks associated with the use and management of human sources. Some of those agencies expressed concerns that a legislative framework—which would be required to facilitate external oversight—may compromise the operational flexibility and efficiency required for effective policing.

The Australian Institute of Policing told the Commission that Victoria Police’s current processes for human sources with legal obligations of confidentiality or privilege are ‘adequate and effective’, noting the changes to these processes since the use of Ms Gobbo as a human source.⁹⁴

Ms Steendam told the Commission there are risks associated with external oversight:

The main risk is that the sharing of any information about human sources makes it more likely that the identity of the human source will become known. In turn, the prospect of information about a human source being made known to an oversight body may need to be disclosed to a potential human source. This risks creating a chilling effect [in that it discourages this human source and others from providing information to police for fear for their safety]. Victoria Police would support safeguards to limit the nature of any information about a human source provided to that which is genuinely needed.⁹⁵

In contrast, Professor Sir Jonathan (Jon) Murphy, QPM, DL, Liverpool John Moores University, told the Commission that, in his experience, the potential disclosure of human source identities or information to IPCO in the United Kingdom has not deterred people from becoming human sources.⁹⁶

Stakeholders suggested that the following factors can create and strengthen positive relationships between law enforcement and oversight agencies to help overcome concerns:

• law enforcement and oversight agencies working collaboratively on implementation of the oversight regime⁹⁷
• oversight agencies having robust security arrangements in place for handling sensitive information⁹⁸
• oversight agencies adopting an open, transparent and constructive approach with law enforcement agencies during inspections or audits⁹⁹
• oversight agencies seeking to understand the law enforcement agency’s operational objectives and operating environment.¹⁰⁰

Scope of external oversight

The Commission heard differing views on the appropriate scope of any external oversight regime for the use of human sources by Victoria Police—in terms of both the categories of human sources and the aspects of the police–human source relationship that should be subject to oversight.

Victoria Police submitted that external oversight should have a narrow application, limited to human sources with legal obligations of confidentiality or privilege:

Victoria Police does not consider that there is good evidence to support extending external oversight to other categories of human sources, given the level of internal governance and oversight, the risks to those sources and the fact that no issues have been identified that would justify such oversight.¹⁰¹

IBAC told the Commission that oversight should be tailored to risk, with more ‘intensive oversight where it is going to be most effective’.¹⁰² According to IBAC, this could involve compliance monitoring and outcome reporting for all human sources used by Victoria Police and, for high-risk, vulnerable and complex human sources, external involvement in decision making (including reviewing proposed registrations to ensure they are appropriate and justified) and the capacity to review and make recommendations on relevant decisions.¹⁰³ IBAC also suggested that high-risk human sources who should be subject to more stringent oversight include lawyers, medical professionals, journalists, Members of Parliament and clerics, along with children and people with an intellectual or other mental impairment or physical disability.¹⁰⁴ The VI suggested that high-risk human sources might also include people in particularly compromised situations due to their relationship with targets of Victoria Police’s investigations, and people with other forms of vulnerability.¹⁰⁵

In relation to the aspects of the police–human source relationship that should be subject to external oversight, Victoria Police advocated for limiting oversight to decisions about the registration of human sources and said that oversight of their subsequent use and management would require further consideration.

In a statement to the Commission, Ms Steendam noted:

There will be many operational decisions that should be properly left to Victoria Police, for example, how human sources are tasked, how their cover is managed and the like.¹⁰⁶

IBAC suggested that external oversight should involve access to comprehensive information about the police–human source relationship, including the recruitment and registration, tasking, length and scope of registration, and deregistration of human sources.¹⁰⁷

This appears to align with the United Kingdom approach. IPCO told the Commission that it assesses the following aspects of human source use and management:

• the recruitment process
• risk assessments
• the human source’s taskings and rewards, and details of any contact
• whether useful intelligence was gained from the human source
• the relationships between police officers who manage human sources
• training maintained by police officers who manage human sources
• internal oversight arrangements.¹⁰⁸

IPCO also told the Commission that it:

… looks particularly for evidence from the handler, controller and authorising officer, and at the documented decision making, to see that the key issues of necessity, proportionality, collateral intrusion and risk have been suitably addressed individually for each [human source].¹⁰⁹

Models of external oversight

Involvement in decision making to register human sources

As outlined above, Victoria Police must obtain external approval, usually from a judge or magistrate, to use a range of covert powers such as telecommunications intercepts and surveillance devices. Whether to register a human source, however, is an internal police decision.

The United Kingdom’s legislative regime requires an IPCO Judicial Commissioner to authorise the use of a human source from whom public authorities intend to obtain legally privileged information, in recognition of the important relationship between a lawyer and their client and the associated protections afforded to legally privileged information.¹¹⁰

Former police officer Dr Adrian James, Liverpool John Moores University, told the Commission that external involvement in law enforcement agency decisions about human sources is essential and can resolve the challenges that arise from purely internal registration processes, including that the applicant and the authorising officer are immersed in the same organisational cultures, values and behaviours and may share the same organisational goals.¹¹¹ Sir Jon told the Commission that the United Kingdom’s regime—including IPCO’s involvement in registrations—provides officers with a clear and consistent process for making challenging ethical decisions and gives them more confidence that they are making the right decisions.¹¹²

As noted earlier, some stakeholders told the Commission that, in certain situations, an external agency should be involved in decisions related to Victoria Police’s registration of human sources.

The VI suggested that ‘a proposal to recruit a high-risk source should trigger an external decision-making process, as in the [United Kingdom] model’.¹¹³ Victoria Legal Aid suggested that a lawyer should not be registered or used as a human source unless an external oversight agency can be satisfied that there is no risk of a breach of professional obligations.¹¹⁴

IBAC and the PIM suggested that, should external oversight of human sources be introduced, an external agency could review or test certain applications or proposed decisions when dealing with prospective or registered human sources with legal obligations of confidentiality or privilege. This would be similar to the role that the PIM plays in the witness protection regime, where Victoria Police is the final decision maker.¹¹⁵ IBAC also suggested this role could extend to other vulnerable and complex sources.¹¹⁶

The PIM noted that this involvement in decision making or ‘active oversight’ could be complemented by other mechanisms performed by a different agency, such as independent retrospective reviewing of Victoria Police’s decision making and/or monitoring of its compliance. The PIM suggested that active oversight would be most effective if it included involvement both in the decision to register a human source with legal obligations of confidentiality or privilege, and in the decision to disseminate any confidential or privileged information received.¹¹⁷

The PIM also noted it would probably be the most suitable agency to undertake this type of external oversight (that is, involvement in decision making or ‘active oversight’) due to:

• its extensive experience in testing applications for covert powers
• its operating hours (24 hours a day, seven days a week)
• its existing governance and security to manage highly sensitive information
• the success of its involvement in the witness protection regime, which could provide a model for any comparable involvement in Victoria Police’s decisions about the use and management of human sources with legal obligations of confidentiality or privilege.¹¹⁸

Victoria Police told the Commission it had considered a model in which the PIM would sit on the Human Source Ethics Committee, the internal decision-making body for certain high-risk sources, and provide ‘external advice’, but acknowledged that this would not constitute external oversight, which ‘should properly occur completely separately from Victoria Police, that is, not by membership of the decision making body’.¹¹⁹

As noted above, Victoria Police told the Commission that the design of any external oversight model must consider associated risks, explaining that sharing any information about a human source makes it more likely that their identity will become known. It cautioned that appropriate safeguards would be needed to manage this risk.¹²⁰ Victoria Police also stated that the current police oversight bodies may not currently have the expertise, operational knowledge and experience to oversee this specialised policing activity.¹²¹

In her evidence to the Commission, Ms Steendam explained that current internal decision-making processes within Victoria Police provide for registrations to occur more quickly in urgent circumstances, and noted that any external involvement in decision making would need to include processes for expediting registrations of human sources where it is appropriate to do so.¹²²

Review of decisions and monitoring compliance with the regulatory framework

As noted above, models for compliance monitoring and review of decisions in relation to the exercise of police powers in Victoria vary in form and intensity. The Commission heard different views about the utility of this type of oversight generally, and about the approach that could be adopted in any external monitoring of Victoria Police’s use of human sources.

Some stakeholders emphasised the importance of monitoring an agency’s records to assess compliance with legislative and regulatory requirements. IBAC told the Commission that this is a ‘powerful tool in ensuring transparency and rigour’ and that it requires engagement and consultation between the oversight and law enforcement agency, which can in turn drive positive organisational change.¹²³ The VI noted that external oversight involving inspections is effective where proper record keeping strongly encourages compliance with the substantive aim of a legislative requirement, such as prohibitions on, or permissions for, the use and communication of information. The VI said such an approach is particularly suitable where the actions being tested are performed using systems, such as telecommunications interception activities.¹²⁴

Sir Jon identified several benefits arising from law enforcement agencies in the United Kingdom being subject to compliance inspections by IPCO and its predecessor, including:

• objective external scrutiny by experienced inspectors
• reducing the chance of poor and unprofessional record keeping
• providing a means of learning through analytical examination of the law enforcement agency’s registrations to use human sources.¹²⁵

Compliance monitoring can, however, have limitations. The IBAC Committee Inquiry noted that compliance-monitoring legislation often limits oversight bodies to assessing only whether an agency is acting in accordance with the law, rather than assessing how agencies perform their functions or directly examining its policies and procedures.¹²⁶ The VI suggested that inspection of a limited set of records may not reveal systemic or significant breaches of the law, particularly breaches that result from, or are enabled by, actions that are not required to be documented in that set of records.¹²⁷

Sir Jon also highlighted the difficulties an oversight agency can encounter in assessing whether a law enforcement agency’s formal records reflect operational practice. He explained that:

… understanding what lies beneath the formal records is a continual challenge, not just for authorising officers but for wise and discerning independent regulators as well.¹²⁸

As noted earlier in this chapter, IBAC’s role in relation to firearm prohibition orders provides an example of a more intensive form of monitoring that extends beyond whether records have been kept adequately, to whether police decisions made about the exercise of their powers are appropriate and justified.

The Firearms Act gives IBAC a broad remit to monitor Victoria Police’s use of powers and the performance of its duties and functions relating to firearms prohibition orders.¹²⁹ It requires IBAC, among other things, to review a sample of firearm prohibition orders each quarter and determine whether each order should have been made, having regard to the statutory criteria for making such orders and the information considered in making the order.¹³⁰ The Firearms Act also empowers IBAC to recommend any action it considers appropriate in relation to a reviewed order and requires the Chief Commissioner of Victoria Police to give a written response to that recommendation within 45 days.¹³¹ It also requires IBAC to include in its annual report:

• the number of firearm prohibition orders it has reviewed
• the number of such reviews where it recommended action to the Chief Commissioner
• the number of recommendations the Chief Commissioner accepted (and, by implication, rejected).¹³²

This arrangement seeks to balance the public interest in protecting police intelligence and methodology with the public interest in assuring the community that such orders, which limit the rights of those subject to them, are appropriate and justified.

Some compliance-monitoring regimes for the use of human sources also appear to have a broader scope than inspecting and reporting on record keeping:

• In the United Kingdom, IPCO monitors compliance with legislative requirements and other applicable guidance, including assessing the quality of human source management documentation and a law enforcement agency’s assessment of necessity and proportionality.¹³³
• In Australia, IGIS monitors intelligence agencies’ human source management processes to ensure the agencies act legally and with propriety, comply with ministerial guidelines and directives, and respect human rights.¹³⁴

External review of the appropriateness of police decisions and the related use of their powers and functions is a more in-depth form of compliance monitoring than records inspection. It is, however, a more time and resource intensive model and requires greater understanding of the various legal, operational and procedural factors relevant to decisions made.

The Commission heard that the timing, as well as the form of compliance monitoring is relevant to its effectiveness in holding police to account. For example, Victoria Legal Aid submitted that stronger, external oversight of Victoria Police’s use of human sources should include oversight that occurs in ‘real time’ as investigations proceed, arguing that this would promote transparency and accountability.¹³⁵ Others have suggested that retrospective oversight is ‘likely to be less rigorous than prior scrutiny’ (that is, real-time oversight) and that it is easier for a law enforcement agency to prove that powers have been used appropriately during a retrospective inspection, once it has already obtained relevant evidence or intelligence from the use of those powers.¹³⁶

Reviewing and investigating complaints

Some stakeholders told the Commission that where there is no dedicated external oversight of the use of human sources by police services, oversight bodies should have jurisdiction to deal with complaints about police actions or decisions related to human sources (including, for some oversight agencies, own motion powers). In this context, Dr Adrian James emphasised that an independent complaints mechanism is an essential element of any oversight regime.¹³⁷

However, the Commission also heard that there are limitations to a model of external oversight of police use of human sources that relies entirely on complaints. IBAC told the Commission:

It is highly unlikely that persons adversely affected by Victoria Police’s decisions or conduct in this highly covert area of operation would complain to IBAC (or any other agency) about any potential police misconduct, due to the secrecy and high level of risk to personal safety that is inherent in the human source relationship with law enforcement officers and bodies. In IBAC’s view, this reality only makes external oversight over the management of human sources by Victoria Police all the more critical.¹³⁸

Features of an effective external oversight model

This section outlines evidence before the Commission about the functions, powers and capabilities an oversight agency would need in order to provide effective external oversight of Victoria Police’s use of human sources, if such a regime were introduced.

Powers and governing framework

As outlined earlier in the chapter, external oversight arrangements for many Victoria Police powers and functions are set out in legislation. This ensures that the scope of oversight functions and powers, and corresponding police obligations, is clear. This is also the case in relation to oversight of human sources in the United Kingdom, with IPCO’s functions and powers set out in the Investigatory Powers Act.

The Commission’s review of relevant legislative regimes in Victoria and elsewhere indicated that the key elements of a legislative framework for external oversight are:

• a clear statement of the objectives of the oversight regime
• a clear statement of the oversight agency’s functions and duties
• adequate powers for the oversight agency to perform its functions
• a corresponding obligation for Victoria Police and its officers to cooperate and assist the oversight agency
• an ability for the oversight agency to report on its work and make recommendations to Victoria Police
• the public release of reports, with sensitive information likely to jeopardise any person’s safety, an investigation, a prosecution or national security, excluded.

An oversight agency’s objectives, functions and duties

Clearly setting out an oversight agency’s objectives, functions and duties in legislation is important to:

• provide clarity to the agency and Victoria Police
• support transparency to the public
• ensure, to the extent possible, consistency in approach with the oversight regime for other covert powers exercised by Victoria Police.

Broadly, the functions of existing oversight agencies are outlined in similar terms across statutory oversight regimes in Victoria.

For example, the Public Interest Monitor Act 2011 (Vic) outlines the PIM’s role in applications for police to use a range of covert and intrusive powers.¹³⁹ Similarly, the legislative regimes that enable the use of specific covert and intrusive powers and methods also set out the PIM’s role.¹⁴⁰

In the case of IBAC’s and the VI’s compliance-monitoring roles, common functions include:

• monitoring compliance with legislative requirements (with varying scope and intensity)
• conducting inspections
• in some cases, reviewing decisions and actions
• providing reports and, in some cases, making recommendations relating to the exercise of its functions.¹⁴¹

An oversight agency’s powers and Victoria Police’s obligations to assist

Oversight agencies have similar types of powers across the various oversight regimes.

The PIM, in fulfilling its functions to test police applications or to inform police decisions, generally has the power to appear at hearings, access relevant records and/or ask questions and make submissions.¹⁴²

Similarly, to fulfil their compliance-monitoring functions, the VI and IBAC generally (with some variations in the details) have powers to:

• enter premises of the law enforcement agency, after giving notice¹⁴³
• access records, including to take copies and extracts¹⁴⁴
• request relevant officers to give information, and/or attend before an inspecting officer and answer questions.¹⁴⁵

Victoria Police has corresponding legislative obligations to assist oversight agencies in the performance of their functions, including:

• in relation to the PIM, an obligation to notify the PIM of a relevant application and provide copies of the application and of supporting material, along with copies of material that is adverse to the approval of the application¹⁴⁶
• in relation to the VI and IBAC, an obligation to assist the agency in discharging its compliance-monitoring functions.¹⁴⁷

Victorian oversight agencies told the Commission that powers to access law enforcement agencies’ records and databases are critical to effective external compliance monitoring.

The VI identified the ‘lack of access to information regarding the operational context for oversighted activities’ as one of the challenges facing oversight agencies.¹⁴⁸ IBAC cautioned that while a prescriptive legislative inspection regime may be useful in defining an oversight agency’s inspection functions, it would not be advantageous to provide an exhaustive list of materials that it may request.¹⁴⁹

This sentiment was echoed during the Commission’s consultations with agencies from interstate and international jurisdictions. For example, IPCO told the Commission that, under its legislative framework, it has unfettered access to all human source records and databases during inspections. It explained that it:

… also has access to any associated [documents] used to record decisions and information falling outside the statutory considerations, which are viewed to enable deeper insight of how the [human source] is being operationally utilised and managed.¹⁵⁰

Similarly, Western Australia’s Corruption and Crime Commission noted that it has undertaken reviews of Western Australia Police’s use of human sources and was granted access to the police human source management database, including working expenses, rewards, letters of recognition, policy logs and critical decision logs. This allowed it to review police communications with each human source, where necessary.¹⁵¹

At the Commonwealth level, IGIS is empowered to inquire into any matter relating to ASIO’s compliance with publicly available guidelines, which are issued by the Minister for Home Affairs under sections 8A(1) and 8A(2) of the Australian Security Intelligence Act 1979 (Cth). To facilitate this, the guidelines require ASIO to ensure that IGIS and its authorised staff have effective access to all information held by ASIO (including relevant policies and procedures) and can retain information required to demonstrate its propriety and compliance with applicable laws.¹⁵²

In terms of obligations on police, the Commission heard that it would be important for any external agency to ‘be supported by powers to require Victoria Police officers to provide assistance to the oversight body in the exercise of its monitoring functions’.¹⁵³

Reporting requirements and recommendation-making powers

The Commission heard from a range of stakeholders about the reporting and recommendation-making powers and functions of external oversight agencies.

External oversight regimes in Victoria generally involve public reporting, with key features relating to:

• Frequency—compliance-monitoring reports are usually required annually, but under some regimes, the oversight agency can make special reports where it considers it necessary and/or at the request of the responsible Minister.¹⁵⁴
• Content—generally, reports must cover the compliance or performance of the agency subject to oversight as well as the performance of the external oversight agency.
• Recipient—generally, the recipient is the responsible Minister and sometimes a copy is provided to the Chief Commissioner or Parliament.
• Tabling in Parliament—some legislative regimes specify that reports must be tabled in Parliament.¹⁵⁵
• Vetting—mechanisms exist to remove from the report information that may endanger a person, prejudice a prosecution or compromise an investigation or methodology, before any public release of the report.¹⁵⁶
• Recommendations—some regimes have specific provisions for the external oversight agency to make recommendations relating to the exercise of its functions.

The Commission heard that public reporting of compliance offers advantages including greater accountability and transparency in otherwise opaque areas of law enforcement practice, promoting community confidence in law enforcement agencies’ practices, and informing the public about whether an agency is implementing necessary reforms or recommendations.¹⁵⁷ Sir Jon also noted that publishing an oversight agency’s annual reports is a means to spread best practice.¹⁵⁸

Some stakeholders stressed the need to ensure that public reporting does not expose human sources to increased safety or security risks, reveal law enforcement agencies’ operational processes, or impose an unnecessary administrative burden.¹⁵⁹ IBAC, for example, noted that a public report might need to contain less detail than the reports provided in private to Victoria Police, to ensure the protection of sensitive police information.¹⁶⁰

The Commission also heard from stakeholders regarding the ability of external oversight agencies to make and enforce recommendations.

IBAC told the Commission that the legislative power for external oversight agencies to make recommendations is most effective if accompanied by the power to require Victoria Police to act on, or respond to, those recommendations.¹⁶¹ The VI told the Commission that, while engagement can be an effective way to encourage implementation, the ability to require Victoria Police to report on implementation within a reasonable timeframe would also be beneficial.¹⁶²

The power to direct or recommend action, including within specified timeframes, is not without precedent in Victoria’s oversight regimes. For example:

• The judge or magistrate responsible for issuing a surveillance device warrant ‘may order any information obtained from or relating to the execution of the warrant or any record of that information be dealt with in the way specified in the order'.¹⁶³
• The PIM may make recommendations to the Chief Commissioner about matters arising from the PIM’s functions under the Witness Protection Act 1991 (Vic) and the Chief Commissioner must take the recommended action within a reasonable period or provide a written explanation to the PIM as to why that action has not or will not be taken.¹⁶⁴
• After reviewing a firearm prohibition order to determine whether or not it should have been issued, IBAC may recommend to the Chief Commissioner that certain action should be taken and the Chief Commissioner must respond to that recommendation in writing within 45 days.¹⁶⁵ Additionally, IBAC is required to record how many recommendations it has made and how many the Chief Commissioner has accepted in IBAC’s annual report.¹⁶⁶

Organisational capability and relationships

While the knowledge, experience and capabilities required by an external oversight agency’s personnel depends on the agency’s specific functions and powers, some stakeholders shared their views with the Commission about the broad capabilities that an oversight agency should have if it were responsible for overseeing the use of human sources. This included, for example, an understanding of the operating context in which human sources are engaged to gather intelligence and information.¹⁶⁷

The International Commission of Jurists advocated for a judicially led oversight commission for human source management in Victoria similar to the United Kingdom’s model, where IPCO consists of the Investigatory Powers Commissioner and a team of Judicial Commissioners.¹⁶⁸ Dr Buckley, former police officer in the United Kingdom, noted that one of the benefits of having judicial officers involved in the process of registering human sources is they ‘ask the right questions’.¹⁶⁹

The VI noted the importance of oversight agencies understanding, or having experience in, law enforcement functions.¹⁷⁰ It submitted that oversight agency personnel could be seconded to Victoria Police in the early stages of implementation to ‘learn its systems, operational context, and contribute to its procedural development’.¹⁷¹ The VI also told the Commission that it relies on good working relationships with Victoria Police to develop operational knowledge, which can otherwise be difficult to obtain.¹⁷²

The United Kingdom Home Office told the Commission that police respond positively when oversight agencies take a pragmatic approach that shows understanding of operational requirements and pressures.¹⁷³ IPCO echoed this, noting that its Judicial Commissioners sometimes accompany inspectors to interact with agencies and obtain a clearer understanding of the operational practices related to activities they oversee. IPCO also told the Commission that before finalising inspections, it meets face-to-face with the handling team and senior officers to discuss its proposed findings, areas for improvement and positive feedback. In addition, as part of its commitment to fostering best practice human source management, IPCO attends training and other forums with public authorities and informs officers of the importance of legislative compliance and IPCO’s role and functions.¹⁷⁴

Stakeholders told the Commission that it is important for oversight agencies to have an open, collaborative and educative relationship with the agencies they oversee, but also stressed that maintaining the oversight agency’s independence is critical.¹⁷⁵ For example, as noted earlier, while public authorities can seek general advice from IPCO on issues that fall within its legislative remit, it will not issue formal advice about specific operational decisions or issues, which could compromise or otherwise conflict with its independent oversight role.¹⁷⁶

Security arrangements

The Commission heard that it is essential for external oversight agencies to have robust security arrangements in place to handle sensitive and confidential information, such as information about or provided by human sources. For instance, strong security arrangements are required for similar covert methods and functions so that oversight bodies have appropriate access to databases and records, while also protecting the integrity and security of police investigations and the safety of members of the public they involve.¹⁷⁷ Ms Steendam noted the PIM and VI’s current oversight of Victoria Police already navigate the sensitivities and issues associated with these similar methods.¹⁷⁸

The PIM told the Commission that robust security arrangements could include appropriate clearances for staff and secure environments to store information.¹⁷⁹ The VI expressed similar views, adding that ‘proper resourcing is pivotal, not just of inspection staff, but also of infrastructure and security—information management, personnel integrity, security vetting processes’.¹⁸⁰ The VI also observed the long lead times for security vetting for certain clearance levels for staff and suggested that setting and obtaining the appropriate clearance levels must be factored in to implementation timeframes for any external oversight regime.¹⁸¹ Likewise, IBAC explained that due to the risk associated with additional agencies and individuals learning of the identity of a human source, external oversight should be clear, contained and safeguarded through appropriate processes and security settings.¹⁸²

The Commission also notes that information security can be built into legislative and regulatory frameworks. For example, both the Surveillance Devices Act 1999 (Vic) and Witness Protection Act require the PIM to return certain materials to police once it has fulfilled its functions.¹⁸³

Alignment with Victoria’s current police oversight system

The Commission is mindful that it is desirable for any external oversight of Victoria Police’s use of human sources to fit within Victoria’s existing police oversight system, rather than introducing yet another body in an already crowded space.

This section outlines the challenges posed by the existing oversight framework, and opportunities to streamline police oversight in Victoria.

Benefits of the current framework

The Commission heard that there are some benefits in dispersing police oversight functions across multiple agencies. For example, the VI noted that the current system:

• develops specialised knowledge and entities
• enables oversight entities to focus on their specific functions
• largely avoids conflicts of interests that could arise either from an agency overseeing powers it can also use, or from an agency reviewing or investigating a matter it had previously been involved in through its decision-making function
• provides consistent, system-wide oversight of a specific covert or intrusive power; for example, the VI oversees five agencies’ use of controlled operations.¹⁸⁴

IBAC noted that the VI and PIM’s oversight functions and powers complement its own oversight functions and powers. Further, it observed that this ‘tiered approach to oversight (or separation of roles between oversight bodies) strengthens the impartiality and independence of each agency by avoiding the centralisation of power in a single agency’.¹⁸⁵

Shortcomings of the current framework

The Commission also heard that the current oversight framework has shortcomings; specifically, that the institutional framework can cause duplication and fragmentation, and that legislation takes an inconsistent approach to oversight functions, powers and obligations.

IBAC told the Commission that the current system:

… contains elements of fragmentation caused by a lack of role clarity around some areas of oversight, as well as inconsistencies in the type and level of oversight exercised by each agency. Broadly, this reflects a lack of [a] cohesive framework based on established oversight principles, the expansion of law enforcement powers and the ad hoc development of the integrity system as a check and balance on those increasing powers. Further, there are jurisdictional overlaps with the Commonwealth Ombudsman who has oversight of telecommunications interceptions along with VI. Different approaches are taken by different agencies to oversight often making it more onerous to meet or reconcile approaches.¹⁸⁶

IBAC stated that the lack of an overarching policy framework has the following consequences:

• difficulties and inefficiencies for Victoria Police in implementing a planned response to compliance oversight and risk management
• dispersed effort across a range of agencies that undermines consistent, proportionate and planned compliance monitoring geared towards prevention and capability building
• a lack of transparency and consistency, alongside increased risks of monitoring [gaps], that undermines public confidence in the oversight of covert and intrusive powers of Victoria Police.¹⁸⁷

The VI also identified potential challenges with the current framework, including that it:

• may not provide an overall picture across the system or identify systemic problems
• may pose challenges for identifying and assessing connections between the use of different powers or activities
• may lead to the application of inconsistent oversight methodologies
• risks being complicated or confusing in practice.¹⁸⁸

The VI pointed out that reporting obligations of oversight bodies are inconsistent, noting that ‘some Acts require public reports, some not, and the different Acts vary in their description of reporting obligations without clear reason’.¹⁸⁹ The Commission notes there are also inconsistencies in the prescribed content of reports, and in the VI and IBAC’s powers to monitor compliance.¹⁹⁰

The VI also commented on information-sharing difficulties, a view shared by the PIM, who stated that:

A disadvantage (perhaps inevitable) of this separation of functions is that it limits the scope for the sharing of information and experience that may be of interest to more than one agency.¹⁹¹

Streamlining oversight of investigatory powers

Given some of the shortcomings identified by stakeholders, the Commission considered the benefits and risks of streamlining or centralising oversight of certain covert powers used by Victoria Police.

IPCO told the Commission that its replacement of three predecessor agencies provided benefits including clarity, consistency and the ability to examine law enforcement agencies’ powers more holistically.¹⁹²

Victorian oversight agencies did not consider such an approach to be viable here. IBAC noted that while a centralised oversight model could provide a comprehensive response to the issues raised during the Commission, the creation of a new statutory entity is unnecessary because:

• a number of existing agencies already oversee Victoria Police’s use of covert and intrusive powers and functions
• the cost and complexity of creating a United Kingdom style model far outweigh the benefits when balanced against the risks
• much of the legislation governing controlled operations, assumed identities and witness protection is based on national model laws, making a single Victorian statutory framework regulating all covert and intrusive powers infeasible.¹⁹³

The VI agreed that consolidating oversight powers in one body is unlikely to be possible, given that relevant powers are contained in both state and Commonwealth legislation. However, the VI did identify potential advantages, noting that because existing legislation enables certain powers to be used together, consolidation would give the oversight body an overall picture of the use of covert and intrusive powers.¹⁹⁴

While stakeholders agreed that consolidation of oversight is not viable, some suggested that there is a need for greater consistency in the approach to the oversight of covert and intrusive powers in Victoria.¹⁹⁵ For example, IBAC told the Commission:

The development of a cohesive framework based on established principles that looks to the desired outcomes of police oversight in this context should exist to … guide policy and legislative reform that [harmonise] the current patchwork of agencies and laws. Such a framework would create a basis for a more targeted oversight program design which would support greater efficiency and effectiveness through consistency, proportionality and responsiveness of oversight activity that prevents and detects risks and non-compliance.¹⁹⁶

Conclusions and recommendations

Based on stakeholder views and other evidence obtained during its inquiry, the Commission concludes that the police oversight system in Victoria would be strengthened by establishing a dedicated external oversight regime for Victoria Police’s use and management of human sources.

The Commission considers there are compelling reasons for such external scrutiny, including the potential intrusiveness of and inherent risks in the covert nature of human source management; and the need for greater accountability and transparency in Victoria Police’s use of human sources.

It recommends the establishment of a tiered external oversight model, with the nature and intensity of oversight aligned to the level of risk associated with the use of different human sources and the information they provide. It proposes that:

• The highest level of scrutiny should apply to Victoria Police decisions relating to the registration of ‘reportable human sources’ (that is, human sources who are reasonably expected to have access to confidential or privileged information). A final decision to register such a source should involve the PIM (Tier 1 oversight).
• External monitoring of Victoria Police’s legislative and regulatory compliance should apply to its use of all human sources and be conducted by IBAC (Tier 2 oversight).
• IBAC’s existing jurisdiction to investigate and oversee complaints about serious police misconduct or corruption, including in relation to Victoria Police’s use and management of human sources, should remain (Tier 3 oversight).

The Commission also considers that there may be merit in the Victorian Government undertaking a principle based review to bring greater coherence to the broader police oversight system, but notes that wholesale change is not warranted.

These conclusions and recommendations are discussed in turn below. The Commission also outlines key considerations regarding implementation of the proposed external oversight model, should this be introduced.

Introducing dedicated external oversight of Victoria Police’s use of human sources

Although the police oversight system in Victoria is more comprehensive now than when Ms Gobbo was a human source, there is still no legislated, external oversight regime for Victoria Police’s use of human sources. This is the case even though, like other covert and intrusive methods, the use of human sources poses risks to human rights, individuals and the administration of justice.

The Commission is persuaded by the view put by several stakeholders that the absence of dedicated oversight of Victoria Police’s use of human sources represents a significant gap in Victoria’s police oversight system. Reasons to fill this gap, as outlined in this chapter and elsewhere in this report, are as follows:

• The use of human sources is a critical tool to prevent, detect and solve crime, and is likely to be increasingly important in the future as the effectiveness of other investigative methods diminishes through technological change and the growing sophistication of criminal networks.
• Over 20 reviews in as many years, both internal and external to Victoria Police, have consistently identified human source management as a high risk for Victoria Police, along with evidence of non-compliance with human source management policies and procedures and, in some cases, corrupt or improper conduct among officers.
• IBAC’s jurisdiction to investigate police misconduct, triggered in large part by complaints or notifications, has limited utility given the covert nature of human source management and the unlikelihood of human sources, fearful for their and others’ safety, making a complaint.
• External oversight would encourage Victoria Police compliance with procedural requirements and enable issues to be identified and addressed at an earlier stage.
• The greater accountability and transparency that external oversight brings would help to restore public confidence in Victoria Police’s use of human sources.
• More broadly, external oversight would foster community confidence in Victoria Police and provide reassurance that it is not misusing its powers or infringing human rights.
• Given the covert nature of Victoria Police’s use of human sources, there is a risk that without dedicated external oversight, future aberrant conduct—such as that examined by this Commission—would not be reported to Victoria’s oversight agencies in a timely way.

The Commission acknowledges Victoria Police’s view that current internal governance arrangements provide adequate safeguards in all but the highest-risk cases (namely, human sources involving legal obligations of confidentiality or privilege), and further that external oversight raises security concerns and risks discouraging people from becoming human sources.

The Commission is unconvinced by the first point. It notes, for example, the historical and ongoing concerns about Victoria Police’s compliance with internal policies and procedures.

The second point requires careful attention in the design and implementation of the oversight model. The Commission draws comfort from evidence that external oversight of human sources in the United Kingdom does not appear to have affected the willingness of people to assist police¹⁹⁷ or to have led to the identities of human sources being leaked or becoming otherwise improperly known. In the Victorian context, there are also examples of mechanisms to ensure that external oversight of highly sensitive police work does not compromise individual safety and security, police methods, investigations or current prosecutions.

The Commission recommends that, to complement the legislative regime recommended and outlined in Chapter 12, the Victorian Government establishes a dedicated external oversight regime for Victoria Police’s use and management of human sources to:

• provide assurance to the Victorian Government, Victorian Parliament and community that Victoria Police is using and managing human sources in a manner that is appropriate, ethical and effective
• foster continuous improvement in Victoria Police’s human source management practices.

The Commission recommends that the external oversight regime be implemented within two years, recognising that the Government will need to consult with Victoria Police, Victorian oversight agencies and other relevant stakeholders, and further that it is desirable for the regime to commence at the same time as the commencement of the legislative framework for Victoria Police’s use of human sources, as recommended in Chapter 12.

A principle and risk-based external oversight model

The Commission heard that an oversight model should be underpinned by a clear set of principles. In Chapter 12, the Commission outlines a series of design principles to underpin its proposed human source management framework. Some of the principles articulated in that chapter are also relevant to the design of external oversight arrangements. For example, the Commission considers that any external oversight of Victoria Police’s human sources should be guided by:

• Necessity and proportionality—more intensive oversight should be applied to higher-risk human sources and/or information from human sources, balancing the public interest in police having workable tools to prevent, investigate and prosecute crime, with the public interest in ensuring that the use of such tools is necessary, proportionate and justified.
• Accountability—the framework should support Victoria Police being accountable for its decisions about human sources and provide transparency to the public around the administration of human source management.
• Effectiveness—oversight functions should not only facilitate technical compliance, but also contribute to ethical decision-making and use of human sources; and oversight agencies should have the powers, capabilities and resources to fulfil their functions effectively.
• Safety and sensitivity—the oversight model should achieve its objectives without compromising the safety of any individual, exposing sensitive police methods, or prejudicing investigations or prosecutions.
• Consistency—to the extent possible, the oversight framework for human source management should align with the broader police oversight system.

Overview of the proposed external oversight model

Figure 13.3 below summarises the tiered model for external oversight of Victoria Police’s use of human sources recommended by the Commission. It illustrates that the intensity of external oversight should be correlated to the level of risk involved in using a human source or the information they provide.

Figure 13.3: Proposed external oversight model for the use of human sources by Victoria Police

The Commission recommends that Tier 1 oversight be limited to the proposed registration of human sources who are reasonably expected to have access to confidential or privileged information (referred to by the Commission as ‘reportable human sources’).

This would allow for independent input in Victoria Police’s decisions about the use of human sources in circumstances where there are greater risks to the administration of justice—that is, where the use of a human source could result in a prosecution being withdrawn, a trial being stayed or a conviction overturned.

The Commission considers that Tier 2 oversight should apply to all human sources used by Victoria Police, not just those involving legal obligations of confidentiality or privilege, because:

• an oversight model that is broader in scope would help to identify and remedy any circumstances where Victoria Police fails to identify, at the registration phase, that a human source falls into the ‘reportable human source’ category
• previous reviews and inquiries have highlighted risks and concerns surrounding the use of human sources other than those involving legal obligations of confidentiality or privilege (for example, risks related to improper handler–source relationships)
• external oversight would encourage sound, ethical and lawful practice across the entire Victoria Police human source program and, in so doing, make it more likely that appropriate standards will be observed in all cases
• an oversight model would provide assurance to human sources that their police handler is complying with relevant legislative and policy requirements, while also providing assurance to the police handler about the lawfulness of their actions
• the approach is supported by Victorian oversight bodies and other stakeholders
• external oversight of the use of all human sources is critical to restoring community confidence in this program and Victoria Police.

The Commission makes further recommendations related to each tier of the proposed external oversight model below.

The Commission is mindful that IBAC and a small number of other Victorian agencies also use human sources, and that regimes regulating the use of investigative powers and methods in Victoria typically apply to all law enforcement agencies with such powers. While outside the scope of its terms of reference, the Commission suggests, as outlined in Chapter 12, that the recommended new legislation for Victoria Police’s use of human sources should apply to all Victorian agencies that use human sources subject to appropriate consultation. A logical extension of that suggestion, if the Victorian Government accepts it, would be for the recommended external oversight regime to also apply to those agencies.

The Commission urges the Government to take these steps, following consultation with IBAC and other relevant stakeholders. The suggested extension of the external oversight regime to other agencies is discussed further later in this chapter.

Increasing scrutiny of Victoria Police decisions related to ‘reportable human sources’ (Tier 1)

The Commission considers that the PIM should be involved in final decisions to register reportable human sources, noting that:

• stakeholder views support more intensive oversight for certain higher-risk human sources
• robust scrutiny at this early phase provides an opportunity to test the necessity and proportionality of the registration, and to identify and address any risks
• failure to follow a rigorous process and apply critical judgement at the registration phase can have significant consequences for the ongoing management of the human source, as Victoria Police’s experience with Ms Gobbo illustrates.

The Commission considered the possible adoption of the United Kingdom model, where an IPCO Judicial Commissioner approves the registration of human sources where an agency intends to obtain legally privileged information. This approach is similar to that adopted in relation to applications for surveillance device warrants, telecommunications interception warrants and other warrants in Victoria, which are determined by a magistrate or judge.

On balance, the Commission is not attracted to this approach. It considers that an appropriate level of scrutiny and rigour can be achieved without the formality of an independent agency, person or court making the final decision about whether to register a human source. In addition, casting the PIM in a decision-making rather than public interest advocacy role would be a significant departure from its current role in relation to other covert police powers (and from the roles of other Victorian oversight agencies).

Instead, the Commission considers that:

• Victoria Police, via the Chief Commissioner or delegate of or above the rank of Assistant Commissioner, should make registration decisions relating to reportable human sources.¹⁹⁹
• The PIM should have a role in this decision making; namely, to advocate the community’s interest in a process that is necessarily private and shielded from public scrutiny and can result in decisions limiting a person’s human rights.

The Commission proposes that the PIM would fulfil its role by:

• testing whether applications for the registration of reportable human sources are necessary and proportionate to the law enforcement objective sought to be achieved
• testing whether the circumstances are sufficiently exceptional and compelling to warrant the registration of a reportable source where it is intended to obtain or disseminate confidential or privileged information (that is, where there is a serious threat to national security, the community, or the life and welfare of a person; and further, where the information is not able to be obtained through any other reasonable means)
• making recommendations to Victoria Police on the appropriateness of such decisions.

The PIM’s proposed role is set out in Figure 13.4 below.

This model has precedent in Victoria, with the PIM performing a similar role in relation to Victoria Police decisions about witness protection, and a somewhat comparable public interest advocacy role in court applications relating to applications for surveillance devices and telecommunications interception.

Figure 13.4: Overview of proposed role of the Public Interest Monitor in Victoria Police decisions to register reportable human sources

Scope of the Public Interest Monitor’s involvement in the registration of reportable human sources

The PIM’s involvement in the decision-making process is only recommended for the registration of reportable human sources. The Commission considers that it would be disproportionate and unnecessary for all human source registrations to be subject to this external oversight measure, noting the comprehensive compliance-monitoring scheme for ‘Tier 2’ proposed below.

As outlined in Chapter 12, the Commission considers that other complex or higher-risk human sources, such as people under the age of 18 years or with a serious mental or medical health condition, should also be defined as reportable human sources. This would mean any application for the registration of such a person as a human source would be subject to the more rigorous authorisation process, including the PIM’s advice.

The Commission has not formally recommended the PIM’s involvement in decisions relating to these types of human sources, as it falls outside the terms of reference and the Commission has not canvassed the views of key stakeholders from the youth and mental health sectors. Nevertheless, the Commission urges the Victorian Government to consult with relevant stakeholders, with a view to bringing registration and oversight requirements for these human sources into line with those for human sources potentially involving legal obligations of confidentiality and privilege.

Figure 12.4 in Chapter 12 sets out the Commission’s recommended process for registering human sources. In summary, this process would involve the following steps for PIM involvement in final decisions regarding the registration of reportable human sources:

• The Victoria Police handling team submits an application for the registration of a human source to the Human Source Management Unit (HSMU).
• If identified as potentially a prospective reportable human source, the HSMU must obtain formal legal advice from the Victoria Police Legal Services Department or Victorian Government Solicitor’s Office and submit the application and legal advice to the Central Source Registrar (CSR) for review and endorsement.
• If endorsed, the CSR progresses the application and advice to the Chief Commissioner (or delegate) for consideration.
• The Chief Commissioner (or delegate) notifies the PIM of the proposed registration of a reportable source and provides the PIM with all material relevant to the application (including the legal advice and any material adverse to the application).
• The Chief Commissioner (or delegate) decides whether to register the human source, taking into account whether their use is necessary and proportionate, and any recommendations of the PIM (as set out in Figure 13.4 above).

The Commission is aware that the requirement for the HSMU to obtain legal advice and for the PIM’s involvement may seem duplicative; however, it considers that:

• The legal advice should assist the HSMU, CSR and Chief Commissioner to determine the nature of the information the prospective source has access to, or is reasonably expected to have access to (including whether it may be confidential or privileged information), and whether the proposed registration is necessary and proportionate.
• In cases where the CSR or Chief Commissioner is satisfied that registration is not appropriate, there would be no need to engage the PIM.
• In other cases where Victoria Police considers the registration is justified, the PIM would provide a critical external perspective on the merits of that proposed decision. The PIM’s consideration would take into account the legal advice and other material related to the application, which should help expedite the PIM’s assessment and resultant submissions or recommendations.

As noted in Chapter 12, the Commission recognises the importance of Victoria Police being able to act without delay in genuine emergency situations, such as where there is a serious and imminent threat to public safety. The procedures for registering a reportable human source in these circumstances are set out in more detail later in this chapter.

The Public Interest Monitor’s functions relating to the registration of reportable human sources

The Commission considers that the legislative functions of the PIM in relation to Victoria Police decisions to register reportable human sources should be based on its functions under the Public Interest Monitor Act and related legislation. This is for the same reasons set out there; to represent the public interest in what is necessarily a non-public decision-making process about the use of covert, intrusive and human rights-limiting powers and functions.

The PIM’s functions should include:

• testing the content and sufficiency of information relied on in the application to register a reportable human source, including the risk assessment and any other material accompanying the application
• asking questions of any person giving information in relation to the application
• making submissions and recommendations on the appropriateness of, or justification for, registering the proposed human source.

In undertaking these functions, the PIM should consider whether the information supporting the application satisfies the test for registration of a human source set out in Chapter 12; that is, whether the registration is appropriate and justified.

In cases where it is specifically intended to acquire confidential or privileged information, the PIM should also consider whether there are sufficiently exceptional and compelling circumstances to justify the extraordinary step of obtaining or disseminating the information.

The PIM should also have regard to any other legislative, regulatory or policy requirements, and the risk posed by, and mitigation strategies proposed for, the registration of the human source.

The Public Interest Monitor’s functions where there are changes in the scope of the registration

The Commission recognises that any human source could inadvertently or unexpectedly provide confidential or privileged information to Victoria Police.

In the case of a person registered as a non-reportable human source, this would in effect make them a prospective reportable human source. As set out in Chapter 12, the Commission recommends that the information should be quarantined and the human source’s registration suspended. Victoria Police would need to commence a new application so that the person is subject to the more rigorous registration process associated with reportable human sources, including the PIM’s involvement.

Similarly, where a reportable source was registered with no expectation that they would provide confidential or privileged information but ends up doing so, the information should be quarantined.

If, in either of these circumstances, Victoria Police wished to disseminate the confidential or privileged information, it would need to commence a new application seeking the Chief Commissioner or delegate’s authorisation (informed by legal advice and the PIM’s recommendation) that there are exceptional and compelling circumstances.

The Public Interest Monitor’s powers

The Commission considers that the proposed new legislation must clearly set out all the PIM’s powers, to ensure that both the PIM and Victoria Police have a clear understanding of their respective roles and responsibilities.

The PIM requires free and unfettered access to all documents and the power to ask questions of Victoria Police officers and decision makers, in line with its powers under other regimes. The PIM should also have clear powers to make submissions and recommendations to the Chief Commissioner (or delegate).

In Chapter 12, the Commission recommends that, when considering whether to register a reportable source, the Chief Commissioner (or delegate) should be required to have regard to the PIM’s recommendations. As discussed further below, the legislation should also require the Chief Commissioner (or delegate) to, within a reasonable time, take the PIM’s recommended action or advise the PIM as to why they have not taken, or do not intend to take, the recommended action.

Where, as is likely, the Chief Commissioner has delegated his or her power to make relevant decisions to a delegate of or above the rank of Assistant Commissioner, and that delegate has declined to take the recommended action, and the PIM is not satisfied with the delegate’s reasons, the PIM should be able to escalate the matter administratively to the Chief Commissioner for re-consideration.

Emergency authorisations

As noted in Chapter 12, the Commission recognises the importance of Victoria Police being able to act without delay in genuine emergency situations. In line with other police powers, such as those relating to surveillance devices, the Commission considers that Victoria Police should be able to register reportable human sources without PIM involvement in emergency situations.

The Commission considers that this would only be justifiable where there are both exceptional and compelling circumstances and the threat is imminent. As noted above, ‘exceptional and compelling circumstances’ means there is a serious threat to national security, the community or the life and welfare of a person, and the information is not able to be obtained through any other reasonable means.

Where this occurs, application materials should be provided to the PIM as soon as possible after registration and the PIM should be empowered to make submissions or recommendations to the Chief Commissioner or delegate about the adequacy of any decisions made or actions taken.

The Public Interest Monitor’s reporting functions

The Commission recommends that the PIM should report at least annually to the Attorney-General, with a copy provided to the Minister for Police and Chief Commissioner, on the performance of its functions in relation to human sources. The PIM should also be empowered to make ‘special reports’ to the Attorney-General as it deems necessary or on the request of the Attorney-General. These provisions would promote accountability for, and transparency of, Victoria Police’s use and management of human sources and align with the PIM’s functions in relation to the witness protection regime.²⁰⁰

The annual report should include:

• the number of occasions on which Victoria Police notified the PIM of an application to register a reportable human source
• the number of occasions on which Victoria Police notified the PIM of an application to register a reportable human source where it intended to obtain or disseminate confidential or privileged information
• the number of occasions on which the Chief Commissioner notified the PIM of an urgent decision made to register a reportable human source, and whether the PIM was satisfied the circumstances warranted an emergency authorisation
• the number of occasions on which Victoria Police accepted or did not accept a recommendation made by the PIM
• the PIM’s view of the adequacy of reasons given by Victoria Police where the PIM’s recommendation was not accepted
• any other matter relevant to the PIM’s functions.

To ensure transparency and accountability, the Attorney-General should be required to table any report by the PIM in Parliament and cause it to be published on an appropriate Victorian Government website. This is consistent with report tabling requirements under other oversight regimes in Victoria.

The Commission acknowledges that some information contained in reports might be sensitive or risk revealing the identity of the human source. It therefore proposes that the legislation should require the PIM not to include, in any version of a report to be tabled or published, information that may jeopardise the safety of any person, or compromise Victoria Police investigative methods or any current investigations or prosecutions. This obligation is the same as that applying to the PIM’s reporting obligations under the Witness Protection Act.²⁰¹

Victoria Police’s obligations

The Commission has carefully considered the obligations that should be placed on Victoria Police to comply with the proposed new oversight regime. Guidance in this regard can be taken from other regimes where Victoria Police has obligations to the PIM.

In Chapter 12, the Commission recommends that the Chief Commissioner (or delegate) must have regard to the submissions or recommendations of the PIM in making a decision to register a reportable human source.

To support the PIM’s role in this process, the Commission recommends that Victoria Police be subject to additional obligations to notify the PIM of an application and intention to register a reportable human source and to provide the PIM with copies of all information supporting the application, including any content that is adverse to the registration or proposed use of the reportable human source. This would allow the PIM to make a proper assessment and test all relevant information.

Where the Chief Commissioner makes an emergency authorisation without engaging the PIM, Victoria Police should provide the PIM with details of the registration as soon as practical after it occurs. This would include the application, supporting material, any content adverse to the registration, and the reasons why an emergency authorisation was necessary. In these circumstances, the Chief Commissioner should also be required to explain to the PIM how the circumstances of the registration met the threshold for an emergency authorisation.

Consistent with requirements under other external oversight regimes, the Commission also considers that Victoria Police should be subject to a general obligation to provide reasonable assistance to the PIM to support it in exercising its functions.

Monitoring compliance of Victoria Police’s use of all human sources (Tier 2)

Tier 2 of the Commission’s recommended oversight model involves retrospective monitoring of compliance with the human source management framework. As displayed in Figure 13.5 and discussed in further detail below, this aspect of the external oversight regime would:

• involve an external oversight agency conducting periodic inspections of Victoria Police records to monitor compliance with the framework governing the registration, use and management of all human sources
• allow the external oversight agency to look behind documentation to assess the appropriateness of Victoria Police decisions, ensure practice reflects formal records, and assess the adequacy of administrative policies and procedures
• require Victoria Police to report at regular intervals (for example, every three or six months) to the oversight agency when it has obtained confidential or privileged information from a human source, outlining how it has been or will be dealt with
• require Victoria Police to report to the oversight agency at regular intervals any material non-compliance with the human source management framework, along with steps taken to remedy any impact in the individual case and to avoid future recurrence
• allow the external oversight agency to make recommendations to the Chief Commissioner regarding any matter relating to its oversight functions
• require the external oversight agency to report to the Attorney-General annually (and at other times as it deems necessary or when requested by the Attorney-General) on Victoria Police compliance and related matters
• be tailored to ensure oversight mechanisms are proportionate to risk and benefits of the use and management of various types of human sources, and to avoid an unnecessary administrative burden on Victoria Police.

As noted above, the Commission recognises that Victoria already has a number of oversight agencies and it does not wish to add to this already crowded arena. As such, the Commission has considered which of the existing oversight agencies would be most appropriate to undertake this Tier 2 oversight function. It identified IBAC and the VI as the two most likely candidates.

The benefits of IBAC performing this role include that:

• It already monitors Victoria Police’s compliance with various legislative regimes enabling the use of covert and other investigative powers and functions, and some of its compliance-monitoring functions are more intensive than those exercised by the VI.
• The human source oversight function would sit comfortably with IBAC’s broader police integrity functions, noting that it can already conduct own motion investigations and may receive complaints about Victoria Police’s use of human sources.

By contrast, the advantages of the VI undertaking this role are:

• It already has compliance-monitoring functions in respect of certain other Victoria Police covert powers and functions, such as controlled operations, which sometimes involve the use of human sources.
• Unlike IBAC, it does not use human sources itself; consequently, there is no potential for a perceived or actual conflict arising from an agency overseeing the use of powers by Victoria Police that it also uses itself.

On balance, the Commission considers that the benefits of IBAC monitoring Victoria Police’s compliance with the human source management framework outweigh the benefits of the VI undertaking the role. It considers that any risk of conflict between IBAC’s own use of human sources and its monitoring of Victoria Police’s compliance should be manageable, particularly given the already existing ability for Victoria Police or members of the public to make complaints to the VI should there be any concerns about IBAC’s use of human sources.

An overview of IBAC’s proposed compliance monitoring role is displayed in Figure 13.5 below.

Figure 13.5: Overview of proposed retrospective compliance-monitoring regime

While outside the Commission’s terms of reference, in Chapter 12 the Commission urges the Victorian Government to extend the proposed new legislation to all Victorian agencies using human sources, including IBAC. As a logical extension, the Commission has also proposed that the recommended external oversight regime should also apply to those agencies. The significant risks, together with the benefits associated with Victoria Police’s use of human sources also exist for other agencies that use sources, even though their programs are of a lesser scale.

Should the Government accept this suggestion, the choice of agency to perform the function is a challenging one. In part, that is a measure of the complexity of the integrity framework that has evolved in Victoria. While not having consulted on this specific issue given the constraints of the terms of reference, the Commission suggests that, based on the current configuration of Victoria’s integrity and oversight system, the VI is arguably the most appropriate compliance monitor of IBAC and the other agencies’ use of human sources. The Commission acknowledges that this would result in both IBAC and the VI overseeing human source use in Victoria, and also that complexities could arise where, for example, Victoria Police uses a human source in a controlled operation, with IBAC responsible for overseeing the use of the human source and the VI the controlled operation.

The Commission does not want to see these complexities impede the swift implementation of the necessary reforms it has recommended in respect of Victoria Police. Whether the recommended legislative and oversight regime should apply to agencies other than Victoria Police, and which agency or agencies would be best suited to perform this oversight function, could be considered further alongside the broader review of the institutional and legislative framework for external police oversight that the Commission recommends later in this chapter.

The Commission is mindful that some stakeholders were critical of a retrospective compliance-monitoring approach, as it may not allow issues to be identified or external scrutiny applied in real time (that is, it may be too late to identify and rectify any issues of concern). The proposed ‘Tier 1’ oversight role of the PIM as an advocate in the decision-making process for the most sensitive and high-risk human source management decisions is intended in part to address this concern at the ‘front end’; that is, before any use is made of a reportable human source. More extensive use of real-time monitoring, would, in the Commission’s view, be:

• unworkable, given the sometimes extensive level of interaction between police and human sources and the need for police to respond quickly when taking actions or making decisions about a source’s day-to-day management
• undesirable, as it would ‘second-guess’ police operational decision making, create a significant administrative burden, and dilute Victoria Police’s primary responsibility for ensuring effective, efficient and ethical practice in the use of human sources
• unnecessary, as the proposed oversight model ensures transparency and encourages compliance and high professional and ethical standards.

Scope of IBAC’s compliance-monitoring function

For the reasons outlined above, the Commission considers that IBAC’s compliance-monitoring functions should apply to Victoria Police’s use and management of all human sources. To ensure proportionality, the intensity of compliance monitoring should be commensurate with the risk posed by categories of human sources and/or the information they provide, so that the purpose of external oversight can be achieved with the minimum possible administrative burden on Victoria Police.

IBAC’s compliance-monitoring functions

The Commission considers that IBAC should have legislative functions to monitor, make recommendations about and report on Victoria Police’s compliance with the framework for the registration, use and management of all human sources. Consistent with other compliance-based oversight regimes in Victoria, these legislative functions should include conducting periodic inspections of Victoria Police records (for example, every six months).

The compliance-monitoring function should apply to the entire period of a human source’s registration, not just the initial registration decision. The circumstances and risks associated with a human source can change over the period of their registration. The approach recommended by the Commission reflects that the use and management of a source—particularly where they are to be tasked and rewarded—involves significant risks throughout the entire period of registration, and sometimes, even after the source has been deactivated.

The Commission is mindful of evidence that traditional compliance-monitoring regimes focusing on matters such as record-keeping requirements, while beneficial, have their limitations. For example, if IBAC’s role were limited to monitoring whether a risk assessment had been undertaken and documented, without considering the quality and adequacy of the risk assessment, its external oversight function may be of limited utility. The Commission therefore considers that IBAC should be able to look behind formal documentation to assess whether decisions made by Victoria Police are sound.

The Commission understands that this approach aligns with IPCO’s oversight of human source management in the United Kingdom and IGIS’ focus on the lawfulness and propriety of Australian intelligence agencies’ use of human sources; and, in the Victorian context, bears some similarity to IBAC’s existing compliance-monitoring functions in relation to firearm prohibition orders.

As the Commission proposes that compliance-monitoring should apply to all human sources (not just reportable human sources), and include an element of qualitative assessment in addition to technical compliance, it considers that the legislative framework should permit IBAC to discharge its functions by examining a representative sample of human source files for each reporting period. This approach is similar to IBAC’s existing oversight of firearm prohibition orders, and with IPCO’s compliance-monitoring approach in the United Kingdom,²⁰² and would provide IBAC with the ability to target its inspection activities; for example, based on common risks and themes identified in previous inspections.

The Commission notes that in the United Kingdom, public authorities are required to report compliance errors to IPCO, and to explain what is being done to prevent recurrence. This serves a specific purpose, as the Investigatory Powers Commissioner is required by law to disclose certain serious errors to affected persons. The Commission considers that reporting compliance errors or breaches to IBAC could have several benefits; namely, it could:

• provide additional rigour by requiring IBAC to assess whether any breaches or deviations warrant investigation or remedial action
• enable IBAC to assess whether appropriate remedial steps have been taken
• assist IBAC in discharging its compliance-monitoring functions
• help ensure early identification and rectification of emerging issues or concerns
• encourage Victoria Police to adopt cultural change and invest in and proactively manage internal compliance.

The Commission is mindful, however, that reporting all breaches or deviations could impose a significant administrative burden on Victoria Police and may be a disproportionate requirement for minor breaches. This reporting obligation should therefore be confined to material breaches of, or material deviations from, the human source management framework. The terms ‘material breach’ and ‘material deviation’ should be defined in consultation with IBAC and Victoria Police in developing the proposed new legislation, focusing on matters that could have a significant adverse impact on the integrity of human source management, community confidence and/or the administration of justice. The Commission considers that Victoria Police should report regularly to IBAC on the occurrence of any such material breaches or material deviations (for example, every three or six months).

The Commission has also considered whether additional safeguards should apply to confidential or privileged information. This type of information, and its unintentional receipt, use, dissemination or retention by Victoria Police, has been a key focus of the Commission’s work. Its improper use and management raise legal and ethical issues for Victoria Police and other agencies (such as the Office of Public Prosecutions). It can also have significant impacts on individuals and the broader criminal justice system. As discussed in Chapter 12, it is not always easy or possible for a police officer or the human source to determine whether information is confidential or privileged, and whether it is appropriate to provide, obtain or disseminate such information.

Consequently, as an added safeguard, the Commission considers that Victoria Police should report to IBAC at regular intervals (for example, every three or six months) on any confidential or privileged information it has obtained from a human source. This report should include how police have dealt with, or propose to deal with, that information (including the PIM’s advice on the source’s registration, how Victoria Police responded to it and any other measures it may have put in place). IBAC’s role would include assessing such reports, confirming that mandated controls are in place and, if these measures are considered inadequate, making recommendations to improve internal procedure.

The Commission notes that law enforcement agencies in the United Kingdom must report the receipt from a human source of confidential and privileged information to IPCO, whose functions include ruling on whether privileged information should be destroyed or may be retained.²⁰³ The Commission does not recommend IBAC be involved in these decisions, noting that it would not be consistent with IBAC’s existing functions, and further that under the recommended model, the PIM would be engaged in final decisions about the registration of reportable sources and provide advice on the proposed use of that source and any confidential or privileged information they may provide. In addition, IBAC’s regular review, as proposed above, would further assist Victoria Police to ensure this sensitive information is managed appropriately.

IBAC’s powers and Victoria Police obligations

The Commission considers that IBAC should have the full suite of powers normally associated with compliance-monitoring and inspection regimes, including powers to enter premises; inspect, copy and take extracts from documents; ask questions; and request additional information. Further, the Chief Commissioner should have a legislative obligation to ensure that all officers and employees of Victoria Police give IBAC all reasonable assistance to discharge its functions.

In addition to the power to make recommendations to Victoria Police outlined above, IBAC should also have the power to examine whether and how they are implemented.

As noted above, the Chief Commissioner should also have specific legislative obligations, including to report at regular intervals on certain compliance breaches and on the management of confidential or privileged information obtained from human sources.

IBAC’s reporting functions

The Commission considers that IBAC should have reporting and recommendation-making functions to foster transparency, accountability and a culture of continuous improvement in the use and management of human sources by Victoria Police.

The Commission considers that IBAC should be required to report annually to the Attorney-General on the performance of its legislative functions in relation to the use of human sources. The report should include:

• Victoria Police’s compliance with the human source management framework, including the appropriateness of its decisions, based on a representative sample of cases
• the number and nature of material breaches or deviations reported by Victoria Police, and the nature and adequacy of remedial actions
• the dissemination of confidential or privileged information by Victoria Police
• any recommendations made by IBAC to Victoria Police and Victoria Police’s response and progress in implementing them
• any other matters relevant to IBAC’s compliance-monitoring functions under the proposed legislation.

To ensure that emerging issues can be raised in a timely manner, IBAC should also have the power to report to the Attorney-General at any other time it considers necessary. In addition, the Attorney-General should

be able to request a report when the Attorney-General considers it warranted. A copy of these reports should also be provided to the Chief Commissioner and the Minister for Police.

To ensure transparency and accountability and consistent with tabling requirements under other oversight regimes in Victoria, the Attorney-General should be required to table the IBAC’s report in Parliament, and cause it to be published on an appropriate Victorian Government website.

Victoria’s compliance-monitoring regimes already require oversight agencies, such as the VI and IBAC, to make public reports on sensitive police operational areas, such as controlled operations and surveillance devices. To minimise any risk to personal security, investigative methods or current investigations and prosecutions, the proposed legislation should require the IBAC to remove or redact any such content from the version of the report to be tabled or published.

In addition to reporting, IBAC’s ability to recommend improvements to the administration of Victoria Police’s human source management framework will be critical to the effectiveness of the oversight regime. IBAC’s power to make recommendations should be comprehensive, including, for example, improvements to police policies and procedures. The Commission envisages that IBAC and Victoria Police would work closely and cooperatively on formulating and implementing recommendations, underpinned by the legislative requirements for the Chief Commissioner to either accept IBAC’s recommendations or respond in writing explaining why they have not been accepted.

The Commission notes IBAC’s compliance-monitoring role in respect of Victoria Police’s use of firearm prohibition orders provides a good basis for such a model. In this scheme, the making of recommendations in individual cases occurs in private and is shielded from public scrutiny on account of the sensitive information involved, which, if released, could endanger a person, disclose police methods or compromise a current investigation or prosecution. Nevertheless, the scheme provides the community with a general insight into whether the exercise of police powers was appropriate and justified through the mandatory public reporting of the number of recommended actions and how often Victoria Police took these actions.

Reviewing and investigating complaints (Tier 3)

The Commission acknowledges that the investigation of complaints made about Victoria Police’s use and management of human sources will remain a necessary part of the external oversight framework. IBAC’s existing complaints-based jurisdiction would be complemented by the additional oversight arrangements proposed by the Commission in this chapter. Additionally, the Commission recommends that Victoria Police be required to inform human sources upon registration that they are able, at any time during or following their period of registration, to make a complaint to IBAC about the conduct of police officers, and that they may be afforded the protections available under the Public Interest Disclosure Act 2012 (Vic).

Due to the different areas of focus between this Commission and the IBAC Parliamentary Committee, there is no significant overlap or intersection between this Commission’s recommendations and those of the 2018 IBAC Committee Inquiry; nor are any recommendations from this Commission and the Committee’s reports inconsistent.

The Commission does note that any efforts to strengthen IBAC’s oversight functions and powers in relation to Victoria Police—to the extent that this will raise standards, ethical decision making and public confidence—will have collateral benefits for Victoria Police’s human source management. The Commission therefore urges the Government to respond to the IBAC Parliamentary Committee’s report, and implement any relevant recommendations, as a matter of priority.

Information sharing

Victorian oversight agencies told the Commission that constraints on the sharing of information between agencies can pose challenges.

To ensure that external agencies responsible for overseeing human source management have all relevant information to perform their functions, legislation should allow the PIM and external oversight agencies to share information where they reasonably believe such information is relevant to another agency’s functions.

In the context of the Commission’s recommended external oversight model, IBAC would undertake reviews after a reportable human source has been registered or after confidential or privileged information has been used or disseminated. The PIM would have been involved in making recommendations or submissions on these matters before the decisions are made (or soon after in emergency circumstances) and, therefore, would have an interest in the external oversight agency’s review. This is both in terms of the specific case and the lessons it may contain for the PIM’s consideration of, and recommendations in, future cases. This arrangement already exists for both these agencies in their respective oversight roles in Victoria’s Witness Protection Program.²⁰⁴

The Commission is aware that information shared could be highly sensitive. It is therefore important that the external agencies are provided with sufficient capacity and infrastructure, and have appropriate protocols, to securely share, store and dispose of sensitive information. Additionally, external oversight agencies must have staff with the appropriate security clearances to receive and review the information provided by Victoria Police.

Implementation of the new oversight model

The Commission agrees with stakeholder views about the importance of careful, comprehensive and coordinated implementation planning and delivery to establish a successful new oversight model. Implementation planning would need to consider lead times and resources required to build organisational capacity and capability, develop secure systems and establish operating procedures.

Capability, expertise and capacity

The Commission heard that external oversight regimes are most effective where the oversight agency understands the environment in which law enforcement agencies operate. This understanding is in addition to the technical capability required to discharge the oversight agency’s functions.

The Commission notes that the PIM has the technical legal capability required to discharge its proposed functions of testing the content and sufficiency of applications to register a reportable human source.

A PIM (whether the Principal PIM or a Deputy PIM) must be an Australian lawyer²⁰⁵ and the Commission observes that the Governor in Council has always appointed senior legal figures to these roles. This legal expertise may be supplemented by building the PIM’s specific knowledge in relation to human source management; for example, through training and/or engagement with Victoria Police and IBAC. Modelling would also need to be undertaken to determine whether the PIM has capacity, under its current resourcing model, to deal with the increased demand from this new jurisdiction; however, the Commission does not expect the increase to be substantial, noting that, as discussed in Chapter 12, of the approximately 1,200 human source registration applications submitted between July 2017 and June 2020, only about 4.4 per cent were potentially subject to legal obligations of confidentiality or privilege.²⁰⁶

The Commission notes that IBAC has the audit and compliance-monitoring capability required to discharge the functions recommended under the proposed model. Given that IBAC’s jurisdiction is proposed to have more qualitative aspects than other covert powers monitoring regimes—in that it should inquire into the rigour and judgement applied in the making of decisions—it would be important for it to build organisational expertise around human source management in an operational policing context. This may occur through recruitment, training and/or engagement with Victoria Police and interstate or federal oversight agencies. As this would be a substantial new jurisdiction for IBAC, both in breadth and depth, modelling would need to be undertaken to ensure IBAC has the necessary staffing capacity, capability and resources to discharge its functions. Similarly, the Commission appreciates the VI may require similar planning and resourcing should it be given new oversight functions over IBAC and other agencies’ use of human sources.

Stakeholders have mentioned the benefits of a cooperative model, whereby the external oversight agency could embed staff with Victoria Police to obtain a more in-depth understanding of its systems and procedures. The Commission believes that this could be a valuable approach to explore, but also emphasises the need to avoid developing an overly familiar relationship that could compromise the independence of the oversight agency.

Security, funding and implementation governance

The Commission agrees with stakeholder views that security needs to be a primary focus in implementing external oversight of Victoria Police’s use of human sources. The PIM and IBAC are accustomed to handling highly sensitive material under their existing legislative functions. Leveraging off these foundations, planning would be required to ensure that ICT systems and applications, operating procedures and clearance levels of personnel are robust and meet the risk profile required of human source management. These matters would need to be worked through by oversight agencies and Victoria Police.

IBAC told the Commission that any external oversight regime for human sources ‘would need to be supported by legislation and … sufficient investment by Government to both implement and maintain independent oversight’.²⁰⁷ The Commission considers that the PIM and IBAC would require additional funding to fulfil their new oversight functions. Cost drivers may include additional staffing, training, infrastructure, information technology and personnel security, business applications and the development of new operating procedures. Victoria Police would also likely incur costs in adapting and responding to the new oversight model, which may not be able to be met through existing funding or internal reprioritisation.

Similar considerations of resourcing needs would apply to the VI, should it be given new oversight functions of IBAC and other agencies’ use of human sources.

Chapter 17 deals with governance structures to monitor implementation of the Commission’s recommendations. It will be important that, as part of this process, there is strong, central coordination of the implementation of the human source oversight arrangements proposed in this chapter.

A principle-based review of external oversight of police powers in Victoria

As outlined above, Victoria Police exercises investigatory and associated powers under a range of statutes that also establish specific external oversight regimes. The Commission heard that despite common themes (such as compliance monitoring and reporting), variation across these oversight regimes creates a system that is:

• fragmented—with different agencies performing like functions under the different regimes applicable to Victoria Police
• inconsistent—with variation in the form and substance of oversight agencies’ functions, powers and reporting arrangements, and thus the type and level of oversight exercised
• limited—with a somewhat technical and procedural focus on compliance, rather than a more substantive assessment of whether decisions and actions are necessary, proportionate, ethical and justified.

The Commission heard that to some extent, the current configuration of the oversight system is not underpinned by principle or a sound policy rationale. Rather, to reiterate IBAC’s view quoted above, the current oversight system:

… contains elements of fragmentation caused by a lack of role clarity around some areas of oversight, as well as inconsistencies in the type and level of oversight exercised by each agency. Broadly, this reflects a lack of [a] cohesive framework based on established oversight principles, the expansion of law enforcement powers and the ad hoc development of the integrity system as a check and balance on those increased powers.²⁰⁸

The Commission is mindful that the recommended oversight regime for the use of human sources unavoidably adds to the ad hoc development of Victoria’s oversight system. The Commission also notes that the external oversight regime recommended in relation to human sources is in many ways more robust than regimes that apply to other police powers and methods.

Consequently, the Commission considers that there would be merit in the Victorian Government undertaking a principle-based review of the institutional and legal structure for the oversight of police powers in Victoria. It may be timely to undertake this review in tandem with the policy response to the 2018 IBAC Committee Inquiry. The potential benefits of such a review include:

• streamlining, consolidating or rebalancing oversight jurisdiction between existing integrity bodies to ensure clarity and coherence around roles, responsibilities and areas of specialisation, so that system design can best achieve the desired outcomes (such as good, ethical and accountable police practice, transparency and public confidence)
• shifting to a more meaningful, outcome-focused form of monitoring where the necessity, proportionality and justification of decisions made and actions taken is the focus of the assessment and reporting
• where possible and justified, ensuring that functions, powers and obligations are consistent across different oversight regimes, and proportionate to the level of intrusiveness and/or risk associated with the use of the police power
• easing the compliance burden for Victoria Police, while improving accountability.

The Commission recognises that such a review would not be a trivial undertaking. It would require extensive consultation with integrity bodies, law enforcement agencies, experts and stakeholders. Further, implementing any reforms arising from such a review would likely require legislative amendment and have a range of organisational and funding implications. These reforms would take time to complete.

Consequently, the Commission considers that its recommendations for external oversight of Victoria Police’s use of human sources should be developed and implemented simultaneously with the proposed principle-based review, and not deferred pending the outcome of this review and any resultant reforms to the broader police oversight system.